[Bug analyzer/114778] New: ICE: internal compiler error: in get_region_for_local, at analyzer/region.cc:1366

[Bug analyzer/114778] New: ICE: internal compiler error: in get_region_for_local, at analyzer/region.cc:1366

[iamanonymous.cs at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114778

            Bug ID: 114778
           Summary: ICE: internal compiler error: in get_region_for_local,
                    at analyzer/region.cc:1366
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: iamanonymous.cs at gmail dot com
  Target Milestone: ---

Compiler Explorer: https://godbolt.org/z/r3E89h944

*******************************************************************************
OS and Platform:
$ uname -a:
Linux ubuntu 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023
x86_64 x86_64 x86_64 GNU/Linux
*******************************************************************************
gcc version:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/root/gcc_set/202404101100/bin/gcc
COLLECT_LTO_WRAPPER=/root/gcc_set/202404101100/libexec/gcc/x86_64-pc-linux-gnu/14.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --prefix=/root/gcc_set/202404101100
--with-gmp=/root/build_essential --with-mpfr=/root/build_essential
--with-mpc=/root/build_essential --enable-languages=c,c++ --disable-multilib
--with-sanitizer=address,undefined,thread,leak
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.1 20240410 (experimental) (GCC) 

git version: 0774240b4df9a9bc48ce33a9625788e402498f5a
*******************************************************************************
Program:
$ cat mutant.c
int b;
int a(char *c) { return c[9]; }
void d() {
  struct e {
    char g[b]
  } f(struct e arg) {
    a(arg.g);
  }
  if (f != 'd')
    ;
}

*******************************************************************************
Command Lines:
$ gcc -fanalyzer -c mutant.c
mutant.c: In function ‘d’:
mutant.c:6:3: warning: no semicolon at end of struct or union
    6 |   } f(struct e arg) {
      |   ^
mutant.c:9:9: warning: comparison between pointer and integer
    9 |   if (f != 'd')
      |         ^~
during IPA pass: analyzer
mutant.c: In function ‘a’:
mutant.c:2:26: internal compiler error: in get_region_for_local, at
analyzer/region.cc:1366
    2 | int a(char *c) { return c[9]; }
      |                         ~^~~
0x88c303 ana::frame_region::get_region_for_local(ana::region_model_manager*,
tree_node*, ana::region_model_context const*) const
        ../../gcc/gcc/analyzer/region.cc:1366
0x14815a2 ana::region_model::get_lvalue(ana::path_var,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:2466
0x148541a ana::region_model::get_rvalue_1(ana::path_var,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:2532
0x1481ccc ana::region_model::get_rvalue(ana::path_var,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:2610
0x2173639 ana::region_model::check_region_bounds(ana::region const*,
ana::access_direction, ana::svalue const*, ana::region_model_context*) const
        ../../gcc/gcc/analyzer/bounds-checking.cc:1396
0x147f3c9 ana::region_model::check_region_access(ana::region const*,
ana::access_direction, ana::svalue const*, ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:3095
0x147f3c9 ana::region_model::check_region_access(ana::region const*,
ana::access_direction, ana::svalue const*, ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:3084
0x147f3c9 ana::region_model::check_region_for_read(ana::region const*,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:3129
0x147f3c9 ana::region_model::check_region_for_read(ana::region const*,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:3126
0x147f3c9 ana::region_model::get_store_value(ana::region const*,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:2690
0x1481ccc ana::region_model::get_rvalue(ana::path_var,
ana::region_model_context*) const
        ../../gcc/gcc/analyzer/region-model.cc:2610
0x148664c ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
        ../../gcc/gcc/analyzer/region-model.cc:1244
0x144daf0 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::uncertainty_t*, bool*,
ana::path_context*)
        ../../gcc/gcc/analyzer/engine.cc:1515
0x1450915 ana::exploded_graph::process_node(ana::exploded_node*)
        ../../gcc/gcc/analyzer/engine.cc:4125
0x145166a ana::exploded_graph::process_worklist()
        ../../gcc/gcc/analyzer/engine.cc:3516
0x1453c4b ana::impl_run_checkers(ana::logger*)
        ../../gcc/gcc/analyzer/engine.cc:6210
0x1454bb6 ana::run_checkers()
        ../../gcc/gcc/analyzer/engine.cc:6308
0x1443a98 execute
        ../../gcc/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug analyzer/114778] ICE: in get_region_for_local, at analyzer/region.cc:1366

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114778

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this.

It's failing this assertion in frame_region::get_region_for_local :

1421            case VAR_DECL:
1422              gcc_assert (!is_global_var (expr));
1423              /* Fall through.  */
1424            case PARM_DECL:
1425            case RESULT_DECL:
1426              gcc_assert (DECL_CONTEXT (expr) == m_fun.decl);
1427              break;

(gdb) pt expr
 <var_decl 0x7fffea8212d0 D.2795
    type <integer_type 0x7fffea664000 sizetype public unsigned DI
        size <integer_cst 0x7fffea644f48 constant 64>
        unit-size <integer_cst 0x7fffea644f60 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffea664000 precision:64 min <integer_cst 0x7fffea644f78 0> max <integer_cst
0x7fffea6455e0 18446744073709551615>>
    used unsigned ignored DI ../../src/pr114778.c:6:5 size <integer_cst
0x7fffea644f48 64> unit-size <integer_cst 0x7fffea644f60 8>
    align:64 warn_if_not_align:0 context <function_decl 0x7fffea7f5a00 f>>

(gdb) p m_fun.decl
$1 = <function_decl 0x7fffea7f5600 a>

Looks like another ICE due to GCC's nested functions extension for C, which the
analyzer doesn't yet support.

[Bug analyzer/114778] ICE: in get_region_for_local, at analyzer/region.cc:1366

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114778

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Duplicate of bug 106634.

*** This bug has been marked as a duplicate of bug 106634 ***

[Bug analyzer/114778] ICE: in get_region_for_local, at analyzer/region.cc:1366

[iamanonymous.cs at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114778

--- Comment #3 from Anonymous <iamanonymous.cs at gmail dot com> ---
(In reply to David Malcolm from comment #1)
> Thanks for filing this.
> 
> It's failing this assertion in frame_region::get_region_for_local :
> 
> 1421		case VAR_DECL:
> 1422		  gcc_assert (!is_global_var (expr));
> 1423		  /* Fall through.  */
> 1424		case PARM_DECL:
> 1425		case RESULT_DECL:
> 1426		  gcc_assert (DECL_CONTEXT (expr) == m_fun.decl);
> 1427		  break;
> 
> (gdb) pt expr
>  <var_decl 0x7fffea8212d0 D.2795
>     type <integer_type 0x7fffea664000 sizetype public unsigned DI
>         size <integer_cst 0x7fffea644f48 constant 64>
>         unit-size <integer_cst 0x7fffea644f60 constant 8>
>         align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
> 0x7fffea664000 precision:64 min <integer_cst 0x7fffea644f78 0> max
> <integer_cst 0x7fffea6455e0 18446744073709551615>>
>     used unsigned ignored DI ../../src/pr114778.c:6:5 size <integer_cst
> 0x7fffea644f48 64> unit-size <integer_cst 0x7fffea644f60 8>
>     align:64 warn_if_not_align:0 context <function_decl 0x7fffea7f5a00 f>>
> 
> (gdb) p m_fun.decl
> $1 = <function_decl 0x7fffea7f5600 a>
> 
> Looks like another ICE due to GCC's nested functions extension for C, which
> the analyzer doesn't yet support.

Thank you for your answer to this issue!