[Bug analyzer/94105] New: ICE in get_region, at analyzer/region-model.h:1744

[Bug analyzer/94105] New: ICE in get_region, at analyzer/region-model.h:1744

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94105

            Bug ID: 94105
           Summary: ICE in get_region, at analyzer/region-model.h:1744
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-10.0.1-alpha20200308 snapshot (g:9de42a8e995451cb13dceb3970ae23ff88240bff)
ICEs when compiling gcc/testsuite/c-c++-common/torture/pr58794-1.c w/
-fanalyzer:

% gcc-10.0.1 -fanalyzer -c gcc/testsuite/c-c++-common/torture/pr58794-1.c
during IPA pass: analyzer
gcc/testsuite/c-c++-common/torture/pr58794-1.c: In function 'main':
gcc/testsuite/c-c++-common/torture/pr58794-1.c:27:16: internal compiler error:
in get_region, at analyzer/region-model.h:1744
   27 |       *c[b.g.f1.f][d + 1] = 0;
      |          ~~~~~~^~
0x71dc62 ana::frame_region*
ana::region_model::get_region<ana::frame_region>(ana::region_id) const
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.h:1744
0x71ed45 ana::array_region*
ana::region_model::get_region<ana::array_region>(ana::region_id) const
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.cc:4860
0x71ed45 ana::region_model::get_lvalue_1(ana::path_var,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.cc:4752
0x110e973 ana::region_model::get_lvalue(ana::path_var,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.cc:4899
0x110fffc ana::region_model::get_rvalue_1(ana::path_var,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.cc:4965
0x11100d3 ana::region_model::get_rvalue(ana::path_var,
ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/region-model.cc:4979
0x10f1ff0 ana::impl_sm_context::warn_for_state(ana::supernode const*, gimple
const*, tree_node*, unsigned int, ana::pending_diagnostic*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:278
0x111ed2a on_stmt
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/sm-malloc.cc:737
0x10ee396 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::state_change*) const
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:1086
0x10eebf1 ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:2516
0x10ef0da ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:2334
0x10ef809 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:3785
0x10f028c ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/engine.cc:3842
0x10e50e8 execute
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/analyzer/analyzer-pass.cc:84

[Bug analyzer/94105] ICE in get_region, at analyzer/region-model.h:1744

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94105

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.0
   Last reconfirmed|                            |2020-03-10
             Status|UNCONFIRMED                 |ASSIGNED
   Target Milestone|---                         |10.0
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r10-5950-g757bf1dff5e8cee3.

[Bug analyzer/94105] ICE in get_region, at analyzer/region-model.h:1744

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94105

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by g:5c048755ec98645f8436b630df3f9294ca9cbc2a.

[Bug analyzer/94105] ICE in get_region, at analyzer/region-model.h:1744

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94105

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
commit r10-7168-g5c048755ec98645f8436b630df3f9294ca9cbc2a
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Mar 10 19:03:37 2020 -0400

    analyzer: handle NOP_EXPR in get_lvalue [PR94099,PR94105]

    PR analyzer/94099 and PR analyzer/94105 both report ICEs relating to
    calling region_model::get_lvalue on a NOP_EXPR.

    PR analyzer/94099's ICE happens when generating a checker_path when
    encountering an unhandled tree code (NOP_EXPR) in get_lvalue with a
    NULL context (from for_each_state_change).

    PR analyzer/94105 ICE happens when handling an ARRAY_REF where the
    first operand is a NOP_EXPR: the unhandled tree code gives us
    a symbolic_region, but the case for ARRAY_REF assumes we have an
    array_region.

    This patch fixes the ICEs by handling NOP_EXPR within
    region_model::get_lvalue, and bulletproofs both of the above sources
    of failure.

    gcc/analyzer/ChangeLog:
            PR analyzer/94099
            PR analyzer/94105
            * diagnostic-manager.cc (for_each_state_change): Bulletproof
            against errors in get_rvalue by passing a
            tentative_region_model_context and rejecting if there's an error.
            * region-model.cc (region_model::get_lvalue_1): When handling
            ARRAY_REF, handle results of error-handling.  Handle NOP_EXPR.

    gcc/testsuite/ChangeLog:
            PR analyzer/94099
            PR analyzer/94105
            * gcc.dg/analyzer/pr94099.c: New test.
            * gcc.dg/analyzer/pr94105.c: New test.