[Bug analyzer/94688] New: ice caused by analyzer

[Bug analyzer/94688] New: ice caused by analyzer

[pmatos at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94688

            Bug ID: 94688
           Summary: ice caused by analyzer
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: pmatos at gcc dot gnu.org
  Target Milestone: ---

While reducing a testcase for a separate bug I found an analyzer ice.

///
a, b;
c() { d((void (*)()) & a + b); }
/// 

Compiled with todays (2020.04.21) head:
  gcc -O2 -g -fanalyzer  -Wall   -I./.. -I./../include -I./../../rktio
-I../../rktio -pthread -I/usr/lib64/libffi/include   -DUSE_SENORA_GC    -c
foreign.i -o foreign.o
foreign.i:1:1: warning: data definition has no type or storage class
    1 | a, b;
      | ^
foreign.i:1:1: warning: type defaults to 'int' in declaration of 'a'
[-Wimplicit-int]
foreign.i:1:4: warning: type defaults to 'int' in declaration of 'b'
[-Wimplicit-int]
    1 | a, b;
      |    ^
foreign.i:2:1: warning: return type defaults to 'int' [-Wimplicit-int]
    2 | c() { d((void (*)()) & a + b); }
      | ^
foreign.i: In function 'c':
foreign.i:2:7: warning: implicit declaration of function 'd'
[-Wimplicit-function-declaration]
    2 | c() { d((void (*)()) & a + b); }
      |       ^
foreign.i:2:32: warning: control reaches end of non-void function
[-Wreturn-type]
    2 | c() { d((void (*)()) & a + b); }
      |                                ^
during IPA pass: analyzer
foreign.i:2:7: internal compiler error: in get_or_create_mem_ref, at
analyzer/region-model.cc:6969
    2 | c() { d((void (*)()) & a + b); }
      |       ^
0x763ce6 ana::region_model::get_or_create_mem_ref(tree_node*, ana::svalue_id,
ana::svalue_id, ana::region_model_context*)
        ../../gcc/gcc/analyzer/region-model.cc:6969
0x11c9585 ana::region_model::get_or_create_pointer_plus_expr(tree_node*,
ana::svalue_id, ana::svalue_id, ana::region_model_context*)
        ../../gcc/gcc/analyzer/region-model.cc:7058
0x11c9585 ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
        ../../gcc/gcc/analyzer/region-model.cc:4237
0x119bee2 ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::state_change*) const
        ../../gcc/gcc/analyzer/engine.cc:1019
0x119c841 ana::exploded_graph::process_node(ana::exploded_node*)
        ../../gcc/gcc/analyzer/engine.cc:2530
0x119ccb2 ana::exploded_graph::process_worklist()
        ../../gcc/gcc/analyzer/engine.cc:2348
0x119f07e ana::impl_run_checkers(ana::logger*)
        ../../gcc/gcc/analyzer/engine.cc:4029
0x11a0a7c ana::run_checkers()
        ../../gcc/gcc/analyzer/engine.cc:4097
0x1194808 execute
        ../../gcc/gcc/analyzer/analyzer-pass.cc:84
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.



However without the -fanalyzer flag it compiles and returns exit code 0.

[Bug analyzer/94688] ICE caused by analyzer since r10-7502-ga96f1c38a787fbc8

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94688

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.0
                 CC|                            |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-04-21
             Status|UNCONFIRMED                 |ASSIGNED
            Version|unknown                     |10.0
            Summary|ice caused by analyzer      |ICE caused by analyzer
                   |                            |since
                   |                            |r10-7502-ga96f1c38a787fbc8

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r10-7502-ga96f1c38a787fbc8.

A test-case with warnings:

$ cat pr94688.i
int a, b;
void d();
void c() { d((void (*)()) & a + b); }

[Bug analyzer/94688] ICE caused by analyzer since r10-7502-ga96f1c38a787fbc8

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94688

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.0                        |10.2

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.1 has been released.

[Bug analyzer/94688] ICE caused by analyzer since r10-7502-ga96f1c38a787fbc8

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94688

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.2                        |10.3

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.2 is released, adjusting target milestone.

[Bug analyzer/94688] ICE caused by analyzer since r10-7502-ga96f1c38a787fbc8

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94688

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The ICE should be fixed by g:808f4dfeb3a95f50f15e71148e5c1067f90a126d (for GCC
11).  Marking this as fixed.