[Bug analyzer/94999] New: internal compiler error: in saved_diagnostic

[Bug analyzer/94999] New: internal compiler error: in saved_diagnostic

[tommy-gccbugs at thorn dot ws]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94999

            Bug ID: 94999
           Summary: internal compiler error: in saved_diagnostic
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: tommy-gccbugs at thorn dot ws
  Target Milestone: ---

Created attachment 48478
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48478&action=edit
Reproduces the internal bug

GCC 10 just landed in Ubuntu Focal, identifying itself as

  gcc version 10.0.1 20200411 (experimental) [master revision
  bb87d5cc77d:75961caccb7:f883c46b4877f637e0fa5025b4d6b5c9040ec566]
  (Ubuntu 10-20200411-0ubuntu1)

I gave the analyzer a try and immediately hit an internal error with

  $ gcc-10 -fanalyzer -std=c99 bug.c

during IPA pass: analyzer
memory.c: In function ‘mk_entry’:
memory.c:116:12: internal compiler error: in saved_diagnostic, at
analyzer/diagnostic-manager.cc:84
  116 |     return (struct entry) {safe_calloc(end - start, 1), start, end};
      |            ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-10/README.Bugs> for instructions.

[Bug analyzer/94999] internal compiler error: in saved_diagnostic

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94999

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|UNCONFIRMED                 |RESOLVED
             Blocks|                            |95006

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this.

I'm able to reproduce this with the revision in question
(f883c46b4877f637e0fa5025b4d6b5c9040ec566), but it's fixed in GCC 10.1

It's an assertion failure here:

#1  0x000000000242ee44 in ana::saved_diagnostic::saved_diagnostic
(this=0x3c6ca60, sm=0x0, enode=0x3ce0b20, 
    snode=0x332a110, stmt=0x0, stmt_finder=0x0, var=<tree 0x0>, state=0,
d=0x3cff4e0)
    at ../../src/gcc/analyzer/diagnostic-manager.cc:84
84        gcc_assert (m_stmt || m_stmt_finder);

when handling a false positive from -Wanalyzer-use-of-uninitialized-value,
which I removed in r10-8012-g78b9783774bfd3540f38f5b1e3c7fc9f719653d7.

The diagnostic is generated when analyzing the return from mk_entry to
memory_ensure_mapped_range on this code:

static struct entry
mk_entry(uint64_t start, uint64_t end)
{
    return (struct entry) {safe_calloc(end - start, 1), start, end};
}

I think -fanalyzer is failing to handle a CONSTRUCTOR tree code (on those
{...}), and thus is erroneously treating the return value as uninitialized,
when the code looks correct to me.

The failure to handle CONSTRUCTOR tree codes is PR analyzer/94447, so I'm going
to close this out as a duplicate of that bug; clearly it needs to be fixed in
order to reimplement -Wanalyzer-use-of-uninitialized-value; adding to the
analyzer-uninit tracker bug.

*** This bug has been marked as a duplicate of bug 94447 ***


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95006
[Bug 95006] Reimplement -Wanalyzer-use-of-uninitialized-value

[Bug analyzer/94999] internal compiler error: in saved_diagnostic

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94999

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Actually, it's possibly failing to realize that calloc zeroes the memory. 
Either way it makes a good test case for when reintroducing
-Wanalyzer-use-of-uninitialized-value; thanks.