[Bug analyzer/95152] New: internal compiler error: in get_or_create_mem_ref, at analyzer/region-model.cc:6938

[Bug analyzer/95152] New: internal compiler error: in get_or_create_mem_ref, at analyzer/region-model.cc:6938

[pieter+gcc-bugzilla at plexis dot eu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

            Bug ID: 95152
           Summary: internal compiler error: in get_or_create_mem_ref, at
                    analyzer/region-model.cc:6938
           Product: gcc
           Version: 10.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: pieter+gcc-bugzilla at plexis dot eu
  Target Milestone: ---

Created attachment 48545
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48545&action=edit
The pre-processed source

While compiling dnsdist[1] from git with '-fanalyzer', GCC 10.1.0 has an
internal compiler error:

during IPA pass: analyzer
In file included from dnsdist.hh:24,
                 from dnsdist-lua-bindings.cc:23:
ext/luawrapper/include/LuaContext.hpp: In lambda function:
ext/luawrapper/include/LuaContext.hpp:1241:27: internal compiler error: in
get_or_create_mem_ref, at analyzer/region-model.cc:6938
 1241 |             writeFunction_(*object, value);
      |             ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.

The full commandline is as follows:

g++ -DHAVE_CONFIG_H -I.  -I. -I. -pthread   -I/usr/include/luajit-2.0 
-I/usr/include/editline    -I./ext/yahttp  -march=x86-64 -mtune=generic -O2
-pipe -fno-plt -DNETSNMP_ENABLE_IPV6 -fno-strict-aliasing -DNETSNMP_REMOVE_U64
-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -Ulinux -Dlinux=linux
-D_REENTRANT -D_GNU_SOURCE -fwrapv -fno-strict-aliasing -pipe
-fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2 -I/usr/lib/perl5/5.30/core_perl/CORE
-I/usr/include/libnl3 -D_FORTIFY_SOURCE=2 -I. -I/usr/include 
-DSYSCONFDIR=\"/usr/local/etc\"           -fPIE -DPIE -U_FORTIFY_SOURCE
-D_FORTIFY_SOURCE=2 --param ssp-buffer-size=4 -fstack-protector -g -O3 -Wall
-Wextra -Wshadow -Wno-unused-parameter -Wmissing-declarations -Wredundant-decls
-fanalyzer -MT dnsdist-lua-bindings.o -MD -MP -MF $depbase.Tpo -c -o
dnsdist-lua-bindings.o dnsdist-lua-bindings.cc

This is a ArchLinux system, where 'g++ -v' shows this:

Using built-in specs.
COLLECT_GCC=/usr/bin/g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-pc-linux-gnu/10.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /build/gcc/src/gcc/configure --prefix=/usr --libdir=/usr/lib
--libexecdir=/usr/lib --mandir=/usr/share/man --infodir=/usr/share/info
--with-bugurl=https://bugs.archlinux.org/
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++,d --with-isl
--with-linker-hash-style=gnu --with-system-zlib --enable-__cxa_atexit
--enable-cet=auto --enable-checking=release --enable-clocale=gnu
--enable-default-pie --enable-default-ssp --enable-gnu-indirect-function
--enable-gnu-unique-object --enable-install-libiberty --enable-linker-build-id
--enable-lto --enable-multilib --enable-plugin --enable-shared
--enable-threads=posix --disable-libssp --disable-libstdcxx-pch
--disable-libunwind-exceptions --disable-werror
gdc_include_dir=/usr/include/dlang/gdc
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 10.1.0 (GCC) 

The triggering line is in the LuaWrapper[2], a project that can wrap C++
objects and to Lua. I have attached the pre-processed source.

If you need more information, let me know!

1 - https://dnsdist.org
2 -
https://github.com/PowerDNS/pdns/blob/134755f54093a595610e035d01a07f125df3ab13/ext/luawrapper/include/LuaContext.hpp#L1241

[Bug analyzer/95152] internal compiler error: in get_or_create_mem_ref, at analyzer/region-model.cc:6938

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
           Keywords|                            |needs-bisection,
                   |                            |needs-reduction
   Last reconfirmed|                            |2020-05-15
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, I'm reducing that..

[Bug analyzer/95152] internal compiler error: in get_or_create_mem_ref, at analyzer/region-model.cc:6938

[fredrik.hederstierna@securitas-direct.com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

Fredrik Hederstierna <fredrik.hederstierna@securitas-direct.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fredrik.hederstierna@securi
                   |                            |tas-direct.com

--- Comment #2 from Fredrik Hederstierna <fredrik.hederstierna@securitas-direct.com> ---
I have had the same problem with arm-none-eabi-gcc (GCC) 10.1.0, using
-fanalyzer.

Compiling my_test.c ..
during IPA pass: analyzer
falcon_fota.c: In function 'my_verify.part.0':
falcon_fota.c:629:5: internal compiler error: in get_or_create_mem_ref, at
analyzer/region-model.cc:6938
  629 |     app_info_t *app_info = RAM_APP_INFO_POS;
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.


The pointer RAM_APP_INFO_POS is a quite special reference with address of
external variable, and adding constants to that value:

// example
extern void *_app_data_offs;
#define RAM_ADDRESS      ((uint32_t)(0xC0000000))
#define APP_INFO_POS     ((uint32_t)&_app_data_offs)
#define RAM_APP_INFO_POS (RAM_ADDRESS + APP_INFO_POS)


arm-eabi-gcc -v

Using built-in specs.
COLLECT_GCC=/opt/gcc/arm-none-eabi-toolchain-gcc-10.1.0-binutils-2.33.1-newlib-3.3.0-hardfloat/bin/arm-none-eabi-gcc
COLLECT_LTO_WRAPPER=/opt/gcc/arm-none-eabi-toolchain-gcc-10.1.0-binutils-2.33.1-newlib-3.3.0-hardfloat/libexec/gcc/arm-none-eabi/10.1.0/lto-wrapper
Target: arm-none-eabi
Configured with: ../../gcc-10.1.0/configure --enable-languages=c,c++
--target=arm-none-eabi
--prefix=/opt/gcc/arm-none-eabi-toolchain-gcc-10.1.0-binutils-2.33.1-newlib-3.3.0-hardfloat
--with-gnu-as --with-gnu-ld --with-newlib --with-system-zlib
--with-endian=little --disable-interwork --with-mode=thumb --with-abi=aapcs
--with-cpu=cortex-m4 --with-float=hard --with-fpu=fpv4-sp-d16 --disable-nls
--disable-libssp --enable-multilib
Thread model: single
Supported LTO compression algorithms: zlib
gcc version 10.1.0 (GCC)

[Bug analyzer/95152] ICE in get_or_create_mem_ref, at analyzer/region-model.cc:6938 since r10-5950-g757bf1dff5e8cee3

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Keywords|needs-bisection,            |
                   |needs-reduction             |
            Summary|internal compiler error: in |ICE in
                   |get_or_create_mem_ref, at   |get_or_create_mem_ref, at
                   |analyzer/region-model.cc:69 |analyzer/region-model.cc:69
                   |38                          |38 since
                   |                            |r10-5950-g757bf1dff5e8cee3

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced test-case:

$ struct n;
class o {
public:
  using d = n;
  d operator*();
};
class p {
public:
  p(char *);
  void operator=(p);
};
template <class ad> class q {
public:
  ad operator*();
};
void(ag)(int(int *));
auto a = [] {};
int f, g;
class r {
public:
  template <typename i, typename j> void k(p aj, j i::*ak) {
    auto b = [=](i am, j c) { am.*ak = c; };
    k<j>(aj, a, b);
  }
  template <typename, typename an, typename ao> void k(p aj, an, ao ap) {
    aq(aj, 0, ap);
  }
  int as;
  template <typename> struct s {};
  template <typename aw, typename ax> void ay(int *az, int, p, ax ba) {
    t<aw>::bc(az, ba);
  }
  template <typename an, typename ao> void aq(p aj, an, ao ap) {
    ay<void(o, p)>(&as, 4, aj, [ap](o bj, p c) { ap(*bj, c); });
  }
  template <typename> struct t;
  template <typename bl> struct I { static auto bn(int *, int) -> q<bl>; };
  template <typename bo, typename l> static auto bp(int *, bo, l bq, int) {
    bq();
  }
  template <typename bo, typename l, typename br, typename... bs>
  static auto bp(int *az, bo bt, l bq, int bu, s<br>, bs... bv) {
    auto c = I<br>::bn(az, bu);
    J<l, br> d{bq, *c};
    bp(az, bt, d, 1, bv...);
  }
  template <typename by, typename bz> struct J {
    by ca;
    bz cb;
    template <typename... cc> void operator()(cc... cd) { ca(cb, cd...); }
  };
};
template <typename ce, typename... cf> struct r::t<ce(cf...)> {
  template <typename by> static auto bc(int *, by) {
    auto e = [](int *) -> int { bq(static_cast<by *>(0)); };
    ag(e);
  }
  template <typename by> static auto bq(by ch) { cj(*ch); }
  template <typename by> static auto cj(by ch) {
    bp(&g, int{}, ch, f, s<cf>{}...);
  }
};
struct n {
  p aj;
};
r h;
void m() { h.k("", &n::aj); }

$ g++ -fanalyzer x.ii -c -O3
x.ii: In lambda function:
x.ii:55:59: warning: no return statement in function returning non-void
[-Wreturn-type]
   55 |     auto e = [](int *) -> int { bq(static_cast<by *>(0)); };
      |                                                           ^
x.ii: In function ‘void m()’:
x.ii:67:16: warning: ISO C++ forbids converting a string constant to ‘char*’
[-Wwrite-strings]
   67 | void m() { h.k("", &n::aj); }
      |                ^~
during IPA pass: analyzer
x.ii: In lambda function:
x.ii:22:14: internal compiler error: in get_or_create_mem_ref, at
analyzer/region-model.cc:6938
   22 |     auto b = [=](i am, j c) { am.*ak = c; };
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x86fc20 ana::region_model::get_or_create_mem_ref(tree_node*, ana::svalue_id,
ana::svalue_id, ana::region_model_context*)
        /home/marxin/Programming/gcc/gcc/analyzer/region-model.cc:6938
0x1448285 ana::region_model::get_or_create_pointer_plus_expr(tree_node*,
ana::svalue_id, ana::svalue_id, ana::region_model_context*)
        /home/marxin/Programming/gcc/gcc/analyzer/region-model.cc:7021
0x1448285 ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
        /home/marxin/Programming/gcc/gcc/analyzer/region-model.cc:4197
0x141c12f ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::state_change*) const
        /home/marxin/Programming/gcc/gcc/analyzer/engine.cc:1019
0x141ca31 ana::exploded_graph::process_node(ana::exploded_node*)
        /home/marxin/Programming/gcc/gcc/analyzer/engine.cc:2530
0x141ce82 ana::exploded_graph::process_worklist()
        /home/marxin/Programming/gcc/gcc/analyzer/engine.cc:2348
0x141f0de ana::impl_run_checkers(ana::logger*)
        /home/marxin/Programming/gcc/gcc/analyzer/engine.cc:4029
0x1420abc ana::run_checkers()
        /home/marxin/Programming/gcc/gcc/analyzer/engine.cc:4097
0x1414ea8 execute
        /home/marxin/Programming/gcc/gcc/analyzer/analyzer-pass.cc:84
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug analyzer/95152] ICE in get_or_create_mem_ref, at analyzer/region-model.cc:6938 since r10-5950-g757bf1dff5e8cee3

[fredrik.hederstierna@securitas-direct.com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

--- Comment #4 from Fredrik Hederstierna <fredrik.hederstierna@securitas-direct.com> ---
Stripped down example:

File <test.i>:


typedef struct {
  int var;
} info_t;
extern void *_data_offs;
void test()
{
  info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
  my_func(info->var == 0);
}

Output:

during IPA pass: analyzer
test2.i:10:42: internal compiler error: in get_or_create_mem_ref, at
analyzer/region-model.cc:6938
   10 |   info_t *info = ((void *)((void *)1) + ((unsigned int)&_data_offs));
      |                                         ~^~~~~~~~~~~~~~~~~~~~~~~~~~
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.


Compilation:

/opt/gcc/arm-none-eabi-toolchain-gcc-10.1.0-binutils-2.33.1-newlib-3.3.0-hardfloat/bin/arm-none-eabi-gcc
-fanalyzer -O2 -o test.o test.i

BR Fredrik

[Bug analyzer/95152] ICE in get_or_create_mem_ref, at analyzer/region-model.cc:6938 since r10-5950-g757bf1dff5e8cee3

[yagi.uwu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

yagi uwu <yagi.uwu at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |yagi.uwu at gmail dot com

--- Comment #5 from yagi uwu <yagi.uwu at gmail dot com> ---
Hello, i too got an error that seems to be the same as yours, but i
accidentally managed to find a simple example, so i am showing it with the hope
it can help find the bug.

The source file fits here:
void foo(void)
{
        // the size does not seem relevant
        // the parameters do not either
        // nor do the return types
        void (*a[1]) ();
        void (*p) () = a + 1; // <- the error happens here
        // the amount add does not seem to matter,
        // but it needs to be different to 0
}

My system is under linux mint.
This is what /home/yagigami/gcc-installs/usr/local/bin/gcc -v shows:
Using built-in specs.
COLLECT_GCC=/home/yagigami/gcc-installs/usr/local/bin/gcc
COLLECT_LTO_WRAPPER=/home/yagigami/gcc-installs/usr/local/bin/../libexec/gcc/x86_64-pc-linux-gnu/10.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/configure
--enable-languages=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 10.1.0 (GCC)

This is the error message:
during IPA pass: analyzer
bug.c:7:26: internal compiler error: in get_or_create_mem_ref, at
analyzer/region-model.cc:6932
    7 |         void (*p) () = a + 1;
      |                        ~~^~~
0x5f84d9 ana::region_model::get_or_create_mem_ref(tree_node*, ana::svalue_id,
ana::svalue_id, ana::region_model_context*)
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/region-model.cc:6932
0xe02bf7 ana::region_model::get_or_create_pointer_plus_expr(tree_node*,
ana::svalue_id, ana::svalue_id, ana::region_model_context*)
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/region-model.cc:7021
0xe02bf7 ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/region-model.cc:4197
0xde6a6a ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*, ana::state_change*) const
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/engine.cc:1019
0xde73cf ana::exploded_graph::process_node(ana::exploded_node*)
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/engine.cc:2530
0xde781a ana::exploded_graph::process_worklist()
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/engine.cc:2348
0xde7f0b ana::impl_run_checkers(ana::logger*)
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/engine.cc:4029
0xde8a9c ana::run_checkers()
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/engine.cc:4097
0xdde058 execute
       
/home/yagigami/gcc/release-10.1/gcc-releases-gcc-10.1.0/gcc/analyzer/analyzer-pass.cc:84

[Bug analyzer/95152] ICE in get_or_create_mem_ref, at analyzer/region-model.cc:6938 since r10-5950-g757bf1dff5e8cee3

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:6b31b6b52612a6d4a7a84e71f6331464d68400d4

commit r11-2792-g6b31b6b52612a6d4a7a84e71f6331464d68400d4
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Aug 20 17:50:14 2020 -0400

    analyzer: add regression tests [PR95152]

    PR analyzer/95152 reports various ICEs in
    region_model::get_or_create_mem_ref.

    I removed this function as part of the state rewrite in
    r11-2694-g808f4dfeb3a95f50f15e71148e5c1067f90a126d.
    I've verified that these two test cases reproduce the issue with 10.2
    and don't ICE with trunk; adding them as regression tests.

    gcc/testsuite/ChangeLog:
            PR analyzer/95152
            * gcc.dg/analyzer/pr95152-4.c: New test.
            * gcc.dg/analyzer/pr95152-5.c: New test.

[Bug analyzer/95152] ICE in get_or_create_mem_ref, at analyzer/region-model.cc:6938 since r10-5950-g757bf1dff5e8cee3

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95152

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
As noted in the above commit, I removed the offending function in
r11-2694-g808f4dfeb3a95f50f15e71148e5c1067f90a126d and can no longer reproduce
this; marking it as fixed (for GCC 11).