[Bug analyzer/96639] New: [11 Regression] ICE: Segmentation fault (in useless_type_conversion_p)

[Bug analyzer/96639] New: [11 Regression] ICE: Segmentation fault (in useless_type_conversion_p)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96639

            Bug ID: 96639
           Summary: [11 Regression] ICE: Segmentation fault (in
                    useless_type_conversion_p)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-11.0.0-alpha20200816 snapshot (g:c99116aeeb9644ebddec653ee8b19de4d38b65bd)
ICEs when compiling the following testcase w/ -fanalyzer:

void *
calloc (__SIZE_TYPE__, __SIZE_TYPE__);

int
x7 (void)
{
  int **md = calloc (1, 1);

  return md[0][0];
}

% gcc-11.0.0 -fanalyzer -c at88dqtc.c
during IPA pass: analyzer
at88dqtc.c: In function 'x7':
at88dqtc.c:9:15: internal compiler error: Segmentation fault
    9 |   return md[0][0];
      |          ~~~~~^~~
0xd7da1f crash_signal
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/toplev.c:327
0xab1798 useless_type_conversion_p(tree_node*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/gimple-expr.c:71
0x1108dce types_compatible_p
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/gimple-expr.h:67
0x1108dce ana::region::get_subregions_for_binding(ana::region_model_manager*,
generic_wide_int<fixed_wide_int_storage<128> >,
generic_wide_int<fixed_wide_int_storage<128> >, tree_node*,
auto_vec<ana::region const*, 0ul>*) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/region.cc:262
0x113822c ana::binding_cluster::get_representative_path_vars(ana::region_model
const*, hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue
const*> >*, ana::region const*, ana::svalue const*, auto_vec<ana::path_var,
0ul>*) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/store.cc:1121
0x11392e7 ana::store::get_representative_path_vars(ana::region_model const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*,
ana::svalue const*, auto_vec<ana::path_var, 0ul>*) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/store.cc:1805
0x110dc5d ana::region_model::get_representative_path_var(ana::svalue const*,
hash_set<ana::svalue const*, false, default_hash_traits<ana::svalue const*> >*)
const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/region-model.cc:1806
0x110e3a7 ana::region_model::get_representative_tree(ana::svalue const*) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/region-model.cc:1851
0x10f8474 ana::impl_sm_context::get_diagnostic_tree(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:295
0x11320df on_stmt
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/sm-malloc.cc:805
0x10f318f ana::exploded_node::on_stmt(ana::exploded_graph&, ana::supernode
const*, gimple const*, ana::program_state*) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:1098
0x10f426d ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:2526
0x10f4d5a ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:2341
0x10f6e8f ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:4107
0x10f7aac ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:4175
0x10ec468 execute
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/analyzer-pass.cc:84

[Bug analyzer/96639] [11 Regression] ICE: Segmentation fault (in useless_type_conversion_p)

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96639

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-08-17
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; confirmed.

[Bug analyzer/96639] [11 Regression] ICE: Segmentation fault (in useless_type_conversion_p)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96639

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:42c5ae5d7f0ad89b75d93c497fe44b6c66da7e76

commit r11-2724-g42c5ae5d7f0ad89b75d93c497fe44b6c66da7e76
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Aug 17 11:40:44 2020 -0400

    analyzer: fix ICE due to NULL type [PR96639]

    gcc/analyzer/ChangeLog:
            PR analyzer/96639
            * region.cc (region::get_subregions_for_binding): Check for "type"
            being NULL.

    gcc/testsuite/ChangeLog:
            PR analyzer/96639
            * gcc.dg/analyzer/pr96639.c: New test.

[Bug analyzer/96639] [11 Regression] ICE: Segmentation fault (in useless_type_conversion_p)

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96639

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.