[Bug analyzer/96646] New: [11 Regression] ICE: Segmentation fault (in tree_class_check)

[Bug analyzer/96646] New: [11 Regression] ICE: Segmentation fault (in tree_class_check)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96646

            Bug ID: 96646
           Summary: [11 Regression] ICE: Segmentation fault (in
                    tree_class_check)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-11.0.0-alpha20200816 snapshot (g:c99116aeeb9644ebddec653ee8b19de4d38b65bd)
ICEs when compiling the following testcase w/ -O1 -fanalyzer:

struct zx {
  struct zx *b4, *g0;
};

struct oo {
  int ph;
  struct zx el;
};

inline void
k7 (struct zx *xj)
{
  xj->b4->g0 = 0;
  xj->b4 = 0;
}

void
n8 (struct oo *yx)
{
  k7 (&yx->el);
  n8 (yx);
}

% gcc-11.0.0 -O1 -fanalyzer -c rn6i1ylt.c
during IPA pass: analyzer
rn6i1ylt.c:13:5: internal compiler error: Segmentation fault
   13 |   xj->b4->g0 = 0;
      |   ~~^~~~
0xd7da1f crash_signal
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/toplev.c:327
0x89a9d9 tree_class_check(tree_node*, tree_code_class, char const*, int, char
const*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/tree.h:3417
0x89a9d9 c_pretty_printer::unary_expression(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c-family/c-pretty-print.c:1793
0x898fd7 c_pretty_printer::postfix_expression(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c-family/c-pretty-print.c:1605
0x89a5f5 c_pretty_printer::unary_expression(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c-family/c-pretty-print.c:1797
0x898fd7 c_pretty_printer::postfix_expression(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c-family/c-pretty-print.c:1605
0x8017fd c_tree_printer
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c/c-objc-common.c:317
0x8017fd c_tree_printer
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/c/c-objc-common.c:254
0x189db05 pp_format(pretty_printer*, text_info*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/pretty-print.c:1475
0x1850f1b ana::evdesc::event_desc::formatted_print(char const*, ...) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/pending-diagnostic.cc:63
0x183edf6 ana::state_change_event::get_desc(bool) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/checker-path.cc:255
0x183e892 ana::checker_event::prepare_for_emission(ana::checker_path*,
ana::pending_diagnostic*, diagnostic_event_id_t)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/checker-path.cc:144
0x184e360 ana::checker_path::prepare_for_emission(ana::pending_diagnostic*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/checker-path.h:498
0x184e360 ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph
const&, ana::saved_diagnostic const&, ana::exploded_path const&, gimple const*,
int)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/diagnostic-manager.cc:568
0x184fc7e ana::dedupe_winners::emit_best(ana::diagnostic_manager*,
ana::exploded_graph const&)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/diagnostic-manager.cc:469
0x184e728 ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/diagnostic-manager.cc:522
0x10f6eb4 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:4121
0x10f7aac ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/engine.cc:4175
0x10ec468 execute
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20200816/work/gcc-11-20200816/gcc/analyzer/analyzer-pass.cc:84

[Bug analyzer/96646] [11 Regression] ICE: Segmentation fault (in tree_class_check)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96646

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.0

[Bug analyzer/96646] [11 Regression] ICE: Segmentation fault (in tree_class_check)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96646

--- Comment #1 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:29f5db8ef81fac4db8e66e5f06fdf1d469e8161c

commit r11-3471-g29f5db8ef81fac4db8e66e5f06fdf1d469e8161c
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Fri Sep 25 17:15:42 2020 -0400

    analyzer: fix ICEs treeifying offset_region [PR96646, PR96841]

    gcc/analyzer/ChangeLog:
            PR analyzer/96646
            PR analyzer/96841
            * region-model.cc (region_model::get_representative_path_var):
            When handling offset_region, wrap the MEM_REF's first argument in
            an ADDR_EXPR of pointer type, rather than simply using the tree
            for the parent region.  Require the MEM_REF's second argument to
            be an integer constant.

    gcc/testsuite/ChangeLog:
            PR analyzer/96646
            PR analyzer/96841
            * gcc.dg/analyzer/pr96646.c: New test.
            * gcc.dg/analyzer/pr96841.c: New test.

[Bug analyzer/96646] [11 Regression] ICE: Segmentation fault (in tree_class_check)

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96646

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.