[Bug analyzer/96723] New: [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[Bug analyzer/96723] New: [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96723

            Bug ID: 96723
           Summary: [11 Regression] ICE: SIGSEGV: infinite recursion in
                    ana::region::get_subregions_for_binding with -Og
                    -fanalyzer
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu

Created attachment 49086
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49086&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-g++ -Og -fanalyzer testcase.C 
x86_64-pc-linux-gnu-g++: internal compiler error: Segmentation fault signal
terminated program cc1plus
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.

(gdb) bt
#0  0x00007ffff772a0b6 in _int_malloc () from /lib64/libc.so.6
#1  0x00007ffff772b9e4 in malloc () from /lib64/libc.so.6
#2  0x0000000001fec7f5 in operator new(unsigned long) ()
#3  0x00000000016c75e3 in ana::region_model_manager::get_field_region
(this=this@entry=0x7fffffffcc10, parent=parent@entry=0x10336890,
field=field@entry=0x7ffff75e8f00)
    at /repo/gcc-trunk/gcc/analyzer/region-model.h:2352
#4  0x00000000016ac2f6 in ana::region::get_subregions_for_binding
(this=0x10336890, mgr=0x7fffffffcc10, relative_bit_offset=...,
size_in_bits=..., type=0x7ffff74ad000, out=0x7fffffffbec8)
    at /repo/gcc-trunk/gcc/analyzer/region.cc:314
#5  0x00000000016ac33f in ana::region::get_subregions_for_binding
(this=0x10336510, mgr=0x7fffffffcc10, relative_bit_offset=...,
size_in_bits=..., type=0x7ffff74ad000, out=0x7fffffffbec8)
    at /repo/gcc-trunk/gcc/analyzer/region.cc:315
#6  0x00000000016ac33f in ana::region::get_subregions_for_binding
(this=0x10336190, mgr=0x7fffffffcc10, relative_bit_offset=...,
size_in_bits=..., type=0x7ffff74ad000, out=0x7fffffffbec8)
    at /repo/gcc-trunk/gcc/analyzer/region.cc:315
#7  0x00000000016ac33f in ana::region::get_subregions_for_binding
(this=0x10335e10, mgr=0x7fffffffcc10, relative_bit_offset=...,
size_in_bits=..., type=0x7ffff74ad000, out=0x7fffffffbec8)
...

$ x86_64-pc-linux-gnu-g++ -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest/bin/x86_64-pc-linux-gnu-g++
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r11-2779-20200820091258-g1763ec9b20c-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r11-2779-20200820091258-g1763ec9b20c-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.0.0 20200820 (experimental) (GCC)

[Bug analyzer/96723] [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96723

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2020-08-20
     Ever confirmed|0                           |1

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; am working on a fix.

[Bug analyzer/96723] [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96723

Arseny Solokha <asolokha at gmx dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |asolokha at gmx dot com

--- Comment #2 from Arseny Solokha <asolokha at gmx dot com> ---
*** Bug 96666 has been marked as a duplicate of this bug. ***

[Bug analyzer/96723] [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96723

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:00cb0f5840795698557731c6e549a5ce99573223

commit r11-2789-g00cb0f5840795698557731c6e549a5ce99573223
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Aug 20 10:00:49 2020 -0400

    analyzer: fix infinite recursion ICE on unions [PR96723]

    Attempts to store sm-state into a union in C++ triggered an infinite
    recursion when trying to generate a representative tree, due to
    erroneously trying to use the dtor of the union as a field.

    Fix it by filtering out non-FIELD_DECLs when walking TYPE_FIELDs
    in region::get_subregions_for_binding.

    gcc/analyzer/ChangeLog:
            PR analyzer/96723
            * region-model-manager.cc
            (region_model_manager::get_field_region): Assert that field is a
            FIELD_DECL.
            * region.cc (region::get_subregions_for_binding): In
            union-handling, filter the TYPE_FIELDS traversal to just
FIELD_DECLs.

    gcc/testsuite/ChangeLog:
            PR analyzer/96723
            * g++.dg/analyzer/pr96723.C: New test.

[Bug analyzer/96723] [11 Regression] ICE: SIGSEGV: infinite recursion in ana::region::get_subregions_for_binding with -Og -fanalyzer

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96723

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above commit.