[Bug analyzer/100043] New: analyzer: ICE (segfault) in ana::region_model::on_assignment

[acoplan at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100043

            Bug ID: 100043
           Summary: analyzer: ICE (segfault) in
                    ana::region_model::on_assignment
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

The following fails:

$ cat test.c
void f() {
  char a[] = "";
  __builtin_mempcpy(0, a, 2);
}
$ aarch64-linux-gnu-gcc -c test.c -O -fanalyzer
during IPA pass: analyzer
test.c: In function ‘f’:
test.c:2:8: internal compiler error: Segmentation fault
    2 |   char a[] = "";
      |        ^
0xdf7a11 crash_signal
        /home/alecop01/toolchain/src/gcc/gcc/toplev.c:327
0x127f7fa ana::region_model::on_assignment(gassign const*,
ana::region_model_context*)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/region-model.cc:729
0x1258cfd ana::feasibility_state::maybe_update_for_edge(ana::logger*,
ana::exploded_edge const*, ana::rejected_constraint**)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/engine.cc:3635
0x1bff0be ana::epath_finder::process_worklist_item(ana::feasible_worklist*,
ana::trimmed_graph const&, ana::feasible_graph*, ana::exploded_node const*,
unsigned int, ana::exploded_path**) const
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:457
0x1c00ef2 ana::epath_finder::explore_feasible_paths(ana::exploded_node const*,
char const*, unsigned int)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:379
0x1c0180b ana::epath_finder::get_best_epath(ana::exploded_node const*, char
const*, unsigned int, ana::feasibility_problem**)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:160
0x1c019ae ana::saved_diagnostic::calc_best_epath(ana::epath_finder*)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:685
0x1c020cf ana::dedupe_winners::add(ana::logger*, ana::epath_finder*,
ana::saved_diagnostic*)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:979
0x1c020cf ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph
const&)
       
/home/alecop01/toolchain/src/gcc/gcc/analyzer/diagnostic-manager.cc:1096
0x1262d3e ana::impl_run_checkers(ana::logger*)
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/engine.cc:4887
0x1263c6e ana::run_checkers()
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/engine.cc:4944
0x1255e4a execute
        /home/alecop01/toolchain/src/gcc/gcc/analyzer/analyzer-pass.cc:87
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

The testcase was reduced from gcc.dg/analyzer/pr93355-localealias.c.