[creduce-dev] crash report with empty-struct-to-int and rename-param

[Kees Bakker]

Hi,

Here are two crash reports. One for empty-struct-to-int and one
for rename-param. Both were produced in the same creduce run.


This is with git commit 98501cee

BTW. In the creduce script run I disabled (commented out) reduce-array-size

--
Kees


 #include "csmith.h"
struct S0
{
  
  int f4;
};

uint32_t g_33[1];


int8_t g_91;
int16_t g_127;
int16_t g_128;
int32_t g_139;


struct S0 g_160;

struct S0 *g_159 = &g_160;
uint16_t g_167;

uint32_t g_202[4];
int32_t g_306;







int8_t *g_1088 = &g_91;

;
;
;
static uint32_t func_36 ( uint64_t, uint32_t *, int16_t, uint32_t * );
;
static int64_t func_44 ( uint16_t, uint32_t *, uint8_t, int32_t );
static struct S0 func_60 ( int16_t, uint32_t ***, int32_t );
;
int8_t
func_1 (  )
{
  uint64_t l_8 = 0;
  int32_t l_31 = 0;
  uint32_t *l_32 = &g_33[0];
  int32_t l_786;
  uint32_t *l_955[1][1][8];
  uint32_t *l_972 = &g_202[0];
  int32_t l_1090;
  int32_t l_1118;
          func_36
		  (  func_44 ( 0, 0, 0, 0 ) , 0, 0, 0 )        ;
  return 0;
}

;

;

;
uint32_t
func_36 ( uint64_t p_37, uint32_t * p_38, int16_t p_39, uint32_t * p_40 )
{
  return 0;
}

;
int64_t
func_44 ( uint16_t p_45, uint32_t * p_46, uint8_t p_47, int32_t p_48 )
{
  uint32_t **l_87;
  uint32_t ***l_86 = 0;
  int32_t l_93 = 0;
  int16_t *l_181 = &g_128;
  int32_t *l_785 = &g_139;
     func_60 ( 0, 0, 0 )   ;
  return 0;
}
struct S0
func_60 ( int16_t p_61, uint32_t *** p_62, int32_t p_63 )
{
  int32_t l_193 = -8L;
  int16_t l_229[1][1][1];
  int32_t l_231;
  int8_t **l_440;
  int64_t l_675;
  int i;
  for ( ; g_167 <= 0; g_167++ )
    {
      int32_t l_184[2];
      for ( ; g_127 <= 1; g_127++ )
	{
	  uint32_t *l_201 = &g_202[0];
	  int32_t l_203;
	      *l_201 =
		  safe_mod_func_uint64_t_u_u ( p_63,  l_193  )    ;
	  int32_t l_532;
	  int32_t l_539 = 0;
	  int32_t l_698[1];
	  i = 0;
	  
	  for ( 0; 0; i++ ) ;
	  for ( l_231 = 0; l_231 <= 1; l_231++ )
	    {
	      int8_t ***l_542;
	      0;
	      
	       ;
	      
		for ( ; p_63 <= 7; p_63++ ) ;
	      
	    }
	}
      for ( ; l_193 >= 0; l_193-- ) ;
    }
  return *g_159;
}

;

void
main (  )
{
  int i;
  
  crc32_gentab (  );
  func_1 (  );
  for ( i = 0; i < 1; i++ )
    transparent_crc ( g_202[0], "g_202[]", 0 );
  platform_main_end ( crc32_context, 0 );
}
 

// this should reproduce the crash:
// /loc/kees/creduce/creduce/../clang_delta/clang_delta --transformation=empty-struct-to-int --counter=1 /usr/src/tricore/usr/kees/reduce/csmith-1754403176/clang_delta_crash_tmp_file4Fs1bj.c

#include "csmith.h"
struct S0
{
  int f4;
};
int16_t g_127;
struct S0 g_160;
struct S0 *g_159 = &g_160;
uint16_t g_167;
uint32_t g_202[4];
struct S0 func_60 ( int16_t, uint32_t ***, int32_t );
int8_t
func_1 (  )
{
  func_60 ( 0, 0, 0 );
  return 0;
}
struct S0
func_60 ( int16_t p_61, uint32_t *** p_62, int32_t p_63 )
{
  int32_t l_193 = -8L;
  int32_t l_231;
  int i;
  for ( ; g_167 <= 0; g_167++ )
    {
      for ( ; g_127 <= 1; g_127++ )
	{
	  uint32_t *l_201 = &g_202[0];
	  *l_201 = safe_mod_func_uint64_t_u_u ( p_63, l_193 );
	  for ( 0; 0; i++ ) ;
	  for ( l_231 = 0; l_231 <= 1; l_231++ )
	    for ( ; p_63 <= 7; p_63++ ) ;
	}
      for ( ; l_193 >= 0; l_193-- ) ;
    }
  return *g_159;
}
void
main (  )
{
  int i;
  crc32_gentab (  );
  func_1 (  );
  for ( i = 0; i < 1; i++ )
    transparent_crc ( g_202[0], "g_202[]", 0 );
  platform_main_end ( crc32_context, 0 );
}


// this should reproduce the crash:
// /loc/kees/creduce/creduce/../clang_delta/clang_delta --transformation=rename-param --counter=1 /usr/src/tricore/usr/kees/reduce/csmith-1754403176/clang_delta_crash_tmp_fileCFhAFB.c