[Bug analyzer/113923] Segfault in gcc/gcc/tree-diagnostic.cc:265

[bouanto at zoho dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113923

--- Comment #8 from Antoni <bouanto at zoho dot com> ---
(In reply to David Malcolm from comment #2)
> inlined_call_event's ctor should probably assert that params
>                     tree apparent_callee_fndecl,
>                     tree apparent_caller_fndecl,
> are both non-NULL, which might catch the issue slightly early.

I added an assert and here's the stacktrace:

during IPA pass: analyzer
libgccjit.so: internal compiler error: : in inlined_call_event, at
analyzer/checker-event.h:578
0x73d4eafbf076 ana::inlined_call_event::inlined_call_event(unsigned int,
tree_node*, tree_node*, int, int)
        ../../../gcc/gcc/analyzer/checker-event.h:578
0x73d4eafbe7dd ana::checker_path::inject_any_inlined_call_events(ana::logger*)
        ../../../gcc/gcc/analyzer/checker-path.cc:319
0x73d4eafd415f
ana::diagnostic_manager::emit_saved_diagnostic(ana::exploded_graph const&,
ana::saved_diagnostic&)
        ../../../gcc/gcc/analyzer/diagnostic-manager.cc:1599
0x73d4eafd981d ana::dedupe_winners::emit_best(ana::diagnostic_manager*,
ana::exploded_graph const&)
        ../../../gcc/gcc/analyzer/diagnostic-manager.cc:1472
0x73d4eafd3dcb
ana::diagnostic_manager::emit_saved_diagnostics(ana::exploded_graph const&)
        ../../../gcc/gcc/analyzer/diagnostic-manager.cc:1524
0x73d4e9a0327a ana::impl_run_checkers(ana::logger*)
        ../../../gcc/gcc/analyzer/engine.cc:6226
0x73d4e9a03613 ana::run_checkers()
        ../../../gcc/gcc/analyzer/engine.cc:6300
0x73d4e99f484c execute
        ../../../gcc/gcc/analyzer/analyzer-pass.cc:87


I can also confirm that this is related to always_inline as there are no
segfaults when removing the #[inline(always)] in the following example (see
comment):

#![no_std]

#![allow(internal_features)]
#![feature(core_intrinsics, lang_items, start)]
#![feature(transparent_unions)]
use core::mem::ManuallyDrop;

#[panic_handler]
fn panic_handler(_: &core::panic::PanicInfo<'_>) -> ! {
    core::intrinsics::abort();
}

#[lang="eh_personality"]
fn eh_personality(){}

#[derive(Clone, Copy)]
#[repr(transparent)]
pub union MaybeUninit<T> {
    uninit: (),
    value: ManuallyDrop<T>,
}

impl<T> MaybeUninit<T> {
    // NOTE: there are no segfaults when removing the next line.
    #[inline(always)]
    pub const fn uninit() -> MaybeUninit<T> {
        MaybeUninit { uninit: () }
    }
}

#[start]
fn main(_argc: isize, _argv: *const *const u8) -> isize {
    let mut x = MaybeUninit::<&i32>::uninit();
    0
}