https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126805
Bug ID: 126805
Summary: [analyzer] ICE in convert_region_from_summary for a
class return slot
Product: gcc
Version: 16.1.0
Status: UNCONFIRMED
Keywords: ice-on-valid-code
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: hello at bjornpagen dot com
Target Milestone: ---
Host: aarch64-apple-darwin24
Target: aarch64-apple-darwin24
Build: aarch64-apple-darwin24
GCC produces an internal compiler error when the analyzer replays a call
summary for a function that returns a class through a hidden return slot. The
analyzer should complete without a diagnostic. The smallest testcase needs two
call sites and -fanalyzer-call-summaries.
Testcase:
struct payload {
int x;
payload(int v) : x(v) {}
payload(const payload& o) : x(o.x) {}
};
__attribute__((noinline)) static payload take(payload& v) {
return v;
}
static void run(payload& out, payload& v) {
out = take(v);
}
void caller1(payload& t, payload& v) {
run(t, v);
}
void caller2(payload& t, payload& v) {
run(t, v);
}
Command:
g++-16 -O2 -std=c++17 -fanalyzer -fanalyzer-call-summaries --param
analyzer-min-snodes-for-call-summary=0 -c repro-standalone.cc
Compiler output:
during IPA pass: analyzer
In function 'void run(payload&, payload&)',
inlined from 'void caller1(payload&, payload&)' at
repro-standalone.cc:16:5:
repro-standalone.cc:12:19: internal compiler error: in
convert_region_from_summary, at analyzer/call-summary.cc:550
12 | out = take(v);
| ~~~~^~~
Expected result:
The analyzer completes, and the compilation exits with status 0. The same
testcase compiles with -fanalyzer when -fanalyzer-call-summaries is absent.
Versions tested:
GCC 16.1.0 reproduces the ICE on aarch64-apple-darwin24.
The official gcc:16.1.0 container reproduces it on aarch64-linux.
GCC master commit 475e9efffaf8de781d7e17b687faf1807e104b01 reproduces it on
aarch64-linux.
The testcase compiles cleanly with -Wall -Wextra when the analyzer is absent.
Environment:
Using built-in specs.
COLLECT_GCC=g++-16
COLLECT_LTO_WRAPPER=/Users/bjorn/.gcc/versions/16.1.0/libexec/gcc/aarch64-apple-darwin24/16.1.0/lto-wrapper
Target: aarch64-apple-darwin24
Configured with: ../gcc-16.1.0/configure
--prefix=/Users/bjorn/.gcc/versions/16.1.0 --enable-languages=c,c++
--disable-nls --enable-checking=release --program-suffix=-16 --with-system-zlib
--build=aarch64-apple-darwin24
--with-sysroot=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 16.1.0 (GCC)
PR 114473 has a different crash in deref_rvalue. PR 114798 has a different
crash in convert_svalue_from_summary_1.
