https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94099
--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
commit r10-7168-g5c048755ec98645f8436b630df3f9294ca9cbc2a
Author: David Malcolm <dmalc...@redhat.com>
Date: Tue Mar 10 19:03:37 2020 -0400
analyzer: handle NOP_EXPR in get_lvalue [PR94099,PR94105]
PR analyzer/94099 and PR analyzer/94105 both report ICEs relating to
calling region_model::get_lvalue on a NOP_EXPR.
PR analyzer/94099's ICE happens when generating a checker_path when
encountering an unhandled tree code (NOP_EXPR) in get_lvalue with a
NULL context (from for_each_state_change).
PR analyzer/94105 ICE happens when handling an ARRAY_REF where the
first operand is a NOP_EXPR: the unhandled tree code gives us
a symbolic_region, but the case for ARRAY_REF assumes we have an
array_region.
This patch fixes the ICEs by handling NOP_EXPR within
region_model::get_lvalue, and bulletproofs both of the above sources
of failure.
gcc/analyzer/ChangeLog:
PR analyzer/94099
PR analyzer/94105
* diagnostic-manager.cc (for_each_state_change): Bulletproof
against errors in get_rvalue by passing a
tentative_region_model_context and rejecting if there's an error.
* region-model.cc (region_model::get_lvalue_1): When handling
ARRAY_REF, handle results of error-handling. Handle NOP_EXPR.
gcc/testsuite/ChangeLog:
PR analyzer/94099
PR analyzer/94105
* gcc.dg/analyzer/pr94099.c: New test.
* gcc.dg/analyzer/pr94105.c: New test.
