[Bug analyzer/93950] ICE: in make_region_for_unexpected_tree_code, at analyzer/region-model.cc:4786 with -fanalyzer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93950

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:71b633aaea3aac2d983da7b1b99da8c9a8c80d1a

commit r10-6880-g71b633aaea3aac2d983da7b1b99da8c9a8c80d1a
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Feb 26 16:32:16 2020 -0500

    analyzer: fix ICE with -Wanalyzer-null-dereference [PR 93950]

    PR analyzer/93950 reports an ICE when pruning the path of a
    -Wanalyzer-null-dereference diagnostic.

    The root cause is a bug in the state-tracking code, in which the
    variable of interest is tracked from the callee to a "nullptr" param
    at the caller, whereupon we have an INTEGER_CST "variable", and
    the attempt to look up its lvalue fails.

    This code could use a rewrite; in the meantime this patch extends
    the bulletproofing from g:8525d1f5f57b11fe04a97674cc2fc2b7727621d0
    for PR analyzer/93544 to all of the various places where var can
    be updated, fixing the ICE.

    gcc/analyzer/ChangeLog:
        PR analyzer/93950
        * diagnostic-manager.cc
        (diagnostic_manager::prune_for_sm_diagnostic): Assert that var is
        either NULL or not a constant.  When updating var, bulletproof
        against constant values.

    gcc/testsuite/ChangeLog:
        PR analyzer/93950
        * g++.dg/analyzer/pr93950.C: New test.