[Bug analyzer/93451] New: ICE: qsort checking failed (error: qsort comparator non-negative on sorted output: 0)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93451

            Bug ID: 93451
           Summary: ICE: qsort checking failed (error: qsort comparator
                    non-negative on sorted output: 0)
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-10.0.0-alpha20200126 snapshot (g:787c79e559f5f011989b94298346d89542eb9052)
ICEs when compiling the following testcase w/ -O1 -fanalyzer:

void
mt (double);

void
nm (void)
{
  double ao = 0.0;
  long int es = -1;

  mt (ao);
  ++ao;
  mt (ao);
  mt (*(double *) &es);
}

% gcc-10.0.0 -O1 -fanalyzer -c gneu3e9x.c
gneu3e9x.c: In function 'nm':
gneu3e9x.c:10:3: error: qsort comparator non-negative on sorted output: 0
   10 |   mt (ao);
      |   ^~~~~~~
during IPA pass: analyzer
gneu3e9x.c:10:3: internal compiler error: qsort checking failed
0x790d0b qsort_chk_error
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/vec.c:214
0x790e2a qsort_chk(void*, unsigned long, unsigned long, int (*)(void const*,
void const*, void*), void*)
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/vec.c:256
0x180d098 gcc_qsort(void*, unsigned long, unsigned long, int (*)(void const*,
void const*))
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/sort.cc:270
0x11000c3 vec<ana::svalue_id, va_heap, vl_embed>::qsort(int (*)(void const*,
void const*))
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/vec.h:1125
0x11000c3 vec<ana::svalue_id, va_heap, vl_ptr>::qsort(int (*)(void const*, void
const*))
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/vec.h:1997
0x11000c3 ana::region_model::canonicalize(ana::region_model_context*)
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/region-model.cc:3756
0x10f4e5a ana::program_state::prune_for_point(ana::exploded_graph&,
ana::program_point const&, ana::state_change*) const
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/program-state.cc:868
0x10e1be7 ana::exploded_graph::get_or_create_node(ana::program_point const&,
ana::program_state const&, ana::state_change*)
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/engine.cc:1845
0x10e4b79 ana::exploded_graph::process_node(ana::exploded_node*)
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/engine.cc:2456
0x10e5342 ana::exploded_graph::process_worklist()
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/engine.cc:2259
0x10e59c9 ana::impl_run_checkers(ana::logger*)
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/engine.cc:3580
0x10e6463 ana::run_checkers()
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/engine.cc:3634
0x10dbf08 execute
       
/var/tmp/portage/sys-devel/gcc-10.0.0_alpha20200126/work/gcc-10-20200126/gcc/analyzer/analyzer-pass.cc:84