From: David Malcolm <dmalcolm@redhat.com>
Date: Fri, 6 Feb 2026 15:29:46 +0000 (-0500)
Subject: analyzer: fix ICE on repeated_svalue with no type [PR117491]
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=87d9a9fd394f3cab1ab4dd62fa30bab806b03ffc;p=thirdparty%2Fgcc.git

analyzer: fix ICE on repeated_svalue with no type [PR117491]

gcc/analyzer/ChangeLog:
	PR analyzer/117491
	* region-model-manager.cc
	(region_model_manager::maybe_fold_repeated_svalue): Don't ICE when
	inner_svalue has null type.

gcc/testsuite/ChangeLog:
	PR analyzer/117491
	* gcc.dg/analyzer/torture/ice-pr117491.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---

diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 76ca8348eda..1a2a0c740d0 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -1065,20 +1065,21 @@ region_model_manager::maybe_fold_repeated_svalue (tree type,
 
   /* If INNER_SVALUE is the same size as OUTER_SIZE,
      turn into simply a cast.  */
-  if (tree cst_outer_num_bytes = outer_size->maybe_get_constant ())
-    {
-      HOST_WIDE_INT num_bytes_inner_svalue
-	= int_size_in_bytes (inner_svalue->get_type ());
-      if (num_bytes_inner_svalue != -1)
-	if (num_bytes_inner_svalue
-	    == (HOST_WIDE_INT)tree_to_uhwi (cst_outer_num_bytes))
-	  {
-	    if (type)
-	      return get_or_create_cast (type, inner_svalue);
-	    else
-	      return inner_svalue;
-	  }
-    }
+  if (inner_svalue->get_type ())
+    if (tree cst_outer_num_bytes = outer_size->maybe_get_constant ())
+      {
+	HOST_WIDE_INT num_bytes_inner_svalue
+	  = int_size_in_bytes (inner_svalue->get_type ());
+	if (num_bytes_inner_svalue != -1)
+	  if (num_bytes_inner_svalue
+	      == (HOST_WIDE_INT)tree_to_uhwi (cst_outer_num_bytes))
+	    {
+	      if (type)
+		return get_or_create_cast (type, inner_svalue);
+	      else
+		return inner_svalue;
+	    }
+      }
 
   /* Handle zero-fill of a specific type.  */
   if (tree cst = inner_svalue->maybe_get_constant ())
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c b/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c
new file mode 100644
index 00000000000..9ca6c8ebb18
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c
@@ -0,0 +1,10 @@
+short c;
+int x;
+void *d, *s;
+
+void
+foo()
+{
+  __builtin_memset(&c, !x, sizeof c);
+  __builtin_memcpy(d, s, c);
+}