From: David Malcolm <dmalcolm@redhat.com>
Date: Thu, 12 Feb 2026 01:49:43 +0000 (-0500)
Subject: analyzer: fix ICE in push_frame with missing return statement [PR124073]
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c32489989b66718d5b422090582e6de527bf386f;p=thirdparty%2Fgcc.git

analyzer: fix ICE in push_frame with missing return statement [PR124073]

gcc/analyzer/ChangeLog:
	PR analyzer/124073
	* region-model.cc (region_model::push_frame): Bulletproof against
	DECL_RESULT having null SSA on function missing a return
	statement (-Wreturn-type).

gcc/testsuite/ChangeLog:
	PR analyzer/124073
	* g++.dg/analyzer/ice-pr124073.C: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---

diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 871b91c069a..2546f44795d 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -6371,13 +6371,14 @@ region_model::push_frame (const function &fun,
 
 	    /* Get region for default val of DECL_RESULT within the
 	       callee.  */
-	    tree result_default_ssa = get_ssa_default_def (fun, result);
-	    gcc_assert (result_default_ssa);
-	    const region *callee_result_reg
-	      = get_lvalue (result_default_ssa, ctxt);
+	    if (tree result_default_ssa = get_ssa_default_def (fun, result))
+	      {
+		const region *callee_result_reg
+		  = get_lvalue (result_default_ssa, ctxt);
 
-	    /* Set the callee's reference to refer to the caller's lhs.  */
-	    set_value (callee_result_reg, ref_sval, ctxt);
+		/* Set the callee's reference to refer to the caller's lhs.  */
+		set_value (callee_result_reg, ref_sval, ctxt);
+	      }
 	  }
     }
   else
diff --git a/gcc/testsuite/g++.dg/analyzer/ice-pr124073.C b/gcc/testsuite/g++.dg/analyzer/ice-pr124073.C
new file mode 100644
index 00000000000..b48448ffefc
--- /dev/null
+++ b/gcc/testsuite/g++.dg/analyzer/ice-pr124073.C
@@ -0,0 +1,24 @@
+// { dg-do compile { target c++11 } }
+
+template <typename _Tp> struct remove_cv {
+  using type = _Tp;
+};
+struct basic_string {
+  ~basic_string();
+};
+template <typename T> using remove_cvref_t = remove_cv<T>;
+template <typename> struct basic_string_view {};
+template <typename> struct basic_format_string;
+auto format(...) -> basic_string {} // { dg-warning "no return statement" }
+template <int N>
+auto compile_string_to_view(const char (&)[N]) -> basic_string_view<char>;
+
+void MallocError() {
+  format([] {
+    using char_type = remove_cvref_t<decltype(0)>;
+    struct FMT_COMPILE_STRING {
+      operator char_type() {} // { dg-warning "no return statement" }
+    };
+    return FMT_COMPILE_STRING();
+  });
+}