From: David Malcolm <dmalcolm@redhat.com>
Date: Tue, 17 Feb 2026 23:04:17 +0000 (-0500)
Subject: analyzer: fix ICE due to sloppy types in unaryop_svalue [PR124104]
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f310e487e1a5f01dcc0ce47996c91c35444ce9de;p=thirdparty%2Fgcc.git

analyzer: fix ICE due to sloppy types in unaryop_svalue [PR124104]

gcc/analyzer/ChangeLog:
	PR analyzer/124104
	* svalue.cc (unaryop_svalue::maybe_get_value_range): Bail out for
	incompatible types.

gcc/testsuite/ChangeLog:
	PR analyzer/124104
	* c-c++-common/analyzer/casts-3.c: New test.
	* gcc.dg/analyzer/ice-pr124104.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>
---

diff --git a/gcc/analyzer/svalue.cc b/gcc/analyzer/svalue.cc
index 5cb0fafbf5d..be9daced7e8 100644
--- a/gcc/analyzer/svalue.cc
+++ b/gcc/analyzer/svalue.cc
@@ -1585,7 +1585,8 @@ unaryop_svalue::maybe_get_value_range (value_range &out) const
   if (m_arg->maybe_get_value_range (arg_vr))
     {
       range_op_handler handler (m_op);
-      if (handler)
+      if (handler
+	  && handler.operand_check_p (type, arg_vr.type (), type))
 	{
 	  /* For unary ops, range_op_hander::fold_range expects
 	     a VARYING of the unknown value as the 2nd operand.  */
diff --git a/gcc/testsuite/c-c++-common/analyzer/casts-3.c b/gcc/testsuite/c-c++-common/analyzer/casts-3.c
new file mode 100644
index 00000000000..432ccc85a50
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/analyzer/casts-3.c
@@ -0,0 +1,13 @@
+#include "analyzer-decls.h"
+
+static int __attribute__((noipa))
+as_int (unsigned char c)
+{
+  return c;
+}
+
+void test_1 (unsigned char c)
+{
+  __analyzer_eval (as_int (c) >= 0); /* { dg-warning "TRUE" } */
+  __analyzer_eval (as_int (c) < 256); /* { dg-warning "TRUE" } */
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/ice-pr124104.c b/gcc/testsuite/gcc.dg/analyzer/ice-pr124104.c
new file mode 100644
index 00000000000..3a48d6bbd6e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/ice-pr124104.c
@@ -0,0 +1,9 @@
+short s;
+
+short
+foo()
+{
+  short t = 0;
+  __atomic_fetch_sub(&t, s, 0);
+  return t ?: 5;
+}