https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67133
Manuel López-Ibáñez <manu at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |law at gcc dot gnu.org --- Comment #7 from Manuel López-Ibáñez <manu at gcc dot gnu.org> --- (In reply to Zhendong Su from comment #0) > The following code causes an ICE when compiled with the current gcc trunk at > -Os and above on x86_64-linux-gnu in both 32-bit and 64-bit modes. > > It is a regression from 5.1.x. This was already latent in r226635, just compile with options: -Os -fisolate-erroneous-paths-dereference -fisolate-erroneous-paths-attribute The problem is that infer_nonnull_range gets: (gdb) p debug_gimple_stmt(stmt) __builtin_unreachable (); which is decorated with attributes: (gdb) p debug_tree(attrs) <tree_list 0x7ffff64b3bb8 purpose <identifier_node 0x7ffff644b3c0 nonnull> value <tree_list 0x7ffff645edc0 value <integer_cst 0x7ffff6444060 constant 1>> chain <tree_list 0x7ffff64b3b90 purpose <identifier_node 0x7ffff644b2d0 format> value <tree_list 0x7ffff6460730 value <identifier_node 0x7ffff644b550 printf> chain <tree_list 0x7ffff645ef00 value <integer_cst 0x7ffff6444060 1> chain <tree_list 0x7ffff645ede8 value <integer_cst 0x7ffff6444318 constant 2>>>>>> That is, this __builtin_unreachable has __attribute__((nonnull(1))), which doesn't make any sense and breaks infer_nonnull_range when it tries to access its first argument. I have no idea whatsoever how __builtin_unreachable gets to have attribute nonnull, but that is a pre-existing bug. Surprising it doesn't break more stuff.