[gcc r16-7364] analyzer: fix ICE on repeated_svalue with no type [PR117491]

[David Malcolm via Gcc-cvs]

https://gcc.gnu.org/g:87d9a9fd394f3cab1ab4dd62fa30bab806b03ffc

commit r16-7364-g87d9a9fd394f3cab1ab4dd62fa30bab806b03ffc
Author: David Malcolm <dmalc...@redhat.com>
Date:   Fri Feb 6 10:29:46 2026 -0500

    analyzer: fix ICE on repeated_svalue with no type [PR117491]
    
    gcc/analyzer/ChangeLog:
            PR analyzer/117491
            * region-model-manager.cc
            (region_model_manager::maybe_fold_repeated_svalue): Don't ICE when
            inner_svalue has null type.
    
    gcc/testsuite/ChangeLog:
            PR analyzer/117491
            * gcc.dg/analyzer/torture/ice-pr117491.c: New test.
    
    Signed-off-by: David Malcolm <dmalc...@redhat.com>

Diff:
---
 gcc/analyzer/region-model-manager.cc               | 29 +++++++++++-----------
 .../gcc.dg/analyzer/torture/ice-pr117491.c         | 10 ++++++++
 2 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/gcc/analyzer/region-model-manager.cc 
b/gcc/analyzer/region-model-manager.cc
index 76ca8348edae..1a2a0c740d09 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -1065,20 +1065,21 @@ region_model_manager::maybe_fold_repeated_svalue (tree 
type,
 
   /* If INNER_SVALUE is the same size as OUTER_SIZE,
      turn into simply a cast.  */
-  if (tree cst_outer_num_bytes = outer_size->maybe_get_constant ())
-    {
-      HOST_WIDE_INT num_bytes_inner_svalue
-       = int_size_in_bytes (inner_svalue->get_type ());
-      if (num_bytes_inner_svalue != -1)
-       if (num_bytes_inner_svalue
-           == (HOST_WIDE_INT)tree_to_uhwi (cst_outer_num_bytes))
-         {
-           if (type)
-             return get_or_create_cast (type, inner_svalue);
-           else
-             return inner_svalue;
-         }
-    }
+  if (inner_svalue->get_type ())
+    if (tree cst_outer_num_bytes = outer_size->maybe_get_constant ())
+      {
+       HOST_WIDE_INT num_bytes_inner_svalue
+         = int_size_in_bytes (inner_svalue->get_type ());
+       if (num_bytes_inner_svalue != -1)
+         if (num_bytes_inner_svalue
+             == (HOST_WIDE_INT)tree_to_uhwi (cst_outer_num_bytes))
+           {
+             if (type)
+               return get_or_create_cast (type, inner_svalue);
+             else
+               return inner_svalue;
+           }
+      }
 
   /* Handle zero-fill of a specific type.  */
   if (tree cst = inner_svalue->maybe_get_constant ())
diff --git a/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c 
b/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c
new file mode 100644
index 000000000000..9ca6c8ebb184
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/torture/ice-pr117491.c
@@ -0,0 +1,10 @@
+short c;
+int x;
+void *d, *s;
+
+void
+foo()
+{
+  __builtin_memset(&c, !x, sizeof c);
+  __builtin_memcpy(d, s, c);
+}