From 7d8f4240c94e2e7643ac13cda1fdd0bb6ca3a3fb Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Mon, 5 Apr 2021 10:51:46 -0400
Subject: [PATCH] analyzer: fix ICE on zero-arg calls passed to
 __attribute__((nonnull)) [PR 99906]

gcc/analyzer/ChangeLog:
	PR analyzer/99906
	* analyzer.cc (maybe_reconstruct_from_def_stmt): Fix NULL
	dereference on calls with zero arguments.
	* sm-malloc.cc (malloc_state_machine::on_stmt): When handling
	__attribute__((nonnull)), only call get_diagnostic_tree if the
	result will be used.

gcc/testsuite/ChangeLog:
	PR analyzer/99906
	* gcc.dg/analyzer/pr99906.c: New test.
---
 gcc/analyzer/analyzer.cc                | 2 +-
 gcc/analyzer/sm-malloc.cc               | 3 ++-
 gcc/testsuite/gcc.dg/analyzer/pr99906.c | 3 +++
 3 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/analyzer/pr99906.c

diff --git a/gcc/analyzer/analyzer.cc b/gcc/analyzer/analyzer.cc
index 2b4cffd08f5..12c03f6cfbd 100644
--- a/gcc/analyzer/analyzer.cc
+++ b/gcc/analyzer/analyzer.cc
@@ -148,7 +148,7 @@ maybe_reconstruct_from_def_stmt (tree ssa_name,
 	  }
 	return build_call_array_loc (gimple_location (call_stmt),
 				     return_type, fn,
-				     num_args, &args[0]);
+				     num_args, args.address ());
       }
       break;
     }
diff --git a/gcc/analyzer/sm-malloc.cc b/gcc/analyzer/sm-malloc.cc
index ae03b068a88..1d5b8601b1f 100644
--- a/gcc/analyzer/sm-malloc.cc
+++ b/gcc/analyzer/sm-malloc.cc
@@ -1600,11 +1600,11 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
 		  if (bitmap_empty_p (nonnull_args)
 		      || bitmap_bit_p (nonnull_args, i))
 		    {
-		      tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
 		      state_t state = sm_ctxt->get_state (stmt, arg);
 		      /* Can't use a switch as the states are non-const.  */
 		      if (unchecked_p (state))
 			{
+			  tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
 			  sm_ctxt->warn (node, stmt, arg,
 					 new possible_null_arg (*this, diag_arg,
 								callee_fndecl,
@@ -1616,6 +1616,7 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
 			}
 		      else if (state == m_null)
 			{
+			  tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
 			  sm_ctxt->warn (node, stmt, arg,
 					 new null_arg (*this, diag_arg,
 						       callee_fndecl, i));
diff --git a/gcc/testsuite/gcc.dg/analyzer/pr99906.c b/gcc/testsuite/gcc.dg/analyzer/pr99906.c
new file mode 100644
index 00000000000..bb399a3e2ff
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/pr99906.c
@@ -0,0 +1,3 @@
+void bar(void *) __attribute__((__nonnull__));
+void *baz(void);
+void foo(void) { bar(baz()); }