[Bug analyzer/126288] -fanalyzer ICE with strtok and malloc

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126288

--- Comment #2 from Bartosz Szreder <zgredder at gmail dot com> ---
(In reply to Eric Gallager from comment #1)
> Any chance you could get a backtrace?

My bad, should've included it in the first place.

$ gcc -S ice.c -fanalyzer
during IPA pass: analyzer
ice.c: In function ‘ice’:
ice.c:6:9: internal compiler error: Segmentation fault
    6 |         strtok(malloc(1), " ");
      |         ^~~~~~~~~~~~~~~~~~~~~~
0x560f260c4e7d internal_error(char const*, ...)
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/diagnostic-global-context.cc:787
0x560f24c9cdc7 crash_signal
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/toplev.cc:325
0x560f2512b286 ana::region_model::get_region_for_poisoned_expr(tree_node*)
const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/region-model.cc:1630
0x560f2512b286 ana::region_model::check_for_poison(ana::svalue const*,
tree_node*, ana::region const*, ana::region_model_context*) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/region-model.cc:1592
0x560f2512be11 ana::region_model::scan_for_null_terminator_1(ana::region
const*, tree_node*, ana::svalue const**, ana::region_model_context*) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/region-model.cc:4840
0x560f2512cd0f ana::region_model::scan_for_null_terminator(ana::region const*,
tree_node*, ana::svalue const**, ana::region_model_context*) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/region-model.cc:4871
0x560f25104401
ana::kf_strtok::strtok_call_info::update_model(ana::region_model*,
ana::exploded_edge const*, ana::region_model_context*) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/kf.cc:1965
0x560f2510b99c ana::gimple_stmt_op::execute_on_state(ana::operation_context&,
ana::program_state) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/ops.cc:426
0x560f2510cb2c ana::call_and_return_op::execute(ana::operation_context&) const
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/ops.cc:853
0x560f250ee9ea ana::exploded_graph::process_node(ana::exploded_node*)
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/engine.cc:3787
0x560f250ef02a ana::exploded_graph::process_worklist()
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/engine.cc:3416
0x560f250f1df9 ana::impl_run_checkers(ana::logger*)
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/engine.cc:5276
0x560f250f2b46 ana::run_checkers()
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/engine.cc:5367
0x560f250e1a4c execute
       
/usr/src/debug/sys-devel/gcc-16.1.1_p20260613/gcc-16-20260613/gcc/analyzer/analyzer-pass.cc:81
/usr/libexec/gcc/x86_64-pc-linux-gnu/16/cc1 -quiet ice.c -quiet -dumpbase ice.c
-dumpbase-ext .c -mtune=generic -march=x86-64 -mtls-dialect=gnu2 -fanalyzer -o
ice.s -foffload-options=-fno-stack-protector -fcf-protection
-foffload-options=-fcf-protection=none