[Bug analyzer/126805] New: [analyzer] ICE in convert_region_from_summary for a class return slot

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126805

            Bug ID: 126805
           Summary: [analyzer] ICE in convert_region_from_summary for a
                    class return slot
           Product: gcc
           Version: 16.1.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: hello at bjornpagen dot com
  Target Milestone: ---
              Host: aarch64-apple-darwin24
            Target: aarch64-apple-darwin24
             Build: aarch64-apple-darwin24

GCC produces an internal compiler error when the analyzer replays a call
summary for a function that returns a class through a hidden return slot. The
analyzer should complete without a diagnostic. The smallest testcase needs two
call sites and -fanalyzer-call-summaries.

Testcase:
struct payload {
        int x;
        payload(int v) : x(v) {}
        payload(const payload& o) : x(o.x) {}
};

__attribute__((noinline)) static payload take(payload& v) {
        return v;
}

static void run(payload& out, payload& v) {
        out = take(v);
}

void caller1(payload& t, payload& v) {
        run(t, v);
}

void caller2(payload& t, payload& v) {
        run(t, v);
}

Command:
g++-16 -O2 -std=c++17 -fanalyzer -fanalyzer-call-summaries --param
analyzer-min-snodes-for-call-summary=0 -c repro-standalone.cc

Compiler output:
during IPA pass: analyzer
In function 'void run(payload&, payload&)',
    inlined from 'void caller1(payload&, payload&)' at
repro-standalone.cc:16:5:
repro-standalone.cc:12:19: internal compiler error: in
convert_region_from_summary, at analyzer/call-summary.cc:550
   12 |         out = take(v);
      |               ~~~~^~~

Expected result:
The analyzer completes, and the compilation exits with status 0. The same
testcase compiles with -fanalyzer when -fanalyzer-call-summaries is absent.

Versions tested:
GCC 16.1.0 reproduces the ICE on aarch64-apple-darwin24.
The official gcc:16.1.0 container reproduces it on aarch64-linux.
GCC master commit 475e9efffaf8de781d7e17b687faf1807e104b01 reproduces it on
aarch64-linux.
The testcase compiles cleanly with -Wall -Wextra when the analyzer is absent.

Environment:
Using built-in specs.
COLLECT_GCC=g++-16
COLLECT_LTO_WRAPPER=/Users/bjorn/.gcc/versions/16.1.0/libexec/gcc/aarch64-apple-darwin24/16.1.0/lto-wrapper
Target: aarch64-apple-darwin24
Configured with: ../gcc-16.1.0/configure
--prefix=/Users/bjorn/.gcc/versions/16.1.0 --enable-languages=c,c++
--disable-nls --enable-checking=release --program-suffix=-16 --with-system-zlib
--build=aarch64-apple-darwin24
--with-sysroot=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 16.1.0 (GCC)

PR 114473 has a different crash in deref_rvalue. PR 114798 has a different
crash in convert_svalue_from_summary_1.