[Bug tree-optimization/106630] [13 Regression] ICE: Segmentation fault signal terminated program cc1plus with -O2 since r13-1268-g8c99e307b20c50

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106630

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
We are folding a POINTER_PLUS_EXPR of

(vector(8) short int *) &g + a_9 * 48

and

48

which first gets to (vector(8) short int *) &g + (a_9 * 48 + 48)

which gets

/* (A * C) +- (B * C) -> (A+-B) * C and (A * C) +- A -> A * (C+-1).
    Modeled after fold_plusminus_mult_expr.  */

applied producing (a_9 + 1) * 48

the fold code produces a (sizetype) cast around (unsigned long) which is
useless (but not in GENERIC) and then

/* Narrow integer multiplication by a zero_one_valued_p operand.
   Multiplication by [0,1] is guaranteed not to overflow.  */
(simplify
 (convert (mult@0 zero_one_valued_p@1 INTEGER_CST@2))
 (if (INTEGRAL_TYPE_P (type)
      && INTEGRAL_TYPE_P (TREE_TYPE (@0))
      && TYPE_PRECISION (type) <= TYPE_PRECISION (TREE_TYPE (@0)))
  (mult (convert @1) (convert @2))))

triggers but folding this multiplication via fold-const.cc extract_muldiv
hoists the conversion again:

          if (TREE_CODE (arg1) == INTEGER_CST
              && (tem = extract_muldiv (op0, arg1, code, NULL_TREE,
                                        &strict_overflow_p)) != 0)
            {
              if (strict_overflow_p)
                fold_overflow_warning (("assuming signed overflow does not "
                                        "occur when simplifying "
                                        "multiplication"),
                                       WARN_STRICT_OVERFLOW_MISC);
              return fold_convert_loc (loc, type, tem);

which triggers the endless loop.  The fix might be to change the above
pattern guard to TYPE_PRECISION (type) < TYPE_PRECISION (TREE_TYPE (@0))
which would match what the comment says.

The comment about DOM + missing cprop remains of course.

I'm testing the above.