[Bug middle-end/111009] [12/13/14 regression] -fno-strict-overflow erroneously elides null pointer checks and causes SIGSEGV on perf from linux-6.4.10

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111009

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |amacleod at redhat dot com,
                   |                            |rguenth at gcc dot gnu.org
           Priority|P3                          |P2
   Target Milestone|---                         |12.4
   Last reconfirmed|                            |2023-08-14
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
There's nothing really wrong with lifting the &dso->maj computation, on GIMPLE
&dso->maj is just address arithmetic.

Interestingly we unswitch the loop but only with -fwrapv-pointer.

OK, so the bug looks like we have


 if (&dso->maj != 0)
   for (;;)
     {
       if (!dso) return 1;
       if (dso == curr) return 1;
...
     }

and the if (!dso) test is optimized away since &dso->maj != 0.

That's done by DOM3 here:

Optimizing statement _21 = dso_8(D) == _11;
LKUP STMT _21 = dso_8(D) eq_expr _11
2>>> STMT _21 = dso_8(D) eq_expr _11
Optimizing statement _22 = _21 | _13;
  Replaced '_13' with constant '0'
Applying pattern match.pd:201, gimple-match-10.cc:6318
gimple_simplified to _22 = _21;
  Folded to: _22 = _21;

I don't see where _13 = 0 is entered, this is possibly ranger related:

_13 : CACHE: BB 9 DOM query for _13, found [irange] _Bool VARYING at BB3
797     GORI  recomputation attempt on edge 3->16 for _13 = dso_8(D) == 0B;
798     GORI    outgoing_edge for dso_8(D) on edge 3->16
799     GORI      compute op 1 (a_9) at if (a_9 == 0B)
        GORI        LHS =[irange] _Bool [1, 1]
        GORI        Computes a_9 = [irange] int * [0, 0] intersect Known range
: [irange] int * VARYING
        GORI      TRUE : (799) produces  (a_9) [irange] int * [0, 0]
800     GORI      compute op 1 (dso_8(D)) at a_9 = &dso_8(D)->maj;
        GORI        LHS =[irange] int * [0, 0]
        GORI        Computes dso_8(D) = [irange] struct dso * [0, 0] intersect
Known range : [irange] struct dso * VARYING
        GORI      TRUE : (800) produces  (dso_8(D)) [irange] struct dso * [0,
0]
        GORI    TRUE : (798) outgoing_edge (dso_8(D)) [irange] struct dso * [0,
0]
        GORI  TRUE : (797) recomputation (_13) [irange] _Bool [1, 1]

I don't think we can do this.  Andrew?