[Bug target/61656] New: Undefined behavior in classify_argument

[Bug target/61656] New: Undefined behavior in classify_argument

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

            Bug ID: 61656
           Summary: Undefined behavior in classify_argument
           Product: gcc
           Version: 4.10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jakub at gcc dot gnu.org
                CC: hjl.tools at gmail dot com, hubicka at gcc dot gnu.org,
                    uros at gcc dot gnu.org
            Target: x86_64-linux

/usr/src/gcc/obj052/gcc/xgcc -B/usr/src/gcc/obj052/gcc/
-fno-diagnostics-show-caret -fdiagnostics-color=never -O0 -w -c -o pr4
2025-2.o /usr/src/gcc/gcc/testsuite/gcc.c-torture/compile/pr42025-2.c
../../gcc/config/i386/i386.c:6583:60: runtime error: mload of value 32669,
which is not a valid value for type 'x86_64_reg_class'

This is on passing
typedef struct { void *p; } Ptr;
struct A { int i; union { Ptr p; char *q; } u; };
by value and the problem is that when processing the union with bit_offset 64,
words is 1 (u is DImode 64-bit field), but when we recurse, we are called with
64-bit scalar DImode q and bit_offset 64, that is size (128-1)&0x7f and so it
is the size < 64+64 case where we return 2 and { X86_64_INTEGER_CLASS,
X86_64_INTEGER_CLASS }; in subclauses.  But words is 1 and we merge classes up
to num (2).  A simple fix could be:
   if (!num)
     return 0;
-  for (i = 0; i < num; i++)
+  for (i = 0; i < num && i < words; i++)
     classes[i] = merge_classes (subclasses[i], classes[i]);
in the UNION_TYPE case, as it seems the caller will not care about classes
above returned number (words).  I'd hope such a patch should not change the ABI
even.
I don't know whether there isn't an ABI problem related to this though, say
if at bit_offset 64 we have just SImode field in the union rather than DImode,
then I'd guess the recursive call would give us { X86_64_INTEGER_CLASS,
X86_64_INTEGERSI_CLASS }; but we'd use X86_64_INTEGER_CLASS anyway, as we are
looking at position 0, not 1.

[Bug target/61656] Undefined behavior in classify_argument

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

--- Comment #1 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Jakub Jelinek from comment #0)
> /usr/src/gcc/obj052/gcc/xgcc -B/usr/src/gcc/obj052/gcc/
> -fno-diagnostics-show-caret -fdiagnostics-color=never -O0 -w -c -o pr4
> 2025-2.o /usr/src/gcc/gcc/testsuite/gcc.c-torture/compile/pr42025-2.c
> ../../gcc/config/i386/i386.c:6583:60: runtime error: mload of value 32669,
> which is not a valid value for type 'x86_64_reg_class'
> 
> This is on passing
> typedef struct { void *p; } Ptr;
> struct A { int i; union { Ptr p; char *q; } u; };
> by value and the problem is that when processing the union with bit_offset
> 64,
> words is 1 (u is DImode 64-bit field), but when we recurse, we are called
> with
> 64-bit scalar DImode q and bit_offset 64, that is size (128-1)&0x7f and so
> it is the size < 64+64 case where we return 2 and { X86_64_INTEGER_CLASS,
> X86_64_INTEGER_CLASS }; in subclauses.  But words is 1 and we merge classes
> up to num (2).  A simple fix could be:
>    if (!num)
>      return 0;
> -  for (i = 0; i < num; i++)
> +  for (i = 0; i < num && i < words; i++)
>      classes[i] = merge_classes (subclasses[i], classes[i]);
> in the UNION_TYPE case, as it seems the caller will not care about classes
> above returned number (words).  I'd hope such a patch should not change the
> ABI even.
> I don't know whether there isn't an ABI problem related to this though, say
> if at bit_offset 64 we have just SImode field in the union rather than
> DImode,
> then I'd guess the recursive call would give us { X86_64_INTEGER_CLASS,
> X86_64_INTEGERSI_CLASS }; but we'd use X86_64_INTEGER_CLASS anyway, as we
> are looking at position 0, not 1.

X86_64_INTEGER_CLASS and X86_64_INTEGERSI_CLASS are handled in the same way,
the only difference is that the later class allows/uses cheaper movl insn. So,
if a SImode value lives at bit_offset 64, the change from INTEGER_CLASS to
INTEGERSI_CLASS does NOT introduce an ABI change - movl just narrows memory
load and sets "don't care" high bits to zero.
>From gcc-bugs-return-455678-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jul 04 12:21:58 2014
Return-Path: <gcc-bugs-return-455678-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 13185 invoked by alias); 4 Jul 2014 12:21:57 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 13092 invoked by uid 48); 4 Jul 2014 12:21:47 -0000
From: "matz at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/61203] [4.8/4.9/4.10 Regression] g++.old-deja/g++.jason/rvalue2.C FAILs with -O2 -fno-inline
Date: Fri, 04 Jul 2014 12:21:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: matz at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.8.4
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61203-4-3K0tVqMA4y@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61203-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61203-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00269.txt.bz2
Content-length: 917

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida203

--- Comment #3 from Michael Matz <matz at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #2)
> same spot.  No idea what to do against this though, treating a CLOBBER as a
> barrier for propagation of addresses to other local variables would penalize
> stuff way too much.

Conceptually this should be the right thing.  The clobber says
the object doesn't exist anymore, so also forming its address should be
invalid/implementation defined.  Either the clobber should move or it should
be a barrier also for addresses of the clobbered object.  I'm not sure if that
really would penalize much.

> And giving up on stack slot sharing because of such an
> artificial testcase is not useful either.

Perhaps expansion could detect the situation (address of clobbered object
leaked after the clobber) and disable sharing just for such problematic
objects.

[Bug target/61656] Undefined behavior in classify_argument

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

--- Comment #4 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Jakub Jelinek from comment #3)
> So, are you ok with the #c0 pseudo patch?  I guess I can bootstrap/regtest
> it today.

If we are narrowing the load from movq to movl for a SImode value, then the
patch is OK.
>From gcc-bugs-return-456067-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jul 10 15:50:39 2014
Return-Path: <gcc-bugs-return-456067-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 8106 invoked by alias); 10 Jul 2014 15:50:38 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 7794 invoked by uid 48); 10 Jul 2014 15:50:30 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/61656] Undefined behavior in classify_argument
Date: Thu, 10 Jul 2014 15:50:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61656-4-yLNTYhDXDg@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00658.txt.bz2
Content-length: 803

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida656

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Depends on what testcase.  In pr42025-2.c, it clearly uses movl %edi, %eax,
with and without the patch.  If I write:
typedef struct
{
  int p;
} Ptr;

struct A
{
  long int i;
  union
  {
    Ptr p;
    int q;
  } u;
};

extern Ptr get_stuff (void);
extern void use_stuff (int);

__attribute__((noinline, noclone))
static int foo(struct A p, int q)
{
  int ret = p.u.q;
  if (p.i)
    p.u.p = get_stuff ();
  else
    p.u.q = q;

  use_stuff (p.u.q);
  return ret;
}

void bar(struct A *p, int q)
{
  foo(*p, q);
}

then it uses movq %rsi, ... and the patch doesn't change anything on that.
If you want to use movl %esi, ... in foo in this testcase, more changes are
needed of course.

[Bug target/61656] Undefined behavior in classify_argument

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

--- Comment #6 from Uroš Bizjak <ubizjak at gmail dot com> ---
(In reply to Jakub Jelinek from comment #5)

> then it uses movq %rsi, ... and the patch doesn't change anything on that.
> If you want to use movl %esi, ... in foo in this testcase, more changes are
> needed of course.

This is allowed, as long as we don't use movl on a DImode value. So, your
proposed patch avoids undefined issue, while optimizes memory access a bit.
>From gcc-bugs-return-456069-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jul 10 16:17:14 2014
Return-Path: <gcc-bugs-return-456069-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 6177 invoked by alias); 10 Jul 2014 16:17:13 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 5930 invoked by uid 48); 10 Jul 2014 16:17:04 -0000
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/61656] Undefined behavior in classify_argument
Date: Thu, 10 Jul 2014 16:17:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61656-4-fMUt1ruzy5@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00660.txt.bz2
Content-length: 510

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida656

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The patch actually just removes the undefined behavior and nothing else, it
really doesn't affect code generation.  It just causes merge_classes (which is
a const function) not to be called on (initialized) subclasses[i] and
(uninitialized) classes[i], storing the result back to classes[i].  We are not
going to use the result of the merger of the initialized and uninitialized
value later.

[Bug target/61656] Undefined behavior in classify_argument

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Mon Jul 14 07:31:57 2014
New Revision: 212509

URL: https://gcc.gnu.org/viewcvs?rev=212509&root=gcc&view=rev
Log:
    PR target/61656
    * config/i386/i386.c (classify_argument): Don't merge classes above
    number of words.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/config/i386/i386.c

[Bug target/61656] Undefined behavior in classify_argument

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug target/61656] Undefined behavior in classify_argument

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zeccav at gmail dot com

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 61901 has been marked as a duplicate of this bug. ***

[Bug target/61656] Undefined behavior in classify_argument

[uros at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

--- Comment #11 from uros at gcc dot gnu.org ---
Author: uros
Date: Fri Jul 25 07:47:36 2014
New Revision: 213046

URL: https://gcc.gnu.org/viewcvs?rev=213046&root=gcc&view=rev
Log:
    Backport from mainline
    2014-07-14  Jakub Jelinek  <jakub@redhat.com>

    PR target/61656
    * config/i386/i386.c (classify_argument): Don't merge classes above
    number of words.


Modified:
    branches/gcc-4_9-branch/gcc/ChangeLog
    branches/gcc-4_9-branch/gcc/config/i386/i386.c

[Bug target/61656] Undefined behavior in classify_argument

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.3

--- Comment #12 from Uroš Bizjak <ubizjak at gmail dot com> ---
Also fixed for 4.9 branch.
>From gcc-bugs-return-457071-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jul 25 07:50:09 2014
Return-Path: <gcc-bugs-return-457071-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 29101 invoked by alias); 25 Jul 2014 07:50:09 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 29046 invoked by uid 48); 25 Jul 2014 07:50:06 -0000
From: "ubizjak at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/61656] Undefined behavior in classify_argument
Date: Fri, 25 Jul 2014 07:50:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: ubizjak at gmail dot com
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.2
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: target_milestone
Message-ID: <bug-61656-4-y5h1Fu4H52@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61656-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg01662.txt.bz2
Content-length: 295

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61656

Uroš Bizjak <ubizjak at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.9.3                       |4.9.2
>From gcc-bugs-return-457072-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Fri Jul 25 07:56:08 2014
Return-Path: <gcc-bugs-return-457072-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 32606 invoked by alias); 25 Jul 2014 07:56:08 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 32561 invoked by uid 48); 25 Jul 2014 07:56:04 -0000
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/61902] signed integer overflow in real.c in real_from_integer
Date: Fri, 25 Jul 2014 07:56:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 4.9.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: minor
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.10.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status resolution target_milestone
Message-ID: <bug-61902-4-UoduTozWs3@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61902-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61902-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg01663.txt.bz2
Content-length: 792

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida902

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |4.10.0

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
This code has changed a lot in 4.10/5.0.  The pair is no longer there and
instead we use wide_int and:
      /* We have to ensure we can negate the largest negative number.  */
      wide_int val = wide_int::from (val_in, maxbitlen, sgn);

      if (r->sign)
        val = -val;

So closing as fixed in GCC 4.10/5.0.