[Bug tree-optimization/94734] [10 Regression] Program crashes when compiled with -O2 since r10-1892-gb9ef6a2e04bfd013

["rguenther at suse dot de" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94734

--- Comment #12 from rguenther at suse dot de <rguenther at suse dot de> ---
On Fri, 24 Apr 2020, jakub at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94734
> 
> --- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
> If we don't want to revert the change completely, could we perhaps do:
> --- gcc/tree-ssa-phiopt.c.jj    2020-03-19 10:23:50.542872359 +0100
> +++ gcc/tree-ssa-phiopt.c       2020-04-24 10:54:10.341716841 +0200
> @@ -2237,10 +2237,26 @@ cond_store_replacement (basic_block midd
>       whose value is not available readily, which we want to avoid.  */
>    if (!nontrap->contains (lhs))
>      {
> -      /* If LHS is a local variable without address-taken, we could
> -        always safely move down the store.  */
> -      tree base = get_base_address (lhs);
> -      if (!auto_var_p (base) || TREE_ADDRESSABLE (base))
> +      /* If LHS is an access to a local variable without address-taken
> +        or its part and the access is provably within the bounds of the
> +        local variable, we could always safely move down the store.  */
> +      HOST_WIDE_INT offset, size, decl_size;
> +      bool reverse;
> +      tree base = get_ref_base_and_extent_hwi (lhs, &offset, &size,
> +                                              &reverse);
> +      if (base == NULL_TREE || !auto_var_p (base) || TREE_ADDRESSABLE (base))
> +       return false;
> +      if (!DECL_SIZE (base)
> +         || !tree_fits_shwi_p (DECL_SIZE (base)))
> +       return false;
> +      decl_size = tree_to_shwi (DECL_SIZE (base));
> +      if (offset < 0
> +         || size < 0
> +         || decl_size < 0
> +         || offset >= decl_size
> +         || size > decl_size
> +         || ((unsigned HOST_WIDE_INT) offset + size
> +             > (unsigned HOST_WIDE_INT) decl_size))
>         return false;
>      }

That should be roughly equivalent to

  if (!nontrap->contains (lhs)
      || !tree_could_trap_p (lhs))

which for ARRAY_REFs checks in_array_bounds_p.