[gcc/devel/gccgo] analyzer: fix handling of negative byte offsets (v2) (PR 93281)

[gcc/devel/gccgo] analyzer: fix handling of negative byte offsets (v2) (PR 93281)

[Ian Lance Taylor]

https://gcc.gnu.org/g:5f0303833d542b273da33e4b149974e739d350e5

commit 5f0303833d542b273da33e4b149974e739d350e5
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Jan 15 15:55:11 2020 -0500

    analyzer: fix handling of negative byte offsets (v2) (PR 93281)
    
    Various 32-bit targets show failures in gcc.dg/analyzer/data-model-1.c
    with tests of the form:
      __analyzer_eval (q[-2].x == 107024); /* { dg-warning "TRUE" } */
      __analyzer_eval (q[-2].y == 107025); /* { dg-warning "TRUE" } */
    where they emit UNKNOWN instead.
    
    The root cause is that gimple has a byte-based twos-complement offset
    of -16 expressed like this:
      _55 = q_92 + 4294967280;  (32-bit)
    or:
      _55 = q_92 + 18446744073709551600; (64-bit)
    
    Within region_model::convert_byte_offset_to_array_index that unsigned
    offset was being divided by the element size to get an offset within
    an array.
    
    This happened to work on 64-bit target and host, but not elsewhere;
    the offset needs to be converted to a signed type before the division
    is meaningful.
    
    This patch does so, fixing the failures.
    
    gcc/analyzer/ChangeLog:
    	PR analyzer/93281
    	* region-model.cc
    	(region_model::convert_byte_offset_to_array_index): Convert to
    	ssizetype before dividing by byte_size.  Use fold_binary rather
    	than fold_build2 to avoid needlessly constructing a tree for the
    	non-const case.

Diff:
---
 gcc/analyzer/ChangeLog       |  9 +++++++++
 gcc/analyzer/region-model.cc | 10 ++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/gcc/analyzer/ChangeLog b/gcc/analyzer/ChangeLog
index 2ca7144..e809018 100644
--- a/gcc/analyzer/ChangeLog
+++ b/gcc/analyzer/ChangeLog
@@ -1,3 +1,12 @@
+2020-01-17  David Malcolm  <dmalcolm@redhat.com>
+
+	PR analyzer/93281
+	* region-model.cc
+	(region_model::convert_byte_offset_to_array_index): Convert to
+	ssizetype before dividing by byte_size.  Use fold_binary rather
+	than fold_build2 to avoid needlessly constructing a tree for the
+	non-const case.
+
 2020-01-15  David Malcolm  <dmalcolm@redhat.com>
 
 	* engine.cc (class impl_region_model_context): Fix comment.
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 5c39be4..f67572e 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -6414,11 +6414,13 @@ region_model::convert_byte_offset_to_array_index (tree ptr_type,
       /* This might not be a constant.  */
       tree byte_size = size_in_bytes (elem_type);
 
+      /* Try to get a constant by dividing, ensuring that we're in a
+	 signed representation first.  */
       tree index
-	= fold_build2 (TRUNC_DIV_EXPR, integer_type_node,
-		       offset_cst, byte_size);
-
-      if (CONSTANT_CLASS_P (index))
+	= fold_binary (TRUNC_DIV_EXPR, ssizetype,
+		       fold_convert (ssizetype, offset_cst),
+		       fold_convert (ssizetype, byte_size));
+      if (index && TREE_CODE (index) == INTEGER_CST)
 	return get_or_create_constant_svalue (index);
     }