[gcc(refs/vendors/ARM/heads/morello)] Avoid an ICE predicting the value of malloc calls

[gcc(refs/vendors/ARM/heads/morello)] Avoid an ICE predicting the value of malloc calls

[Matthew Malcomson]

https://gcc.gnu.org/g:8e81ac941753958ccaf91bae3c9b6980b0803624

commit 8e81ac941753958ccaf91bae3c9b6980b0803624
Author: Matthew Malcomson <matthew.malcomson@arm.com>
Date:   Tue Sep 21 13:05:41 2021 +0100

    Avoid an ICE predicting the value of malloc calls
    
    When attempting to predict the value of malloc calls, we were using
    `boolean_true_node` as their expected return.
    
    This was in order to better predict branches based on whether the
    allocation returned NULL or not (See PR 83023).
    
    This ignores the type of the result of this call.  The code would simply
    convert to the relevant pointer type later on when trying to determine
    the expected values of expressions containing that result.
    
    Said conversion is no longer allowed since we disallow plain conversion
    from a non-capability to a capability.  This patch changes the
    prediction of a malloc-like call to be a pointer of the relevant type
    with value 1, and does so with a call to
    `fold_build_replace_address_value` so that this works with capabilities.
    
    Also add a testcase into the testsuite that exercises the code path that
    triggered an ICE from this invalid setup.

Diff:
---
 gcc/predict.c                                              |  7 +++++--
 .../gcc.target/aarch64/morello/malloc-expected-value.c     | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/gcc/predict.c b/gcc/predict.c
index 4c4bba54939..9be34b1593c 100644
--- a/gcc/predict.c
+++ b/gcc/predict.c
@@ -60,6 +60,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "cfgrtl.h"
 #include "stringpool.h"
 #include "attribs.h"
+#include "target.h"
 
 /* Enum with reasons why a predictor is ignored.  */
 
@@ -2448,7 +2449,8 @@ expr_expected_value_1 (tree type, tree op0, enum tree_code code,
 	    {
 	      if (predictor)
 		*predictor = PRED_MALLOC_NONNULL;
-	      return boolean_true_node;
+	      return fold_build_replace_address_value (build_zero_cst (type),
+						       boolean_true_node);
 	    }
 
 	  if (DECL_BUILT_IN_CLASS (decl) == BUILT_IN_NORMAL)
@@ -2526,7 +2528,8 @@ expr_expected_value_1 (tree type, tree op0, enum tree_code code,
 	      case BUILT_IN_REALLOC:
 		if (predictor)
 		  *predictor = PRED_MALLOC_NONNULL;
-		return boolean_true_node;
+		return fold_build_replace_address_value (build_zero_cst (type),
+							 boolean_true_node);
 	      default:
 		break;
 	    }
diff --git a/gcc/testsuite/gcc.target/aarch64/morello/malloc-expected-value.c b/gcc/testsuite/gcc.target/aarch64/morello/malloc-expected-value.c
new file mode 100644
index 00000000000..4678f6c8078
--- /dev/null
+++ b/gcc/testsuite/gcc.target/aarch64/morello/malloc-expected-value.c
@@ -0,0 +1,14 @@
+/* { dg-do compile } */
+/* This testcase used to ICE inside expr_expected_value_1 since that function
+   would set the "expected value" of a malloc call as boolean_true_node, and
+   attempting to convert that node to a pointer would trigger an ICE.  */
+int *a;
+int b;
+int c(int e) {
+  a = __builtin_alloca(e);
+  long d = (long)a;
+  b = (long)(a + 2);
+  for (; b;)
+    ;
+  return d;
+}