[gcc r14-4677] tree-optimization/111807 - ICE in verify_sra_access_forest

[gcc r14-4677] tree-optimization/111807 - ICE in verify_sra_access_forest

[Richard Biener]

https://gcc.gnu.org/g:3aaf704bca3e01c72d9fe6de01ae5416dba6b5db

commit r14-4677-g3aaf704bca3e01c72d9fe6de01ae5416dba6b5db
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Oct 16 12:54:28 2023 +0200

    tree-optimization/111807 - ICE in verify_sra_access_forest
    
    The following addresses build_reconstructed_reference failing to
    build references with a different offset than the models and thus
    the caller conditional being off.  This manifests when attempting
    to build a ref with offset 160 from the model BIT_FIELD_REF <l_4827[9], 8, 0>
    onto the same base l_4827 but the models offset being 288.  This
    cannot work for any kind of ref I can think of, not just with
    BIT_FIELD_REFs.
    
            PR tree-optimization/111807
            * tree-sra.cc (build_ref_for_model): Only call
            build_reconstructed_reference when the offsets are the same.
    
            * gcc.dg/torture/pr111807.c: New testcase.

Diff:
---
 gcc/testsuite/gcc.dg/torture/pr111807.c | 12 ++++++++++++
 gcc/tree-sra.cc                         |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/gcc/testsuite/gcc.dg/torture/pr111807.c b/gcc/testsuite/gcc.dg/torture/pr111807.c
new file mode 100644
index 000000000000..09fbdcfb667a
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr111807.c
@@ -0,0 +1,12 @@
+/* { dg-do compile } */
+
+static struct A {
+  int x : 4;
+} a;
+static int b;
+int main()
+{
+  struct A t[2];
+  t[0] = b ? t[1] : a;
+  return (b ? t[1].x : 0) && 1;
+}
diff --git a/gcc/tree-sra.cc b/gcc/tree-sra.cc
index 24d0c20da6ae..f8dff8b27d76 100644
--- a/gcc/tree-sra.cc
+++ b/gcc/tree-sra.cc
@@ -1751,7 +1751,7 @@ build_ref_for_model (location_t loc, tree base, HOST_WIDE_INT offset,
 	  && !TREE_THIS_VOLATILE (base)
 	  && (TYPE_ADDR_SPACE (TREE_TYPE (base))
 	      == TYPE_ADDR_SPACE (TREE_TYPE (model->expr)))
-	  && offset <= model->offset
+	  && offset == model->offset
 	  /* build_reconstructed_reference can still fail if we have already
 	     massaged BASE because of another type incompatibility.  */
 	  && (res = build_reconstructed_reference (loc, base, model)))