[gcc r14-9029] tree-optimization/113895 - consistency check fails in copy_reference_ops_from_ref

[gcc r14-9029] tree-optimization/113895 - consistency check fails in copy_reference_ops_from_ref

[Richard Biener]

https://gcc.gnu.org/g:5fd1cbfd65ef2b6dd87cd78ce6509e7d561981ac

commit r14-9029-g5fd1cbfd65ef2b6dd87cd78ce6509e7d561981ac
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Feb 16 10:08:43 2024 +0100

    tree-optimization/113895 - consistency check fails in copy_reference_ops_from_ref
    
    The following addresses consistency check fails in copy_reference_ops_from_ref
    when we are handling out-of-bound array accesses (it's almost impossible
    to identically mimic the get_ref_base_and_extent behavior).  It also
    addresses the case where an out-of-bound constant offset computes to a
    -1 off which is the special value for "unknown".  This patch basically
    turns off verification in those cases.
    
            PR tree-optimization/113895
            * tree-ssa-sccvn.cc (copy_reference_ops_from_ref): Disable
            consistency checking when there are out-of-bound array
            accesses.  Allow -1 off when from an array reference with
            constant index.
    
            * gcc.dg/torture/pr113895-2.c: New testcase.
            * gcc.dg/torture/pr113895-3.c: Likewise.
            * gcc.dg/torture/pr113895-4.c: Likewise.

Diff:
---
 gcc/testsuite/gcc.dg/torture/pr113895-2.c | 13 +++++++++++++
 gcc/testsuite/gcc.dg/torture/pr113895-3.c | 10 ++++++++++
 gcc/testsuite/gcc.dg/torture/pr113895-4.c | 14 ++++++++++++++
 gcc/tree-ssa-sccvn.cc                     | 31 +++++++++++++++++++++++++++++--
 4 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/torture/pr113895-2.c b/gcc/testsuite/gcc.dg/torture/pr113895-2.c
new file mode 100644
index 000000000000..a1c20250c99c
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr113895-2.c
@@ -0,0 +1,13 @@
+/* { dg-do compile } */
+
+extern void d(int);
+int a[2][4], b;
+int main() {
+  while (b) {
+    int c;
+    d(a[b][c]);
+    for (c = 0; c < 7; c++)
+      ;
+  }
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/torture/pr113895-3.c b/gcc/testsuite/gcc.dg/torture/pr113895-3.c
new file mode 100644
index 000000000000..255975f3353f
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr113895-3.c
@@ -0,0 +1,10 @@
+/* { dg-do compile } */
+
+extern void f();
+char a[1][1], b;
+int main() {
+  int c = -1U;
+  if (b)
+    f(a[c][b]);
+  return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/torture/pr113895-4.c b/gcc/testsuite/gcc.dg/torture/pr113895-4.c
new file mode 100644
index 000000000000..75f71dcb451a
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr113895-4.c
@@ -0,0 +1,14 @@
+/* { dg-do compile } */
+
+long a, b, c;
+int d;
+long e[2][1];
+int f() {
+  if (c == a)
+    c = b;
+}
+void g() {
+  int h, i = 0;
+  for (; f() + d + i; i++)
+    e[h][i] = 4;
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index d6b8c734e7ba..38b806649cd9 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -1107,9 +1107,29 @@ copy_reference_ops_from_ref (tree ref, vec<vn_reference_op_s> *result)
 	 the vn_reference ops differ by adjusting those indexes to
 	 appropriate constants.  */
       poly_int64 off = 0;
+      bool oob_index = false;
       for (unsigned i = result->length (); i > start; --i)
 	{
 	  auto &op = (*result)[i-1];
+	  if (flag_checking
+	      && op.opcode == ARRAY_REF
+	      && TREE_CODE (op.op0) == INTEGER_CST)
+	    {
+	      /* The verifier below chokes on inconsistencies of handling
+		 out-of-bound accesses so disable it in that case.  */
+	      tree atype = (*result)[i].type;
+	      if (TREE_CODE (atype) == ARRAY_TYPE)
+		if (tree dom = TYPE_DOMAIN (atype))
+		  if ((TYPE_MIN_VALUE (dom)
+		       && TREE_CODE (TYPE_MIN_VALUE (dom)) == INTEGER_CST
+		       && (wi::to_widest (op.op0)
+			   < wi::to_widest (TYPE_MIN_VALUE (dom))))
+		      || (TYPE_MAX_VALUE (dom)
+			  && TREE_CODE (TYPE_MAX_VALUE (dom)) == INTEGER_CST
+			  && (wi::to_widest (op.op0)
+			      > wi::to_widest (TYPE_MAX_VALUE (dom)))))
+		    oob_index = true;
+	    }
 	  if ((op.opcode == ARRAY_REF
 	       || op.opcode == ARRAY_RANGE_REF)
 	      && TREE_CODE (op.op0) == SSA_NAME)
@@ -1162,12 +1182,19 @@ copy_reference_ops_from_ref (tree ref, vec<vn_reference_op_s> *result)
 		}
 	      else
 		{
-		  gcc_assert (known_ne (op.off, -1));
+		  gcc_assert (known_ne (op.off, -1)
+			      /* Out-of-bound indices can compute to
+				 a known -1 offset.  */
+			      || ((op.opcode == ARRAY_REF
+				   || op.opcode == ARRAY_RANGE_REF)
+				  && poly_int_tree_p (op.op0)
+				  && poly_int_tree_p (op.op1)
+				  && TREE_CODE (op.op2) == INTEGER_CST));
 		  off += op.off * BITS_PER_UNIT;
 		}
 	    }
 	}
-      if (flag_checking)
+      if (flag_checking && !oob_index)
 	{
 	  ao_ref r;
 	  if (start != 0)