Function Double_Divide computes the division of its parameters
(X / (Y*Z)) in a way that avoids overflows on signed integers, except in
two specific cases, when X = -2**63, abs(Y) = abs(Z) = 1 (leading to an
overflow in -To_Int(Qu)) and when X = -2**63 and Y*Z is large enough
that Qu=0 and so the remainder Ru=2**63 (leading to an overflow in
-To_Int(Ru)), for example with Y = Z = 2**32-1.

This fix avoids the overflow by applying "-" on the unsigned value
before the conversion to signed integer.

The issue cannot manifest as an overflow check failure in our runtime,
as overflow checks are suppressed by using pragma Suppress at the start
of the file. Assuming a machine implements wraparound semantics here,
the result was correct even with the suppressed overflow.

As a result, there can be no test showing the difference.

Tested on x86_64-pc-linux-gnu, committed on trunk

2019-09-17  Yannick Moy  <moy@adacore.com>

gcc/ada/

	* libgnat/s-arit64.adb (Double_Divide): Fix two possible
	overflows.