From 89eaccbc4b1e5ff7fea2eb4e3fb5870c6ca4160b Mon Sep 17 00:00:00 2001
From: Aldy Hernandez <aldyh@redhat.com>
Date: Tue, 25 Oct 2022 22:44:51 +0200
Subject: [PATCH] [PR tree-optimization/107394] Canonicalize global franges as
 they are read back.

The problem here is that we're inlining a global range with NANs into
a function that has been tagged with __attribute__((optimize
("-ffinite-math-only"))).  As the global range is copied from
SSA_NAME_RANGE_INFO, its NAN bits are copied, which then cause
frange::verify_range() to fail a sanity check making sure no NANs
creep in when !HONOR_NANS.

I think what we should do is nuke the NAN bits as we're restoring the
global range.  For that matter, if we use the frange constructor,
everything except that NAN sign will be done automatically, including
dropping INFs to the min/max representable range when appropriate.

	PR tree-optimization/107394

gcc/ChangeLog:

	* value-range-storage.cc (frange_storage_slot::get_frange): Use
	frange constructor.

gcc/testsuite/ChangeLog:

	* gcc.dg/tree-ssa/pr107394.c: New test.
---
 gcc/testsuite/gcc.dg/tree-ssa/pr107394.c | 22 ++++++++++++++++
 gcc/value-range-storage.cc               | 33 ++++++++++++++++--------
 2 files changed, 44 insertions(+), 11 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/tree-ssa/pr107394.c

diff --git a/gcc/testsuite/gcc.dg/tree-ssa/pr107394.c b/gcc/testsuite/gcc.dg/tree-ssa/pr107394.c
new file mode 100644
index 00000000000..0e1e5ac40ce
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr107394.c
@@ -0,0 +1,22 @@
+// { dg-do compile }
+// { dg-options "-O2" }
+
+static double
+quux (double x)
+{
+  return __builtin_fabs (x);
+}
+
+__attribute__ ((flatten, optimize ("-ffinite-math-only"))) static int
+bar (int *p)
+{
+  *p = quux (0.0);
+
+  return 0;
+}
+
+void
+foo (int *p)
+{
+  (void) bar (p);
+}
diff --git a/gcc/value-range-storage.cc b/gcc/value-range-storage.cc
index 6e054622830..462447ba250 100644
--- a/gcc/value-range-storage.cc
+++ b/gcc/value-range-storage.cc
@@ -261,17 +261,28 @@ frange_storage_slot::get_frange (frange &r, tree type) const
 {
   gcc_checking_assert (r.supports_type_p (type));
 
-  r.set_undefined ();
-  r.m_kind = m_kind;
-  r.m_type = type;
-  r.m_min = m_min;
-  r.m_max = m_max;
-  r.m_pos_nan = m_pos_nan;
-  r.m_neg_nan = m_neg_nan;
-  r.normalize_kind ();
-
-  if (flag_checking)
-    r.verify_range ();
+  // Handle explicit NANs.
+  if (m_kind == VR_NAN)
+    {
+      if (HONOR_NANS (type))
+	{
+	  if (m_pos_nan && m_neg_nan)
+	    r.set_nan (type);
+	  else
+	    r.set_nan (type, m_neg_nan);
+	}
+      else
+	r.set_undefined ();
+      return;
+    }
+
+  // Use the constructor because it will canonicalize the range.
+  r = frange (type, m_min, m_max, m_kind);
+
+  // The constructor will set the NAN bits for HONOR_NANS, but we must
+  // make sure to set the NAN sign if known.
+  if (HONOR_NANS (type) && (m_pos_nan ^ m_neg_nan) == 1)
+    r.update_nan (m_neg_nan);
 }
 
 bool
-- 
2.37.3