This replicates tree-eh.c in_array_bound_p into VNs
vn_reference_may_trap to fix hoisting of a possibly trapping
ARRAY_REF across a call that might not return.
Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed.
2021-08-23 Richard Biener <rguent...@suse.de>
PR tree-optimization/79334
* tree-ssa-sccvn.c (copy_reference_ops_from_ref): Record
a type also for COMPONENT_REFs.
(vn_reference_may_trap): Check ARRAY_REF with constant index
against the array domain.
* gcc.dg/torture/pr79334-0.c: New testcase.
* gcc.dg/torture/pr79334-1.c: Likewise.
---
gcc/testsuite/gcc.dg/torture/pr79334-0.c | 23 ++++++++++++++++++
gcc/testsuite/gcc.dg/torture/pr79334-1.c | 1 +
gcc/tree-ssa-sccvn.c | 30 ++++++++++++++++++++----
3 files changed, 50 insertions(+), 4 deletions(-)
create mode 100644 gcc/testsuite/gcc.dg/torture/pr79334-0.c
create mode 100644 gcc/testsuite/gcc.dg/torture/pr79334-1.c
diff --git a/gcc/testsuite/gcc.dg/torture/pr79334-0.c
b/gcc/testsuite/gcc.dg/torture/pr79334-0.c
new file mode 100644
index 00000000000..fa45a6d77d0
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr79334-0.c
@@ -0,0 +1,23 @@
+/* { dg-do run } */
+/* { dg-additional-sources "pr79334-1.c" } */
+
+extern int d[][8];
+
+static void __attribute__((noinline))
+func_that_exits (int flag)
+{
+ if (!flag)
+ __builtin_exit (0);
+}
+
+int main ()
+{
+ int e = 0;
+ while (1)
+ {
+ func_that_exits (e);
+ /* We do not know whether d[1024][0] will trap. */
+ e = d[1024][0];
+ }
+ return 0;
+}
diff --git a/gcc/testsuite/gcc.dg/torture/pr79334-1.c
b/gcc/testsuite/gcc.dg/torture/pr79334-1.c
new file mode 100644
index 00000000000..b1c8a27753e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr79334-1.c
@@ -0,0 +1 @@
+int d[1][8];
diff --git a/gcc/tree-ssa-sccvn.c b/gcc/tree-ssa-sccvn.c
index 82bd10bd83c..bf87cee3857 100644
--- a/gcc/tree-ssa-sccvn.c
+++ b/gcc/tree-ssa-sccvn.c
@@ -914,9 +914,8 @@ copy_reference_ops_from_ref (tree ref,
vec<vn_reference_op_s> *result)
break;
case COMPONENT_REF:
/* The field decl is enough to unambiguously specify the field,
- a matching type is not necessary and a mismatching type
- is always a spurious difference. */
- temp.type = NULL_TREE;
+ so use its type here. */
+ temp.type = TREE_TYPE (TREE_OPERAND (ref, 1));
temp.op0 = TREE_OPERAND (ref, 1);
temp.op1 = TREE_OPERAND (ref, 2);
temp.reverse = (AGGREGATE_TYPE_P (TREE_TYPE (TREE_OPERAND (ref, 0)))
@@ -5873,10 +5872,33 @@ vn_reference_may_trap (vn_reference_t ref)
return true;
break;
case ARRAY_RANGE_REF:
- case ARRAY_REF:
if (TREE_CODE (op->op0) == SSA_NAME)
return true;
break;
+ case ARRAY_REF:
+ {
+ if (TREE_CODE (op->op0) != INTEGER_CST)
+ return true;
+
+ /* !in_array_bounds */
+ tree domain_type = TYPE_DOMAIN (ref->operands[i+1].type);
+ if (!domain_type)
+ return true;
+
+ tree min = op->op1;
+ tree max = TYPE_MAX_VALUE (domain_type);
+ if (!min
+ || !max
+ || TREE_CODE (min) != INTEGER_CST
+ || TREE_CODE (max) != INTEGER_CST)
+ return true;
+
+ if (tree_int_cst_lt (op->op0, min)
+ || tree_int_cst_lt (max, op->op0))
+ return true;
+
+ break;
+ }
case MEM_REF:
/* Nothing interesting in itself, the base is separate. */
break;
--
2.31.1
