Fortran: error recovery handling invalid CLASS variable [PR107899]

gcc/fortran/ChangeLog:

PR fortran/107899
* resolve.cc (resolve_deallocate_expr): Avoid NULL pointer dereference
on invalid CLASS variable.

gcc/testsuite/ChangeLog:

PR fortran/107899
* gfortran.dg/pr107899.f90: New test.

c++: pack in requires-expr parm list [PR107417]

Here find_parameter_packs_r isn't detecting the pack T inside the
requires-expr's parameter list ultimately because cp_walk_trees
deliberately avoids walking the list so as to avoid false positives in
the unexpanded pack checker.

But it should still be fine to walk the TREE_TYPE of each parameter,
which we already need to do from for_each_template_parm_r, and is
sufficient to fix the testcase.

PR c++/107417

gcc/cp/ChangeLog:

* pt.cc (for_each_template_parm_r) <case REQUIRES_EXPR>: Move
walking of the TREE_TYPE of each parameter to ...
* tree.cc (cp_walk_subtrees) <case REQUIRES_EXPR>: ... here.

gcc/testsuite/ChangeLog:

* g++.dg/cpp2a/concepts-requires33.C: New test.

libstdc++, Darwin: Limit recursive mutex init to OS versions needing it.

The problem described in pr 51906 was fixed in the next OS release.  Limit the
workaround to systems that need it.

Signed-off-by: Iain Sandoe <iain@sandoe.co.uk>
libstdc++-v3/ChangeLog:

* config/os/bsd/darwin/os_defines.h
(_GTHREAD_USE_RECURSIVE_MUTEX_INIT_FUNC): Limit use of this macro
to OS versions that need it.

libstdc++, Darwin: Fix weak attribute to use __weak__ instead of weak.

The text for _GLIBCXX_WEAK_DEFINITION has used 'weak' for the attribute name,
since its intoduction.  Amend to use the implementation namespace '__weak__'
version.

Signed-off-by: Iain Sandoe <iain@sandoe.co.uk>
libstdc++-v3/ChangeLog:

* config/os/bsd/darwin/os_defines.h (_GLIBCXX_WEAK_DEFINITION): Use the
implementation namespace for the weak attribute.

libsanitizer, Darwin: Restrict build to Darwin 16 or newer.

The latest import has added dependencies on system resources that are not
present until Darwin 16.  It might be possible to work around these for
earlier systems, but in the short-term we have to disable the build so that
bootstrap completes.

Signed-off-by: Iain Sandoe <iain@sandoe.co.uk>
libsanitizer/ChangeLog:

* configure.tgt: Restrict build to Darwin 16 or newer.

coroutines: Do not promote temporaries that will be elided.

We usually need to 'promote' (i.e. save to the coroutine frame) any temporary
variable that is in a target expression that must persist across an await
expression.  However, if the TE is just used as a direct initializer for
another object it will be elided - and we should not promote it since that
would lead to a DTOR call for something that is never constructed.

Since we now have a mechanism to tell if TEs will be elided, use that.

Although the PRs referenced initially appear to be different issues, they all
stem from this.

Co-Authored-By: Adrian Perl <adrian.perl@web.de>
Signed-off-by: Iain Sandoe <iain@sandoe.co.uk>
PR c++/100611
PR c++/101367
PR c++/101976
PR c++/99576

gcc/cp/ChangeLog:

* coroutines.cc (find_interesting_subtree): Do not promote temporaries
that are only used as direct initializers for some other object.

gcc/testsuite/ChangeLog:

* g++.dg/coroutines/pr100611.C: New test.
* g++.dg/coroutines/pr101367.C: New test.
* g++.dg/coroutines/pr101976.C: New test.
* g++.dg/coroutines/pr99576_1.C: New test.
* g++.dg/coroutines/pr99576_2.C: New test.

Daily bump.

c++: substituting CONST_DECL_USING_P enumerators [PR103081]

We implement class-scope using enum by injecting clones of the enum's
CONST_DECLs as fields of the class, for which CONST_DECL_USING_P is
true, so that qualified lookup naturally finds the enumerators.
Substitution into such a CONST_DECL currently ICEs however, because we
assume the DECL_CONTEXT is always the ENUMERAL_TYPE (which has
TYPE_VALUES) but in this case it's the RECORD_TYPE for the class scope
(which has TYPE_FIELDS).

Since these CONST_DECLs appear to always be non-dependent, this patch
fixes this by shortcutting substitution for CONST_DECLs that have
non-dependent DECL_CONTEXT.  This subsumes the existing (and seemingly
dead) DECL_NAMESPACE_SCOPE_P early exit test and also benefits
substitution into ordinary non-dependent CONST_DECLs.

PR c++/103081

gcc/cp/ChangeLog:

* pt.cc (tsubst_copy) <case CONST_DECL>: Generalize
early exit test for namespace-scope decls to check dependence of
the enclosing scope instead.  Remove dead early exit test.

gcc/testsuite/ChangeLog:

* g++.dg/cpp2a/using-enum-10.C: New test.
* g++.dg/cpp2a/using-enum-10a.C: New test.

[testsuite] [riscv] skip ssa-sink-18.c

On riscv64, despite being lp64, we choose two IV candidates as on arm,
which prevents some of the expected sinking.  Add an xfail for it.

for  gcc/testsuite/ChangeLog

* gcc.dg/tree-ssa/ssa-sink-18.c: xfail sink2 on riscv64.

[testsuite] [riscv] uninit-pred-9_b bogus warning

Like other platforms, riscv hits the uninitialized warning because the
optimizations don't eliminate the nonviable path that would enable it
to be omitted.

for  gcc/testsuite/ChangeLog

* gcc.dg/uninit-pred-9_b.c: Add riscv*-*-* to the xfail list
for the bogus warning.

Daily bump.

Fortran: intrinsic MERGE shall use all its arguments [PR107874]

gcc/testsuite/ChangeLog:

PR fortran/107874
* gfortran.dg/merge_1.f90: Avoid recursive I/O.

analyzer: introduce struct event_loc_info

gcc/analyzer/ChangeLog:
* analyzer.h (struct event_loc_info): New forward decl.
* bounds-checking.cc: Use event_loc_info throughout to bundle the
loc, fndecl, depth triples.
* call-info.cc: Likewise.
* checker-event.cc: Likewise.
* checker-event.h (struct event_loc_info): New decl.  Use it
throughout to bundle the loc, fndecl, depth triples.
* checker-path.cc: Likewise.
* checker-path.h: Likewise.
* diagnostic-manager.cc: Likewise.
* engine.cc: Likewise.
* infinite-recursion.cc: Likewise.
* pending-diagnostic.cc: Likewise.
* pending-diagnostic.h: Likewise.
* region-model.cc: Likewise.
* sm-signal.cc: Likewise.
* varargs.cc: Likewise.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: fixes to region creation messages [PR107851]

In r13-2573-gc81b60b8c6ff3d I split up the analyzer's region-creation
events to describe the memory space and capacity of the region as two
separate events to avoid combinatorial explosion of message wordings.

However I didn't take into account r13-1405-ge6c3bb379f515b which
added a pending_diagnostic::describe_region_creation_event vfunc which
could change the wording of region creation events.

Hence for:

#include <stdlib.h>
#include <stdint.h>

void test ()
{
  int32_t *ptr = malloc (1);
  free (ptr);
}

trunk currently emits:

  Compiler Explorer (x86_64 trunk): https://godbolt.org/z/e3Td7c9s5:

<source>: In function 'test':
<source>:6:18: warning: allocated buffer size is not a multiple of the pointee's size [CWE-131] [-Wanalyzer-allocation-size]
    6 |   int32_t *ptr = malloc (1);
      |                  ^~~~~~~~~~
  'test': events 1-3
    |
    |    6 |   int32_t *ptr = malloc (1);
    |      |                  ^~~~~~~~~~
    |      |                  |
    |      |                  (1) allocated 1 bytes here
    |      |                  (2) allocated 1 bytes here
    |      |                  (3) assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
    |

where events (1) and (2) are different region_creation_events that have
had their wording overridden (also, with a "1 bytes" issue).

This patch reorganizes region creation events so that each
pending_diagnostic instead creates the events that is appropriate for it,
and the events have responsibility for their own wording.

With this patch, the above emits:

<source>: In function 'test':
<source>:6:18: warning: allocated buffer size is not a multiple of the pointee's size [CWE-131] [-Wanalyzer-allocation-size]
    6 |   int32_t *ptr = malloc (1);
      |                  ^~~~~~~~~~
  'test': events 1-2
    |
    |    6 |   int32_t *ptr = malloc (1);
    |      |                  ^~~~~~~~~~
    |      |                  |
    |      |                  (1) allocated 1 byte here
    |      |                  (2) assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
    |

fixing the duplicate event, and fixing the singular/plural issue.

gcc/analyzer/ChangeLog:
PR analyzer/107851
* analyzer.cc (make_label_text_n): Convert param "n" from int to
unsigned HOST_WIDE_INT.
* analyzer.h (make_label_text_n): Likewise for decl.
* bounds-checking.cc: Include "analyzer/checker-event.h" and
"analyzer/checker-path.h".
(out_of_bounds::add_region_creation_events): New.
(concrete_past_the_end::describe_region_creation_event): Replace
with...
(concrete_past_the_end::add_region_creation_events): ...this.
(symbolic_past_the_end::describe_region_creation_event): Delete.
* checker-event.cc (region_creation_event::region_creation_event):
Update for dropping all member data.
(region_creation_event::get_desc): Delete, splitting out into
region_creation_event_memory_space::get_desc,
region_creation_event_capacity::get_desc, and
region_creation_event_debug::get_desc.
(region_creation_event_memory_space::get_desc): New.
(region_creation_event_capacity::get_desc): New.
(region_creation_event_allocation_size::get_desc): New.
(region_creation_event_debug::get_desc): New.
* checker-event.h: Include "analyzer/program-state.h".
(enum rce_kind): Delete.
(class region_creation_event): Drop all member data.
(region_creation_event::region_creation_event): Make protected.
(region_creation_event::get_desc): Delete.
(class region_creation_event_memory_space): New.
(class region_creation_event_capacity): New.
(class region_creation_event_allocation_size): New.
(class region_creation_event_debug): New.
* checker-path.cc (checker_path::add_region_creation_events): Add
"pd" param.  Call pending_diangnostic::add_region_creation_events.
Update for conversion of RCE_DEBUG to region_creation_event_debug.
* checker-path.h (checker_path::add_region_creation_events): Add
"pd" param.
* diagnostic-manager.cc (diagnostic_manager::build_emission_path):
Pass pending_diagnostic to
emission_path::add_region_creation_events.
(diagnostic_manager::build_emission_path): Pass path_builder to
add_event_on_final_node.
(diagnostic_manager::add_event_on_final_node): Add "pb" param.
Pass pending_diagnostic to
emission_path::add_region_creation_events.
(diagnostic_manager::add_events_for_eedge): Pass
pending_diagnostic to emission_path::add_region_creation_events.
* diagnostic-manager.h
(diagnostic_manager::add_event_on_final_node): Add "pb" param.
* pending-diagnostic.cc
(pending_diagnostic::add_region_creation_events): New.
* pending-diagnostic.h (struct region_creation): Delete.
(pending_diagnostic::describe_region_creation_event): Delete.
(pending_diagnostic::add_region_creation_events): New vfunc.
* region-model.cc: Include "analyzer/checker-event.h" and
"analyzer/checker-path.h".
(dubious_allocation_size::dubious_allocation_size): Initialize
m_has_allocation_event.
(dubious_allocation_size::describe_region_creation_event): Delete.
(dubious_allocation_size::describe_final_event): Update for
replacement of m_allocation_event with m_has_allocation_event.
(dubious_allocation_size::add_region_creation_events): New.
(dubious_allocation_size::m_allocation_event): Replace with...
(dubious_allocation_size::m_has_allocation_event): ...this.

gcc/testsuite/ChangeLog:
PR analyzer/107851
* gcc.dg/analyzer/allocation-size-4.c: Update expected wording.
* gcc.dg/analyzer/allocation-size-multiline-1.c: New test.
* gcc.dg/analyzer/allocation-size-multiline-2.c: New test.
* gcc.dg/analyzer/out-of-bounds-multiline-1.c: Update expected
wording.
* gcc.dg/analyzer/out-of-bounds-multiline-2.c: New test.
* gcc.dg/analyzer/out-of-bounds-read-char-arr.c: Update expected
wording.
* gcc.dg/analyzer/out-of-bounds-read-int-arr.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-write-char-arr.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-write-int-arr.c: Likewise.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

testsuite: Adjust dg-error for -fimplicit-constexpr

Some of the new tests were failing with -fimplicit-constexpr.  This
patch adjusts the expected diagnostic.  Tested with

GXX_TESTSUITE_STDS=98,11,14,17,20,23 make check-c++ RUNTESTFLAGS="--target_board=unix\{,-fimplicit-constexpr\} dg.exp=spaceship-eq3.C"

gcc/testsuite/ChangeLog:

* g++.dg/cpp0x/constexpr-ex1.C: Adjust dg-error.
* g++.dg/cpp23/constexpr-nonlit10.C: Adjust dg-warning.
* g++.dg/cpp23/constexpr-nonlit11.C: Likewise.
* g++.dg/cpp2a/spaceship-eq3.C: Add dg-error.

c++: Set the locus of the function result decl

gcc/cp/ChangeLog:

* decl.cc (grokdeclarator): Build RESULT_DECL.
(start_preparsed_function): Copy location from template.
* semantics.cc (apply_deduced_return_type): Handle
arg != current_function_decl.
* method.cc (implicitly_declare_fn): Use it.

gcc/ChangeLog:

* function.cc (init_function_start): Use DECL_RESULT location
for -Waggregate-return warning.

gcc/testsuite/ChangeLog:

* g++.dg/diagnostic/return-type-loc1.C: New test.

Co-authored-by: Jason Merrill <jason@redhat.com>

Fix a few incorrect accesses.

This consists of 3 changes which stronger type checking has indicated
are incorrect.

gcc/
* fold-const.cc (fold_unary_loc): Check TREE_TYPE of node.
(tree_invalid_nonnegative_warnv_p): Likewise.

gcc/c-family/
* c-attribs.cc (handle_deprecated_attribute): Use type when
using TYPE_NAME.

driver: fix validate_switches logic

Under the old logic for validate_switches, once suffix or starred got set,
they stayed set for all later switches found in the spec.  So for e.g.

%{g*:%{%:debug-level-gt(0):

Once we see g*, starred is set.  Then we see %:, and it sees that as a
zero-length switch, which because starred is still set, matches any and all
command-line options.  So targets that use such a spec accept all options in
the driver, while ones that don't reject some, such as the recent
-nostdlib++.

This patch fixes the inconsistency, so all targets would complain about
-nostdlib++, and then sets SKIPOPT for it so they don't.

gcc/ChangeLog:

* gcc.cc (validate_switches): Reset suffix/starred on loop.

gcc/cp/ChangeLog:

* g++spec.cc (lang_specific_driver): Set SKIPOPT for nostdlib++.

LRA: Check hard reg availability of pseudo and its subreg for pseudo reload

Do not reload subreg pseudo if there are hard regs for subreg mode
but there are no hard regs for pseudo mode.

        PR target/106462

gcc/ChangeLog:

* lra-constraints.cc (curr_insn_transform): Check available hard
regs for pseudo and its subreg to decide what to reload.

gcc/testsuite/ChangeLog:

* gcc.target/mips/pr106462.c: New test.

Improve ix86_expand_fast_convert_bf_to_sf with new extendbfsf2_1.

After supporting extendbfsf2_1, ix86_expand_fast_convert_bf_to_sf can
be improved with pslld either.
CONST_INT_P is not handled since constant shift can be optimized off.

gcc/ChangeLog:

* config/i386/i386-expand.cc
(ix86_expand_fast_convert_bf_to_sf): Use extendbfsf2_1 for
nonimmediate operand.

gcc/testsuite/ChangeLog:

* gcc.target/i386/cbranchbf4.c: New test.

gcc: regenerate configure

gcc/ChangeLog:

* configure: Regenerate.

Daily bump.

i386: Save/restore recog_data in ix86_vector_duplicate_value [PR106577]

On Tue, Aug 16, 2022 at 09:14:06AM +0100, Richard Sandiford via Gcc-patches wrote:
> IMO the correct low-effort fix is to save and restore recog_data
> in ix86_vector_duplicate_value.  It's a relatively big copy,
> but the current code is pretty wasteful anyway (allocating at
> least a new SET and INSN for every query).  Compared to the
> overhead of doing that, a copy to and from the stack shouldn't
> be too bad.

The following patch does that.
It isn't the first spot in the compiler that does that, not even the first
spot in the i386 backend.
In i386-expand.cc beyond these 2 recog_memoized calls there is one in
expand_vselect, but I think it is unlikely we'd run into these issues trying
to expand new permutations from splitters.

2022-12-02  Jakub Jelinek  <jakub@redhat.com>

PR target/106577
* config/i386/i386-expand.cc (ix86_vector_duplicate_value): Save/restore
recog_data around recog_memoized calls.

* gcc.target/i386/pr106577.c: New test.

c++: Incremental fix for g++.dg/gomp/for-21.C [PR84469]

The PR84469 patch I've just posted regresses the for-21.C testcase,
when in OpenMP loop there are at least 2 associated loops and
in a template outer structured binding with non type dependent expression
is used in the expressions of some inner loop, we don't diagnose those
any longer, as the (weirdly worded) diagnostics was only done during
finish_id_expression -> mark_used which for the inner loop expressions
happens before the structured bindings are finalized.  When in templates,
mark_used doesn't diagnose uses of non-deduced variables, and if the
range for expression is type dependent, it is similarly diagnosed during
instantiation.  But newly with the PR84469 fix if the range for expression
is not type dependent, there is no place that would diagnose it, as during
instantiation the structured bindings are already deduced.

This patch ensures that the bug of using structured bindings from one
associated loop in other associated loops is diagnosed by the
c_omp_check_loop_iv code by ensuring that cp_finish_decomp is called
already during cp_convert_omp_range_for if the artificial iterator
has been successfully auto-deduced.

2022-12-02  Jakub Jelinek  <jakub@redhat.com>

PR c++/84469
gcc/c-family/
* c-omp.cc (c_omp_is_loop_iterator): For range for with structured
binding return TREE_VEC_LENGTH (d->declv) even if decl is equal
to any of the structured binding decls.
gcc/cp/
* parser.cc (cp_convert_omp_range_for): After do_auto_deduction if
!processing_template_decl call cp_finish_decomp with
processing_template_decl temporarily incremented.
gcc/testsuite/
* g++.dg/gomp/for-21.C (f3, f6, f9): Adjust expected diagnostics.
* g++.dg/gomp/for-22.C: New test.

c++: Deduce range for structured bindings if expression is not type dependent [PR84469]

As shown on the decomp56.C testcase, if the range for expression
when using structured bindings is not type dependent, we deduce
the finish the structured binding types only when not in template
(cp_convert_range_for takes care of that), but if in templates,
do_range_for_auto_deduction is called instead and it doesn't handle
structured bindings.  During instantiation they are handled later,
but during the parsing keeping the structured bindings type
dependent when they shouldn't be changes behavior.
The following patch calls cp_finish_decomp even from
do_range_for_auto_deduction.
The patch regresses the OpenMP g++.dg/gomp/for-21.C test (3 errors
are gone), I'll post an incremental patch for it momentarily.

2022-12-02  Jakub Jelinek  <jakub@redhat.com>

PR c++/84469
* parser.cc (do_range_for_auto_deduction): Add DECOMP_FIRST_NAME
and DECOMP_CNT arguments.  Call cp_finish_decomp if DECL
is a structured binding.
(cp_parser_range_for): Adjust do_range_for_auto_deduction caller.
(cp_convert_omp_range_for): Likewise.

* g++.dg/cpp1z/decomp56.C: New test.
* g++.dg/gomp/pr84469.C: New test.

match.pd: rewrite select to branchless expression

This patches transforms ((x & 0x1) == 0) ? y : z <op> y -into
(-(typeof(y))(x & 0x1) & z) <op> y, where op is a '^' or a '|'. It also
transforms (cond (and (x , 0x1) != 0), (z op y), y ) into (-(and (x ,
0x1)) & z ) op y.

Matching this patterns allows GCC to generate branchless code for one of
the functions in coremark.

* match.pd ((x & 0x1) == 0) ? y : z <op> y
-> (-(typeof(y))(x & 0x1) & z) <op> y.

* gcc.dg/tree-ssa/branchless-cond.c: New test.

Add --param max-unswitch-depth

The following adds a --param to limit the depth of unswitched loop
nests.  One can use --param max-unswitch-depth=1 to disable unswitching
of outer loops (the innermost loop will then be unswitched).

PR tree-optimization/107946
* params.opt (-param=max-unswitch-depth=): New.
* doc/invoke.texi (--param=max-unswitch-depth): Document.
* tree-ssa-loop-unswitch.cc (init_loop_unswitch_info): Honor
--param=max-unswitch-depth

PR59447: --with-dwarf2 implies "(or later)"

This patch includes "(or later)" in the documentation of the gcc
subdirectory's --with-dwarf2 configure flag. Closes PR59447.

gcc/ChangeLog:

PR bootstrap/59447
* configure: Regenerate.
* configure.ac: Document --with-dwarf2 flag as also
applying to later DWARF standards.
* doc/install.texi: Likewise.

analyzer: handle comparisons against negated symbolic values [PR107948]

gcc/analyzer/ChangeLog:
PR analyzer/107948
* region-model-manager.cc
(region_model_manager::maybe_fold_binop): Fold (0 - VAL) to -VAL.
* region-model.cc (region_model::eval_condition): Handle e.g.
"-X <= 0" as equivalent to X >= 0".

gcc/testsuite/ChangeLog:
PR analyzer/107948
* gcc.dg/analyzer/feasibility-pr107948.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: add test coverage for string ops

gcc/testsuite/ChangeLog:
* gcc.dg/analyzer/string-ops-concat-pair.c: New test.
* gcc.dg/analyzer/string-ops-dup.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

Fix ICE due to incorrect insn type.

;; if reg/mem op
(define_insn_reservation  "slm_sseishft_3" 2
  (and (eq_attr "cpu" "slm")
       (and (eq_attr "type" "sseishft")
            (not (match_operand 2 "immediate_operand"))))
  "slm-complex, slm-all-eu")

in slm.md it will check operands[2] for type sseishft, but for
extendbfsf2_1 there's no second operand which caused ICE.
The patch set type from sseishft to sseishft1 to fix the issue.

gcc/ChangeLog:

PR target/107934
* config/i386/i386.md (extendbfsf2_1): Change type from
sseishft to sseishft1.

gcc/testsuite/ChangeLog:

* gcc.target/i386/pr107934.c: New test.

c++: comptypes ICE with BOUND_TEMPLATE_TEMPLATE_PARMs [PR107539]

Here we end up giving the two BOUND_TEMPLATE_TEMPLATE_PARMs
C<decltype(f::t)> and C<decltype(g::t)> the same TYPE_CANONICAL because
the hash table that interns TYPE_CANONICAL for template type parameters
doesn't set the comparing_specializations flag which controls how
PARM_DECLs from different contexts compare equal.

Later, from spec_hasher::equal for the corresponding two specializations
A<C<decltype(f::t)>> and A<C<decltype(g::t)>>, we compare the two bound
ttps with comparing_specializations set hence they now (structurally)
compare different despite having the same TYPE_CANONICAL, and so we get
the error:

  internal compiler error: same canonical type node for different types
    'C<decltype (t)>' and 'C<decltype (t)>'

This suggests that we should be setting comparing_specializations from
ctp_hasher::equal to match spec_hasher::equal.  But doing so introduces
a separate ICE in cpp2a/concepts-placeholder3.C:

  internal compiler error: canonical types differ for identical types
    'auto [requires ::same_as<<placeholder>, decltype(f::x)>]' and
    'auto [requires ::same_as<<placeholder>, decltype(g::x)>]'

because norm_hasher::equal doesn't set comparing_specializations either.

I'm not sure when exactly we need to set comparing_specializations given
what it controls (TYPENAME_TYPE equality/hashing and PARM_DECL equality)
but it seems to be the conservative choice to set the flag wherever we
have a global hash table that relies on type equality.  To that end this
patch sets comparing_specializations in ctp_hasher and norm_hasher, as
well as in atom_hasher and sat_hasher for good measure.  This turns out
to be a compile time win of about 2% in some concepts tests, probably
because of the improved TYPENAME_TYPE hashing enabled by the flag.

PR c++/107539

gcc/cp/ChangeLog:

* constraint.cc (norm_hasher::hash, norm_hasher::equal): Set
comparing_specializations.
(sat_hasher::hash, sat_hasher::equal): Likewise.
* cp-tree.h (atom_hasher::hash, atom_hasher::equal): Likewise.
* pt.cc (ctp_hasher::hash, ctp_hasher::equal): Likewise.

gcc/testsuite/ChangeLog:

* g++.dg/template/canon-type-19.C: New test.

libstdc++: Add error handler for <stacktrace>

Not providing an error handler results in a null pointer dereference
when an error occurs.

Co-authored-by: Jonathan Wakely <jwakely@redhat.com>
libstdc++-v3/ChangeLog:

* include/std/stacktrace (stacktrace_entry::_S_err_handler): New
static function.
(stacktrace_entry, basic_stacktrace): Pass &_S_err_handler to
all calls to libbacktrace.

varasm: Fix type confusion bug

This patch fixes a type confusion bug in varasm.cc:assemble_variable.
The problem is that the current code calls:

  sect = get_variable_section (decl, false);

and then accesses sect->named.name without checking whether the section
is in fact a named section. In the surrounding else clause, we only know
that SECTION_STYLE (sect) != SECTION_NOSWITCH, so it is possible that
the section is an unnamed section.

In practice, this means that we end up doing a wild string compare
between a function pointer and the string literal ".vtable_map_vars".
This is because sect->named.name aliases sect->unnamed.callback in the
section union.

This can be seen in GDB with a simple testcase such as "int x;".

This patch fixes the issue by checking the SECTION_STYLE of the section
is in fact SECTION_NAMED before trying to do the string comparison.

We drop the existing check of whether sect->named.name is non-NULL
because this should presumably always be the case for a named section.

gcc/ChangeLog:

* varasm.cc (assemble_variable): Fix type confusion bug when
checking for ".vtable_map_vars" section.

gcc: remove incpath.o from CXX_C_OBJS

The object is already included in OBJS (libbackend.a), thus
we don't need it.

gcc/cp/ChangeLog:

* Make-lang.in: Remove extra object dependency.

RISC-V: Remove tail && mask policy operand for vmclr, vmset, vmld, vmst

1. vector.md: remove tail && mask policy operand for mask mode operations since
   we don't need them according to RVV ISA.
2. riscv-v.cc: adapt emit_pred_op for mask mode predicated mov since all RVV modes
   including vector integer mode && vector float mode  && vector bool mode are
   all use emit_pred_op function. For vector integer mode && vector float mode,
   we have instruction like vle.v/vse.v that we need tail && mask policy.
   However, for vector bool mode, the instruction is vlm/vsm that we don't need
   tail && mask policy. So we add a condition here to add tail && mask policy operand
   during expand if it is not a vector bool modes.

This patch is to cleanup the code and make it be consistent with RVV ISA.

gcc/ChangeLog:

* config/riscv/riscv-v.cc (emit_pred_op): Adapt for mask mode.
* config/riscv/vector.md: Remove Tail && make policy operand for mask mode mov.

RISC-V: Add attributes for VSETVL PASS

gcc/ChangeLog:

* config/riscv/riscv-protos.h (enum vlmul_type): New enum.
(get_vlmul): New function.
(get_ratio): Ditto.
* config/riscv/riscv-v.cc (struct mode_vtype_group): New struct.
(ENTRY): Adapt for attributes.
(enum vlmul_type): New enum.
(get_vlmul): New function.
(get_ratio): New function.
* config/riscv/riscv-vector-switch.def (ENTRY): Adapt for attributes.
* config/riscv/riscv.cc (ENTRY): Ditto.
* config/riscv/vector.md (false,true): Add attributes.

RISC-V: Add duplicate vector support.

gcc/ChangeLog:

* config/riscv/constraints.md (Wdm): New constraint.
* config/riscv/predicates.md (direct_broadcast_operand): New predicate.
* config/riscv/riscv-protos.h (RVV_VLMAX): New macro.
(emit_pred_op): Refine function.
* config/riscv/riscv-selftests.cc (run_const_vector_selftests): New function.
(run_broadcast_selftests): Ditto.
(BROADCAST_TEST): New tests.
(riscv_run_selftests): More tests.
* config/riscv/riscv-v.cc (emit_pred_move): Refine function.
(emit_vlmax_vsetvl): Ditto.
(emit_pred_op): Ditto.
(expand_const_vector): New function.
(legitimize_move): Add constant vector support.
* config/riscv/riscv.cc (riscv_print_operand): New asm print rule for const vector.
* config/riscv/riscv.h (X0_REGNUM): New macro.
* config/riscv/vector-iterators.md: New attribute.
* config/riscv/vector.md (vec_duplicate<mode>): New pattern.
(@pred_broadcast<mode>): New pattern.

gcc/testsuite/ChangeLog:

* gcc.target/riscv/rvv/base/dup-1.c: New test.
* gcc.target/riscv/rvv/base/dup-2.c: New test.

amdgcn: Add preprocessor builtins for every processor type

Provide a specific builtin for each possible value of '-march'.

gcc/ChangeLog:

* config/gcn/gcn-opts.h (TARGET_FIJI): -march=fiji.
(TARGET_VEGA10): -march=gfx900.
(TARGET_VEGA20): -march=gfx906.
(TARGET_GFX908): -march=gfx908.
(TARGET_GFX90a): -march=gfx90a.
* config/gcn/gcn.h (TARGET_CPU_CPP_BUILTINS): Define a builtin that
uniquely maps to '-march'.

ada: Strip conversions for the implementation of storage models

This is necessary for unconstrained allocators with qualified expression.

gcc/ada/

* gcc-interface/trans.cc (get_storage_model_access): Strip any type
conversion around the node before looking into it.

ada: Enforce Aggregate aspect legality rule

Ada 2022 requires that an Aggregate aspect specification shall specify a
a name for at least one of Add_Named, Add_Unnamed, or Assign_Indexed.
Enforce this rule.

gcc/ada/

* sem_ch13.adb
(Validate_Aspect_Aggregate): Reject illegal case where none of
Add_Named, Add_Unnamed, and Assign_Indexed are specified.

ada: Further adjustments to User's Guide for PIE default

gcc/ada/

* doc/gnat_ugn/gnat_and_program_execution.rst (Non-Symbolic
Traceback): Add compilation line.
(Symbolic Traceback): Remove obsolete stuff.
* doc/gnat_ugn/gnat_utility_programs.rst (gnatsymbolize): Adjust.
* gnat_ugn.texi: Regenerate.

ada: Fix misphrasing in comment

gcc/ada/

* lib-xref.adb (Generate_Reference): Fix misphrasing in comment.

ada: Use the address type of a Storage_Model_Type for 'Address

When an Address attribute applies to an object that is a dereference of
an access value whose type has aspect Designated_Storage_Model, the
attribute will now be treated as having the address type associated
with the Storage_Model_Type of the access type's associated Storage_Model
object instead of being of type System.Address.

gcc/ada/

* sem_attr.adb (Analyze_Attribute, Attribute_Address): In the case
where the attribute's prefix is a dereference of a value of an
access type that has aspect Designated_Storage_Model (or a
renaming of such a dereference), set the attribute's type to the
corresponding Storage_Model_Type's associated address type rather
than System.Address.

ada: Fix minor issues in reference manual

This patch fixes a few minor issues in the GNAT library section of
the reference manual.

gcc/ada/

* doc/gnat_rm/the_gnat_library.rst: Fix minor issues.
* gnat_rm.texi: Regenerate.

ada: Minor updates to gnat/doc configuration

Minor updates to conf.py (comments, indentation)

gcc/ada/

* doc/share/conf.py: minor updates

arm: Fix MVE testsuite fallouts

After the recent patches to improve / tidy up MVE tests and patterns,
a few more tests need to be updated (replacing spaces with tabs).

gcc/testsuite/ChangeLog:

* gcc.target/arm/simd/mve-compare-1.c: Update.
* gcc.target/arm/simd/mve-compare-scalar-1.c: Update.
* gcc.target/arm/simd/mve-vabs.c: Update.
* gcc.target/arm/simd/mve-vadd-1.c: Update.
* gcc.target/arm/simd/mve-vadd-scalar-1.c: Update.
* gcc.target/arm/simd/mve-vcmp.c: Update.
* gcc.target/arm/simd/pr101325.c: Update.

tree-optimization/107937 - uninit predicate simplification fixup

The following changes the predicate representation to record the
value of a predicate with an empty set of AND predicates.  That's
necessary to properly represent the conservative fallback for the
def vs use predicates.  Since simplification now can result in
such an empty set this distinction becomes important and we need
to check for this as we otherwise ICE.

PR tree-optimization/107937
* gimple-predicate-analysis.h (predicate::is_true): New.
(predicate::is_false): Likewise.
(predicate::empty_val): Likewise.
(uninit_analysis::uninit_analysis): Properly initialize
def_preds.
* gimple-predicate-analysis.cc (simplify_1b): Indicate
whether the chain became empty.
(predicate::simplify): Release emptied chain before removing it.
(predicate::normalize): Replace temporary object with assertion.
(uninit_analysis::is_use_guarded): Deal with predicates
that simplify to true/false.

* gcc.dg/pr107937.c: New testcase.

tree-optimization/107935 - fixup equivalence handling in PHI VN

The following makes sure to honor the backedge processing logic
that forces VARYING there.

PR tree-optimization/107935
* tree-ssa-sccvn.cc (visit_phi): Honor forced VARYING on
backedges.

* gcc.dg/torture/pr107935.c: New testcase.

i386: Improve *concat<mode><dwi>3_{1,2,3,4} patterns [PR107627]

On the first testcase we've regressed since 12 at -O2:
-       movq    8(%rsi), %rax
-       movq    %rdi, %r8
-       movq    (%rsi), %rdi
+       movq    (%rsi), %rax
+       movq    8(%rsi), %r8
        movl    %edx, %ecx
-       shrdq   %rdi, %rax
-       movq    %rax, (%r8)
+       xorl    %r9d, %r9d
+       movq    %rax, %rdx
+       xorl    %eax, %eax
+       orq     %r8, %rax
+       orq     %r9, %rdx
+       shrdq   %rdx, %rax
+       movq    %rax, (%rdi)
On the second testcase we've emitted such terrible code
with the useless xors and ors for a long time.
For PR91681 the *concat<mode><dwi>3_{1,2,3,4} patterns have been added
but they allow just register inputs and register or memory offsettable
output.
The following patch fixes this by allowing also memory inputs on those
patterns, because the pattern is then split to 0-2 emit_move_insns or
one xchg and those can handle loads from memory too just fine.
So that we don't narrow memory loads (source has 128-bit (or for ia32
64-bit) load and we would make 64-bit (or for ia32 32-bit) load out of it),
register_operand -> nonmemory_operand change is done only for operands
in zero_extend arguments.  o <- m, m or o <- m, r or o <- r, m alternatives
aren't used, we'd lack registers to perform the moves.  But what is
in addition to the current ro <- r, r supported are r <- m, r and r <- r, m
(in that case we just need to be careful about corner cases, see what
emit_move_insn we'd call and if we wouldn't clobber registers used in m's
address before loading - split_double_concat handles that now) and
&r <- m, m (in that case I think the early clobber is the easiest solution).

The first testcase then on 12 -> patched trunk at -O2 changes:
-       movq    8(%rsi), %rax
-       movq    %rdi, %r8
-       movq    (%rsi), %rdi
+       movq    8(%rsi), %r9
+       movq    (%rsi), %r10
        movl    %edx, %ecx
-       shrdq   %rdi, %rax
-       movq    %rax, (%r8)
+       movq    %r9, %rax
+       shrdq   %r10, %rax
+       movq    %rax, (%rdi)
so same amount of instructions and second testcase 12 -> patched trunk
at -O2 -m32:
-       pushl   %edi
-       xorl    %edi, %edi
        pushl   %esi
-       movl    16(%esp), %esi
+       pushl   %ebx
+       movl    16(%esp), %eax
        movl    20(%esp), %ecx
-       movl    (%esi), %eax
-       movl    4(%esi), %esi
-       movl    %eax, %edx
-       movl    $0, %eax
-       orl     %edi, %edx
-       orl     %esi, %eax
-       shrdl   %edx, %eax
        movl    12(%esp), %edx
+       movl    4(%eax), %ebx
+       movl    (%eax), %esi
+       movl    %ebx, %eax
+       shrdl   %esi, %eax
        movl    %eax, (%edx)
+       popl    %ebx
        popl    %esi
-       popl    %edi

BTW, I wonder if we couldn't add additional patterns which would catch
the case where one of the operands is constant and how does this interact
with the stv pass in 32-bit mode where I think stv is right after combine,
so if we match these patterns, perhaps it would be nice to handle them
in stv (unless they are handled there already).

2022-12-01  Jakub Jelinek  <jakub@redhat.com>

PR target/107627
* config/i386/i386.md (*concat<mode><dwi>3_1, *concat<mode><dwi>3_2):
For operands which are zero_extend arguments allow memory if
output operand is a register.
(*concat<mode><dwi>3_3, *concat<mode><dwi>3_4): Likewise.  If
both input operands are memory, use early clobber on output operand.
* config/i386/i386-expand.cc (split_double_concat): Deal with corner
cases where one input is memory and the other is not and the address
of the memory input uses a register we'd overwrite before loading
the memory into a register.

* gcc.target/i386/pr107627-1.c: New test.
* gcc.target/i386/pr107627-2.c: New test.

rs6000: Corrects comments which are added by r13-4423

gcc/
* config/rs6000/rs6000-call.cc (swap_endian_selector_for_mode):
Corrects comments of this function and make them clear.

c++: small contracts fixes

The first is an actual bug: remove_contract_attributes was only keeping one
attribute.  The second just helps flow analysis in optimizers and static
analyzers.

gcc/cp/ChangeLog:

* contracts.cc (remove_contract_attributes): Actually prepend
to the list.
* pt.cc (tsubst_contract): Only look for a postcondition if type is
nonnull.

Fix unrecognizable insn due to illegal immediate_operand (const_int 255) of QImode.

For __builtin_ia32_vec_set_v16qi (a, -1, 2) with
!flag_signed_char. it's transformed to
__builtin_ia32_vec_set_v16qi (_4, 255, 2) in the gimple,
and expanded to (const_int 255) in the rtl. But for immediate_operand,
it expects (const_int 255) to be signed extended to
(const_int -1). The mismatch caused an unrecognizable insn error.

The patch converts (const_int 255) to (const_int -1) in the backend
expander.

gcc/ChangeLog:

PR target/107863
* config/i386/i386-expand.cc (ix86_expand_vec_set_builtin):
Convert op1 to target mode whenever mode mismatch.

gcc/testsuite/ChangeLog:

* gcc.target/i386/pr107863.c: New test.

analyzer: fix i18n issues in symbolic out-of-bounds [PR106626]

gcc/analyzer/ChangeLog:
PR analyzer/106626
* bounds-checking.cc
(symbolic_past_the_end::describe_final_event): Delete, moving to
symbolic_buffer_overflow::describe_final_event and
symbolic_buffer_over_read::describe_final_event, eliminating
composition of text strings via "byte_str" and "m_dir_str".
(symbolic_past_the_end::m_dir_str): Delete field.
(symbolic_buffer_overflow::symbolic_buffer_overflow): Drop
m_dir_str.
(symbolic_buffer_overflow::describe_final_event): New, as noted
above.
(symbolic_buffer_over_read::symbolic_buffer_overflow): Drop
m_dir_str.
(symbolic_buffer_over_read::describe_final_event): New, as noted
above.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: unify bounds-checking class hierarchies

Convert out-of-bounds class hierarchy from:

  pending_diagnostic
    out_of_bounds
      past_the_end
        buffer_overflow (*)
        buffer_over_read (*)
      buffer_underwrite (*)
      buffer_under_read (*)
    symbolic_past_the_end
      symbolic_buffer_overflow (*)
      symbolic_buffer_over_read (*)

to:

  pending_diagnostic
    out_of_bounds
      concrete_out_of_bounds
        concrete_past_the_end
          concrete_buffer_overflow (*)
          concrete_buffer_over_read (*)
        concrete_buffer_underwrite (*)
        concrete_buffer_under_read (*)
      symbolic_past_the_end
        symbolic_buffer_overflow (*)
        symbolic_buffer_over_read (*)

where the concrete classes (i.e. the instantiable ones) are marked
with a (*).

Doing so undercovered a bug where, for CWE-131-examples.c, we were
emitting an extra:
  warning: heap-based buffer over-read [CWE-122] [-Wanalyzer-out-of-bounds]
at the:
  WidgetList[numWidgets] = NULL;
The issue was that within set_next_state we get the rvalue for the LHS,
which looks like a read to the bounds-checker.  The patch fixes this by
passing NULL as the region_model_context * for such accesses.

gcc/analyzer/ChangeLog:
* bounds-checking.cc (class out_of_bounds): Split out from...
(class concrete_out_of_bounds): New abstract subclass.
(class past_the_end): Rename to...
(class concrete_past_the_end): ...this, and make a subclass of
concrete_out_of_bounds.
(class buffer_overflow): Rename to...
(class concrete_buffer_overflow): ...this, and make a subclass of
concrete_past_the_end.
(class buffer_over_read): Rename to...
(class concrete_buffer_over_read): ...this, and make a subclass of
concrete_past_the_end.
(class buffer_underwrite): Rename to...
(class concrete_buffer_underwrite): ...this, and make a subclass
of concrete_out_of_bounds.
(class buffer_under_read): Rename to...
(class concrete_buffer_under_read): ...this, and make a subclass
of concrete_out_of_bounds.
(class symbolic_past_the_end): Convert to a subclass of
out_of_bounds.
(symbolic_buffer_overflow::get_kind): New.
(symbolic_buffer_over_read::get_kind): New.
(region_model::check_region_bounds): Update for renamings.
* engine.cc (impl_sm_context::set_next_state): Eliminate
"new_ctxt", passing NULL to get_rvalue instead.
(impl_sm_context::warn): Likewise.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

diagnostics: tweak diagnostic_path::interprocedural_p [PR106626]

The region-creation event at the start of...

<source>: In function 'int_arr_write_element_after_end_off_by_one':
<source>:14:11: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
   14 |   arr[10] = x;
      |   ~~~~~~~~^~~
  event 1
    |
    |   10 | int32_t arr[10];
    |      |         ^~~
    |      |         |
    |      |         (1) capacity is 40 bytes
    |
    +--> 'int_arr_write_element_after_end_off_by_one': events 2-3
           |
           |   12 | void int_arr_write_element_after_end_off_by_one(int32_t x)
           |      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |      |
           |      |      (2) entry to 'int_arr_write_element_after_end_off_by_one'
           |   13 | {
           |   14 |   arr[10] = x;  /* { dg-line line } */
           |      |   ~~~~~~~~~~~
           |      |           |
           |      |           (3) out-of-bounds write from byte 40 till byte 43 but 'arr' ends at byte 40
           |
<source>:14:11: note: write of 4 bytes to beyond the end of 'arr'
   14 |   arr[10] = x;
      |   ~~~~~~~~^~~
<source>:14:11: note: valid subscripts for 'arr' are '[0]' to '[9]'

...makes diagnostic_manager::finish_pruning consider the path to be
interprocedural, and so it doesn't prune the function entry event.

This patch tweaks diagnostic_path::interprocedural_p to ignore
leading events outside of any function, so that it considers the
path to be intraprocedural, and thus diagnostic_manager::finish_pruning
prunes the function entry event, leading to this simpler output:

<source>: In function 'int_arr_write_element_after_end_off_by_one':
<source>:14:11: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
   14 |   arr[10] = x;
      |   ~~~~~~~~^~~
  event 1
    |
    |   10 | int32_t arr[10];
    |      |         ^~~
    |      |         |
    |      |         (1) capacity is 40 bytes
    |
    +--> 'int_arr_write_element_after_end_off_by_one': event 2
           |
           |   14 |   arr[10] = x;
           |      |   ~~~~~~~~^~~
           |      |           |
           |      |           (2) out-of-bounds write from byte 40 till byte 43 but 'arr' ends at byte 40
           |
<source>:14:11: note: write of 4 bytes to beyond the end of 'arr'
<source>:14:11: note: valid subscripts for 'arr' are '[0]' to '[9]'

gcc/ChangeLog:
PR analyzer/106626
* diagnostic-path.h
(diagnostic_path::get_first_event_in_a_function): New decl.
* diagnostic.cc (diagnostic_path::get_first_event_in_a_function):
New.
(diagnostic_path::interprocedural_p): Ignore leading events that
are outside of any function.

gcc/testsuite/ChangeLog:
PR analyzer/106626
* gcc.dg/analyzer/out-of-bounds-multiline-1.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: more bounds-checking wording tweaks [PR106626]

This patch tweaks the wording of -Wanalyzer-out-of-bounds:

* use the spellings/terminology of CWE:
  * replace "underread" with "under-read", as per:
     https://cwe.mitre.org/data/definitions/127.html
  * replace "overread" with "over-read" as per:
     https://cwe.mitre.org/data/definitions/126.html
  * replace "underflow" with "underwrite" as per:
    https://cwe.mitre.org/data/definitions/124.html

* wherever known, specify the memory region of the bad access,
so that it says e.g. "heap-based buffer over-read"
or "stack-based buffer over-read"

gcc/analyzer/ChangeLog:
PR analyzer/106626
* bounds-checking.cc (out_of_bounds::get_memory_space): New.
(buffer_overflow::emit): Use it.
(class buffer_overread): Rename to...
(class buffer_over_read): ...this.
(buffer_over_read::emit): Specify which memory space the read is
from, where known.  Change "overread" to "over-read".
(class buffer_underflow): Rename to...
(class buffer_underwrite): ...this.
(buffer_underwrite::emit): Specify which memory space the write is
to, where known.  Change "underflow" to "underwrite".
(class buffer_underread): Rename to...
(class buffer_under_read): Rename to...
(buffer_under_read::emit): Specify which memory space the read is
from, where known.  Change "underread" to "under-read".
(symbolic_past_the_end::get_memory_space): New.
(symbolic_buffer_overflow::emit): Use it.
(class symbolic_buffer_overread): Rename to...
(class symbolic_buffer_over_read): ...this.
(symbolic_buffer_over_read::emit): Specify which memory space the
read is from, where known.  Change "overread" to "over-read".
(region_model::check_symbolic_bounds): Update for class renaming.
(region_model::check_region_bounds): Likewise.

gcc/testsuite/ChangeLog:
PR analyzer/106626
* gcc.dg/analyzer/call-summaries-2.c: Update expected results.
* gcc.dg/analyzer/out-of-bounds-1.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-2.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-3.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-4.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-5.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-container_of.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-read-char-arr.c: Likewise.  Rename
functions from "int_arr_" to "char_arr_".
* gcc.dg/analyzer/out-of-bounds-read-int-arr.c: Update expected
results.
* gcc.dg/analyzer/out-of-bounds-read-struct-arr.c: New test.
* gcc.dg/analyzer/out-of-bounds-write-char-arr.c: Update expected
results.  Rename functions from "int_arr_" to "char_arr_".
* gcc.dg/analyzer/out-of-bounds-write-int-arr.c: Update expected
results.
* gcc.dg/analyzer/out-of-bounds-write-struct-arr.c: New test.
* gcc.dg/analyzer/pr101962.c: Update expected results.
* gcc.dg/analyzer/realloc-5.c: Update expected results.
* gcc.dg/analyzer/zlib-3.c: Update expected results.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: add note about valid subscripts [PR106626]

Consider -fanalyzer on:

#include <stdint.h>

int32_t arr[10];

void int_arr_write_element_after_end_off_by_one(int32_t x)
{
  arr[10] = x;
}

Trunk x86_64: https://godbolt.org/z/17zn3qYY4

Currently we emit:

<source>: In function 'int_arr_write_element_after_end_off_by_one':
<source>:7:11: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
    7 |   arr[10] = x;
      |   ~~~~~~~~^~~
  event 1
    |
    |    3 | int32_t arr[10];
    |      |         ^~~
    |      |         |
    |      |         (1) capacity is 40 bytes
    |
    +--> 'int_arr_write_element_after_end_off_by_one': events 2-3
           |
           |    5 | void int_arr_write_element_after_end_off_by_one(int32_t x)
           |      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |      |
           |      |      (2) entry to 'int_arr_write_element_after_end_off_by_one'
           |    6 | {
           |    7 |   arr[10] = x;
           |      |   ~~~~~~~~~~~
           |      |           |
           |      |           (3) out-of-bounds write from byte 40 till byte 43 but 'arr' ends at byte 40
           |
<source>:7:11: note: write of 4 bytes to beyond the end of 'arr'
    7 |   arr[10] = x;
      |   ~~~~~~~~^~~

This is worded in terms of bytes, due to the way -Wanalyzer-out-of-bounds
is implemented, but this isn't what the user wrote.

This patch tries to get closer to the user's code by adding a note about
array bounds when we're referring to an array.  In the above example it
adds this trailing note:

  note: valid subscripts for 'arr' are '[0]' to '[9]'

gcc/analyzer/ChangeLog:
PR analyzer/106626
* bounds-checking.cc (out_of_bounds::maybe_describe_array_bounds):
New.
(buffer_overflow::emit): Call maybe_describe_array_bounds.
(buffer_overread::emit): Likewise.
(buffer_underflow::emit): Likewise.
(buffer_underread::emit): Likewise.

gcc/testsuite/ChangeLog:
PR analyzer/106626
* gcc.dg/analyzer/call-summaries-2.c: Add dg-message for expected
note about valid indexes.
* gcc.dg/analyzer/out-of-bounds-1.c: Likewise, fixing up existing
dg-message directives.
* gcc.dg/analyzer/out-of-bounds-write-char-arr.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-write-int-arr.c: Likewise.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: fix wording of 'number of bad bytes' note [PR106626]

Consider -fanalyzer on:

#include <stdint.h>

int32_t arr[10];

void int_arr_write_element_after_end_far(int32_t x)
{
  arr[100] = x;
}

Trunk x86_64: https://godbolt.org/z/7GqEcYGq6

Currently we emit:

<source>: In function 'int_arr_write_element_after_end_far':
<source>:7:12: warning: buffer overflow [CWE-787] [-Wanalyzer-out-of-bounds]
    7 |   arr[100] = x;
      |   ~~~~~~~~~^~~
  event 1
    |
    |    3 | int32_t arr[10];
    |      |         ^~~
    |      |         |
    |      |         (1) capacity is 40 bytes
    |
    +--> 'int_arr_write_element_after_end_far': events 2-3
           |
           |    5 | void int_arr_write_element_after_end_far(int32_t x)
           |      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |      |
           |      |      (2) entry to 'int_arr_write_element_after_end_far'
           |    6 | {
           |    7 |   arr[100] = x;
           |      |   ~~~~~~~~~~~~
           |      |            |
           |      |            (3) out-of-bounds write from byte 400 till byte 403 but 'arr' ends at byte 40
           |
<source>:7:12: note: write is 4 bytes past the end of 'arr'
    7 |   arr[100] = x;
      |   ~~~~~~~~~^~~

The wording of the final note:
  "write is 4 bytes past the end of 'arr'"
reads to me as if the "4 bytes past" is describing where the access
occurs, which seems wrong, as the write is far beyond the end of the
array.  Looking at the implementation, it's actually describing the
number of bytes within the access that are beyond the bounds of the
buffer.

This patch updates the wording so that the final note reads
  "write of 4 bytes to beyond the end of 'arr'"
which more clearly expresses that it's the size of the access
being described.

The patch also uses inform_n to avoid emitting "1 bytes".

gcc/analyzer/ChangeLog:
PR analyzer/106626
* bounds-checking.cc (buffer_overflow::emit): Use inform_n.
Update wording to clarify that we're talking about the size of
the bad access, rather than its position.
(buffer_overread::emit): Likewise.

gcc/testsuite/ChangeLog:
PR analyzer/106626
* gcc.dg/analyzer/out-of-bounds-read-char-arr.c: Update for
changes to expected wording.
* gcc.dg/analyzer/out-of-bounds-read-int-arr.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-write-char-arr.c: Likewise.
* gcc.dg/analyzer/out-of-bounds-write-int-arr.c: Likewise.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: move bounds checking to a new bounds-checking.cc

gcc/ChangeLog:
* Makefile.in (ANALYZER_OBJS): Add analyzer/bounds-checking.o.

gcc/analyzer/ChangeLog:
* bounds-checking.cc: New file, taken from region-model.cc.
* region-model.cc (class out_of_bounds): Move to
bounds-checking.cc.
(class past_the_end): Likewise.
(class buffer_overflow): Likewise.
(class buffer_overread): Likewise.
(class buffer_underflow): Likewise.
(class buffer_underread): Likewise.
(class symbolic_past_the_end): Likewise.
(class symbolic_buffer_overflow): Likewise.
(class symbolic_buffer_overread): Likewise.
(region_model::check_symbolic_bounds): Likewise.
(maybe_get_integer_cst_tree): Likewise.
(region_model::check_region_bounds): Likewise.
* region-model.h: Add comment.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: fix ICE on bind/connect with a constant fd [PR107928]

gcc/analyzer/ChangeLog:
PR analyzer/107928
* sm-fd.cc (fd_state_machine::on_bind): Handle m_constant_fd in
the "success" outcome.
(fd_state_machine::on_connect): Likewise.
* sm-fd.dot: Add "constant_fd" state and its transitions.

gcc/testsuite/ChangeLog:
PR analyzer/107928
* gcc.dg/analyzer/fd-bind-pr107928.c: New test.
* gcc.dg/analyzer/fd-connect-pr107928.c: New test.
* gcc.dg/analyzer/fd-stream-socket-active-open.c
(test_active_open_from_connect_constant): New, adapted from
test_active_open_from_connect.
* gcc.dg/analyzer/fd-stream-socket-passive-open.c
(test_passive_open_from_bind_constant): New, adapted from
test_passive_open_from_bind.
(test_passive_open_from_listen_constant): New, adapted from
test_passive_open_from_listen.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

rs6000: Generates permute index directly for little endian targets (PR100866)

2022-10-11  Haochen Gui <guihaoc@linux.ibm.com>

gcc/
PR target/100866
* config/rs6000/rs6000-call.cc (swap_endian_selector_for_mode):
Generate permute index directly for little endian targets.
* config/rs6000/vsx.md (revb_<mode>): Call vprem directly with
corresponding permute indexes.

gcc/testsuite/
PR target/100866
* gcc.target/powerpc/pr100866-1.c: New.

Daily bump.

maintainer-scripts: Add gdc to update_web_docs_git

So that it's built and uploaded to gcc.gnu.org/onlinedocs.

PR web/107749

maintainer-scripts/ChangeLog:

* update_web_docs_git: Add gdc to MANUALS.

d: Add language reference section to documentation files.

Adds an initial body of documentation for the D front-end - other than
the existing documentation for command-line usage/the man page.

Documentation covers code generation choices specific to GNU D - what
attributes are supported, intrinsics, pragmas, predefined versions,
language extensions, missing features and deviations from spec.

More could be added or elaborated upon, such as what linkage do
different symbols get, mixed language programming with C and C++, the
anatomy of a TypeInfo and ModuleInfo object, and so on.  This is enough
as a first wave just to get it off the ground.

gcc/d/ChangeLog:

* Make-lang.in (D_TEXI_FILES): Add d/implement-d.texi.
* gdc.texi: Adjust introduction, include implement-d.texi.
* implement-d.texi: New file.

d: Update recipes for building html and pdf documentation

gcc/d/ChangeLog:

* Make-lang.in: Only include doc/include when building documentation.
(d.html): Rename html directory to $(build_htmldir)/gdc.

d: Separate documentation indices into options and keywords.

gcc/d/ChangeLog:

* gdc.texi: Separate indices into options and keywords.

d: Synchronize gdc documentation with options in d/lang.opt

gcc/d/ChangeLog:

* gdc.texi: Update gdc option documentation.
* lang.opt (frevert=intpromote): Correct documentation.

runtime: force XSI strerror on hurd

Reviewed-on: https://go-review.googlesource.com/c/gofrontend/+/454275

Fix addvdi3 and subvdi3 patterns

While most PA 2.0 instructions support both 32 and 64-bit traps
and conditions, the addi and subi instructions only support 32-bit
traps and conditions. Thus, we need to force immediate operands
to register operands on the 64-bit target and use the add/sub
instructions which can trap on 64-bit signed overflow.

2022-11-30  John David Anglin  <danglin@gcc.gnu.org>

gcc/ChangeLog:

* config/pa/pa.md (addvdi3): Force operand 2 to a register.
Remove "addi,tsv,*" instruction from unamed pattern.
(subvdi3): Force operand 1 to a register.
Remove "subi,tsv" instruction from from unamed pattern.

aarch64: Specify that FEAT_MOPS sequences clobber CC

According to the architecture pseudocode the FEAT_MOPS sequences overwrite the NZCV flags
as par of their operation, so GCC needs to model that in the relevant RTL patterns.
For the testcase:
void g();
void foo (int a, size_t N, char *__restrict__ in,
         char *__restrict__ out)
{
  if (a != 3)
    __builtin_memcpy (out, in, N);
  if (a > 3)
    g ();
}

we will currently generate:
foo:
        cmp     w0, 3
        bne     .L6
.L1:
        ret
.L6:
        cpyfp   [x3]!, [x2]!, x1!
        cpyfm   [x3]!, [x2]!, x1!
        cpyfe   [x3]!, [x2]!, x1!
        ble     .L1 // Flags reused after CPYF* sequence
        b       g

This is wrong as the result of cmp needs to be recalculated after the MOPS sequence.
With this patch we'll insert a "cmp w0, 3" before the ble, similar to what clang does.

Bootstrapped and tested on aarch64-none-linux-gnu.
Pushing to trunk and to the GCC 12 branch after some baking time.

gcc/ChangeLog:

* config/aarch64/aarch64.md (aarch64_cpymemdi): Specify clobber of CC reg.
(*aarch64_cpymemdi): Likewise.
(aarch64_movmemdi): Likewise.
(aarch64_setmemdi): Likewise.
(*aarch64_setmemdi): Likewise.

gcc/testsuite/ChangeLog:

* gcc.target/aarch64/mops_5.c: New test.
* gcc.target/aarch64/mops_6.c: Likewise.
* gcc.target/aarch64/mops_7.c: Likewise.

d: Fix ICE on named continue label in an unrolled loop [PR107592]

Continue labels in an unrolled loop require a unique label per
iteration.  Previously this used the Statement body node for each
unrolled iteration to generate a new entry in the label hash table.
This does not work when the continue label has an identifier, as said
named label is pointing to the outer UnrolledLoopStatement node.

What would happen is that during the lowering of `continue label', an
automatic label associated with the unrolled loop would be generated,
and a jump to that label inserted, but because it was never pushed by
the visitor for the loop itself, it subsequently never gets emitted.

To fix, correctly use the UnrolledLoopStatement as the key to look up
and store the break/continue label pair, but remove the continue label
from the value entry after every loop to force a new label to be
generated by the next call to `push_continue_label'

PR d/107592

gcc/d/ChangeLog:

* toir.cc (IRVisitor::push_unrolled_continue_label): New method.
(IRVisitor::pop_unrolled_continue_label): New method.
(IRVisitor::visit (UnrolledLoopStatement *)): Use them instead of
push_continue_label and pop_continue_label.

gcc/testsuite/ChangeLog:

* gdc.dg/pr107592.d: New test.

switch conversion: remove dead variable

gcc/ChangeLog:

* tree-switch-conversion.cc (bit_test_cluster::emit): Remove
dead variable bt_range.

fix Clang warning

Fixes:
gcc/fortran/parse.cc:5782:32: warning: for loop has empty body [-Wempty-body]

gcc/fortran/ChangeLog:

* parse.cc (parse_omp_structured_block): Remove extra semicolon.

Make Warray-bounds alias to Warray-bounds= [PR107787]

According to the documentation, the -Werror= option makes the specified
warning into an error and also automatically implies that option. Then
it seems that the behavior of the compiler when specifying
-Werror=array-bounds=X should be the same as specifying
"-Werror=array-bounds -Warray-bounds=X", so we expect to receive
array-bounds pass diagnostics and they must be processed as errors.

In practice, we observe that the array-bounds pass is indeed invoked,
but its diagnostics are processed as warnings, not errors.

This happens because Warray-bounds and Warray-bounds= are
declared as two different options in common.opt, so when
diagnostic_classify_diagnostic is called, DK_ERROR is set for
the Warray-bounds= option, but diagnostic_report_diagnostic called from
warning_at receives opt_index of Warray-bounds, so information about
DK_ERROR is lost. Fix this by using Alias in declaration of
Warray-bounds (similar to Wattribute-alias).

Co-authored-by: Franz Sirl <Franz.Sirl-kernel@lauterbach.com>
gcc/ChangeLog:

PR driver/107787
* common.opt (Warray-bounds): Turn into alias of
-Warray-bounds=1.
* builtins.cc (c_strlen): Use OPT_Warray_bounds_
instead of OPT_Warray_bounds.
* diagnostic-spec.cc (nowarn_spec_t::nowarn_spec_t): Ditto.
* gimple-array-bounds.cc (array_bounds_checker::check_array_ref,
array_bounds_checker::check_mem_ref,
array_bounds_checker::check_addr_expr,
array_bounds_checker::check_array_bounds): Ditto.
* gimple-ssa-warn-restrict.cc (maybe_diag_access_bounds): Ditto.

gcc/c-family/ChangeLog:

PR driver/107787
* c-common.cc (fold_offsetof,
convert_vector_to_array_for_subscript): Use OPT_Warray_bounds_
instead of OPT_Warray_bounds.

gcc/testsuite/ChangeLog:

PR driver/107787
* gcc.dg/Warray-bounds-34.c: Correct the regular expression
for -Warray-bounds=.
* gcc.dg/Warray-bounds-43.c: Likewise.
* gcc.dg/pr107787.c: New test.

Improve profile handling in switch lowering.

PR tree-optimization/101301
PR tree-optimization/103680

gcc/ChangeLog:

* tree-switch-conversion.cc (bit_test_cluster::emit):
Handle correctly remaining probability.
(switch_decision_tree::try_switch_expansion): Fix BB's count
where a cluster expansion happens.
(switch_decision_tree::emit_cmp_and_jump_insns): Fill up also
BB count.
(switch_decision_tree::do_jump_if_equal): Likewise.
(switch_decision_tree::emit_case_nodes): Handle special case
for BT expansion which can also fallback to a default BB.
* tree-switch-conversion.h (cluster::cluster): Add
m_default_prob probability.

tree-optimization/107919 - predicate simplification in uninit

The testcase from the PR at -O2 shows

    ((_277 == 2) AND (_79 == 0))
    OR ((NOT (_277 == 0)) AND (NOT (_277 > 2)) AND (NOT (_277 == 2)) AND (_79 == 0))
    OR ((NOT (pretmp_300 == 255)) AND (_277 == 0) AND (NOT (_277 > 2)) AND (NOT (_277 == 2)) AND (_79 == 0))

which we fail to simplify.  The following patch makes us simplify
the relations on _277, producing

    ((_79 == 0) AND (_277 == 2))
    OR ((_79 == 0) AND (_277 <= 1) AND (NOT (_277 == 0)))
    OR ((_79 == 0) AND (_277 == 0) AND (NOT (pretmp_300 == 255)))

which might be an incremental step to resolve a bogus uninit
diagnostic at -O2.  The patch uses maybe_fold_and_comparison for this.

PR tree-optimization/107919
* gimple-predicate-analysis.cc (simplify_1): Rename to ...
(simplify_1a): .. this.
(simplify_1b): New.
(predicate::simplify): Call both simplify_1a and simplify_1b.

Improve uninit diagnostic dumps

The following dumps the edge a use is uninitialized in a PHI.

* tree-ssa-uninit.cc (find_uninit_use): Dump the edge for a
PHI node.

tree-optimization/107919 - uninit diagnostic predicate simplification

We fail to simplify

        ((_145 != 0B) AND (_531 == 2) AND (_109 == 0))
        OR ((NOT (_145 != 0B)) AND (_531 == 2) AND (_109 == 0))
        OR ((NOT (_531 == 2)) AND (_109 == 0))

because the existing simplification of !A && B || A && B is implemented
too simplistic.  The following re-implements that which fixes the
bogus uninit diagnostic when using -O1 but not yet at -O2.

PR tree-optimization/107919
* gimple-predicate-analysis.cc (predicate::simplify_2):
Handle predicates of arbitrary length.

* g++.dg/warn/Wuninitialized-pr107919-1.C: New testcase.

tree-chrec: Fix up ICE on pointer multiplication [PR107835]

r13-254-gdd3c7873a61019e9 added an optimization for {a, +, a} (x-1),
but as can be seen on the following testcase, the way it is written
where chrec_fold_multiply is called with type doesn't work for pointers:
             res = build_int_cst (TREE_TYPE (x), 1);
             res = chrec_fold_plus (TREE_TYPE (x), x, res);
             res = chrec_convert_rhs (type, res, NULL);
             res = chrec_fold_multiply (type, chrecr, res);
while what we were doing before and what is still used if the condition
doesn't match is fine:
             res = chrec_convert_rhs (TREE_TYPE (chrecr), x, NULL);
             res = chrec_fold_multiply (TREE_TYPE (chrecr), chrecr, res);
             res = chrec_fold_plus (type, CHREC_LEFT (chrec), res);
because it performs chrec_fold_multiply on TREE_TYPE (chrecr) and converts
only afterwards.

I think the easiest fix is to ignore the new path for pointer types.

2022-11-30  Jakub Jelinek  <jakub@redhat.com>

PR tree-optimization/107835
* tree-chrec.cc (chrec_apply): Don't handle "{a, +, a} (x-1)"
as "a*x" if type is a pointer type.

* gcc.c-torture/compile/pr107835.c: New test.

libgomp.texi: List GCN's 'gfx803' under OpenMP Context Selectors

libgomp/ChangeLog:

* libgomp.texi (OpenMP Context Selectors): Add 'gfx803' to gcn's isa.

amdgcn: Support AMD-specific 'isa' traits in OpenMP context selectors

Add support for gfx803 as an alias for fiji.
Add test cases for all supported 'isa' values.

gcc/ChangeLog:

* config/gcn/gcn.cc (gcn_omp_device_kind_arch_isa): Add gfx803.
* config/gcn/t-omp-device: Add gfx803.

libgomp/ChangeLog:

* testsuite/libgomp.c/declare-variant-4-fiji.c: New test.
* testsuite/libgomp.c/declare-variant-4-gfx803.c: New test.
* testsuite/libgomp.c/declare-variant-4-gfx900.c: New test.
* testsuite/libgomp.c/declare-variant-4-gfx906.c: New test.
* testsuite/libgomp.c/declare-variant-4-gfx908.c: New test.
* testsuite/libgomp.c/declare-variant-4-gfx90a.c: New test.
* testsuite/libgomp.c/declare-variant-4.h: New header file.

[PR107304] note test's ifunc requirement

The test uses target_clones, that requires ifunc support.

for  gcc/testsuite/ChangeLog

PR target/107304
* gcc.target/i386/pr107304.c: dg-require ifunc support.

LoongArch: Optimize the implementation of stack check.

The old stack check was performed before the stack was dropped,
which would cause the detection tool to report a memory leak.

The current stack check scheme is as follows:

'-fstack-clash-protection':
1. When the frame->total_size is smaller than the guard page size,
   the stack is dropped according to the original scheme, and there
   is no need to perform stack detection in the prologue.
2. When frame->total_size is greater than or equal to guard page size,
   the first step to drop the stack is to drop the space required by
   the caller-save registers. This space needs to save the caller-save
   registers, so an implicit stack check is performed.
   So just need to check the rest of the stack space.

'-fstack-check':
There is no one-time stack drop and then page-by-page detection as
described in the document. It is also the same as
'-fstack-clash-protection', which is detected immediately after page drop.

It is judged that when frame->total_size is not 0, only the size required
to save the s register is dropped for the first stack down.

The test cases are referenced from aarch64.

gcc/ChangeLog:

* config/loongarch/linux.h (STACK_CHECK_MOVING_SP):
Define this macro to 1.
* config/loongarch/loongarch.cc (STACK_CLASH_PROTECTION_GUARD_SIZE):
Size of guard page.
(loongarch_first_stack_step): Return the size of the first drop stack
according to whether stack checking is performed.
(loongarch_emit_probe_stack_range): Adjust the method of stack checking in prologue.
(loongarch_output_probe_stack_range): Delete useless code.
(loongarch_expand_prologue): Adjust the method of stack checking in prologue.
(loongarch_option_override_internal): Enforce that interval is the same
size as size so the mid-end does the right thing.
* config/loongarch/loongarch.h (STACK_CLASH_MAX_UNROLL_PAGES):
New macro decide whether to loop stack detection.

gcc/testsuite/ChangeLog:

* lib/target-supports.exp:
* gcc.target/loongarch/stack-check-alloca-1.c: New test.
* gcc.target/loongarch/stack-check-alloca-2.c: New test.
* gcc.target/loongarch/stack-check-alloca-3.c: New test.
* gcc.target/loongarch/stack-check-alloca-4.c: New test.
* gcc.target/loongarch/stack-check-alloca-5.c: New test.
* gcc.target/loongarch/stack-check-alloca-6.c: New test.
* gcc.target/loongarch/stack-check-alloca.h: New test.
* gcc.target/loongarch/stack-check-cfa-1.c: New test.
* gcc.target/loongarch/stack-check-cfa-2.c: New test.
* gcc.target/loongarch/stack-check-prologue-1.c: New test.
* gcc.target/loongarch/stack-check-prologue-2.c: New test.
* gcc.target/loongarch/stack-check-prologue-3.c: New test.
* gcc.target/loongarch/stack-check-prologue-4.c: New test.
* gcc.target/loongarch/stack-check-prologue-5.c: New test.
* gcc.target/loongarch/stack-check-prologue-6.c: New test.
* gcc.target/loongarch/stack-check-prologue-7.c: New test.
* gcc.target/loongarch/stack-check-prologue.h: New test.

analyzer: move stdio known fns to sm-file.cc

gcc/analyzer/ChangeLog:
* region-model-impl-calls.cc (class kf_fgets): Move to sm-file.cc.
(kf_fgets::impl_call_pre): Likewise.
(class kf_fread): Likewise.
(kf_fread::impl_call_pre): Likewise.
(class kf_getchar): Likewise.
(class kf_stdio_output_fn): Likewise.
(register_known_functions): Move registration of
BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
"getchar", "fgets", "fgets_unlocked", and "fread" to
register_known_file_functions.
* sm-file.cc (class kf_stdio_output_fn): Move here from
region-model-impl-calls.cc.
(class kf_fgets): Likewise.
(class kf_fread): Likewise.
(class kf_getchar): Likewise.
(register_known_file_functions): Move registration of
BUILT_IN_FPRINTF, BUILT_IN_FPRINTF_UNLOCKED, BUILT_IN_FPUTC,
BUILT_IN_FPUTC_UNLOCKED, BUILT_IN_FPUTS, BUILT_IN_FPUTS_UNLOCKED,
BUILT_IN_FWRITE, BUILT_IN_FWRITE_UNLOCKED, BUILT_IN_PRINTF,
BUILT_IN_PRINTF_UNLOCKED, BUILT_IN_PUTC, BUILT_IN_PUTCHAR,
BUILT_IN_PUTCHAR_UNLOCKED, BUILT_IN_PUTC_UNLOCKED, BUILT_IN_PUTS,
BUILT_IN_PUTS_UNLOCKED, BUILT_IN_VFPRINTF, BUILT_IN_VPRINTF,
"fgets", "fgets_unlocked", "fread", and "getchar" to here from
register_known_functions.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer work on issues with flex-generated lexers [PR103546]

PR analyzer/103546 tracks various false positives seen on
flex-generated lexers.

Whilst investigating them, I noticed an ICE with
-fanalyzer-call-summaries due to attempting to store sm-state
for an UNKNOWN svalue, which this patch fixes.

This patch also provides known_function implementations of all of the
external functions called by the lexer, reducing the number of false
positives.

The patch doesn't eliminate all false positives, but adds integration
tests to try to establish a baseline from which the remaining false
positives can be fixed.

gcc/analyzer/ChangeLog:
PR analyzer/103546
* analyzer.h (register_known_file_functions): New decl.
* program-state.cc (sm_state_map::replay_call_summary): Rejct
attempts to store sm-state for caller_sval that can't have
associated state.
* region-model-impl-calls.cc (register_known_functions): Call
register_known_file_functions.
* sm-fd.cc (class kf_isatty): New.
(register_known_fd_functions): Register it.
* sm-file.cc (class kf_ferror): New.
(class kf_fileno): New.
(class kf_getc): New.
(register_known_file_functions): New.

gcc/ChangeLog:
PR analyzer/103546
* doc/invoke.texi (Static Analyzer Options): Add isatty, ferror,
fileno, and getc to the list of functions known to the analyzer.

gcc/testsuite/ChangeLog:
PR analyzer/103546
* gcc.dg/analyzer/ferror-1.c: New test.
* gcc.dg/analyzer/fileno-1.c: New test.
* gcc.dg/analyzer/flex-with-call-summaries.c: New test.
* gcc.dg/analyzer/flex-without-call-summaries.c: New test.
* gcc.dg/analyzer/getc-1.c: New test.
* gcc.dg/analyzer/isatty-1.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

analyzer: fix folding of '(PTR + 0) => PTR' [PR105784]

gcc/analyzer/ChangeLog:
PR analyzer/105784
* region-model-manager.cc
(region_model_manager::maybe_fold_binop): For POINTER_PLUS_EXPR,
PLUS_EXPR and MINUS_EXPR, eliminate requirement that the final
type matches that of arg0 in favor of a cast.

gcc/testsuite/ChangeLog:
PR analyzer/105784
* gcc.dg/analyzer/torture/fold-ptr-arith-pr105784.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

c++: ICE with <=> of incompatible pointers [PR107542]

In a SFINAE context composite_pointer_type returns error_mark_node if
the given pointer types are incompatible.  But the SPACESHIP_EXPR case
of cp_build_binary_op wasn't prepared for this error_mark_node result,
which led to an ICE (from spaceship_comp_cat) for the below testcase.
(In a non-SFINAE context composite_pointer_type issues a permerror and
returns cv void* in this case, so this ICE seems specific to SFINAE.)

PR c++/107542

gcc/cp/ChangeLog:

* typeck.cc (cp_build_binary_op): In the SPACESHIP_EXPR case,
handle an error_mark_node result type.

gcc/testsuite/ChangeLog:

* g++.dg/cpp2a/spaceship-sfinae2.C: New test.

Daily bump.

syscall, runtime: always call XSI strerror_r

This does the right thing for either glibc or musl on GNU/Linux.

Based on patch by Sören Tempel.

Reviewed-on: https://go-review.googlesource.com/c/gofrontend/+/454176

Fortran: intrinsic MERGE shall use all its arguments [PR107874]

gcc/fortran/ChangeLog:

PR fortran/107874
* simplify.cc (gfc_simplify_merge): When simplifying MERGE with a
constant scalar MASK, ensure that arguments TSOURCE and FSOURCE are
either constant or will be evaluated.
* trans-intrinsic.cc (gfc_conv_intrinsic_merge): Evaluate arguments
before generating conditional expression.

gcc/testsuite/ChangeLog:

PR fortran/107874
* gfortran.dg/merge_init_expr_2.f90: Adjust code to the corrected
simplification.
* gfortran.dg/merge_1.f90: New test.

Co-authored-by: Steven G. Kargl <kargl@gcc.gnu.org>

libstdc++: Avoid bogus warning in std::vector::insert [PR107852]

GCC assumes that any global variable might be modified by operator new,
and so in the testcase for this PR all data members get reloaded after
allocating new storage. By making local copies of the _M_start and
_M_finish members we avoid that, and then the compiler has enough info
to remove the dead branches that trigger bogus -Warray-bounds warnings.

libstdc++-v3/ChangeLog:

PR libstdc++/107852
PR libstdc++/106199
PR libstdc++/100366
* include/bits/vector.tcc (vector::_M_fill_insert): Copy
_M_start and _M_finish members before allocating.
(vector::_M_default_append): Likewise.
(vector::_M_range_insert): Likewise.

libstdc++: Remove unnecessary tag dispatching in std::vector

There's no need to call a _M_xxx_dispatch function with a
statically-known __false_type tag, we can just directly call the
function that should be dispatched to. This will compile a tiny bit
faster and save a function call with optimization or inlining turned
off.

Also add the always_inline attribute to the __iterator_category helper
used for dispatching on the iterator category.

libstdc++-v3/ChangeLog:

* include/bits/stl_iterator_base_types.h (__iterator_category):
Add always_inline attribute.
* include/bits/stl_vector.h (assign(Iter, Iter)): Call
_M_assign_aux directly, instead of _M_assign_dispatch.
(insert(const_iterator, Iter, Iter)): Call _M_range_insert
directly instead of _M_insert_dispatch.

libstdc++: Do not use __used or __packed as identifiers

These names (and __unused) are defined as macros by newlib.

libstdc++-v3/ChangeLog:

* include/std/format: Rename all variables called __used or
__packed.
* testsuite/17_intro/badnames.cc: Add no_pch options.
* testsuite/17_intro/names.cc: Check __packed, __unused and
__used.

c++: explicit specialization and trailing requirements [PR107864]

Here we're crashing when using the explicit specialization of the
function template g with trailing requirements ultimately because
earlier decls_match (called indirectly from register_specialization) for
for the explicit specialization returned false since the template has
trailing requirements whereas the specialization doesn't.

In r12-2230-gddd25bd1a7c8f4, we fixed a similar issue concerning template
requirements instead of trailing requirements.  We could extend that fix
to ignore trailing requirement mismatches for explicit specializations
as well, but it seems cleaner to just propagate constraints from the
specialized template to the specialization when declaring an explicit
specialization so that decls_match will naturally return true in this
case.  And it looks like determine_specialization already does this,
albeit inconsistently (only when specializing a non-template member
function of a class template as in cpp2a/concepts-explicit-spec4.C).

So this patch makes determine_specialization consistently propagate
constraints from the specialized template to the specialization, which
in turn lets us get rid of the function_requirements_equivalent_p special
case added by r12-2230.

PR c++/107864

gcc/cp/ChangeLog:

* decl.cc (function_requirements_equivalent_p): Don't check
DECL_TEMPLATE_SPECIALIZATION.
* pt.cc (determine_specialization): Propagate constraints when
specializing a function template too.  Simplify by using
add_outermost_template_args.

gcc/testsuite/ChangeLog:

* g++.dg/concepts/explicit-spec1a.C: New test.

tree-optimization/107852 - missed optimization with PHIs

The following deals with the situation where we have

<bb 2> [local count: 1073741824]:
_5 = bytes.D.25336._M_impl.D.24643._M_start;
_6 = bytes.D.25336._M_impl.D.24643._M_finish;
pretmp_66 = bytes.D.25336._M_impl.D.24643._M_end_of_storage;
if (_5 != _6)
  goto <bb 3>; [70.00%]
else
  goto <bb 4>; [30.00%]

...

<bb 6> [local count: 329045359]:
_89 = operator new (4);
_43 = bytes.D.25336._M_impl.D.24643._M_start;
_Num_44 = _137 - _43;
if (_Num_44 != 0)

but fail to see that _137 is equal to _5 and thus eventually _Num_44
is zero if not operator new would possibly clobber the global
bytes variable.

The following resolves this in value-numbering by using the
predicated values for _5 == _6 recorded for the dominating
condition.

PR tree-optimization/107852
* tree-ssa-sccvn.cc (visit_phi): Use equivalences recorded
as predicated values to elide more redundant PHIs.

* gcc.dg/tree-ssa/ssa-fre-101.c: New testcase.

tree-optimization/106995 - if-conversion and vanishing loops

When we version loops for vectorization during if-conversion it
can happen that either loop vanishes because we run some VN and
CFG cleanup.  If the to-be vectorized part vanishes we already
redirect the versioning condition to the original loop.  The following
does the same in case the original loop vanishes as happened
for the testcase in the bug in the past (but no longer).

PR tree-optimization/106995
* tree-if-conv.cc (pass_if_conversion::execute): Also redirect the
versioning condition to the original loop if this very loop
vanished during CFG cleanup.

Couple of testsuite adjustments

gcc/testsuite/
* gcc.dg/ipa/iinline-attr.c: XFAIL on SPARC.
* gcc.dg/signbit-2.c: Replace vect_int selector by vect_shift.

Fix PR ada/107810

This just makes the pattern matching more robust.

gcc/testsuite/
PR ada/107810
* gnat.dg/unchecked_convert9.adb: Adjust pattern.

tree-optimization/107898 - ICE with -Walloca-larger-than

The following avoids ICEing with a mismatched prototype for alloca
and -Walloca-larger-than using irange for checks which doesn't
like mismatched types.

PR tree-optimization/107898
* gimple-ssa-warn-alloca.cc (alloca_call_type): Check
the type of the alloca argument is compatible with size_t
before querying ranges.