From 0707f4280907c395b543464175411f8155817a9e Mon Sep 17 00:00:00 2001
From: Jan Hubicka <jh@suse.cz>
Date: Wed, 20 Apr 2022 11:00:33 +0200
Subject: [PATCH] Fix overflows in ipa-modref-tree.cc

gcc/ChangeLog:

2022-04-20  Jan Hubicka  <hubicka@ucw.cz>

	PR ipa/103818

	* ipa-modref-tree.cc (modref_access_node::closer_pair_p): Use
	poly_offset_int to avoid overflow.
	(modref_access_node::update2): likewise.

gcc/testsuite/ChangeLog:

2022-04-20  Jan Hubicka  <hubicka@ucw.cz>

	* gcc.c-torture/compile/103818.c: New test.
---
 gcc/ipa-modref-tree.cc                       | 31 +++++++++++++++++++++-------
 gcc/testsuite/gcc.c-torture/compile/103818.c | 12 +++++++++++
 2 files changed, 35 insertions(+), 8 deletions(-)
 create mode 100644 gcc/testsuite/gcc.c-torture/compile/103818.c

diff --git a/gcc/ipa-modref-tree.cc b/gcc/ipa-modref-tree.cc
index f19af8c..44cb645 100644
--- a/gcc/ipa-modref-tree.cc
+++ b/gcc/ipa-modref-tree.cc
@@ -267,34 +267,42 @@ modref_access_node::closer_pair_p (const modref_access_node &a1,
 
 
   /* Now compute distance of the intervals.  */
-  poly_int64 dist1, dist2;
+  poly_offset_int dist1, dist2;
   if (known_le (offseta1, offsetb1))
     {
       if (!known_size_p (a1.max_size))
 	dist1 = 0;
       else
-	dist1 = offsetb1 - offseta1 - a1.max_size;
+	dist1 = (poly_offset_int)offsetb1
+		- (poly_offset_int)offseta1
+		- (poly_offset_int)a1.max_size;
     }
   else
     {
       if (!known_size_p (b1.max_size))
 	dist1 = 0;
       else
-	dist1 = offseta1 - offsetb1 - b1.max_size;
+	dist1 = (poly_offset_int)offseta1
+		 - (poly_offset_int)offsetb1
+		 - (poly_offset_int)b1.max_size;
     }
   if (known_le (offseta2, offsetb2))
     {
       if (!known_size_p (a2.max_size))
 	dist2 = 0;
       else
-	dist2 = offsetb2 - offseta2 - a2.max_size;
+	dist2 = (poly_offset_int)offsetb2
+		- (poly_offset_int)offseta2
+		- (poly_offset_int)a2.max_size;
     }
   else
     {
       if (!known_size_p (b2.max_size))
 	dist2 = 0;
       else
-	dist2 = offseta2 - offsetb2 - b2.max_size;
+	dist2 = offseta2
+		- (poly_offset_int)offsetb2
+		- (poly_offset_int)b2.max_size;
     }
   /* It may happen that intervals overlap in case size
      is different.  Prefer the overlap to non-overlap.  */
@@ -380,9 +388,16 @@ modref_access_node::update2 (poly_int64 parm_offset1,
     new_max_size = max_size2;
   else
     {
-      new_max_size = max_size2 + offset2 - offset1;
-      if (known_le (new_max_size, max_size1))
-	new_max_size = max_size1;
+      poly_offset_int s = (poly_offset_int)max_size2
+			  + (poly_offset_int)offset2
+			  - (poly_offset_int)offset1;
+      if (s.to_shwi (&new_max_size))
+	{
+	  if (known_le (new_max_size, max_size1))
+	    new_max_size = max_size1;
+	}
+      else
+	new_max_size = -1;
     }
 
   update (parm_offset1, offset1,
diff --git a/gcc/testsuite/gcc.c-torture/compile/103818.c b/gcc/testsuite/gcc.c-torture/compile/103818.c
new file mode 100644
index 0000000..e6cbe78
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/103818.c
@@ -0,0 +1,12 @@
+/* { dg-do compile { target lp64 } } */
+struct A { int b[1]; };
+
+void
+foo (struct A *d)
+{
+  d->b[0] = d->b[-144115188075855873LL] + d->b[11] * d->b[2]
+          + d->b[0] % d->b[1025] + d->b[5];
+  d->b[0] = d->b[144678138029277184LL] + d->b[0] & d->b[-3] * d->b[053]
+          + d->b[7] ^ d->b[-9] + d->b[14] + d->b[9] % d->b[49]
+          + d->b[024] + d->b[82] & d->b[4096];
+}
-- 
2.7.4