From 7716ee1e90412f785cba20acffd59fc7461302cb Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Wed, 30 Nov 2022 11:44:27 +0100
Subject: [PATCH] tree-chrec: Fix up ICE on pointer multiplication [PR107835]
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

r13-254-gdd3c7873a61019e9 added an optimization for {a, +, a} (x-1),
but as can be seen on the following testcase, the way it is written
where chrec_fold_multiply is called with type doesn't work for pointers:
             res = build_int_cst (TREE_TYPE (x), 1);
             res = chrec_fold_plus (TREE_TYPE (x), x, res);
             res = chrec_convert_rhs (type, res, NULL);
             res = chrec_fold_multiply (type, chrecr, res);
while what we were doing before and what is still used if the condition
doesn't match is fine:
             res = chrec_convert_rhs (TREE_TYPE (chrecr), x, NULL);
             res = chrec_fold_multiply (TREE_TYPE (chrecr), chrecr, res);
             res = chrec_fold_plus (type, CHREC_LEFT (chrec), res);
because it performs chrec_fold_multiply on TREE_TYPE (chrecr) and converts
only afterwards.

I think the easiest fix is to ignore the new path for pointer types.

2022-11-30  Jakub Jelinek  <jakub@redhat.com>

	PR tree-optimization/107835
	* tree-chrec.cc (chrec_apply): Don't handle "{a, +, a} (x-1)"
	as "a*x" if type is a pointer type.

	* gcc.c-torture/compile/pr107835.c: New test.
---
 gcc/testsuite/gcc.c-torture/compile/pr107835.c | 11 +++++++++++
 gcc/tree-chrec.cc                              |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/gcc.c-torture/compile/pr107835.c

diff --git a/gcc/testsuite/gcc.c-torture/compile/pr107835.c b/gcc/testsuite/gcc.c-torture/compile/pr107835.c
new file mode 100644
index 0000000..122beff
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/pr107835.c
@@ -0,0 +1,11 @@
+/* PR tree-optimization/107835 */
+
+int *
+foo (void)
+{
+  int *x = 0;
+  unsigned n = n;
+  for (; n; --n, ++x)
+    ;
+  return x;
+}
diff --git a/gcc/tree-chrec.cc b/gcc/tree-chrec.cc
index 7321fb9..dcf26cb 100644
--- a/gcc/tree-chrec.cc
+++ b/gcc/tree-chrec.cc
@@ -622,7 +622,8 @@ chrec_apply (unsigned var,
 	  /* "{a, +, b} (x)"  ->  "a + b*x".  */
 	  else if (operand_equal_p (CHREC_LEFT (chrec), chrecr)
 		   && TREE_CODE (x) == PLUS_EXPR
-		   && integer_all_onesp (TREE_OPERAND (x, 1)))
+		   && integer_all_onesp (TREE_OPERAND (x, 1))
+		   && !POINTER_TYPE_P (type))
 	    {
 	      /* We know the number of iterations can't be negative.
 		 So {a, +, a} (x-1) -> "a*x".  */
-- 
2.7.4