[PR 91832] Do not ICE on negative offsets in ipa-sra

Hi,

IPA-SRA asserts that an offset obtained from get_ref_base_and_extent
is non-negative (after it verifies it is based on a parameter).  That
assumption is invalid as the testcase shows.  One could probably also write a
testcase with defined behavior, but unless I see a reasonable one
where the transformation is really desirable, I'd like to just punt on
those cases.

Bootstrapped and tested on x86_64-linux.  OK for trunk?

Thanks,

Martin

2019-09-24  Martin Jambor  <mjambor@suse.cz>

	PR ipa/91832
	* ipa-sra.c (scan_expr_access): Check that offset is non-negative.

	testsuite/
	* gcc.dg/ipa/pr91832.c: New test.

From-SVN: r276093

gcc/ChangeLog

+2019-09-24  Martin Jambor  <mjambor@suse.cz>
+
+	PR ipa/91832
+	* ipa-sra.c (scan_expr_access): Check that offset is non-negative.
+
 2019-09-24  Richard Biener  <rguenther@suse.de>
 
 	* tree-ssa-sccvn.c (vn_reference_lookup_3): Valueize MEM_REF

gcc/ipa-sra.c

@@ -1692,7 +1692,12 @@ scan_expr_access (tree expr, gimple *stmt, isra_scan_context ctx,
       disqualify_split_candidate (desc, "Encountered a bit-field access.");
       return;
     }
-  gcc_assert (offset >= 0);
+  if (offset < 0)
+    {
+      disqualify_split_candidate (desc, "Encountered an access at a "
+				  "negative offset.");
+      return;
+    }
   gcc_assert ((offset % BITS_PER_UNIT) == 0);
   gcc_assert ((size % BITS_PER_UNIT) == 0);
   if ((offset / BITS_PER_UNIT) >= (UINT_MAX - ISRA_ARG_SIZE_LIMIT)

gcc/testsuite/ChangeLog

+2019-09-24  Martin Jambor  <mjambor@suse.cz>
+
+	PR ipa/91832
+	* gcc.dg/ipa/pr91832.c: New test.
+
 2019-09-24  Richard Biener  <rguenther@suse.de>
 
 	* gcc.dg/torture/20190924-1.c: New testcase.

gcc/testsuite/gcc.dg/ipa/pr91832.c

+/* { dg-do compile } */
+/* { dg-options "-O2"  } */
+
+struct A1 {
+  char a1[1];
+};
+
+void fn2(char a);
+
+void fn1(struct A1 *p1) {
+  fn2(p1->a1[-1]);
+}