re PR tree-optimization/60183 (phiprop creates invalid code)

2014-02-15  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/60183
	* tree-ssa-phiprop.c (propagate_with_phi): Avoid speculating
	loads.
	(tree_ssa_phiprop): Calculate and free post-dominators.

	* gcc.dg/torture/pr60183.c: New testcase.

From-SVN: r207797

gcc/ChangeLog

+2014-02-15  Richard Biener  <rguenther@suse.de>
+
+	PR tree-optimization/60183
+	* tree-ssa-phiprop.c (propagate_with_phi): Avoid speculating
+	loads.
+	(tree_ssa_phiprop): Calculate and free post-dominators.
+
 2014-02-14  Jeff Law  <law@redhat.com>
 
 	PR rtl-optimization/60131

gcc/testsuite/ChangeLog

+2014-02-15  Richard Biener  <rguenther@suse.de>
+
+	PR tree-optimization/60183
+	* gcc.dg/torture/pr60183.c: New testcase.
+
 2014-02-14  Jeff Law  <law@redhat.com>
 
 	PR rtl-optimization/60131

gcc/testsuite/gcc.dg/torture/pr60183.c

+/* { dg-do run } */
+
+/* Large so an out-of-bound read will crash.  */
+unsigned char c[0x30001] = { 1 };
+int j = 2;
+
+static void
+foo (unsigned long *x, unsigned char *y)
+{
+  int i;
+  unsigned long w = x[0];
+  for (i = 0; i < j; i++)
+    {
+      w += *y;
+      y += 0x10000;
+      w += *y;
+      y += 0x10000;
+    }
+  x[1] = w;
+}
+
+__attribute__ ((noinline, noclone)) void
+bar (unsigned long *x)
+{
+  foo (x, c);
+}
+
+int
+main ()
+{
+  unsigned long a[2] = { 0, -1UL };
+  asm volatile (""::"r" (c):"memory");
+  c[0] = 0;
+  bar (a);
+  if (a[1] != 0)
+    __builtin_abort ();
+  return 0;
+}

gcc/tree-ssa-phiprop.c

@@ -309,6 +309,12 @@ propagate_with_phi (basic_block bb, gimple phi, struct phiprop_d *phivn,
       gimple def_stmt;
       tree vuse;
 
+      /* Only replace loads in blocks that post-dominate the PHI node.  That
+         makes sure we don't end up speculating loads.  */
+      if (!dominated_by_p (CDI_POST_DOMINATORS,
+			   bb, gimple_bb (use_stmt)))
+	continue;
+         
       /* Check whether this is a load of *ptr.  */
       if (!(is_gimple_assign (use_stmt)
 	    && TREE_CODE (gimple_assign_lhs (use_stmt)) == SSA_NAME
@@ -380,6 +386,7 @@ tree_ssa_phiprop (void)
   size_t n;
 
   calculate_dominance_info (CDI_DOMINATORS);
+  calculate_dominance_info (CDI_POST_DOMINATORS);
 
   n = num_ssa_names;
   phivn = XCNEWVEC (struct phiprop_d, n);
@@ -397,6 +404,8 @@ tree_ssa_phiprop (void)
   bbs.release ();
   free (phivn);
 
+  free_dominance_info (CDI_POST_DOMINATORS);
+
   return 0;
 }