re PR middle-end/44069 (optimization bug initializing from cast array)

2010-05-25  Richard Guenther  <rguenther@suse.de>

	PR middle-end/44069
	* gimple-fold.c (maybe_fold_stmt_addition): Avoid generating
	out-of-bounds array accesses.

	* g++.dg/torture/pr44069.C: New testcase.

From-SVN: r159824

gcc/ChangeLog

 2010-05-25  Richard Guenther  <rguenther@suse.de>
 
+	PR middle-end/44069
+	* gimple-fold.c (maybe_fold_stmt_addition): Avoid generating
+	out-of-bounds array accesses.
+
+2010-05-25  Richard Guenther  <rguenther@suse.de>
+
 	* lto-wrapper.c (nr, input_names, output_names, makefile): Globalize.
 	(lto_wrapper_exit): Unlink all LTRANS temporary files on error.
 	(run_gcc): Re-organize to make cleanup easier.

gcc/gimple-fold.c

@@ -640,6 +640,18 @@ maybe_fold_stmt_addition (location_t loc, tree res_type, tree op0, tree op1)
 	  if (!is_gimple_assign (offset_def))
 	    return NULL_TREE;
 
+	  /* As we will end up creating a variable index array access
+	     in the outermost array dimension make sure there isn't
+	     a more inner array that the index could overflow to.  */
+	  if (TREE_CODE (TREE_OPERAND (op0, 0)) == ARRAY_REF)
+	    return NULL_TREE;
+
+	  /* Do not build array references of something that we can't
+	     see the true number of array dimensions for.  */
+	  if (!DECL_P (TREE_OPERAND (op0, 0))
+	      && !handled_component_p (TREE_OPERAND (op0, 0)))
+	    return NULL_TREE;
+
 	  if (gimple_assign_rhs_code (offset_def) == MULT_EXPR
 	      && TREE_CODE (gimple_assign_rhs2 (offset_def)) == INTEGER_CST
 	      && tree_int_cst_equal (gimple_assign_rhs2 (offset_def),

gcc/testsuite/ChangeLog

 2010-05-25  Richard Guenther  <rguenther@suse.de>
 
+	PR middle-end/44069
+	* g++.dg/torture/pr44069.C: New testcase.
+
+2010-05-25  Richard Guenther  <rguenther@suse.de>
+
 	* gcc.dg/tree-ssa/sra-10.c: Do not dump esra details.
 
 2010-05-25  Iain Sandoe  <iains@gcc.gnu.org>

gcc/testsuite/g++.dg/torture/pr44069.C

+/* { dg-do run } */
+
+template <unsigned R, unsigned C>
+class M {
+public:
+    M(const int* arr) {
+	for (unsigned long r = 0; r < R; ++r)
+	  for (unsigned long c = 0; c < C; ++c)
+	    m[r*C+c] = arr[r*C+c];
+    }
+    int operator()(unsigned r, unsigned c) const
+      { return m[r*C+c]; }
+private:
+    int m[R*C];
+};
+extern "C" void abort (void);
+int main()
+{
+  int vals[2][2] = { { 1, 2 }, { 5, 6 } };
+  M<2,2> m( &(vals[0][0]) );
+  if (m(1,0) != 5)
+    abort ();
+  return 0;
+}
+