This adds guards to genmatch generated code before accessing call
expression or stmt arguments that might be out of bounds when
the user provided bogus prototypes for what we consider builtins.

2020-02-05  Richard Biener  <rguenther@suse.de>

	PR middle-end/90648
	* genmatch.c (dt_node::gen_kids_1): Emit number of argument
	checks before matching calls.

	* gcc.dg/pr90648.c: New testcase.

Makes some parameters const in libiberty's hashtab library.

include/ChangeLog:

        * hashtab.h (htab_remove_elt): Make a parameter const.
        (htab_remove_elt_with_hash): Likewise.

libiberty/ChangeLog:

        * hashtab.c (htab_remove_elt): Make a parameter const.
        (htab_remove_elt_with_hash): Likewise.

gcc/cp
    * coroutines.cc (maybe_promote_captured_temps): Increase the index
    number for temporary variables' name.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	* tree-ssa-alias.c (aliasing_matching_component_refs_p): Fix up
	function comment typo.

The testcases ICE because when processing the declare simd inbranch,
we don't create the i == 0 clone as it already exists, which means
clone_info->nargs is not adjusted, but we then rely on it being adjusted
when trying other clones.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	PR middle-end/93555
	* omp-simd-clone.c (expand_simd_clones): If simd_clone_mangle or
	simd_clone_create failed when i == 0, adjust clone->nargs by
	clone->inbranch.

	* c-c++-common/gomp/pr93555-1.c: New test.
	* c-c++-common/gomp/pr93555-2.c: New test.
	* gfortran.dg/gomp/pr93555.f90: New test.

	PR lto/93489
	* lto-dump.c (dump_list_functions): Do not
	load body for aliases.
	(dump_body): Likewise here.

	PR c++/92717
	* doc/invoke.texi: Document that one should
	not combine ASLR and -fpch.

These changes are needed for some of the tests in the constrained algorithm
patch, because they use move_iterator with an uncopyable output_iterator.  The
other changes described in the paper are already applied, it seems.

libstdc++-v3/ChangeLog:

	* include/bits/stl_iterator.h (move_iterator::move_iterator): Move __i
	when initializing _M_current.
	(move_iterator::base): Split into two overloads differing in
	ref-qualifiers as in P1207R4 for C++20.

gcc/cp
    * coroutines.cc (build_co_await): Call convert_from_reference
    to wrap co_await_expr with indirect_ref which avoid
    reference/non-reference type confusion.

    (co_await_expander):  Sink to call_expr if await_resume
    is wrapped by indirect_ref.

gcc/testsuite
    * g++.dg/coroutines/co-await-14-return-ref-to-auto.C: New test.

Here, push_tinst_level refused to push into the scope of Foo::Foo
because it was triggered from the ill-formed function fun.  But we didn't
check the return value and tried to pop the un-pushed level.

	PR c++/93551
	* constraint.cc (satisfy_declaration_constraints): Check return
	value of push_tinst_level.

Value-initialization is importantly different from {}-initialization for
this testcase, where the former calls the deleted S constructor and the
latter initializes S happily.

	PR c++/90951
	* constexpr.c (cxx_eval_array_reference): {}-initialize missing
	elements instead of value-initializing them.

Here, we were going down the wrong path in perform_member_init because of
the incorrect parens around the mem-initializer for the array.  And then
cxx_eval_vec_init_1 didn't know what to do with a CONSTRUCTOR as the
initializer.  The latter issue was a straightforward fix, but I also wanted
to fix us silently accepting the parens, which led to factoring out handling
of TREE_LIST and flexarrays.  The latter led to adjusting the expected
behavior on flexary29.C: we should complain about the initializer, but not
complain about a missing initializer.

As I commented on PR 92812, in this process I noticed that we weren't
handling C++20 parenthesized aggregate initialization as a mem-initializer.
So my TREE_LIST handling includes a commented out section that should
probably be part of a future fix for that issue; with it uncommented we
continue to crash on the testcase in C++20 mode, but should instead complain
about the braced-init-list not being a valid initializer for an A.

	PR c++/86917
	* init.c (perform_member_init): Simplify.
	* constexpr.c (cx_check_missing_mem_inits): Allow uninitialized
	flexarray.
	(cxx_eval_vec_init_1): Handle CONSTRUCTOR.

Fix some failures on xstormy16-elf:
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 595)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 642)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 690)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 738)

due to:

warning: overflow in conversion from ‘long int’ to ‘int’ changes
  value from ‘100024’ to ‘-31048’ [-Woverflow]
    20 |   p[0].x = 100024;
       |            ^~~~~~

gcc/testsuite/ChangeLog:
	* gcc.dg/analyzer/data-model-1.c (struct coord): Convert fields
	from int to long.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243681 reports a build
failure with clang 9.0.1:

gcc/analyzer/engine.cc:2971:13: error:
      reinterpret_cast from 'nullptr_t' to 'function *' is not allowed
  v.m_fun = reinterpret_cast<function *> (NULL);
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
engine.cc:2983:21: error:
      reinterpret_cast from 'nullptr_t' to 'function *' is not allowed
  return v.m_fun == reinterpret_cast<function *> (NULL);
                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The casts appears to be unnecessary; eliminate them.

gcc/analyzer/ChangeLog:
	PR analyzer/93543
	* engine.cc (pod_hash_traits<function_call_string>::mark_empty):
	Eliminate reinterpret_cast.
	(pod_hash_traits<function_call_string>::is_empty): Likewise.

This adds back a folding that worked in GCC 4.5 times by amending
the pattern that handles other cases of address vs. SSA name
comparisons.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/93538
	* match.pd (addr EQ/NE ptr): Amend to handle &ptr->x EQ/NE ptr.

	* gcc.dg/tree-ssa/forwprop-38.c: New testcase.

The macro that is defined is _GLIBCXX_NOT_FN_CALL_OP but the macro that
was named in the #undef directive was _GLIBCXX_NOT_FN_CALL. This fixes
the #undef.

	* include/std/functional (_GLIBCXX_NOT_FN_CALL_OP): Un-define after
	use.

The requirements for this function are only that the deleter is
swappable, but we incorrectly require that the element type is complete
and that the deleter can be swapped using std::swap (which requires it
to be move cosntructible and move assignable).

The fix is to add __uniq_ptr_impl::swap which swaps the pointer and
deleter individually, instead of using the generic std::swap on the
tuple containing them.

	PR libstdc++/93562
	* include/bits/unique_ptr.h (__uniq_ptr_impl::swap): Define.
	(unique_ptr::swap, unique_ptr<T[], D>::swap): Call it.
	* testsuite/20_util/unique_ptr/modifiers/93562.cc: New test.

Add forgotten gcc/testsuite/c-c++-common/gomp/has-include-1.c.

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	* macro.c (builtin_has_include): Diagnose __has_include* use outside
	of preprocessing directives.

	* c-c++-common/cpp/has-include-1.c: New test.
	* c-c++-common/cpp/has-include-next-1.c: New test.
	* c-c++-common/gomp/has-include-1.c: New test.

The standard says http://eel.is/c++draft/cpp.cond#7.sentence-2 that
__has_include can't appear at arbitrary places in the source.  As we have
not recognized __has_include* outside of preprocessing directives in the
past, accepting it there now would be a regression.  The patch does still
allow it in #define if it is then used in preprocessing directives, I guess
that use isn't strictly valid either, but clang seems to accept it.

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	* macro.c (builtin_has_include): Diagnose __has_include* use outside
	of preprocessing directives.

	* c-c++-common/cpp/has-include-1.c: New test.
	* c-c++-common/cpp/has-include-next-1.c: New test.
	* c-c++-common/gomp/has-include-1.c: New test.

Some of the following testcases ICE, because one of the cpp_get_token
calls in builtin_has_include reads the CPP_EOF token but the caller isn't
aware that CPP_EOF has been reached and will do another cpp_get_token.
get_token_no_padding is something that is use by the
has_attribute/has_builtin callbacks, which will first peek and will not
consume CPP_EOF (but will consume other tokens).  The !SEEN_EOL ()
check on the other side doesn't work anymore and isn't really needed,
as we don't consume the EOF.  The change adds one further error to the
pr88974.c testcase, if we wanted just one error per __has_include,
we could add some boolean whether we've emitted errors already and
only emit the first one we encounter (not implemented).

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	PR preprocessor/93545
	* macro.c (cpp_get_token_no_padding): New function.
	(builtin_has_include): Use it instead of cpp_get_token.  Don't check
	SEEN_EOL.

	* c-c++-common/cpp/pr88974.c: Expect another diagnostics during error
	recovery.
	* c-c++-common/cpp/pr93545-1.c: New test.
	* c-c++-common/cpp/pr93545-2.c: New test.
	* c-c++-common/cpp/pr93545-3.c: New test.
	* c-c++-common/cpp/pr93545-4.c: New test.

If the user's coroutine return type omits the mandatory promise
type then we will currently restate that error each time we see
a coroutine keyword, which doesn't provide any new information.
This suppresses all but the first instance in each coroutine.

gcc/cp/ChangeLog:

2020-02-04  Iain Sandoe  <iain@sandoe.co.uk>

	* coroutines.cc (find_promise_type): Delete unused forward
	declaration.
	(struct coroutine_info): Add a bool for no promise type error.
	(coro_promise_type_found_p): Only emit the error for a missing
	promise once in each affected coroutine.

gcc/testsuite/ChangeLog:

2020-02-04  Iain Sandoe  <iain@sandoe.co.uk>

	* g++.dg/coroutines/coro-missing-promise.C: New test.

Redundant store removal in FRE was restricted for correctness reasons.
The following extends correctness fixes required to memcpy/aggregate
copy translation.  The main change is that we no longer insert
references rewritten to cover such aggregate copies into the hashtable
but the original one.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/91123
	* tree-ssa-sccvn.c (vn_walk_cb_data::finish): New method.
	(vn_walk_cb_data::last_vuse): New member.
	(vn_walk_cb_data::saved_operands): Likewsie.
	(vn_walk_cb_data::~vn_walk_cb_data): Release saved_operands.
	(vn_walk_cb_data::push_partial_def): Use finish.
	(vn_reference_lookup_2): Update last_vuse and use finish if
	we've saved operands.
	(vn_reference_lookup_3): Use finish and update calls to
	push_partial_defs everywhere.  When translating through
	memcpy or aggregate copies save off operands and alias-set.
	(eliminate_dom_walker::eliminate_stmt): Restore VN_WALKREWRITE
	operation for redundant store removal.

	* gcc.dg/tree-ssa/ssa-fre-85.c: New testcase.

The PR shows that code generation ends up pessimized by the new
canonicalization rules that end up nailing do-not-care elements
to specific values making it hard to generate good code later.

The temporary solution is to avoid this for the cases we also
obviously know the canonicalization will create more GIMPLE stmts than
before.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/92819
	* tree-ssa-forwprop.c (simplify_vector_constructor): Avoid
	generating more stmts than before.

	* gcc.target/i386/pr92819.c: New testcase.
	* gcc.target/i386/pr92803.c: Adjust.

	* config/arm/arm.c (arm_gen_far_branch): Move the function
	outside of selftests.

Make syscall_linux_riscv64.go, new in the 1.14beta1 release, look like
the other syscall_linux_GOARCH.go files.

Reviewed-on: https://go-review.googlesource.com/c/gofrontend/+/217577

This approach required adding a few casts to ztest.c, as it is now
compiled with -Wall.

Fixes PR libbacktrace/90636

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (adjust_vec_address_pcrel): New helper
	function to adjust PC-relative vector addresses.
	(rs6000_adjust_vec_address): Call adjust_vec_address_pcrel to
	handle vectors with PC-relative addresses.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (reg_to_non_prefixed): Add forward
	reference.
	(hard_reg_and_mode_to_addr_mask): Delete.
	(rs6000_adjust_vec_address): If the original vector address
	was REG+REG or REG+OFFSET and the element is not zero, do the add
	of the elements in the original address before adding the offset
	for the vector element.  Use address_to_insn_form to validate the
	address using the register being loaded, rather than guessing
	whether the address is a DS-FORM or DQ-FORM address.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (get_vector_offset): New helper function
	to calculate the offset in memory from the start of a vector of a
	particular element.  Add code to keep the element number in
	bounds if the element number is variable.
	(rs6000_adjust_vec_address): Move calculation of offset of the
	vector element to get_vector_offset.
	(rs6000_split_vec_extract_var): Do not do the initial AND of
	element here, move the code to get_vector_offset.

[expr.const] specifically rules out mentioning a reference even if its
address is never used, because it implies indirection that is similarly
non-constant for a pointer variable.

	PR c++/66477
	* constexpr.c (cxx_eval_constant_expression) [PARM_DECL]: Don't
	defer loading the value of a reference.

Since copying a class object is defined in terms of the copy constructor,
copying an empty class is OK even if it would otherwise not be usable in a
constant expression.  Relatedly, using a parameter as an lvalue is no more
problematic than a local variable, and calling a member function uses the
object as an lvalue.

	PR c++/91953
	* constexpr.c (potential_constant_expression_1) [PARM_DECL]: Allow
	empty class type.
	[COMPONENT_REF]: A member function reference doesn't use the object
	as an rvalue.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (rs6000_adjust_vec_address): Add some
	gcc_asserts.

Since coroutine-ness is discovered lazily, we encounter the diagnostics
during each keyword parse.  We were not handling the case where a user code
failed to include fundamental information (e.g. the traits) in a graceful
manner.

Once we've emitted an error for this level of fail, then we suppress
additional copies (otherwise the same thing will be reported for every
coroutine keyword seen).

gcc/cp/ChangeLog:

2020-02-03  Iain Sandoe  <iain@sandoe.co.uk>

	* coroutines.cc (struct coroutine_info): Add a bool flag to note
	that we emitted an error for a bad function return type.
	(get_coroutine_info): Tolerate an unset info table in case of
	missing traits.
	(find_coro_traits_template_decl): In case of error or if we didn't
	find a type template, note we emitted the error and suppress
	duplicates.
	(find_coro_handle_template_decl): Likewise.
	(instantiate_coro_traits): Only check for error_mark_node in the
	return from lookup_qualified_name.
	(coro_promise_type_found_p): Reorder initialization so that we check
	for the traits and their usability before allocation of the info
	table.  Check for a suitable return type and emit a diagnostic for
	here instead of relying on the lookup machinery.  This allows the
	error to have a better location, and means we can suppress multiple
	copies.
	(coro_function_valid_p): Re-check for a valid promise (and thus the
	traits) before proceeding.  Tolerate missing info as a fatal error.

gcc/testsuite/ChangeLog:

2020-02-03  Iain Sandoe  <iain@sandoe.co.uk>

	* g++.dg/coroutines/pr93458-1-missing-traits.C: New test.
	* g++.dg/coroutines/pr93458-2-bad-traits.C: New test.
	* g++.dg/coroutines/pr93458-3-missing-handle.C: New test.
	* g++.dg/coroutines/pr93458-4-bad-coro-handle.C: New test.
	* g++.dg/coroutines/pr93458-5-bad-coro-type.C: New test.

Various places in the analyzer use fold_build2, test the result, then
discard it.  It's more efficient to use fold_binary, which avoids
building and GC-ing a redundant tree for the cases where folding fails.

gcc/analyzer/ChangeLog:
	* constraint-manager.cc (range::constrained_to_single_element):
	Replace fold_build2 with fold_binary.  Remove unnecessary newline.
	(constraint_manager::get_or_add_equiv_class): Replace fold_build2
	with fold_binary in two places, and remove out-of-date comment.
	(constraint_manager::eval_condition): Replace fold_build2 with
	fold_binary.
	* region-model.cc (constant_svalue::eval_condition): Likewise.
	(region_model::on_assignment): Likewise.

PR analyzer/93544 reports an ICE when attempting to report a double-free
within diagnostic_manager::prune_for_sm_diagnostic, in which the
variable of interest has become an INTEGER_CST.  Additionally, it picks
a nonsensical path through the function in which the pointer being
double-freed is known to be NULL, which we shouldn't complain about.

The dump shows that it picks the INTEGER_CST when updating var at a phi
node:
    considering event 4, with var: ‘iftmp.0_2’, state: ‘start’
    updating from ‘iftmp.0_2’ to ‘0B’ based on phi node
      phi: iftmp.0_2 = PHI <iftmp.0_6(3), 0B(2)>
    considering event 3, with var: ‘0B’, state: ‘start’
and that it has picked the shortest path through the exploded graph,
and on this path the pointer has been assigned NULL.

The root cause is that the state machine's on_stmt isn't called for phi
nodes (and wouldn't make much sense, as we wouldn't know which arg to
choose).  malloc state machine::on_stmt "sees" a GIMPLE_ASSIGN to NULL
and handles it by transitioning the lhs to the "null" state, but never
"sees" GIMPLE_PHI nodes.

This patch fixes the ICE by wiring up phi-handling with state machines,
so that state machines have an on_phi vfunc.  It updates the only current
user of "is_zero_assignment" (the malloc sm) to implement equivalent
logic for phi nodes.  Doing so ensures that the pointer is in a separate
sm-state for the NULL vs non-NULL cases, and so gets separate exploded
nodes, and hence the path-finding logic chooses the correct path, and
the correct non-NULL phi argument.

The patch also adds some bulletproofing to prune_for_sm_diagnostic to
avoid crashing in the event of a bad path.

gcc/analyzer/ChangeLog:
	PR analyzer/93544
	* diagnostic-manager.cc
	(diagnostic_manager::prune_for_sm_diagnostic): Bulletproof
	against bad choices due to bad paths.
	* engine.cc (impl_region_model_context::on_phi): New.
	* exploded-graph.h (impl_region_model_context::on_phi): New decl.
	* region-model.cc (region_model::on_longjmp): Likewise.
	(region_model::handle_phi): Add phi param.  Call the ctxt's on_phi
	vfunc.
	(region_model::update_for_phis): Pass phi to handle_phi.
	* region-model.h (region_model::handle_phi): Add phi param.
	(region_model_context::on_phi): New vfunc.
	(test_region_model_context::on_phi): New.
	* sm-malloc.cc (malloc_state_machine::on_phi): New.
	(malloc_state_machine::on_zero_assignment): New.
	* sm.h (state_machine::on_phi): New vfunc.

gcc/testsuite/ChangeLog:
	PR analyzer/93544
	* gcc.dg/analyzer/torture/pr93544.c: New test.

gcc/analyzer/ChangeLog:
	* engine.cc (supernode_cluster::dump_dot): Show BB index as
	well as SN index.
	* supergraph.cc (supernode::dump_dot): Likewise.

PR analyzer/93546 reports an ICE within region_model::add_region_for_type
when merging two region_models each containing a label pointer.  The
two labels are stored as pointers to symbolic_regions, but these regions
were created with NULL type, leading to an assertion failure when a
merged copy is created.

The labels themselves have void (but not NULL) type.

This patch updates make_region_for_type to use the type of the decl when
creating such regions, rather than implicitly setting the region's type
to NULL, fixing the ICE.

gcc/analyzer/ChangeLog:
	PR analyzer/93546
	* region-model.cc (region_model::on_call_pre): Update for new
	param of symbolic_region ctor.
	(region_model::deref_rvalue): Likewise.
	(region_model::add_new_malloc_region): Likewise.
	(make_region_for_type): Likewise, preserving type.
	* region-model.h (symbolic_region::symbolic_region): Add "type"
	param and pass it to base class ctor.

gcc/testsuite/ChangeLog:
	PR analyzer/93546
	* gcc.dg/analyzer/pr93546.c: New test.

gcc/analyzer/ChangeLog:
	PR analyzer/93547
	* constraint-manager.cc
	(constraint_manager::get_or_add_equiv_class): Ensure types are
	compatible before comparing constants.

gcc/testsuite/ChangeLog:
	PR analyzer/93547
	* gcc.dg/analyzer/pr93547.c: New test.