gcc/analyzer/ChangeLog:
	PR analyzer/93669
	* engine.cc (exploded_graph::dump_exploded_nodes): Handle missing
	case of STATUS_WORKLIST in implementation of
	"__analyzer_dump_exploded_nodes".

gcc/testsuite/ChangeLog:
	PR analyzer/93669
	* gcc.dg/analyzer/pr93669.c: New test.

gcc/analyzer/ChangeLog:
	PR analyzer/93649
	* constraint-manager.cc (constraint_manager::add_constraint): When
	merging equivalence classes and updating m_constant, also update
	m_cst_sid.
	(constraint_manager::validate): If m_constant is non-NULL assert
	that m_cst_sid is non-null and is valid.

gcc/testsuite/ChangeLog:
	PR analyzer/93649
	* gcc.dg/analyzer/torture/pr93649.c: New test.

gcc/analyzer/ChangeLog:
	PR analyzer/93657
	* analyzer.opt (fdump-analyzer): Reword description.
	(fdump-analyzer-stderr): Likewise.

The dumps from the analyzer sometimes contain garbled output.

The root cause is due to nesting of calls to pp_printf: I'm using
pp_printf with %qT to print types with a PP using default_tree_printer.

default_tree_printer handles 'T' (and various other codes) via
  dump_generic_node (pp, t, 0, TDF_SLIM, 0);
and dump_generic_node can call pp_printf in various ways, leading
to a pp_printf within a pp_printf, and garbled output.

I don't think it's feasible to fix pp_printf to be reentrant, in
stage 4, at least, so for the moment this patch works around it
in the analyzer.

gcc/analyzer/ChangeLog:
	* region-model.cc (print_quoted_type): New function.
	(svalue::print): Use it to replace %qT.
	(region::dump_to_pp): Likewise.
	(region::dump_child_label): Likewise.
	(region::print_fields): Likewise.

* ira-conflicts.c (print_hard_reg_set): Correct output for sets
including FIRST_PSEUDO_REGISTER - 1.
* ira-color.c (print_hard_reg_set): Ditto.

Before, for a target with FIRST_PSEUDO_REGISTER 20, you'd get "19-18"
for (1<<19).  For (1<<18)|(1<<19), you'd get "18".

I was using ira-conflicts.c:print_hard_reg_set with a local
patch to gdbinit.in in a debug-session, and noticed the
erroneous output.  I see there's an almost identical function in
ira-color.c and on top of that, there's another function by the
same name and with similar semantics in sel-sched-dump.c, but
the last one doesn't try to print ranges.

[testsuite]

	* gcc.target/powerpc/pr70010-2.c: Add -maltivec.
	* gcc.target/powerpc/pr70010-3.c: Add -maltivec.

[GCC][PATCH][ARM]Add ACLE intrinsics for dot product (vusdot - vector, v<us/su>dot - by element) for AArch32 AdvSIMD ARMv8.6 Extension

This patch adds the ARMv8.6 Extension ACLE intrinsics for dot product
operations (vector/by element) to the ARM back-end.

These are:
usdot (vector), <us/su>dot (by element).

The functions are optional from ARMv8.2-a as -march=armv8.2-a+i8mm and
for ARM they remain optional after as of ARMv8.6-a.

The functions are declared in arm_neon.h, RTL patterns are defined to
generate assembler and tests are added to verify and perform adequate checks.

Regression testing on arm-none-eabi passed successfully.

gcc/ChangeLog:

2020-02-11  Stam Markianos-Wright  <stam.markianos-wright@arm.com>

	* config/arm/arm-builtins.c (enum arm_type_qualifiers):
	(USTERNOP_QUALIFIERS): New define.
	(USMAC_LANE_QUADTUP_QUALIFIERS): New define.
	(SUMAC_LANE_QUADTUP_QUALIFIERS): New define.
	(arm_expand_builtin_args): Add case ARG_BUILTIN_LANE_QUADTUP_INDEX.
	(arm_expand_builtin_1): Add qualifier_lane_quadtup_index.
	* config/arm/arm_neon.h (vusdot_s32): New.
	(vusdot_lane_s32): New.
	(vusdotq_lane_s32): New.
	(vsudot_lane_s32): New.
	(vsudotq_lane_s32): New.
	* config/arm/arm_neon_builtins.def (usdot, usdot_lane,sudot_lane): New.
	* config/arm/iterators.md (DOTPROD_I8MM): New.
	(sup, opsuffix): Add <us/su>.
	* config/arm/neon.md (neon_usdot, <us/su>dot_lane: New.
	* config/arm/unspecs.md (UNSPEC_DOT_US, UNSPEC_DOT_SU): New.

gcc/testsuite/ChangeLog:

2020-02-11  Stam Markianos-Wright  <stam.markianos-wright@arm.com>

	* gcc.target/arm/simd/vdot-2-1.c: New test.
	* gcc.target/arm/simd/vdot-2-2.c: New test.
	* gcc.target/arm/simd/vdot-2-3.c: New test.
	* gcc.target/arm/simd/vdot-2-4.c: New test.

2020-02-11  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/93661
	PR tree-optimization/93662
	* tree-ssa-sccvn.c (vn_reference_lookup_3): Properly guard
	tree_to_poly_int64.
	* tree-sra.c (get_access_for_expr): Likewise.

	* gcc.dg/pr93661.c: New testcase.

2020-02-11  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/93661
	PR tree-optimization/93662
	* tree-ssa-sccvn.c (vn_reference_lookup_3): Properly guard
	tree_to_poly_int64.
	* tree-sra.c (get_access_for_expr): Likewise.

	* gcc.dg/pr93661.c: New testcase.

Constant evaluation of genericize_spaceship produced a CONSTRUCTOR, which we
then wanted to bind to a reference, which we can't do.  So wrap the result
in a TARGET_EXPR so we get something with an address.

We also need to handle treating the result of cxx_eval_binary_expression as
a glvalue for SPACESHIP_EXPR.

My earlier change to add uid_sensitive to maybe_constant_value was wrong; we
don't even look at the cache when manifestly_const_eval, and I failed to
adjust the later call to cxx_eval_outermost_constant_expr.

gcc/cp/ChangeLog
2020-02-11  Jason Merrill  <jason@redhat.com>

	PR c++/93650
	PR c++/90691
	* constexpr.c (maybe_constant_value): Correct earlier change.
	(cxx_eval_binary_expression) [SPACESHIP_EXPR]: Pass lval through.
	* method.c (genericize_spaceship): Wrap result in TARGET_EXPR.

This patch fixes two issues with return type deduction in the presence of an
abbreviated function template.

The first issue (PR 69448) is that if a placeholder auto return type contains
any modifiers such as & or *, then the abbreviated function template
compensation in splice_late_return_type does not get performed for the
underlying auto node, leading to incorrect return type deduction.  This happens
because splice_late_return_type does not consider that a placeholder auto return
type might have modifiers.  To fix this it seems we need to look through
modifiers in the return type to obtain the location of the underlying auto node
in order to replace it with the adjusted auto node.  To that end this patch
refactors the utility function find_type_usage to return a pointer to the
matched tree, and uses it to find and replace the underlying auto node.

The second issue (PR 80471) is that the AUTO_IS_DECLTYPE flag is not being
preserved in splice_late_return_type when compensating for an abbreviated
function template, leading to us treating a decltype(auto) return type as if it
was an auto return type.  Fixed by making make_auto_1 set the AUTO_IS_DECLTYPE
flag whenever we're building a decltype(auto) node and adjusting callers
appropriately.  The test for PR 80471 is adjusted to expect the correct
behavior.

gcc/cp/ChangeLog:

	PR c++/69448
	PR c++/80471
	* type-utils.h (find_type_usage): Refactor to take a tree * and to
	return a tree *, and update documentation accordingly.
	* pt.c (make_auto_1): Set AUTO_IS_DECLTYPE when building a
	decltype(auto) node.
	(make_constrained_decltype_auto): No need to explicitly set
	AUTO_IS_DECLTYPE anymore.
	(splice_late_return_type): Use find_type_usage to find and
	replace a possibly nested auto node instead of using is_auto.
	Check test for is_auto into an assert when deciding whether
	to late_return_type.
	(type_uses_auto): Adjust the call to find_type_usage.
	* parser.c (cp_parser_decltype): No need to explicitly set
	AUTO_IS_DECLTYPE anymore.

libcc1/ChangeLog:

	PR c++/69448
	PR c++/80471
	* libcp1plugin.cc (plugin_get_expr_type): No need to explicitly set
	AUTO_IS_DECLTYPE anymore.

gcc/testsuite/ChangeLog:

	PR c++/69448
	PR c++/80471
	* g++.dg/concepts/abbrev3.C: New test.
	* g++.dg/cpp2a/concepts-pr80471.C: Adjust a static_assert to expect the
	correct behavior.
	* g++.dg/cpp0x/auto9.C: Adjust a dg-error directive.

This patch improves the pretty printing of standard concept definitions in error
messages.  In particular, standard concepts are now printed qualified whenever
appropriate, and the "concept" specifier is printed only when the
TFF_DECL_SPECIFIERS flag is specified.

In the below test, the first error message changes from
  9:15: error: ‘b’ was not declared in this scope; did you mean ‘concept b’?
to
  9:15: error: ‘b’ was not declared in this scope; did you mean ‘a::b’?

gcc/cp/ChangeLog:

	* error.c (dump_decl) [CONCEPT_DECL]: Use dump_simple_decl.
	(dump_simple_decl): Handle standard concept definitions as well as
	variable concept definitions.

gcc/testsuite/ChangeLog:

	* g++.dg/cpp2a/concepts6.C: New test.

gcc/analyzer/ChangeLog:
	PR analyzer/93659
	* analyzer.opt (-param=analyzer-max-recursion-depth=): Fix "tha"
	-> "that" typo.
	(Wanalyzer-use-of-uninitialized-value): Fix "initialized" ->
	"uninitialized" typo.

gcc/analyzer/ChangeLog:
	PR analyzer/93350
	* region-model.cc (region_model::get_lvalue_1):
	Handle BIT_FIELD_REF.
	(make_region_for_type): Handle VECTOR_TYPE.

gcc/testsuite/ChangeLog:
	PR analyzer/93350
	* gcc.dg/analyzer/torture/pr93350.c: New test.

gcc/analyzer/ChangeLog:
	PR analyzer/93647
	* diagnostic-manager.cc
	(diagnostic_manager::prune_for_sm_diagnostic): Bulletproof against
	VAR being constant.
	* region-model.cc (region_model::get_lvalue_1): Provide a better
	error message when encountering an unhandled tree code.

gcc/testsuite/ChangeLog:
	PR analyzer/93647
	* gcc.dg/analyzer/torture/pr93647.c: New test.

As mentioned in the PR, for -mavx -mno-avx2 the backend does support
vcondv4div4df and vcondv8siv8sf optabs (while generally 32-byte vectors
aren't much supported in that case, it is performed using
vandps/vandnps/vorps).  The problem is that after the last generic vector
lowering (where the VEC_COND_EXPR still compares two V4DF vectors and
has two V4DI last operands and V4DI result and so is considered ok) fre4
folds the condition into constant, at which point the middle-end during
expansion will try vcond_mask_optab and fall back to trying to expand it
as the constant vector < 0 vcondv4div4di, but neither of them is supported
for -mavx -mno-avx2 and thus we ICE.

So, the options I see is either what the following patch does, also support
vcond_mask_v4div4di and vcond_mask_v4siv4si already for TARGET_AVX, or
require for vcondv4div4df and vcondv8siv8sf TARGET_AVX2 rather than current
TARGET_AVX.

2020-02-10  Jakub Jelinek  <jakub@redhat.com>

	PR target/93637
	* config/i386/sse.md (VI_256_AVX2): New mode iterator.
	(vcond_mask_<mode><sseintvecmodelower>): Use it instead of VI_256.
	Change condition from TARGET_AVX2 to TARGET_AVX.

	* gcc.target/i386/avx-pr93637.c: New test.

PR analyzer/93405 reports an ICE with -fanalyzer when passing
a constant "by reference" in gfortran.

The issue is that the constant is passed as an ADDR_EXPR
of a CONST_DECL, and region_model::get_lvalue_1 doesn't
know how to handle CONST_DECL.

This patch implements it for CONST_DECL by providing
a placeholder region, holding the CONST_DECL's value,
fixing the ICE.

gcc/analyzer/ChangeLog:
	PR analyzer/93405
	* region-model.cc (region_model::get_lvalue_1): Implement
	CONST_DECL.

gcc/testsuite/ChangeLog:
	PR analyzer/93405
	* gfortran.dg/analyzer/pr93405.f90: New test.

This patch adds a gfortran.dg/analyzer subdirectory with an analyzer.exp,
setting DEFAULT_FFLAGS on the tests run within it.

It also adds a couple of simple proof-of-concept tests of e.g. detecting
double-frees from gfortran.

gcc/testsuite/ChangeLog:
	* gfortran.dg/analyzer/analyzer.exp: New subdirectory and .exp
	suite.
	* gfortran.dg/analyzer/malloc-example.f90: New test.
	* gfortran.dg/analyzer/malloc.f90: New test.

	* config/frv/frvbegin.c: Use right flags for .ctors and .dtors
	sections.
	* config/frv/frvend.c: Similarly.

The length used for the comparison for 'CFStringRef' was only comparing
for 'CFString', potentially allowing mismatched identifiers.

2020-02-10  Iain Sandoe  <iain@sandoe.co.uk>

	PR other/93641
	* config/darwin-c.c (darwin_cfstring_ref_p): Fix up last
	argument of strncmp.

        PR fortran/83113
        * array.c: Do not attempt to set the array spec for a submodule
        function symbol (as it has already been set in the corresponding
        module procedure interface).
        * symbol.c: Do not reject duplicate POINTER, ALLOCATABLE, or
        DIMENSION attributes in declarations of a submodule function.
        * gfortran.h: Add a macro that tests for a module procedure in a
        submodule.
        * gfortran.dg/pr83113.f90: New test.

PR c/93640 - The write_only and read_write attributes can be mistyped due to invalid strncmp size argument

gcc/c-family/ChangeLog:

	PR c/93640
	* c-attribs.c (handle_access_attribute): Correct off-by-one mistakes.

gcc/testsuite/ChangeLog:

	PR c/93640
	* gcc.dg/attr-access.c: New test.

Random spotting.  Exposes the missed benefit for delay-slot
filling of a splitter for indexed addressing mode (the [rN+M]
one).  To be considered for common instructions and perhaps only
for suitable M; at least +-63 is obvious (when there's a register
available) as both the original and the add fit in delay-slots.

PR target/93372
* gcc.target/cris/pr93372-3.c, gcc.target/cris/pr93372-4.c,
gcc.target/cris/pr93372-6.c, gcc.target/cris/pr93372-7.c,
gcc.target/cris/pr93372-9.c, gcc.target/cris/pr93372-10.c,
gcc.target/cris/pr93372-11.c, gcc.target/cris/pr93372-12.c,
gcc.target/cris/pr93372-13.c, gcc.target/cris/pr93372-14.c,
gcc.target/cris/pr93372-15.c, gcc.target/cris/pr93372-16.c,
gcc.target/cris/pr93372-17.c, gcc.target/cris/pr93372-18.c,
gcc.target/cris/pr93372-19.c, gcc.target/cris/pr93372-20.c,
gcc.target/cris/pr93372-21.c, gcc.target/cris/pr93372-22.c,
gcc.target/cris/pr93372-23.c, gcc.target/cris/pr93372-24.c,
gcc.target/cris/pr93372-25.c, gcc.target/cris/pr93372-26.c,
gcc.target/cris/pr93372-27.c, gcc.target/cris/pr93372-28.c,
gcc.target/cris/pr93372-29.c, gcc.target/cris/pr93372-30.c,
gcc.target/cris/pr93372-31.c, gcc.target/cris/pr93372-32.c,
gcc.target/cris/pr93372-33.c, gcc.target/cris/pr93372-34.c,
gcc.target/cris/pr93372-35.c: New tests.

Check that somewhat-trivially eliminable compare-instructions
are eliminated, for all instructions.  Note that pr93372-23.c
and pr93372-24.c are xfailed with cc0.

* gcc.target/cris/pr93372-2.c, gcc.target/cris/pr93372-5.c,
gcc.target/cris/pr93372-8.c: New tests.

These tests fails miserably both at being an example of cc0
eliminating compare instructions, and post-cc0-CRIS at showing a
significant improvement.  They're here to track suboptimal
comparison code for CRIS.

This test was separated from the posted and approved patch named
"dbr: Filter-out TARGET_FLAGS_REGNUM from end_of_function_needs"
and applied: it doesn't fail yet.  It differs from the posted
version in that function "g" is commented-out; see the added
comment.

To simplify separating the cc0-specific xfails, let's have an
effective-target.

This likely fits all targets.

* config/cris/cris.c (cris_reduce_compare): New function.
* config/cris/cris-protos.h  (cris_reduce_compare): Add prototype.
* config/cris/cris.md ("cbranch<mode>4", "cbranchdi4", "cstoredi4")
(cstore<mode>4"): Apply cris_reduce_compare in expanders.

The decc0ration work of the CRIS port made me look closer at the
code for trivial comparisons, as in the condition for branches
and conditional-stores, like in:

void g(short int a, short int b)
{
  short int c = a + b;

  if (c >= 0)
    foo ();
}

At -O2, the cc0 version of the CRIS port has an explicit
*uneliminated* compare instruction ("cmp.w -1,$r10") instead of
an (eliminated) compare against 0 (which below I'll call a
zero-compare).  This for the CRIS-cc0 version, but I see this
also for a much older gcc, at 4.7.  For the decc0rated port, the
compare *is* a test against 0, eventually eliminated.  To wit,
for cc0 (mind the delay-slot):

_g:
	subq 4,$sp
	add.w $r11,$r10
	cmp.w -1,$r10
	ble .L9
	move $srp,[$sp]

	jsr _foo
.L9:
	jump [$sp+]

The compare instruction is expected to be eliminated, i.e.  the
following diff to the above is desired, modulo the missing
sibling call, which corresponds to what I get from 4.7 and for
the decc0rated port:

!--- a	Wed Feb  5 15:22:27 2020
!+++ b	Wed Feb  5 15:22:51 2020
!@@ -1,8 +1,7 @@
! _g:
!	 subq 4,$sp
!	 add.w $r11,$r10
!-	cmp.w -1,$r10
!-	ble .L9
!+	bmi .L9
!	 move $srp,[$sp]
!
!	 jsr _foo

Tracking this difference, I see that for both cc0-CRIS and the
decc0rated CRIS, the comparison actually starts out as a compare
against -1 at "expand" time, but is transformed for decc0rated
CRIS to a zero-compare in "cse1".

For CRIS-cc0 "cse1" does try to replace the compare with a
zero-compare, but fails because at the same time it tries to
replace the c operand with (a + b).  Or some such; it fails and
no other pass succeeds.  I was not into fixing cc0-handling in
core gcc, so I didn't look closer.

BTW, at first, I was a bit surprised to see that for compares
against a constant, a zero-compare is not canonical RTX for
*all* conditions, and that instead only a subset of all RTX
conditions against a constant are canonical, transforming one
condition to the canonical one by adding 1 or -1 to the
constant.  It does makes sense at a closer look, but still not
so much when emitting RTL.

There are several places that mention in comments that emitting
RTX as zero-compare is preferable, but nothing is done about it.
Some generic code instead seems confused that the *target* is
helped by seeing canonical RTX, or perhaps it (its authors) like
me, confused about what a canonical comparison is.  For example,
prepare_cmp_insn calls canonicalize_comparison last before
emitting the actual instructions.  I see most ports for various
port-specific reasons does their own massaging in their cbranch
and cstore expanders.  Still, the suboptimal compares *should*
be fixed at expand time; better start out right than just
relying on later optimizations.

This kind of change is not acceptable in the current gcc
development stage, at least as a change in generic code.
However, it's problematic enough that I chose to fix this right
now in the CRIS port.  For that, I claim a possibly
long-standing regression.  After this, code before and after
decc0ration is similar enough that I can spot
compare-elimination-efforts and apply regression test-cases
without them drowning in cc0-specific xfailing.

I hope to eventually lift out cris_reduce_compare (renamed) into
say expmed.c, called in e.g. emit_store_flag_1 (replacing the
in-line code) and prepare_cmp_insn.  Later.

2020-02-10  Jakub Jelinek  <jakub@redhat.com>

	PR target/91913
	* gfortran.dg/pr91913.f90: New test.

Linux CET kernel places a restore token on shadow stack for signal
handler to enhance security.  The restore token is 8 byte and aligned
to 8 bytes.  It is usually transparent to user programs since kernel
will pop the restore token when signal handler returns.  But when an
exception is thrown from a signal handler, now we need to pop the
restore token from shadow stack.  For x86-64, we just need to treat
the signal frame as normal frame.  For i386, we need to search for
the restore token to check if the original shadow stack is 8 byte
aligned.  If the original shadow stack is 8 byte aligned, we just
need to pop 2 slots, one restore token, from shadow stack.  Otherwise,
we need to pop 3 slots, one restore token + 4 byte padding, from
shadow stack.

This patch also includes 2 tests, one has a restore token with 4 byte
padding and one without.

Tested on Linux/x86-64 CET machine with and without -m32.

libgcc/

	PR libgcc/85334
	* config/i386/shadow-stack-unwind.h (_Unwind_Frames_Increment):
	New.

gcc/testsuite/

	PR libgcc/85334
	* g++.target/i386/pr85334-1.C: New test.
	* g++.target/i386/pr85334-2.C: Likewise.

The peephole that detects a mov of one register to another followed by
a comparison of the original register against zero is only used in Arm
state; but the instruction that matches this is generic to all 32-bit
compilation states.  That instruction lacks support for SP which is
permitted in Arm state, but has restrictions in Thumb2 code.

This patch fixes the problem by allowing SP when in ARM state for all
registers; in Thumb state it allows SP only as a source when the
register really is copied to another target.

	* config/arm/arm.md (movsi_compare0): Allow SP as a source register
	in Thumb state and also as a destination in Arm state.  Add T16
	variants.

The last argument to strncasecmp is incorrect, so it matched even when
can%' wasn't followed by t.  Also, the !ISALPHA (format_chars[1]) test
looks pointless, format_chars[1] must be ' if strncasecmp succeeded and
so will never be ISALPHA.

2020-02-10  Jakub Jelinek  <jakub@redhat.com>

	PR other/93641
	* c-format.c (check_plain): Fix up last argument of strncasecmp.
	Remove useless extra test.

	* gcc.dg/format/gcc_diag-11.c (test_cdiag_bad_words): Add two further
	tests.

Commit r10-6500-g811a475e broke the
GCC build for arm-none-uclinuxfdpiceabi, as it forgot to update some
uses of gnu_Unwind_Find_got.

2020-02-10  Christophe Lyon  <christophe.lyon@linaro.org>

	libgcc/
	PR target/93615
	* unwind-arm-common.inc: Replace uses of gnu_Unwind_Find_got with
	_Unwind_gnu_Find_got.
	* unwind-pe.h: Likewise.

I'm not aware of symbols starting with _ZG that don't start with _ZGR
prefix, but perhaps in the future there might be some.

2020-02-10  Jakub Jelinek  <jakub@redhat.com>

	PR other/93641
	* error.c (dump_decl_name): Fix up last argument to strncmp.

Clearly I can't count, so we would consider as SECTION_BSS even sections
like .lbssfoo or .gnu.linkonce.lbbar, even when linker only considers as
special .lbss or .lbss.baz or .gnu.linkonce.lb.qux.

2020-02-10  Jakub Jelinek  <jakub@redhat.com>

	PR target/58218
	PR other/93641
	* config/i386/i386.c (x86_64_elf_section_type_flags): Fix up last
	arguments of strncmp.

We were already rejecting initialization of a flexible array member in a
constructor; we similarly shouldn't try to clean it up.

	PR c++/93618
	* tree.c (array_of_unknown_bound_p): New.
	* init.c (perform_member_init): Do nothing for flexible arrays.

Add xfails for nvptx offloading because
"no GOMP_OFFLOAD_async_run implemented in plugin-nvptx.c"
(https://gcc.gnu.org/PR81688) and because
"omp target link not implemented for nvptx"
(https://gcc.gnu.org/PR81689).

libgomp/
	* testsuite/libgomp.c/target-33.c: Add xfail for execution on
	offload_target_nvptx, cf. https://gcc.gnu.org/PR81688.
	* testsuite/libgomp.c/target-34.c: Likewise.
	* testsuite/libgomp.c/target-link-1.c: Add xfail for
	offload_target_nvptx, cf. https://gcc.gnu.org/PR81689.