The analyzer recognizes __analyzer_dump_exploded_nodes as a "magic"
function for use in DejaGnu tests: at the end of the pass, it issues
a warning at each such call, dumping the count of exploded nodes seen at
the call, which can be checked in test cases via dg-warning directives,
along with the IDs of the enodes (which is helpful when debugging).

My intent was to give a way of testing the results of the state-merging
code.

The state-merging code can generate duplicate exploded nodes at a point
when state merging occurs, taking a pair of enodes from the worklist
that share a program_point and sufficiently similar state.  For these
cases it generates a merged state, and adds edges from those enodes to
the merged-state enode (potentially a new or a pre-existing enode); the
input enodes don't have process_node called on them.

This means that at a CFG join point there can be an unpredictable number
of enodes that we don't care about, where the precise number depends on
the details of the state-merger code, immediately followed by a more
predictable number that we do care about.

I've been papering over this in the analyzer DejaGnu tests somewhat
by adding pairs of __analyzer_dump_exploded_nodes calls at CFG join
points, where the output at the first call is somewhat arbitrary, and
the second has the number we care about; the first number tends to
change "at random" as I tweak the state merging code, in ways that
aren't interesting, but require the tests to be updated.

See e.g. gcc.dg/analyzer/paths-6.c which had:

  __analyzer_dump_exploded_nodes (0); /* { dg-warning "2 exploded nodes" } */
  // FIXME: the above can vary between 2 and 3 exploded nodes
  __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 exploded node" } */

This patch remedies this situation by tracking which enodes are
processed, and which are merely "merger" enodes.  It updates the
output for __analyzer_dump_exploded_nodes so that count of enodes
only includes the *processed* enodes, and that the IDs are split
into "processed" and "merger" enodes.

The patch simplifies the testsuite by eliminating the redundant calls
described above; the example above becomes:

  __analyzer_dump_exploded_nodes (0); /* { dg-warning "1 processed enode" } */

where the output in question is now:

  warning: 1 processed enode: [EN: 94] merger(s): [EN: 93]

The patch also adds various checks on the status of enodes, to ensure
e.g. that each enode is processed at most once.

gcc/analyzer/ChangeLog:
	* engine.cc (exploded_node::dump_dot): Show merger enodes.
	(worklist::add_node): Assert that the node's m_status is
	STATUS_WORKLIST.
	(exploded_graph::process_worklist): Likewise for nodes from the
	worklist.  Set status of merged nodes to STATUS_MERGER.
	(exploded_graph::process_node): Set status of node to
	STATUS_PROCESSED.
	(exploded_graph::dump_exploded_nodes): Rework handling of
	"__analyzer_dump_exploded_nodes", splitting enodes by status into
	"processed" and "merger", showing the count of just the processed
	enodes at the call, rather than the count of all enodes.
	* exploded-graph.h (exploded_node::status): New enum.
	(exploded_node::exploded_node): Initialize m_status to
	STATUS_WORKLIST.
	(exploded_node::get_status): New getter.
	(exploded_node::set_status): New setter.
	(exploded_node::m_status): New field.

gcc/ChangeLog:
	* doc/analyzer.texi
	(Special Functions for Debugging the Analyzer): Update description
	of __analyzer_dump_exploded_nodes.

gcc/testsuite/ChangeLog:
	* gcc.dg/analyzer/data-model-1.c: Update for changed output to
	__analyzer_dump_exploded_nodes, dropping redundant call at merger.
	* gcc.dg/analyzer/data-model-7.c: Likewise.
	* gcc.dg/analyzer/loop-2.c: Update for changed output format.
	* gcc.dg/analyzer/loop-2a.c: Likewise.
	* gcc.dg/analyzer/loop-4.c: Likewise.
	* gcc.dg/analyzer/loop.c: Likewise.
	* gcc.dg/analyzer/malloc-paths-10.c: Likewise; drop redundant
	call at merger.
	* gcc.dg/analyzer/malloc-vs-local-1a.c: Likewise.
	* gcc.dg/analyzer/malloc-vs-local-1b.c: Likewise.
	* gcc.dg/analyzer/malloc-vs-local-2.c: Likewise.
	* gcc.dg/analyzer/malloc-vs-local-3.c: Likewise.
	* gcc.dg/analyzer/paths-1.c: Likewise.
	* gcc.dg/analyzer/paths-1a.c: Likewise.
	* gcc.dg/analyzer/paths-2.c: Likewise.
	* gcc.dg/analyzer/paths-3.c: Likewise.
	* gcc.dg/analyzer/paths-4.c: Update for changed output format.
	* gcc.dg/analyzer/paths-5.c: Likewise.
	* gcc.dg/analyzer/paths-6.c: Likewise; drop redundant calls
	at merger.
	* gcc.dg/analyzer/paths-7.c: Likewise.
	* gcc.dg/analyzer/torture/conditionals-2.c: Update for changed
	output format.
	* gcc.dg/analyzer/zlib-1.c: Likewise; drop redundant calls.
	* gcc.dg/analyzer/zlib-5.c: Update for changed output format.

As mentioned in the PR, the CLOBBERs in vzeroupper are added there even for
registers that aren't ever live in the function before and break the
prologue/epilogue expansion with ms ABI (normal ABIs are fine, as they
consider all [xyz]mm registers call clobbered, but the ms ABI considers
xmm0-15 call used but the bits above low 128 ones call clobbered).
The following patch fixes it by not adding the clobbers during vzeroupper
pass (before pro_and_epilogue), but adding them for -fipa-ra purposes only
during the final output.  Perhaps we could add some CLOBBERs early (say for
df_regs_ever_live_p regs that aren't live in the live_regs bitmap, or
depending on the ABI either add all of them immediately, or for ms ABI add
CLOBBERs for xmm0-xmm5 if they don't have a SET) and add the rest later.
And the addition could be perhaps done at other spots, e.g. in an
epilogue_completed guarded splitter.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	PR target/92190
	* config/i386/i386-features.c (ix86_add_reg_usage_to_vzeroupper): Only
	include sets and not clobbers in the vzeroupper pattern.
	* config/i386/sse.md (*avx_vzeroupper): Require in insn condition that
	the parallel has 17 (64-bit) or 9 (32-bit) elts.
	(*avx_vzeroupper_1): New define_insn_and_split.

	* gcc.target/i386/pr92190.c: New test.

The problem is that x86 is the only target that defines HAVE_ATTR_length and
doesn't schedule any splitting pass at -O0 after pro_and_epilogue.

So, either we go back to handling this during vzeroupper output
(unconditionally, rather than flag_ipa_ra guarded), or we need to tweak the
split* passes for x86.

Seems there are 5 split passes, split1 is run unconditionally before reload,
split2 is run for optimize > 0 or STACK_REGS (x86) after ra but before
epilogue_completed, split3 is run before regstack for STACK_REGS and
optimize and -fno-schedule-insns2, split4 is run before sched2 if sched2 is
run and split5 is run before shorten_branches if HAVE_ATTR_length and not
STACK_REGS.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	PR target/92190
	* recog.c (pass_split_after_reload::gate): For STACK_REGS targets,
	don't run when !optimize.
	(pass_split_before_regstack::gate): For STACK_REGS targets, run even
	when !optimize.

We're now consistently building SLP operations with only
scalar defs from scalars which makes the testcase no longer
testing multiplication vectorization.  The following smuggles
in a constant making the vector variant profitable for SLP build.

2020-02-05  Richard Biener  <rguenther@suse.de>

	PR testsuite/92177
	* gcc.dg/vect/bb-slp-22.c: Adjust.

This adds guards to genmatch generated code before accessing call
expression or stmt arguments that might be out of bounds when
the user provided bogus prototypes for what we consider builtins.

2020-02-05  Richard Biener  <rguenther@suse.de>

	PR middle-end/90648
	* genmatch.c (dt_node::gen_kids_1): Emit number of argument
	checks before matching calls.

	* gcc.dg/pr90648.c: New testcase.

Makes some parameters const in libiberty's hashtab library.

include/ChangeLog:

        * hashtab.h (htab_remove_elt): Make a parameter const.
        (htab_remove_elt_with_hash): Likewise.

libiberty/ChangeLog:

        * hashtab.c (htab_remove_elt): Make a parameter const.
        (htab_remove_elt_with_hash): Likewise.

gcc/cp
    * coroutines.cc (maybe_promote_captured_temps): Increase the index
    number for temporary variables' name.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	* tree-ssa-alias.c (aliasing_matching_component_refs_p): Fix up
	function comment typo.

The testcases ICE because when processing the declare simd inbranch,
we don't create the i == 0 clone as it already exists, which means
clone_info->nargs is not adjusted, but we then rely on it being adjusted
when trying other clones.

2020-02-05  Jakub Jelinek  <jakub@redhat.com>

	PR middle-end/93555
	* omp-simd-clone.c (expand_simd_clones): If simd_clone_mangle or
	simd_clone_create failed when i == 0, adjust clone->nargs by
	clone->inbranch.

	* c-c++-common/gomp/pr93555-1.c: New test.
	* c-c++-common/gomp/pr93555-2.c: New test.
	* gfortran.dg/gomp/pr93555.f90: New test.

	PR lto/93489
	* lto-dump.c (dump_list_functions): Do not
	load body for aliases.
	(dump_body): Likewise here.

	PR c++/92717
	* doc/invoke.texi: Document that one should
	not combine ASLR and -fpch.

These changes are needed for some of the tests in the constrained algorithm
patch, because they use move_iterator with an uncopyable output_iterator.  The
other changes described in the paper are already applied, it seems.

libstdc++-v3/ChangeLog:

	* include/bits/stl_iterator.h (move_iterator::move_iterator): Move __i
	when initializing _M_current.
	(move_iterator::base): Split into two overloads differing in
	ref-qualifiers as in P1207R4 for C++20.

gcc/cp
    * coroutines.cc (build_co_await): Call convert_from_reference
    to wrap co_await_expr with indirect_ref which avoid
    reference/non-reference type confusion.

    (co_await_expander):  Sink to call_expr if await_resume
    is wrapped by indirect_ref.

gcc/testsuite
    * g++.dg/coroutines/co-await-14-return-ref-to-auto.C: New test.

Here, push_tinst_level refused to push into the scope of Foo::Foo
because it was triggered from the ill-formed function fun.  But we didn't
check the return value and tried to pop the un-pushed level.

	PR c++/93551
	* constraint.cc (satisfy_declaration_constraints): Check return
	value of push_tinst_level.

Value-initialization is importantly different from {}-initialization for
this testcase, where the former calls the deleted S constructor and the
latter initializes S happily.

	PR c++/90951
	* constexpr.c (cxx_eval_array_reference): {}-initialize missing
	elements instead of value-initializing them.

Here, we were going down the wrong path in perform_member_init because of
the incorrect parens around the mem-initializer for the array.  And then
cxx_eval_vec_init_1 didn't know what to do with a CONSTRUCTOR as the
initializer.  The latter issue was a straightforward fix, but I also wanted
to fix us silently accepting the parens, which led to factoring out handling
of TREE_LIST and flexarrays.  The latter led to adjusting the expected
behavior on flexary29.C: we should complain about the initializer, but not
complain about a missing initializer.

As I commented on PR 92812, in this process I noticed that we weren't
handling C++20 parenthesized aggregate initialization as a mem-initializer.
So my TREE_LIST handling includes a commented out section that should
probably be part of a future fix for that issue; with it uncommented we
continue to crash on the testcase in C++20 mode, but should instead complain
about the braced-init-list not being a valid initializer for an A.

	PR c++/86917
	* init.c (perform_member_init): Simplify.
	* constexpr.c (cx_check_missing_mem_inits): Allow uninitialized
	flexarray.
	(cxx_eval_vec_init_1): Handle CONSTRUCTOR.

Fix some failures on xstormy16-elf:
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 595)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 642)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 690)
  gcc.dg/analyzer/data-model-1.c  (test for warnings, line 738)

due to:

warning: overflow in conversion from ‘long int’ to ‘int’ changes
  value from ‘100024’ to ‘-31048’ [-Woverflow]
    20 |   p[0].x = 100024;
       |            ^~~~~~

gcc/testsuite/ChangeLog:
	* gcc.dg/analyzer/data-model-1.c (struct coord): Convert fields
	from int to long.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=243681 reports a build
failure with clang 9.0.1:

gcc/analyzer/engine.cc:2971:13: error:
      reinterpret_cast from 'nullptr_t' to 'function *' is not allowed
  v.m_fun = reinterpret_cast<function *> (NULL);
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
engine.cc:2983:21: error:
      reinterpret_cast from 'nullptr_t' to 'function *' is not allowed
  return v.m_fun == reinterpret_cast<function *> (NULL);
                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The casts appears to be unnecessary; eliminate them.

gcc/analyzer/ChangeLog:
	PR analyzer/93543
	* engine.cc (pod_hash_traits<function_call_string>::mark_empty):
	Eliminate reinterpret_cast.
	(pod_hash_traits<function_call_string>::is_empty): Likewise.

This adds back a folding that worked in GCC 4.5 times by amending
the pattern that handles other cases of address vs. SSA name
comparisons.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/93538
	* match.pd (addr EQ/NE ptr): Amend to handle &ptr->x EQ/NE ptr.

	* gcc.dg/tree-ssa/forwprop-38.c: New testcase.

The macro that is defined is _GLIBCXX_NOT_FN_CALL_OP but the macro that
was named in the #undef directive was _GLIBCXX_NOT_FN_CALL. This fixes
the #undef.

	* include/std/functional (_GLIBCXX_NOT_FN_CALL_OP): Un-define after
	use.

The requirements for this function are only that the deleter is
swappable, but we incorrectly require that the element type is complete
and that the deleter can be swapped using std::swap (which requires it
to be move cosntructible and move assignable).

The fix is to add __uniq_ptr_impl::swap which swaps the pointer and
deleter individually, instead of using the generic std::swap on the
tuple containing them.

	PR libstdc++/93562
	* include/bits/unique_ptr.h (__uniq_ptr_impl::swap): Define.
	(unique_ptr::swap, unique_ptr<T[], D>::swap): Call it.
	* testsuite/20_util/unique_ptr/modifiers/93562.cc: New test.

Add forgotten gcc/testsuite/c-c++-common/gomp/has-include-1.c.

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	* macro.c (builtin_has_include): Diagnose __has_include* use outside
	of preprocessing directives.

	* c-c++-common/cpp/has-include-1.c: New test.
	* c-c++-common/cpp/has-include-next-1.c: New test.
	* c-c++-common/gomp/has-include-1.c: New test.

The standard says http://eel.is/c++draft/cpp.cond#7.sentence-2 that
__has_include can't appear at arbitrary places in the source.  As we have
not recognized __has_include* outside of preprocessing directives in the
past, accepting it there now would be a regression.  The patch does still
allow it in #define if it is then used in preprocessing directives, I guess
that use isn't strictly valid either, but clang seems to accept it.

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	* macro.c (builtin_has_include): Diagnose __has_include* use outside
	of preprocessing directives.

	* c-c++-common/cpp/has-include-1.c: New test.
	* c-c++-common/cpp/has-include-next-1.c: New test.
	* c-c++-common/gomp/has-include-1.c: New test.

Some of the following testcases ICE, because one of the cpp_get_token
calls in builtin_has_include reads the CPP_EOF token but the caller isn't
aware that CPP_EOF has been reached and will do another cpp_get_token.
get_token_no_padding is something that is use by the
has_attribute/has_builtin callbacks, which will first peek and will not
consume CPP_EOF (but will consume other tokens).  The !SEEN_EOL ()
check on the other side doesn't work anymore and isn't really needed,
as we don't consume the EOF.  The change adds one further error to the
pr88974.c testcase, if we wanted just one error per __has_include,
we could add some boolean whether we've emitted errors already and
only emit the first one we encounter (not implemented).

2020-02-04  Jakub Jelinek  <jakub@redhat.com>

	PR preprocessor/93545
	* macro.c (cpp_get_token_no_padding): New function.
	(builtin_has_include): Use it instead of cpp_get_token.  Don't check
	SEEN_EOL.

	* c-c++-common/cpp/pr88974.c: Expect another diagnostics during error
	recovery.
	* c-c++-common/cpp/pr93545-1.c: New test.
	* c-c++-common/cpp/pr93545-2.c: New test.
	* c-c++-common/cpp/pr93545-3.c: New test.
	* c-c++-common/cpp/pr93545-4.c: New test.

If the user's coroutine return type omits the mandatory promise
type then we will currently restate that error each time we see
a coroutine keyword, which doesn't provide any new information.
This suppresses all but the first instance in each coroutine.

gcc/cp/ChangeLog:

2020-02-04  Iain Sandoe  <iain@sandoe.co.uk>

	* coroutines.cc (find_promise_type): Delete unused forward
	declaration.
	(struct coroutine_info): Add a bool for no promise type error.
	(coro_promise_type_found_p): Only emit the error for a missing
	promise once in each affected coroutine.

gcc/testsuite/ChangeLog:

2020-02-04  Iain Sandoe  <iain@sandoe.co.uk>

	* g++.dg/coroutines/coro-missing-promise.C: New test.

Redundant store removal in FRE was restricted for correctness reasons.
The following extends correctness fixes required to memcpy/aggregate
copy translation.  The main change is that we no longer insert
references rewritten to cover such aggregate copies into the hashtable
but the original one.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/91123
	* tree-ssa-sccvn.c (vn_walk_cb_data::finish): New method.
	(vn_walk_cb_data::last_vuse): New member.
	(vn_walk_cb_data::saved_operands): Likewsie.
	(vn_walk_cb_data::~vn_walk_cb_data): Release saved_operands.
	(vn_walk_cb_data::push_partial_def): Use finish.
	(vn_reference_lookup_2): Update last_vuse and use finish if
	we've saved operands.
	(vn_reference_lookup_3): Use finish and update calls to
	push_partial_defs everywhere.  When translating through
	memcpy or aggregate copies save off operands and alias-set.
	(eliminate_dom_walker::eliminate_stmt): Restore VN_WALKREWRITE
	operation for redundant store removal.

	* gcc.dg/tree-ssa/ssa-fre-85.c: New testcase.

The PR shows that code generation ends up pessimized by the new
canonicalization rules that end up nailing do-not-care elements
to specific values making it hard to generate good code later.

The temporary solution is to avoid this for the cases we also
obviously know the canonicalization will create more GIMPLE stmts than
before.

2020-02-04  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/92819
	* tree-ssa-forwprop.c (simplify_vector_constructor): Avoid
	generating more stmts than before.

	* gcc.target/i386/pr92819.c: New testcase.
	* gcc.target/i386/pr92803.c: Adjust.

	* config/arm/arm.c (arm_gen_far_branch): Move the function
	outside of selftests.

Make syscall_linux_riscv64.go, new in the 1.14beta1 release, look like
the other syscall_linux_GOARCH.go files.

Reviewed-on: https://go-review.googlesource.com/c/gofrontend/+/217577

This approach required adding a few casts to ztest.c, as it is now
compiled with -Wall.

Fixes PR libbacktrace/90636

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (adjust_vec_address_pcrel): New helper
	function to adjust PC-relative vector addresses.
	(rs6000_adjust_vec_address): Call adjust_vec_address_pcrel to
	handle vectors with PC-relative addresses.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (reg_to_non_prefixed): Add forward
	reference.
	(hard_reg_and_mode_to_addr_mask): Delete.
	(rs6000_adjust_vec_address): If the original vector address
	was REG+REG or REG+OFFSET and the element is not zero, do the add
	of the elements in the original address before adding the offset
	for the vector element.  Use address_to_insn_form to validate the
	address using the register being loaded, rather than guessing
	whether the address is a DS-FORM or DQ-FORM address.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (get_vector_offset): New helper function
	to calculate the offset in memory from the start of a vector of a
	particular element.  Add code to keep the element number in
	bounds if the element number is variable.
	(rs6000_adjust_vec_address): Move calculation of offset of the
	vector element to get_vector_offset.
	(rs6000_split_vec_extract_var): Do not do the initial AND of
	element here, move the code to get_vector_offset.

[expr.const] specifically rules out mentioning a reference even if its
address is never used, because it implies indirection that is similarly
non-constant for a pointer variable.

	PR c++/66477
	* constexpr.c (cxx_eval_constant_expression) [PARM_DECL]: Don't
	defer loading the value of a reference.

Since copying a class object is defined in terms of the copy constructor,
copying an empty class is OK even if it would otherwise not be usable in a
constant expression.  Relatedly, using a parameter as an lvalue is no more
problematic than a local variable, and calling a member function uses the
object as an lvalue.

	PR c++/91953
	* constexpr.c (potential_constant_expression_1) [PARM_DECL]: Allow
	empty class type.
	[COMPONENT_REF]: A member function reference doesn't use the object
	as an rvalue.

2020-02-03  Michael Meissner  <meissner@linux.ibm.com>

	* config/rs6000/rs6000.c (rs6000_adjust_vec_address): Add some
	gcc_asserts.

Since coroutine-ness is discovered lazily, we encounter the diagnostics
during each keyword parse.  We were not handling the case where a user code
failed to include fundamental information (e.g. the traits) in a graceful
manner.

Once we've emitted an error for this level of fail, then we suppress
additional copies (otherwise the same thing will be reported for every
coroutine keyword seen).

gcc/cp/ChangeLog:

2020-02-03  Iain Sandoe  <iain@sandoe.co.uk>

	* coroutines.cc (struct coroutine_info): Add a bool flag to note
	that we emitted an error for a bad function return type.
	(get_coroutine_info): Tolerate an unset info table in case of
	missing traits.
	(find_coro_traits_template_decl): In case of error or if we didn't
	find a type template, note we emitted the error and suppress
	duplicates.
	(find_coro_handle_template_decl): Likewise.
	(instantiate_coro_traits): Only check for error_mark_node in the
	return from lookup_qualified_name.
	(coro_promise_type_found_p): Reorder initialization so that we check
	for the traits and their usability before allocation of the info
	table.  Check for a suitable return type and emit a diagnostic for
	here instead of relying on the lookup machinery.  This allows the
	error to have a better location, and means we can suppress multiple
	copies.
	(coro_function_valid_p): Re-check for a valid promise (and thus the
	traits) before proceeding.  Tolerate missing info as a fatal error.

gcc/testsuite/ChangeLog:

2020-02-03  Iain Sandoe  <iain@sandoe.co.uk>

	* g++.dg/coroutines/pr93458-1-missing-traits.C: New test.
	* g++.dg/coroutines/pr93458-2-bad-traits.C: New test.
	* g++.dg/coroutines/pr93458-3-missing-handle.C: New test.
	* g++.dg/coroutines/pr93458-4-bad-coro-handle.C: New test.
	* g++.dg/coroutines/pr93458-5-bad-coro-type.C: New test.

Various places in the analyzer use fold_build2, test the result, then
discard it.  It's more efficient to use fold_binary, which avoids
building and GC-ing a redundant tree for the cases where folding fails.

gcc/analyzer/ChangeLog:
	* constraint-manager.cc (range::constrained_to_single_element):
	Replace fold_build2 with fold_binary.  Remove unnecessary newline.
	(constraint_manager::get_or_add_equiv_class): Replace fold_build2
	with fold_binary in two places, and remove out-of-date comment.
	(constraint_manager::eval_condition): Replace fold_build2 with
	fold_binary.
	* region-model.cc (constant_svalue::eval_condition): Likewise.
	(region_model::on_assignment): Likewise.