xref: /dragonfly/contrib/gcc-4.7/gcc/tree-vrp.c (revision 8accc937)
1 /* Support routines for Value Range Propagation (VRP).
2    Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011
3    Free Software Foundation, Inc.
4    Contributed by Diego Novillo <dnovillo@redhat.com>.
5 
6 This file is part of GCC.
7 
8 GCC is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3, or (at your option)
11 any later version.
12 
13 GCC is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 GNU General Public License for more details.
17 
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3.  If not see
20 <http://www.gnu.org/licenses/>.  */
21 
22 #include "config.h"
23 #include "system.h"
24 #include "coretypes.h"
25 #include "tm.h"
26 #include "ggc.h"
27 #include "flags.h"
28 #include "tree.h"
29 #include "basic-block.h"
30 #include "tree-flow.h"
31 #include "tree-pass.h"
32 #include "tree-dump.h"
33 #include "timevar.h"
34 #include "tree-pretty-print.h"
35 #include "gimple-pretty-print.h"
36 #include "diagnostic-core.h"
37 #include "intl.h"
38 #include "cfgloop.h"
39 #include "tree-scalar-evolution.h"
40 #include "tree-ssa-propagate.h"
41 #include "tree-chrec.h"
42 #include "gimple-fold.h"
43 #include "expr.h"
44 #include "optabs.h"
45 
46 
47 /* Type of value ranges.  See value_range_d for a description of these
48    types.  */
49 enum value_range_type { VR_UNDEFINED, VR_RANGE, VR_ANTI_RANGE, VR_VARYING };
50 
51 /* Range of values that can be associated with an SSA_NAME after VRP
52    has executed.  */
53 struct value_range_d
54 {
55   /* Lattice value represented by this range.  */
56   enum value_range_type type;
57 
58   /* Minimum and maximum values represented by this range.  These
59      values should be interpreted as follows:
60 
61 	- If TYPE is VR_UNDEFINED or VR_VARYING then MIN and MAX must
62 	  be NULL.
63 
64 	- If TYPE == VR_RANGE then MIN holds the minimum value and
65 	  MAX holds the maximum value of the range [MIN, MAX].
66 
67 	- If TYPE == ANTI_RANGE the variable is known to NOT
68 	  take any values in the range [MIN, MAX].  */
69   tree min;
70   tree max;
71 
72   /* Set of SSA names whose value ranges are equivalent to this one.
73      This set is only valid when TYPE is VR_RANGE or VR_ANTI_RANGE.  */
74   bitmap equiv;
75 };
76 
77 typedef struct value_range_d value_range_t;
78 
79 /* Set of SSA names found live during the RPO traversal of the function
80    for still active basic-blocks.  */
81 static sbitmap *live;
82 
83 /* Return true if the SSA name NAME is live on the edge E.  */
84 
85 static bool
86 live_on_edge (edge e, tree name)
87 {
88   return (live[e->dest->index]
89 	  && TEST_BIT (live[e->dest->index], SSA_NAME_VERSION (name)));
90 }
91 
92 /* Local functions.  */
93 static int compare_values (tree val1, tree val2);
94 static int compare_values_warnv (tree val1, tree val2, bool *);
95 static void vrp_meet (value_range_t *, value_range_t *);
96 static tree vrp_evaluate_conditional_warnv_with_ops (enum tree_code,
97 						     tree, tree, bool, bool *,
98 						     bool *);
99 
100 /* Location information for ASSERT_EXPRs.  Each instance of this
101    structure describes an ASSERT_EXPR for an SSA name.  Since a single
102    SSA name may have more than one assertion associated with it, these
103    locations are kept in a linked list attached to the corresponding
104    SSA name.  */
105 struct assert_locus_d
106 {
107   /* Basic block where the assertion would be inserted.  */
108   basic_block bb;
109 
110   /* Some assertions need to be inserted on an edge (e.g., assertions
111      generated by COND_EXPRs).  In those cases, BB will be NULL.  */
112   edge e;
113 
114   /* Pointer to the statement that generated this assertion.  */
115   gimple_stmt_iterator si;
116 
117   /* Predicate code for the ASSERT_EXPR.  Must be COMPARISON_CLASS_P.  */
118   enum tree_code comp_code;
119 
120   /* Value being compared against.  */
121   tree val;
122 
123   /* Expression to compare.  */
124   tree expr;
125 
126   /* Next node in the linked list.  */
127   struct assert_locus_d *next;
128 };
129 
130 typedef struct assert_locus_d *assert_locus_t;
131 
132 /* If bit I is present, it means that SSA name N_i has a list of
133    assertions that should be inserted in the IL.  */
134 static bitmap need_assert_for;
135 
136 /* Array of locations lists where to insert assertions.  ASSERTS_FOR[I]
137    holds a list of ASSERT_LOCUS_T nodes that describe where
138    ASSERT_EXPRs for SSA name N_I should be inserted.  */
139 static assert_locus_t *asserts_for;
140 
141 /* Value range array.  After propagation, VR_VALUE[I] holds the range
142    of values that SSA name N_I may take.  */
143 static unsigned num_vr_values;
144 static value_range_t **vr_value;
145 static bool values_propagated;
146 
147 /* For a PHI node which sets SSA name N_I, VR_COUNTS[I] holds the
148    number of executable edges we saw the last time we visited the
149    node.  */
150 static int *vr_phi_edge_counts;
151 
152 typedef struct {
153   gimple stmt;
154   tree vec;
155 } switch_update;
156 
157 static VEC (edge, heap) *to_remove_edges;
158 DEF_VEC_O(switch_update);
159 DEF_VEC_ALLOC_O(switch_update, heap);
160 static VEC (switch_update, heap) *to_update_switch_stmts;
161 
162 
163 /* Return the maximum value for TYPE.  */
164 
165 static inline tree
166 vrp_val_max (const_tree type)
167 {
168   if (!INTEGRAL_TYPE_P (type))
169     return NULL_TREE;
170 
171   return TYPE_MAX_VALUE (type);
172 }
173 
174 /* Return the minimum value for TYPE.  */
175 
176 static inline tree
177 vrp_val_min (const_tree type)
178 {
179   if (!INTEGRAL_TYPE_P (type))
180     return NULL_TREE;
181 
182   return TYPE_MIN_VALUE (type);
183 }
184 
185 /* Return whether VAL is equal to the maximum value of its type.  This
186    will be true for a positive overflow infinity.  We can't do a
187    simple equality comparison with TYPE_MAX_VALUE because C typedefs
188    and Ada subtypes can produce types whose TYPE_MAX_VALUE is not ==
189    to the integer constant with the same value in the type.  */
190 
191 static inline bool
192 vrp_val_is_max (const_tree val)
193 {
194   tree type_max = vrp_val_max (TREE_TYPE (val));
195   return (val == type_max
196 	  || (type_max != NULL_TREE
197 	      && operand_equal_p (val, type_max, 0)));
198 }
199 
200 /* Return whether VAL is equal to the minimum value of its type.  This
201    will be true for a negative overflow infinity.  */
202 
203 static inline bool
204 vrp_val_is_min (const_tree val)
205 {
206   tree type_min = vrp_val_min (TREE_TYPE (val));
207   return (val == type_min
208 	  || (type_min != NULL_TREE
209 	      && operand_equal_p (val, type_min, 0)));
210 }
211 
212 
213 /* Return whether TYPE should use an overflow infinity distinct from
214    TYPE_{MIN,MAX}_VALUE.  We use an overflow infinity value to
215    represent a signed overflow during VRP computations.  An infinity
216    is distinct from a half-range, which will go from some number to
217    TYPE_{MIN,MAX}_VALUE.  */
218 
219 static inline bool
220 needs_overflow_infinity (const_tree type)
221 {
222   return INTEGRAL_TYPE_P (type) && !TYPE_OVERFLOW_WRAPS (type);
223 }
224 
225 /* Return whether TYPE can support our overflow infinity
226    representation: we use the TREE_OVERFLOW flag, which only exists
227    for constants.  If TYPE doesn't support this, we don't optimize
228    cases which would require signed overflow--we drop them to
229    VARYING.  */
230 
231 static inline bool
232 supports_overflow_infinity (const_tree type)
233 {
234   tree min = vrp_val_min (type), max = vrp_val_max (type);
235 #ifdef ENABLE_CHECKING
236   gcc_assert (needs_overflow_infinity (type));
237 #endif
238   return (min != NULL_TREE
239 	  && CONSTANT_CLASS_P (min)
240 	  && max != NULL_TREE
241 	  && CONSTANT_CLASS_P (max));
242 }
243 
244 /* VAL is the maximum or minimum value of a type.  Return a
245    corresponding overflow infinity.  */
246 
247 static inline tree
248 make_overflow_infinity (tree val)
249 {
250   gcc_checking_assert (val != NULL_TREE && CONSTANT_CLASS_P (val));
251   val = copy_node (val);
252   TREE_OVERFLOW (val) = 1;
253   return val;
254 }
255 
256 /* Return a negative overflow infinity for TYPE.  */
257 
258 static inline tree
259 negative_overflow_infinity (tree type)
260 {
261   gcc_checking_assert (supports_overflow_infinity (type));
262   return make_overflow_infinity (vrp_val_min (type));
263 }
264 
265 /* Return a positive overflow infinity for TYPE.  */
266 
267 static inline tree
268 positive_overflow_infinity (tree type)
269 {
270   gcc_checking_assert (supports_overflow_infinity (type));
271   return make_overflow_infinity (vrp_val_max (type));
272 }
273 
274 /* Return whether VAL is a negative overflow infinity.  */
275 
276 static inline bool
277 is_negative_overflow_infinity (const_tree val)
278 {
279   return (needs_overflow_infinity (TREE_TYPE (val))
280 	  && CONSTANT_CLASS_P (val)
281 	  && TREE_OVERFLOW (val)
282 	  && vrp_val_is_min (val));
283 }
284 
285 /* Return whether VAL is a positive overflow infinity.  */
286 
287 static inline bool
288 is_positive_overflow_infinity (const_tree val)
289 {
290   return (needs_overflow_infinity (TREE_TYPE (val))
291 	  && CONSTANT_CLASS_P (val)
292 	  && TREE_OVERFLOW (val)
293 	  && vrp_val_is_max (val));
294 }
295 
296 /* Return whether VAL is a positive or negative overflow infinity.  */
297 
298 static inline bool
299 is_overflow_infinity (const_tree val)
300 {
301   return (needs_overflow_infinity (TREE_TYPE (val))
302 	  && CONSTANT_CLASS_P (val)
303 	  && TREE_OVERFLOW (val)
304 	  && (vrp_val_is_min (val) || vrp_val_is_max (val)));
305 }
306 
307 /* Return whether STMT has a constant rhs that is_overflow_infinity. */
308 
309 static inline bool
310 stmt_overflow_infinity (gimple stmt)
311 {
312   if (is_gimple_assign (stmt)
313       && get_gimple_rhs_class (gimple_assign_rhs_code (stmt)) ==
314       GIMPLE_SINGLE_RHS)
315     return is_overflow_infinity (gimple_assign_rhs1 (stmt));
316   return false;
317 }
318 
319 /* If VAL is now an overflow infinity, return VAL.  Otherwise, return
320    the same value with TREE_OVERFLOW clear.  This can be used to avoid
321    confusing a regular value with an overflow value.  */
322 
323 static inline tree
324 avoid_overflow_infinity (tree val)
325 {
326   if (!is_overflow_infinity (val))
327     return val;
328 
329   if (vrp_val_is_max (val))
330     return vrp_val_max (TREE_TYPE (val));
331   else
332     {
333       gcc_checking_assert (vrp_val_is_min (val));
334       return vrp_val_min (TREE_TYPE (val));
335     }
336 }
337 
338 
339 /* Return true if ARG is marked with the nonnull attribute in the
340    current function signature.  */
341 
342 static bool
343 nonnull_arg_p (const_tree arg)
344 {
345   tree t, attrs, fntype;
346   unsigned HOST_WIDE_INT arg_num;
347 
348   gcc_assert (TREE_CODE (arg) == PARM_DECL && POINTER_TYPE_P (TREE_TYPE (arg)));
349 
350   /* The static chain decl is always non null.  */
351   if (arg == cfun->static_chain_decl)
352     return true;
353 
354   fntype = TREE_TYPE (current_function_decl);
355   attrs = lookup_attribute ("nonnull", TYPE_ATTRIBUTES (fntype));
356 
357   /* If "nonnull" wasn't specified, we know nothing about the argument.  */
358   if (attrs == NULL_TREE)
359     return false;
360 
361   /* If "nonnull" applies to all the arguments, then ARG is non-null.  */
362   if (TREE_VALUE (attrs) == NULL_TREE)
363     return true;
364 
365   /* Get the position number for ARG in the function signature.  */
366   for (arg_num = 1, t = DECL_ARGUMENTS (current_function_decl);
367        t;
368        t = DECL_CHAIN (t), arg_num++)
369     {
370       if (t == arg)
371 	break;
372     }
373 
374   gcc_assert (t == arg);
375 
376   /* Now see if ARG_NUM is mentioned in the nonnull list.  */
377   for (t = TREE_VALUE (attrs); t; t = TREE_CHAIN (t))
378     {
379       if (compare_tree_int (TREE_VALUE (t), arg_num) == 0)
380 	return true;
381     }
382 
383   return false;
384 }
385 
386 
387 /* Set value range VR to VR_VARYING.  */
388 
389 static inline void
390 set_value_range_to_varying (value_range_t *vr)
391 {
392   vr->type = VR_VARYING;
393   vr->min = vr->max = NULL_TREE;
394   if (vr->equiv)
395     bitmap_clear (vr->equiv);
396 }
397 
398 
399 /* Set value range VR to {T, MIN, MAX, EQUIV}.  */
400 
401 static void
402 set_value_range (value_range_t *vr, enum value_range_type t, tree min,
403 		 tree max, bitmap equiv)
404 {
405 #if defined ENABLE_CHECKING
406   /* Check the validity of the range.  */
407   if (t == VR_RANGE || t == VR_ANTI_RANGE)
408     {
409       int cmp;
410 
411       gcc_assert (min && max);
412 
413       if (INTEGRAL_TYPE_P (TREE_TYPE (min)) && t == VR_ANTI_RANGE)
414 	gcc_assert (!vrp_val_is_min (min) || !vrp_val_is_max (max));
415 
416       cmp = compare_values (min, max);
417       gcc_assert (cmp == 0 || cmp == -1 || cmp == -2);
418 
419       if (needs_overflow_infinity (TREE_TYPE (min)))
420 	gcc_assert (!is_overflow_infinity (min)
421 		    || !is_overflow_infinity (max));
422     }
423 
424   if (t == VR_UNDEFINED || t == VR_VARYING)
425     gcc_assert (min == NULL_TREE && max == NULL_TREE);
426 
427   if (t == VR_UNDEFINED || t == VR_VARYING)
428     gcc_assert (equiv == NULL || bitmap_empty_p (equiv));
429 #endif
430 
431   vr->type = t;
432   vr->min = min;
433   vr->max = max;
434 
435   /* Since updating the equivalence set involves deep copying the
436      bitmaps, only do it if absolutely necessary.  */
437   if (vr->equiv == NULL
438       && equiv != NULL)
439     vr->equiv = BITMAP_ALLOC (NULL);
440 
441   if (equiv != vr->equiv)
442     {
443       if (equiv && !bitmap_empty_p (equiv))
444 	bitmap_copy (vr->equiv, equiv);
445       else
446 	bitmap_clear (vr->equiv);
447     }
448 }
449 
450 
451 /* Set value range VR to the canonical form of {T, MIN, MAX, EQUIV}.
452    This means adjusting T, MIN and MAX representing the case of a
453    wrapping range with MAX < MIN covering [MIN, type_max] U [type_min, MAX]
454    as anti-rage ~[MAX+1, MIN-1].  Likewise for wrapping anti-ranges.
455    In corner cases where MAX+1 or MIN-1 wraps this will fall back
456    to varying.
457    This routine exists to ease canonicalization in the case where we
458    extract ranges from var + CST op limit.  */
459 
460 static void
461 set_and_canonicalize_value_range (value_range_t *vr, enum value_range_type t,
462 				  tree min, tree max, bitmap equiv)
463 {
464   /* Nothing to canonicalize for symbolic or unknown or varying ranges.  */
465   if ((t != VR_RANGE
466        && t != VR_ANTI_RANGE)
467       || TREE_CODE (min) != INTEGER_CST
468       || TREE_CODE (max) != INTEGER_CST)
469     {
470       set_value_range (vr, t, min, max, equiv);
471       return;
472     }
473 
474   /* Wrong order for min and max, to swap them and the VR type we need
475      to adjust them.  */
476   if (tree_int_cst_lt (max, min))
477     {
478       tree one = build_int_cst (TREE_TYPE (min), 1);
479       tree tmp = int_const_binop (PLUS_EXPR, max, one);
480       max = int_const_binop (MINUS_EXPR, min, one);
481       min = tmp;
482 
483       /* There's one corner case, if we had [C+1, C] before we now have
484 	 that again.  But this represents an empty value range, so drop
485 	 to varying in this case.  */
486       if (tree_int_cst_lt (max, min))
487 	{
488 	  set_value_range_to_varying (vr);
489 	  return;
490 	}
491 
492       t = t == VR_RANGE ? VR_ANTI_RANGE : VR_RANGE;
493     }
494 
495   /* Anti-ranges that can be represented as ranges should be so.  */
496   if (t == VR_ANTI_RANGE)
497     {
498       bool is_min = vrp_val_is_min (min);
499       bool is_max = vrp_val_is_max (max);
500 
501       if (is_min && is_max)
502 	{
503 	  /* We cannot deal with empty ranges, drop to varying.  */
504 	  set_value_range_to_varying (vr);
505 	  return;
506 	}
507       else if (is_min
508 	       /* As a special exception preserve non-null ranges.  */
509 	       && !(TYPE_UNSIGNED (TREE_TYPE (min))
510 		    && integer_zerop (max)))
511         {
512 	  tree one = build_int_cst (TREE_TYPE (max), 1);
513 	  min = int_const_binop (PLUS_EXPR, max, one);
514 	  max = vrp_val_max (TREE_TYPE (max));
515 	  t = VR_RANGE;
516         }
517       else if (is_max)
518         {
519 	  tree one = build_int_cst (TREE_TYPE (min), 1);
520 	  max = int_const_binop (MINUS_EXPR, min, one);
521 	  min = vrp_val_min (TREE_TYPE (min));
522 	  t = VR_RANGE;
523         }
524     }
525 
526   set_value_range (vr, t, min, max, equiv);
527 }
528 
529 /* Copy value range FROM into value range TO.  */
530 
531 static inline void
532 copy_value_range (value_range_t *to, value_range_t *from)
533 {
534   set_value_range (to, from->type, from->min, from->max, from->equiv);
535 }
536 
537 /* Set value range VR to a single value.  This function is only called
538    with values we get from statements, and exists to clear the
539    TREE_OVERFLOW flag so that we don't think we have an overflow
540    infinity when we shouldn't.  */
541 
542 static inline void
543 set_value_range_to_value (value_range_t *vr, tree val, bitmap equiv)
544 {
545   gcc_assert (is_gimple_min_invariant (val));
546   val = avoid_overflow_infinity (val);
547   set_value_range (vr, VR_RANGE, val, val, equiv);
548 }
549 
550 /* Set value range VR to a non-negative range of type TYPE.
551    OVERFLOW_INFINITY indicates whether to use an overflow infinity
552    rather than TYPE_MAX_VALUE; this should be true if we determine
553    that the range is nonnegative based on the assumption that signed
554    overflow does not occur.  */
555 
556 static inline void
557 set_value_range_to_nonnegative (value_range_t *vr, tree type,
558 				bool overflow_infinity)
559 {
560   tree zero;
561 
562   if (overflow_infinity && !supports_overflow_infinity (type))
563     {
564       set_value_range_to_varying (vr);
565       return;
566     }
567 
568   zero = build_int_cst (type, 0);
569   set_value_range (vr, VR_RANGE, zero,
570 		   (overflow_infinity
571 		    ? positive_overflow_infinity (type)
572 		    : TYPE_MAX_VALUE (type)),
573 		   vr->equiv);
574 }
575 
576 /* Set value range VR to a non-NULL range of type TYPE.  */
577 
578 static inline void
579 set_value_range_to_nonnull (value_range_t *vr, tree type)
580 {
581   tree zero = build_int_cst (type, 0);
582   set_value_range (vr, VR_ANTI_RANGE, zero, zero, vr->equiv);
583 }
584 
585 
586 /* Set value range VR to a NULL range of type TYPE.  */
587 
588 static inline void
589 set_value_range_to_null (value_range_t *vr, tree type)
590 {
591   set_value_range_to_value (vr, build_int_cst (type, 0), vr->equiv);
592 }
593 
594 
595 /* Set value range VR to a range of a truthvalue of type TYPE.  */
596 
597 static inline void
598 set_value_range_to_truthvalue (value_range_t *vr, tree type)
599 {
600   if (TYPE_PRECISION (type) == 1)
601     set_value_range_to_varying (vr);
602   else
603     set_value_range (vr, VR_RANGE,
604 		     build_int_cst (type, 0), build_int_cst (type, 1),
605 		     vr->equiv);
606 }
607 
608 
609 /* Set value range VR to VR_UNDEFINED.  */
610 
611 static inline void
612 set_value_range_to_undefined (value_range_t *vr)
613 {
614   vr->type = VR_UNDEFINED;
615   vr->min = vr->max = NULL_TREE;
616   if (vr->equiv)
617     bitmap_clear (vr->equiv);
618 }
619 
620 
621 /* If abs (min) < abs (max), set VR to [-max, max], if
622    abs (min) >= abs (max), set VR to [-min, min].  */
623 
624 static void
625 abs_extent_range (value_range_t *vr, tree min, tree max)
626 {
627   int cmp;
628 
629   gcc_assert (TREE_CODE (min) == INTEGER_CST);
630   gcc_assert (TREE_CODE (max) == INTEGER_CST);
631   gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (min)));
632   gcc_assert (!TYPE_UNSIGNED (TREE_TYPE (min)));
633   min = fold_unary (ABS_EXPR, TREE_TYPE (min), min);
634   max = fold_unary (ABS_EXPR, TREE_TYPE (max), max);
635   if (TREE_OVERFLOW (min) || TREE_OVERFLOW (max))
636     {
637       set_value_range_to_varying (vr);
638       return;
639     }
640   cmp = compare_values (min, max);
641   if (cmp == -1)
642     min = fold_unary (NEGATE_EXPR, TREE_TYPE (min), max);
643   else if (cmp == 0 || cmp == 1)
644     {
645       max = min;
646       min = fold_unary (NEGATE_EXPR, TREE_TYPE (min), min);
647     }
648   else
649     {
650       set_value_range_to_varying (vr);
651       return;
652     }
653   set_and_canonicalize_value_range (vr, VR_RANGE, min, max, NULL);
654 }
655 
656 
657 /* Return value range information for VAR.
658 
659    If we have no values ranges recorded (ie, VRP is not running), then
660    return NULL.  Otherwise create an empty range if none existed for VAR.  */
661 
662 static value_range_t *
663 get_value_range (const_tree var)
664 {
665   static const struct value_range_d vr_const_varying
666     = { VR_VARYING, NULL_TREE, NULL_TREE, NULL };
667   value_range_t *vr;
668   tree sym;
669   unsigned ver = SSA_NAME_VERSION (var);
670 
671   /* If we have no recorded ranges, then return NULL.  */
672   if (! vr_value)
673     return NULL;
674 
675   /* If we query the range for a new SSA name return an unmodifiable VARYING.
676      We should get here at most from the substitute-and-fold stage which
677      will never try to change values.  */
678   if (ver >= num_vr_values)
679     return CONST_CAST (value_range_t *, &vr_const_varying);
680 
681   vr = vr_value[ver];
682   if (vr)
683     return vr;
684 
685   /* After propagation finished do not allocate new value-ranges.  */
686   if (values_propagated)
687     return CONST_CAST (value_range_t *, &vr_const_varying);
688 
689   /* Create a default value range.  */
690   vr_value[ver] = vr = XCNEW (value_range_t);
691 
692   /* Defer allocating the equivalence set.  */
693   vr->equiv = NULL;
694 
695   /* If VAR is a default definition of a parameter, the variable can
696      take any value in VAR's type.  */
697   sym = SSA_NAME_VAR (var);
698   if (SSA_NAME_IS_DEFAULT_DEF (var))
699     {
700       if (TREE_CODE (sym) == PARM_DECL)
701 	{
702 	  /* Try to use the "nonnull" attribute to create ~[0, 0]
703 	     anti-ranges for pointers.  Note that this is only valid with
704 	     default definitions of PARM_DECLs.  */
705 	  if (POINTER_TYPE_P (TREE_TYPE (sym))
706 	      && nonnull_arg_p (sym))
707 	    set_value_range_to_nonnull (vr, TREE_TYPE (sym));
708 	  else
709 	    set_value_range_to_varying (vr);
710 	}
711       else if (TREE_CODE (sym) == RESULT_DECL
712 	       && DECL_BY_REFERENCE (sym))
713 	set_value_range_to_nonnull (vr, TREE_TYPE (sym));
714     }
715 
716   return vr;
717 }
718 
719 /* Return true, if VAL1 and VAL2 are equal values for VRP purposes.  */
720 
721 static inline bool
722 vrp_operand_equal_p (const_tree val1, const_tree val2)
723 {
724   if (val1 == val2)
725     return true;
726   if (!val1 || !val2 || !operand_equal_p (val1, val2, 0))
727     return false;
728   if (is_overflow_infinity (val1))
729     return is_overflow_infinity (val2);
730   return true;
731 }
732 
733 /* Return true, if the bitmaps B1 and B2 are equal.  */
734 
735 static inline bool
736 vrp_bitmap_equal_p (const_bitmap b1, const_bitmap b2)
737 {
738   return (b1 == b2
739 	  || ((!b1 || bitmap_empty_p (b1))
740 	      && (!b2 || bitmap_empty_p (b2)))
741 	  || (b1 && b2
742 	      && bitmap_equal_p (b1, b2)));
743 }
744 
745 /* Update the value range and equivalence set for variable VAR to
746    NEW_VR.  Return true if NEW_VR is different from VAR's previous
747    value.
748 
749    NOTE: This function assumes that NEW_VR is a temporary value range
750    object created for the sole purpose of updating VAR's range.  The
751    storage used by the equivalence set from NEW_VR will be freed by
752    this function.  Do not call update_value_range when NEW_VR
753    is the range object associated with another SSA name.  */
754 
755 static inline bool
756 update_value_range (const_tree var, value_range_t *new_vr)
757 {
758   value_range_t *old_vr;
759   bool is_new;
760 
761   /* Update the value range, if necessary.  */
762   old_vr = get_value_range (var);
763   is_new = old_vr->type != new_vr->type
764 	   || !vrp_operand_equal_p (old_vr->min, new_vr->min)
765 	   || !vrp_operand_equal_p (old_vr->max, new_vr->max)
766 	   || !vrp_bitmap_equal_p (old_vr->equiv, new_vr->equiv);
767 
768   if (is_new)
769     set_value_range (old_vr, new_vr->type, new_vr->min, new_vr->max,
770 	             new_vr->equiv);
771 
772   BITMAP_FREE (new_vr->equiv);
773 
774   return is_new;
775 }
776 
777 
778 /* Add VAR and VAR's equivalence set to EQUIV.  This is the central
779    point where equivalence processing can be turned on/off.  */
780 
781 static void
782 add_equivalence (bitmap *equiv, const_tree var)
783 {
784   unsigned ver = SSA_NAME_VERSION (var);
785   value_range_t *vr = vr_value[ver];
786 
787   if (*equiv == NULL)
788     *equiv = BITMAP_ALLOC (NULL);
789   bitmap_set_bit (*equiv, ver);
790   if (vr && vr->equiv)
791     bitmap_ior_into (*equiv, vr->equiv);
792 }
793 
794 
795 /* Return true if VR is ~[0, 0].  */
796 
797 static inline bool
798 range_is_nonnull (value_range_t *vr)
799 {
800   return vr->type == VR_ANTI_RANGE
801 	 && integer_zerop (vr->min)
802 	 && integer_zerop (vr->max);
803 }
804 
805 
806 /* Return true if VR is [0, 0].  */
807 
808 static inline bool
809 range_is_null (value_range_t *vr)
810 {
811   return vr->type == VR_RANGE
812 	 && integer_zerop (vr->min)
813 	 && integer_zerop (vr->max);
814 }
815 
816 /* Return true if max and min of VR are INTEGER_CST.  It's not necessary
817    a singleton.  */
818 
819 static inline bool
820 range_int_cst_p (value_range_t *vr)
821 {
822   return (vr->type == VR_RANGE
823 	  && TREE_CODE (vr->max) == INTEGER_CST
824 	  && TREE_CODE (vr->min) == INTEGER_CST
825 	  && !TREE_OVERFLOW (vr->max)
826 	  && !TREE_OVERFLOW (vr->min));
827 }
828 
829 /* Return true if VR is a INTEGER_CST singleton.  */
830 
831 static inline bool
832 range_int_cst_singleton_p (value_range_t *vr)
833 {
834   return (range_int_cst_p (vr)
835 	  && tree_int_cst_equal (vr->min, vr->max));
836 }
837 
838 /* Return true if value range VR involves at least one symbol.  */
839 
840 static inline bool
841 symbolic_range_p (value_range_t *vr)
842 {
843   return (!is_gimple_min_invariant (vr->min)
844           || !is_gimple_min_invariant (vr->max));
845 }
846 
847 /* Return true if value range VR uses an overflow infinity.  */
848 
849 static inline bool
850 overflow_infinity_range_p (value_range_t *vr)
851 {
852   return (vr->type == VR_RANGE
853 	  && (is_overflow_infinity (vr->min)
854 	      || is_overflow_infinity (vr->max)));
855 }
856 
857 /* Return false if we can not make a valid comparison based on VR;
858    this will be the case if it uses an overflow infinity and overflow
859    is not undefined (i.e., -fno-strict-overflow is in effect).
860    Otherwise return true, and set *STRICT_OVERFLOW_P to true if VR
861    uses an overflow infinity.  */
862 
863 static bool
864 usable_range_p (value_range_t *vr, bool *strict_overflow_p)
865 {
866   gcc_assert (vr->type == VR_RANGE);
867   if (is_overflow_infinity (vr->min))
868     {
869       *strict_overflow_p = true;
870       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (vr->min)))
871 	return false;
872     }
873   if (is_overflow_infinity (vr->max))
874     {
875       *strict_overflow_p = true;
876       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (vr->max)))
877 	return false;
878     }
879   return true;
880 }
881 
882 
883 /* Return true if the result of assignment STMT is know to be non-negative.
884    If the return value is based on the assumption that signed overflow is
885    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
886    *STRICT_OVERFLOW_P.*/
887 
888 static bool
889 gimple_assign_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
890 {
891   enum tree_code code = gimple_assign_rhs_code (stmt);
892   switch (get_gimple_rhs_class (code))
893     {
894     case GIMPLE_UNARY_RHS:
895       return tree_unary_nonnegative_warnv_p (gimple_assign_rhs_code (stmt),
896 					     gimple_expr_type (stmt),
897 					     gimple_assign_rhs1 (stmt),
898 					     strict_overflow_p);
899     case GIMPLE_BINARY_RHS:
900       return tree_binary_nonnegative_warnv_p (gimple_assign_rhs_code (stmt),
901 					      gimple_expr_type (stmt),
902 					      gimple_assign_rhs1 (stmt),
903 					      gimple_assign_rhs2 (stmt),
904 					      strict_overflow_p);
905     case GIMPLE_TERNARY_RHS:
906       return false;
907     case GIMPLE_SINGLE_RHS:
908       return tree_single_nonnegative_warnv_p (gimple_assign_rhs1 (stmt),
909 					      strict_overflow_p);
910     case GIMPLE_INVALID_RHS:
911       gcc_unreachable ();
912     default:
913       gcc_unreachable ();
914     }
915 }
916 
917 /* Return true if return value of call STMT is know to be non-negative.
918    If the return value is based on the assumption that signed overflow is
919    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
920    *STRICT_OVERFLOW_P.*/
921 
922 static bool
923 gimple_call_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
924 {
925   tree arg0 = gimple_call_num_args (stmt) > 0 ?
926     gimple_call_arg (stmt, 0) : NULL_TREE;
927   tree arg1 = gimple_call_num_args (stmt) > 1 ?
928     gimple_call_arg (stmt, 1) : NULL_TREE;
929 
930   return tree_call_nonnegative_warnv_p (gimple_expr_type (stmt),
931 					gimple_call_fndecl (stmt),
932 					arg0,
933 					arg1,
934 					strict_overflow_p);
935 }
936 
937 /* Return true if STMT is know to to compute a non-negative value.
938    If the return value is based on the assumption that signed overflow is
939    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
940    *STRICT_OVERFLOW_P.*/
941 
942 static bool
943 gimple_stmt_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
944 {
945   switch (gimple_code (stmt))
946     {
947     case GIMPLE_ASSIGN:
948       return gimple_assign_nonnegative_warnv_p (stmt, strict_overflow_p);
949     case GIMPLE_CALL:
950       return gimple_call_nonnegative_warnv_p (stmt, strict_overflow_p);
951     default:
952       gcc_unreachable ();
953     }
954 }
955 
956 /* Return true if the result of assignment STMT is know to be non-zero.
957    If the return value is based on the assumption that signed overflow is
958    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
959    *STRICT_OVERFLOW_P.*/
960 
961 static bool
962 gimple_assign_nonzero_warnv_p (gimple stmt, bool *strict_overflow_p)
963 {
964   enum tree_code code = gimple_assign_rhs_code (stmt);
965   switch (get_gimple_rhs_class (code))
966     {
967     case GIMPLE_UNARY_RHS:
968       return tree_unary_nonzero_warnv_p (gimple_assign_rhs_code (stmt),
969 					 gimple_expr_type (stmt),
970 					 gimple_assign_rhs1 (stmt),
971 					 strict_overflow_p);
972     case GIMPLE_BINARY_RHS:
973       return tree_binary_nonzero_warnv_p (gimple_assign_rhs_code (stmt),
974 					  gimple_expr_type (stmt),
975 					  gimple_assign_rhs1 (stmt),
976 					  gimple_assign_rhs2 (stmt),
977 					  strict_overflow_p);
978     case GIMPLE_TERNARY_RHS:
979       return false;
980     case GIMPLE_SINGLE_RHS:
981       return tree_single_nonzero_warnv_p (gimple_assign_rhs1 (stmt),
982 					  strict_overflow_p);
983     case GIMPLE_INVALID_RHS:
984       gcc_unreachable ();
985     default:
986       gcc_unreachable ();
987     }
988 }
989 
990 /* Return true if STMT is know to to compute a non-zero value.
991    If the return value is based on the assumption that signed overflow is
992    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
993    *STRICT_OVERFLOW_P.*/
994 
995 static bool
996 gimple_stmt_nonzero_warnv_p (gimple stmt, bool *strict_overflow_p)
997 {
998   switch (gimple_code (stmt))
999     {
1000     case GIMPLE_ASSIGN:
1001       return gimple_assign_nonzero_warnv_p (stmt, strict_overflow_p);
1002     case GIMPLE_CALL:
1003       return gimple_alloca_call_p (stmt);
1004     default:
1005       gcc_unreachable ();
1006     }
1007 }
1008 
1009 /* Like tree_expr_nonzero_warnv_p, but this function uses value ranges
1010    obtained so far.  */
1011 
1012 static bool
1013 vrp_stmt_computes_nonzero (gimple stmt, bool *strict_overflow_p)
1014 {
1015   if (gimple_stmt_nonzero_warnv_p (stmt, strict_overflow_p))
1016     return true;
1017 
1018   /* If we have an expression of the form &X->a, then the expression
1019      is nonnull if X is nonnull.  */
1020   if (is_gimple_assign (stmt)
1021       && gimple_assign_rhs_code (stmt) == ADDR_EXPR)
1022     {
1023       tree expr = gimple_assign_rhs1 (stmt);
1024       tree base = get_base_address (TREE_OPERAND (expr, 0));
1025 
1026       if (base != NULL_TREE
1027 	  && TREE_CODE (base) == MEM_REF
1028 	  && TREE_CODE (TREE_OPERAND (base, 0)) == SSA_NAME)
1029 	{
1030 	  value_range_t *vr = get_value_range (TREE_OPERAND (base, 0));
1031 	  if (range_is_nonnull (vr))
1032 	    return true;
1033 	}
1034     }
1035 
1036   return false;
1037 }
1038 
1039 /* Returns true if EXPR is a valid value (as expected by compare_values) --
1040    a gimple invariant, or SSA_NAME +- CST.  */
1041 
1042 static bool
1043 valid_value_p (tree expr)
1044 {
1045   if (TREE_CODE (expr) == SSA_NAME)
1046     return true;
1047 
1048   if (TREE_CODE (expr) == PLUS_EXPR
1049       || TREE_CODE (expr) == MINUS_EXPR)
1050     return (TREE_CODE (TREE_OPERAND (expr, 0)) == SSA_NAME
1051 	    && TREE_CODE (TREE_OPERAND (expr, 1)) == INTEGER_CST);
1052 
1053   return is_gimple_min_invariant (expr);
1054 }
1055 
1056 /* Return
1057    1 if VAL < VAL2
1058    0 if !(VAL < VAL2)
1059    -2 if those are incomparable.  */
1060 static inline int
1061 operand_less_p (tree val, tree val2)
1062 {
1063   /* LT is folded faster than GE and others.  Inline the common case.  */
1064   if (TREE_CODE (val) == INTEGER_CST && TREE_CODE (val2) == INTEGER_CST)
1065     {
1066       if (TYPE_UNSIGNED (TREE_TYPE (val)))
1067 	return INT_CST_LT_UNSIGNED (val, val2);
1068       else
1069 	{
1070 	  if (INT_CST_LT (val, val2))
1071 	    return 1;
1072 	}
1073     }
1074   else
1075     {
1076       tree tcmp;
1077 
1078       fold_defer_overflow_warnings ();
1079 
1080       tcmp = fold_binary_to_constant (LT_EXPR, boolean_type_node, val, val2);
1081 
1082       fold_undefer_and_ignore_overflow_warnings ();
1083 
1084       if (!tcmp
1085 	  || TREE_CODE (tcmp) != INTEGER_CST)
1086 	return -2;
1087 
1088       if (!integer_zerop (tcmp))
1089 	return 1;
1090     }
1091 
1092   /* val >= val2, not considering overflow infinity.  */
1093   if (is_negative_overflow_infinity (val))
1094     return is_negative_overflow_infinity (val2) ? 0 : 1;
1095   else if (is_positive_overflow_infinity (val2))
1096     return is_positive_overflow_infinity (val) ? 0 : 1;
1097 
1098   return 0;
1099 }
1100 
1101 /* Compare two values VAL1 and VAL2.  Return
1102 
1103    	-2 if VAL1 and VAL2 cannot be compared at compile-time,
1104    	-1 if VAL1 < VAL2,
1105    	 0 if VAL1 == VAL2,
1106 	+1 if VAL1 > VAL2, and
1107 	+2 if VAL1 != VAL2
1108 
1109    This is similar to tree_int_cst_compare but supports pointer values
1110    and values that cannot be compared at compile time.
1111 
1112    If STRICT_OVERFLOW_P is not NULL, then set *STRICT_OVERFLOW_P to
1113    true if the return value is only valid if we assume that signed
1114    overflow is undefined.  */
1115 
1116 static int
1117 compare_values_warnv (tree val1, tree val2, bool *strict_overflow_p)
1118 {
1119   if (val1 == val2)
1120     return 0;
1121 
1122   /* Below we rely on the fact that VAL1 and VAL2 are both pointers or
1123      both integers.  */
1124   gcc_assert (POINTER_TYPE_P (TREE_TYPE (val1))
1125 	      == POINTER_TYPE_P (TREE_TYPE (val2)));
1126   /* Convert the two values into the same type.  This is needed because
1127      sizetype causes sign extension even for unsigned types.  */
1128   val2 = fold_convert (TREE_TYPE (val1), val2);
1129   STRIP_USELESS_TYPE_CONVERSION (val2);
1130 
1131   if ((TREE_CODE (val1) == SSA_NAME
1132        || TREE_CODE (val1) == PLUS_EXPR
1133        || TREE_CODE (val1) == MINUS_EXPR)
1134       && (TREE_CODE (val2) == SSA_NAME
1135 	  || TREE_CODE (val2) == PLUS_EXPR
1136 	  || TREE_CODE (val2) == MINUS_EXPR))
1137     {
1138       tree n1, c1, n2, c2;
1139       enum tree_code code1, code2;
1140 
1141       /* If VAL1 and VAL2 are of the form 'NAME [+-] CST' or 'NAME',
1142 	 return -1 or +1 accordingly.  If VAL1 and VAL2 don't use the
1143 	 same name, return -2.  */
1144       if (TREE_CODE (val1) == SSA_NAME)
1145 	{
1146 	  code1 = SSA_NAME;
1147 	  n1 = val1;
1148 	  c1 = NULL_TREE;
1149 	}
1150       else
1151 	{
1152 	  code1 = TREE_CODE (val1);
1153 	  n1 = TREE_OPERAND (val1, 0);
1154 	  c1 = TREE_OPERAND (val1, 1);
1155 	  if (tree_int_cst_sgn (c1) == -1)
1156 	    {
1157 	      if (is_negative_overflow_infinity (c1))
1158 		return -2;
1159 	      c1 = fold_unary_to_constant (NEGATE_EXPR, TREE_TYPE (c1), c1);
1160 	      if (!c1)
1161 		return -2;
1162 	      code1 = code1 == MINUS_EXPR ? PLUS_EXPR : MINUS_EXPR;
1163 	    }
1164 	}
1165 
1166       if (TREE_CODE (val2) == SSA_NAME)
1167 	{
1168 	  code2 = SSA_NAME;
1169 	  n2 = val2;
1170 	  c2 = NULL_TREE;
1171 	}
1172       else
1173 	{
1174 	  code2 = TREE_CODE (val2);
1175 	  n2 = TREE_OPERAND (val2, 0);
1176 	  c2 = TREE_OPERAND (val2, 1);
1177 	  if (tree_int_cst_sgn (c2) == -1)
1178 	    {
1179 	      if (is_negative_overflow_infinity (c2))
1180 		return -2;
1181 	      c2 = fold_unary_to_constant (NEGATE_EXPR, TREE_TYPE (c2), c2);
1182 	      if (!c2)
1183 		return -2;
1184 	      code2 = code2 == MINUS_EXPR ? PLUS_EXPR : MINUS_EXPR;
1185 	    }
1186 	}
1187 
1188       /* Both values must use the same name.  */
1189       if (n1 != n2)
1190 	return -2;
1191 
1192       if (code1 == SSA_NAME
1193 	  && code2 == SSA_NAME)
1194 	/* NAME == NAME  */
1195 	return 0;
1196 
1197       /* If overflow is defined we cannot simplify more.  */
1198       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (val1)))
1199 	return -2;
1200 
1201       if (strict_overflow_p != NULL
1202 	  && (code1 == SSA_NAME || !TREE_NO_WARNING (val1))
1203 	  && (code2 == SSA_NAME || !TREE_NO_WARNING (val2)))
1204 	*strict_overflow_p = true;
1205 
1206       if (code1 == SSA_NAME)
1207 	{
1208 	  if (code2 == PLUS_EXPR)
1209 	    /* NAME < NAME + CST  */
1210 	    return -1;
1211 	  else if (code2 == MINUS_EXPR)
1212 	    /* NAME > NAME - CST  */
1213 	    return 1;
1214 	}
1215       else if (code1 == PLUS_EXPR)
1216 	{
1217 	  if (code2 == SSA_NAME)
1218 	    /* NAME + CST > NAME  */
1219 	    return 1;
1220 	  else if (code2 == PLUS_EXPR)
1221 	    /* NAME + CST1 > NAME + CST2, if CST1 > CST2  */
1222 	    return compare_values_warnv (c1, c2, strict_overflow_p);
1223 	  else if (code2 == MINUS_EXPR)
1224 	    /* NAME + CST1 > NAME - CST2  */
1225 	    return 1;
1226 	}
1227       else if (code1 == MINUS_EXPR)
1228 	{
1229 	  if (code2 == SSA_NAME)
1230 	    /* NAME - CST < NAME  */
1231 	    return -1;
1232 	  else if (code2 == PLUS_EXPR)
1233 	    /* NAME - CST1 < NAME + CST2  */
1234 	    return -1;
1235 	  else if (code2 == MINUS_EXPR)
1236 	    /* NAME - CST1 > NAME - CST2, if CST1 < CST2.  Notice that
1237 	       C1 and C2 are swapped in the call to compare_values.  */
1238 	    return compare_values_warnv (c2, c1, strict_overflow_p);
1239 	}
1240 
1241       gcc_unreachable ();
1242     }
1243 
1244   /* We cannot compare non-constants.  */
1245   if (!is_gimple_min_invariant (val1) || !is_gimple_min_invariant (val2))
1246     return -2;
1247 
1248   if (!POINTER_TYPE_P (TREE_TYPE (val1)))
1249     {
1250       /* We cannot compare overflowed values, except for overflow
1251 	 infinities.  */
1252       if (TREE_OVERFLOW (val1) || TREE_OVERFLOW (val2))
1253 	{
1254 	  if (strict_overflow_p != NULL)
1255 	    *strict_overflow_p = true;
1256 	  if (is_negative_overflow_infinity (val1))
1257 	    return is_negative_overflow_infinity (val2) ? 0 : -1;
1258 	  else if (is_negative_overflow_infinity (val2))
1259 	    return 1;
1260 	  else if (is_positive_overflow_infinity (val1))
1261 	    return is_positive_overflow_infinity (val2) ? 0 : 1;
1262 	  else if (is_positive_overflow_infinity (val2))
1263 	    return -1;
1264 	  return -2;
1265 	}
1266 
1267       return tree_int_cst_compare (val1, val2);
1268     }
1269   else
1270     {
1271       tree t;
1272 
1273       /* First see if VAL1 and VAL2 are not the same.  */
1274       if (val1 == val2 || operand_equal_p (val1, val2, 0))
1275 	return 0;
1276 
1277       /* If VAL1 is a lower address than VAL2, return -1.  */
1278       if (operand_less_p (val1, val2) == 1)
1279 	return -1;
1280 
1281       /* If VAL1 is a higher address than VAL2, return +1.  */
1282       if (operand_less_p (val2, val1) == 1)
1283 	return 1;
1284 
1285       /* If VAL1 is different than VAL2, return +2.
1286 	 For integer constants we either have already returned -1 or 1
1287 	 or they are equivalent.  We still might succeed in proving
1288 	 something about non-trivial operands.  */
1289       if (TREE_CODE (val1) != INTEGER_CST
1290 	  || TREE_CODE (val2) != INTEGER_CST)
1291 	{
1292           t = fold_binary_to_constant (NE_EXPR, boolean_type_node, val1, val2);
1293 	  if (t && integer_onep (t))
1294 	    return 2;
1295 	}
1296 
1297       return -2;
1298     }
1299 }
1300 
1301 /* Compare values like compare_values_warnv, but treat comparisons of
1302    nonconstants which rely on undefined overflow as incomparable.  */
1303 
1304 static int
1305 compare_values (tree val1, tree val2)
1306 {
1307   bool sop;
1308   int ret;
1309 
1310   sop = false;
1311   ret = compare_values_warnv (val1, val2, &sop);
1312   if (sop
1313       && (!is_gimple_min_invariant (val1) || !is_gimple_min_invariant (val2)))
1314     ret = -2;
1315   return ret;
1316 }
1317 
1318 
1319 /* Return 1 if VAL is inside value range MIN <= VAL <= MAX,
1320           0 if VAL is not inside [MIN, MAX],
1321 	 -2 if we cannot tell either way.
1322 
1323    Benchmark compile/20001226-1.c compilation time after changing this
1324    function.  */
1325 
1326 static inline int
1327 value_inside_range (tree val, tree min, tree max)
1328 {
1329   int cmp1, cmp2;
1330 
1331   cmp1 = operand_less_p (val, min);
1332   if (cmp1 == -2)
1333     return -2;
1334   if (cmp1 == 1)
1335     return 0;
1336 
1337   cmp2 = operand_less_p (max, val);
1338   if (cmp2 == -2)
1339     return -2;
1340 
1341   return !cmp2;
1342 }
1343 
1344 
1345 /* Return true if value ranges VR0 and VR1 have a non-empty
1346    intersection.
1347 
1348    Benchmark compile/20001226-1.c compilation time after changing this
1349    function.
1350    */
1351 
1352 static inline bool
1353 value_ranges_intersect_p (value_range_t *vr0, value_range_t *vr1)
1354 {
1355   /* The value ranges do not intersect if the maximum of the first range is
1356      less than the minimum of the second range or vice versa.
1357      When those relations are unknown, we can't do any better.  */
1358   if (operand_less_p (vr0->max, vr1->min) != 0)
1359     return false;
1360   if (operand_less_p (vr1->max, vr0->min) != 0)
1361     return false;
1362   return true;
1363 }
1364 
1365 
1366 /* Return 1 if [MIN, MAX] includes the value zero, 0 if it does not
1367    include the value zero, -2 if we cannot tell.  */
1368 
1369 static inline int
1370 range_includes_zero_p (tree min, tree max)
1371 {
1372   tree zero = build_int_cst (TREE_TYPE (min), 0);
1373   return value_inside_range (zero, min, max);
1374 }
1375 
1376 /* Return true if *VR is know to only contain nonnegative values.  */
1377 
1378 static inline bool
1379 value_range_nonnegative_p (value_range_t *vr)
1380 {
1381   /* Testing for VR_ANTI_RANGE is not useful here as any anti-range
1382      which would return a useful value should be encoded as a
1383      VR_RANGE.  */
1384   if (vr->type == VR_RANGE)
1385     {
1386       int result = compare_values (vr->min, integer_zero_node);
1387       return (result == 0 || result == 1);
1388     }
1389 
1390   return false;
1391 }
1392 
1393 /* Return true if T, an SSA_NAME, is known to be nonnegative.  Return
1394    false otherwise or if no value range information is available.  */
1395 
1396 bool
1397 ssa_name_nonnegative_p (const_tree t)
1398 {
1399   value_range_t *vr = get_value_range (t);
1400 
1401   if (INTEGRAL_TYPE_P (t)
1402       && TYPE_UNSIGNED (t))
1403     return true;
1404 
1405   if (!vr)
1406     return false;
1407 
1408   return value_range_nonnegative_p (vr);
1409 }
1410 
1411 /* If *VR has a value rante that is a single constant value return that,
1412    otherwise return NULL_TREE.  */
1413 
1414 static tree
1415 value_range_constant_singleton (value_range_t *vr)
1416 {
1417   if (vr->type == VR_RANGE
1418       && operand_equal_p (vr->min, vr->max, 0)
1419       && is_gimple_min_invariant (vr->min))
1420     return vr->min;
1421 
1422   return NULL_TREE;
1423 }
1424 
1425 /* If OP has a value range with a single constant value return that,
1426    otherwise return NULL_TREE.  This returns OP itself if OP is a
1427    constant.  */
1428 
1429 static tree
1430 op_with_constant_singleton_value_range (tree op)
1431 {
1432   if (is_gimple_min_invariant (op))
1433     return op;
1434 
1435   if (TREE_CODE (op) != SSA_NAME)
1436     return NULL_TREE;
1437 
1438   return value_range_constant_singleton (get_value_range (op));
1439 }
1440 
1441 /* Return true if op is in a boolean [0, 1] value-range.  */
1442 
1443 static bool
1444 op_with_boolean_value_range_p (tree op)
1445 {
1446   value_range_t *vr;
1447 
1448   if (TYPE_PRECISION (TREE_TYPE (op)) == 1)
1449     return true;
1450 
1451   if (integer_zerop (op)
1452       || integer_onep (op))
1453     return true;
1454 
1455   if (TREE_CODE (op) != SSA_NAME)
1456     return false;
1457 
1458   vr = get_value_range (op);
1459   return (vr->type == VR_RANGE
1460 	  && integer_zerop (vr->min)
1461 	  && integer_onep (vr->max));
1462 }
1463 
1464 /* Extract value range information from an ASSERT_EXPR EXPR and store
1465    it in *VR_P.  */
1466 
1467 static void
1468 extract_range_from_assert (value_range_t *vr_p, tree expr)
1469 {
1470   tree var, cond, limit, min, max, type;
1471   value_range_t *var_vr, *limit_vr;
1472   enum tree_code cond_code;
1473 
1474   var = ASSERT_EXPR_VAR (expr);
1475   cond = ASSERT_EXPR_COND (expr);
1476 
1477   gcc_assert (COMPARISON_CLASS_P (cond));
1478 
1479   /* Find VAR in the ASSERT_EXPR conditional.  */
1480   if (var == TREE_OPERAND (cond, 0)
1481       || TREE_CODE (TREE_OPERAND (cond, 0)) == PLUS_EXPR
1482       || TREE_CODE (TREE_OPERAND (cond, 0)) == NOP_EXPR)
1483     {
1484       /* If the predicate is of the form VAR COMP LIMIT, then we just
1485 	 take LIMIT from the RHS and use the same comparison code.  */
1486       cond_code = TREE_CODE (cond);
1487       limit = TREE_OPERAND (cond, 1);
1488       cond = TREE_OPERAND (cond, 0);
1489     }
1490   else
1491     {
1492       /* If the predicate is of the form LIMIT COMP VAR, then we need
1493 	 to flip around the comparison code to create the proper range
1494 	 for VAR.  */
1495       cond_code = swap_tree_comparison (TREE_CODE (cond));
1496       limit = TREE_OPERAND (cond, 0);
1497       cond = TREE_OPERAND (cond, 1);
1498     }
1499 
1500   limit = avoid_overflow_infinity (limit);
1501 
1502   type = TREE_TYPE (var);
1503   gcc_assert (limit != var);
1504 
1505   /* For pointer arithmetic, we only keep track of pointer equality
1506      and inequality.  */
1507   if (POINTER_TYPE_P (type) && cond_code != NE_EXPR && cond_code != EQ_EXPR)
1508     {
1509       set_value_range_to_varying (vr_p);
1510       return;
1511     }
1512 
1513   /* If LIMIT is another SSA name and LIMIT has a range of its own,
1514      try to use LIMIT's range to avoid creating symbolic ranges
1515      unnecessarily. */
1516   limit_vr = (TREE_CODE (limit) == SSA_NAME) ? get_value_range (limit) : NULL;
1517 
1518   /* LIMIT's range is only interesting if it has any useful information.  */
1519   if (limit_vr
1520       && (limit_vr->type == VR_UNDEFINED
1521 	  || limit_vr->type == VR_VARYING
1522 	  || symbolic_range_p (limit_vr)))
1523     limit_vr = NULL;
1524 
1525   /* Initially, the new range has the same set of equivalences of
1526      VAR's range.  This will be revised before returning the final
1527      value.  Since assertions may be chained via mutually exclusive
1528      predicates, we will need to trim the set of equivalences before
1529      we are done.  */
1530   gcc_assert (vr_p->equiv == NULL);
1531   add_equivalence (&vr_p->equiv, var);
1532 
1533   /* Extract a new range based on the asserted comparison for VAR and
1534      LIMIT's value range.  Notice that if LIMIT has an anti-range, we
1535      will only use it for equality comparisons (EQ_EXPR).  For any
1536      other kind of assertion, we cannot derive a range from LIMIT's
1537      anti-range that can be used to describe the new range.  For
1538      instance, ASSERT_EXPR <x_2, x_2 <= b_4>.  If b_4 is ~[2, 10],
1539      then b_4 takes on the ranges [-INF, 1] and [11, +INF].  There is
1540      no single range for x_2 that could describe LE_EXPR, so we might
1541      as well build the range [b_4, +INF] for it.
1542      One special case we handle is extracting a range from a
1543      range test encoded as (unsigned)var + CST <= limit.  */
1544   if (TREE_CODE (cond) == NOP_EXPR
1545       || TREE_CODE (cond) == PLUS_EXPR)
1546     {
1547       if (TREE_CODE (cond) == PLUS_EXPR)
1548         {
1549           min = fold_build1 (NEGATE_EXPR, TREE_TYPE (TREE_OPERAND (cond, 1)),
1550 			     TREE_OPERAND (cond, 1));
1551           max = int_const_binop (PLUS_EXPR, limit, min);
1552 	  cond = TREE_OPERAND (cond, 0);
1553 	}
1554       else
1555 	{
1556 	  min = build_int_cst (TREE_TYPE (var), 0);
1557 	  max = limit;
1558 	}
1559 
1560       /* Make sure to not set TREE_OVERFLOW on the final type
1561 	 conversion.  We are willingly interpreting large positive
1562 	 unsigned values as negative singed values here.  */
1563       min = force_fit_type_double (TREE_TYPE (var), tree_to_double_int (min),
1564 				   0, false);
1565       max = force_fit_type_double (TREE_TYPE (var), tree_to_double_int (max),
1566 				   0, false);
1567 
1568       /* We can transform a max, min range to an anti-range or
1569          vice-versa.  Use set_and_canonicalize_value_range which does
1570 	 this for us.  */
1571       if (cond_code == LE_EXPR)
1572         set_and_canonicalize_value_range (vr_p, VR_RANGE,
1573 					  min, max, vr_p->equiv);
1574       else if (cond_code == GT_EXPR)
1575         set_and_canonicalize_value_range (vr_p, VR_ANTI_RANGE,
1576 					  min, max, vr_p->equiv);
1577       else
1578 	gcc_unreachable ();
1579     }
1580   else if (cond_code == EQ_EXPR)
1581     {
1582       enum value_range_type range_type;
1583 
1584       if (limit_vr)
1585 	{
1586 	  range_type = limit_vr->type;
1587 	  min = limit_vr->min;
1588 	  max = limit_vr->max;
1589 	}
1590       else
1591 	{
1592 	  range_type = VR_RANGE;
1593 	  min = limit;
1594 	  max = limit;
1595 	}
1596 
1597       set_value_range (vr_p, range_type, min, max, vr_p->equiv);
1598 
1599       /* When asserting the equality VAR == LIMIT and LIMIT is another
1600 	 SSA name, the new range will also inherit the equivalence set
1601 	 from LIMIT.  */
1602       if (TREE_CODE (limit) == SSA_NAME)
1603 	add_equivalence (&vr_p->equiv, limit);
1604     }
1605   else if (cond_code == NE_EXPR)
1606     {
1607       /* As described above, when LIMIT's range is an anti-range and
1608 	 this assertion is an inequality (NE_EXPR), then we cannot
1609 	 derive anything from the anti-range.  For instance, if
1610 	 LIMIT's range was ~[0, 0], the assertion 'VAR != LIMIT' does
1611 	 not imply that VAR's range is [0, 0].  So, in the case of
1612 	 anti-ranges, we just assert the inequality using LIMIT and
1613 	 not its anti-range.
1614 
1615 	 If LIMIT_VR is a range, we can only use it to build a new
1616 	 anti-range if LIMIT_VR is a single-valued range.  For
1617 	 instance, if LIMIT_VR is [0, 1], the predicate
1618 	 VAR != [0, 1] does not mean that VAR's range is ~[0, 1].
1619 	 Rather, it means that for value 0 VAR should be ~[0, 0]
1620 	 and for value 1, VAR should be ~[1, 1].  We cannot
1621 	 represent these ranges.
1622 
1623 	 The only situation in which we can build a valid
1624 	 anti-range is when LIMIT_VR is a single-valued range
1625 	 (i.e., LIMIT_VR->MIN == LIMIT_VR->MAX).  In that case,
1626 	 build the anti-range ~[LIMIT_VR->MIN, LIMIT_VR->MAX].  */
1627       if (limit_vr
1628 	  && limit_vr->type == VR_RANGE
1629 	  && compare_values (limit_vr->min, limit_vr->max) == 0)
1630 	{
1631 	  min = limit_vr->min;
1632 	  max = limit_vr->max;
1633 	}
1634       else
1635 	{
1636 	  /* In any other case, we cannot use LIMIT's range to build a
1637 	     valid anti-range.  */
1638 	  min = max = limit;
1639 	}
1640 
1641       /* If MIN and MAX cover the whole range for their type, then
1642 	 just use the original LIMIT.  */
1643       if (INTEGRAL_TYPE_P (type)
1644 	  && vrp_val_is_min (min)
1645 	  && vrp_val_is_max (max))
1646 	min = max = limit;
1647 
1648       set_value_range (vr_p, VR_ANTI_RANGE, min, max, vr_p->equiv);
1649     }
1650   else if (cond_code == LE_EXPR || cond_code == LT_EXPR)
1651     {
1652       min = TYPE_MIN_VALUE (type);
1653 
1654       if (limit_vr == NULL || limit_vr->type == VR_ANTI_RANGE)
1655 	max = limit;
1656       else
1657 	{
1658 	  /* If LIMIT_VR is of the form [N1, N2], we need to build the
1659 	     range [MIN, N2] for LE_EXPR and [MIN, N2 - 1] for
1660 	     LT_EXPR.  */
1661 	  max = limit_vr->max;
1662 	}
1663 
1664       /* If the maximum value forces us to be out of bounds, simply punt.
1665 	 It would be pointless to try and do anything more since this
1666 	 all should be optimized away above us.  */
1667       if ((cond_code == LT_EXPR
1668 	   && compare_values (max, min) == 0)
1669 	  || (CONSTANT_CLASS_P (max) && TREE_OVERFLOW (max)))
1670 	set_value_range_to_varying (vr_p);
1671       else
1672 	{
1673 	  /* For LT_EXPR, we create the range [MIN, MAX - 1].  */
1674 	  if (cond_code == LT_EXPR)
1675 	    {
1676 	      if (TYPE_PRECISION (TREE_TYPE (max)) == 1
1677 		  && !TYPE_UNSIGNED (TREE_TYPE (max)))
1678 		max = fold_build2 (PLUS_EXPR, TREE_TYPE (max), max,
1679 				   build_int_cst (TREE_TYPE (max), -1));
1680 	      else
1681 		max = fold_build2 (MINUS_EXPR, TREE_TYPE (max), max,
1682 				   build_int_cst (TREE_TYPE (max), 1));
1683 	      if (EXPR_P (max))
1684 		TREE_NO_WARNING (max) = 1;
1685 	    }
1686 
1687 	  set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1688 	}
1689     }
1690   else if (cond_code == GE_EXPR || cond_code == GT_EXPR)
1691     {
1692       max = TYPE_MAX_VALUE (type);
1693 
1694       if (limit_vr == NULL || limit_vr->type == VR_ANTI_RANGE)
1695 	min = limit;
1696       else
1697 	{
1698 	  /* If LIMIT_VR is of the form [N1, N2], we need to build the
1699 	     range [N1, MAX] for GE_EXPR and [N1 + 1, MAX] for
1700 	     GT_EXPR.  */
1701 	  min = limit_vr->min;
1702 	}
1703 
1704       /* If the minimum value forces us to be out of bounds, simply punt.
1705 	 It would be pointless to try and do anything more since this
1706 	 all should be optimized away above us.  */
1707       if ((cond_code == GT_EXPR
1708 	   && compare_values (min, max) == 0)
1709 	  || (CONSTANT_CLASS_P (min) && TREE_OVERFLOW (min)))
1710 	set_value_range_to_varying (vr_p);
1711       else
1712 	{
1713 	  /* For GT_EXPR, we create the range [MIN + 1, MAX].  */
1714 	  if (cond_code == GT_EXPR)
1715 	    {
1716 	      if (TYPE_PRECISION (TREE_TYPE (min)) == 1
1717 		  && !TYPE_UNSIGNED (TREE_TYPE (min)))
1718 		min = fold_build2 (MINUS_EXPR, TREE_TYPE (min), min,
1719 				   build_int_cst (TREE_TYPE (min), -1));
1720 	      else
1721 		min = fold_build2 (PLUS_EXPR, TREE_TYPE (min), min,
1722 				   build_int_cst (TREE_TYPE (min), 1));
1723 	      if (EXPR_P (min))
1724 		TREE_NO_WARNING (min) = 1;
1725 	    }
1726 
1727 	  set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1728 	}
1729     }
1730   else
1731     gcc_unreachable ();
1732 
1733   /* If VAR already had a known range, it may happen that the new
1734      range we have computed and VAR's range are not compatible.  For
1735      instance,
1736 
1737 	if (p_5 == NULL)
1738 	  p_6 = ASSERT_EXPR <p_5, p_5 == NULL>;
1739 	  x_7 = p_6->fld;
1740 	  p_8 = ASSERT_EXPR <p_6, p_6 != NULL>;
1741 
1742      While the above comes from a faulty program, it will cause an ICE
1743      later because p_8 and p_6 will have incompatible ranges and at
1744      the same time will be considered equivalent.  A similar situation
1745      would arise from
1746 
1747      	if (i_5 > 10)
1748 	  i_6 = ASSERT_EXPR <i_5, i_5 > 10>;
1749 	  if (i_5 < 5)
1750 	    i_7 = ASSERT_EXPR <i_6, i_6 < 5>;
1751 
1752      Again i_6 and i_7 will have incompatible ranges.  It would be
1753      pointless to try and do anything with i_7's range because
1754      anything dominated by 'if (i_5 < 5)' will be optimized away.
1755      Note, due to the wa in which simulation proceeds, the statement
1756      i_7 = ASSERT_EXPR <...> we would never be visited because the
1757      conditional 'if (i_5 < 5)' always evaluates to false.  However,
1758      this extra check does not hurt and may protect against future
1759      changes to VRP that may get into a situation similar to the
1760      NULL pointer dereference example.
1761 
1762      Note that these compatibility tests are only needed when dealing
1763      with ranges or a mix of range and anti-range.  If VAR_VR and VR_P
1764      are both anti-ranges, they will always be compatible, because two
1765      anti-ranges will always have a non-empty intersection.  */
1766 
1767   var_vr = get_value_range (var);
1768 
1769   /* We may need to make adjustments when VR_P and VAR_VR are numeric
1770      ranges or anti-ranges.  */
1771   if (vr_p->type == VR_VARYING
1772       || vr_p->type == VR_UNDEFINED
1773       || var_vr->type == VR_VARYING
1774       || var_vr->type == VR_UNDEFINED
1775       || symbolic_range_p (vr_p)
1776       || symbolic_range_p (var_vr))
1777     return;
1778 
1779   if (var_vr->type == VR_RANGE && vr_p->type == VR_RANGE)
1780     {
1781       /* If the two ranges have a non-empty intersection, we can
1782 	 refine the resulting range.  Since the assert expression
1783 	 creates an equivalency and at the same time it asserts a
1784 	 predicate, we can take the intersection of the two ranges to
1785 	 get better precision.  */
1786       if (value_ranges_intersect_p (var_vr, vr_p))
1787 	{
1788 	  /* Use the larger of the two minimums.  */
1789 	  if (compare_values (vr_p->min, var_vr->min) == -1)
1790 	    min = var_vr->min;
1791 	  else
1792 	    min = vr_p->min;
1793 
1794 	  /* Use the smaller of the two maximums.  */
1795 	  if (compare_values (vr_p->max, var_vr->max) == 1)
1796 	    max = var_vr->max;
1797 	  else
1798 	    max = vr_p->max;
1799 
1800 	  set_value_range (vr_p, vr_p->type, min, max, vr_p->equiv);
1801 	}
1802       else
1803 	{
1804 	  /* The two ranges do not intersect, set the new range to
1805 	     VARYING, because we will not be able to do anything
1806 	     meaningful with it.  */
1807 	  set_value_range_to_varying (vr_p);
1808 	}
1809     }
1810   else if ((var_vr->type == VR_RANGE && vr_p->type == VR_ANTI_RANGE)
1811            || (var_vr->type == VR_ANTI_RANGE && vr_p->type == VR_RANGE))
1812     {
1813       /* A range and an anti-range will cancel each other only if
1814 	 their ends are the same.  For instance, in the example above,
1815 	 p_8's range ~[0, 0] and p_6's range [0, 0] are incompatible,
1816 	 so VR_P should be set to VR_VARYING.  */
1817       if (compare_values (var_vr->min, vr_p->min) == 0
1818 	  && compare_values (var_vr->max, vr_p->max) == 0)
1819 	set_value_range_to_varying (vr_p);
1820       else
1821 	{
1822 	  tree min, max, anti_min, anti_max, real_min, real_max;
1823 	  int cmp;
1824 
1825 	  /* We want to compute the logical AND of the two ranges;
1826 	     there are three cases to consider.
1827 
1828 
1829 	     1. The VR_ANTI_RANGE range is completely within the
1830 		VR_RANGE and the endpoints of the ranges are
1831 		different.  In that case the resulting range
1832 		should be whichever range is more precise.
1833 		Typically that will be the VR_RANGE.
1834 
1835 	     2. The VR_ANTI_RANGE is completely disjoint from
1836 		the VR_RANGE.  In this case the resulting range
1837 		should be the VR_RANGE.
1838 
1839 	     3. There is some overlap between the VR_ANTI_RANGE
1840 		and the VR_RANGE.
1841 
1842 		3a. If the high limit of the VR_ANTI_RANGE resides
1843 		    within the VR_RANGE, then the result is a new
1844 		    VR_RANGE starting at the high limit of the
1845 		    VR_ANTI_RANGE + 1 and extending to the
1846 		    high limit of the original VR_RANGE.
1847 
1848 		3b. If the low limit of the VR_ANTI_RANGE resides
1849 		    within the VR_RANGE, then the result is a new
1850 		    VR_RANGE starting at the low limit of the original
1851 		    VR_RANGE and extending to the low limit of the
1852 		    VR_ANTI_RANGE - 1.  */
1853 	  if (vr_p->type == VR_ANTI_RANGE)
1854 	    {
1855 	      anti_min = vr_p->min;
1856 	      anti_max = vr_p->max;
1857 	      real_min = var_vr->min;
1858 	      real_max = var_vr->max;
1859 	    }
1860 	  else
1861 	    {
1862 	      anti_min = var_vr->min;
1863 	      anti_max = var_vr->max;
1864 	      real_min = vr_p->min;
1865 	      real_max = vr_p->max;
1866 	    }
1867 
1868 
1869 	  /* Case 1, VR_ANTI_RANGE completely within VR_RANGE,
1870 	     not including any endpoints.  */
1871 	  if (compare_values (anti_max, real_max) == -1
1872 	      && compare_values (anti_min, real_min) == 1)
1873 	    {
1874 	      /* If the range is covering the whole valid range of
1875 		 the type keep the anti-range.  */
1876 	      if (!vrp_val_is_min (real_min)
1877 		  || !vrp_val_is_max (real_max))
1878 	        set_value_range (vr_p, VR_RANGE, real_min,
1879 				 real_max, vr_p->equiv);
1880 	    }
1881 	  /* Case 2, VR_ANTI_RANGE completely disjoint from
1882 	     VR_RANGE.  */
1883 	  else if (compare_values (anti_min, real_max) == 1
1884 		   || compare_values (anti_max, real_min) == -1)
1885 	    {
1886 	      set_value_range (vr_p, VR_RANGE, real_min,
1887 			       real_max, vr_p->equiv);
1888 	    }
1889 	  /* Case 3a, the anti-range extends into the low
1890 	     part of the real range.  Thus creating a new
1891 	     low for the real range.  */
1892 	  else if (((cmp = compare_values (anti_max, real_min)) == 1
1893 		    || cmp == 0)
1894 		   && compare_values (anti_max, real_max) == -1)
1895 	    {
1896 	      gcc_assert (!is_positive_overflow_infinity (anti_max));
1897 	      if (needs_overflow_infinity (TREE_TYPE (anti_max))
1898 		  && vrp_val_is_max (anti_max))
1899 		{
1900 		  if (!supports_overflow_infinity (TREE_TYPE (var_vr->min)))
1901 		    {
1902 		      set_value_range_to_varying (vr_p);
1903 		      return;
1904 		    }
1905 		  min = positive_overflow_infinity (TREE_TYPE (var_vr->min));
1906 		}
1907 	      else if (!POINTER_TYPE_P (TREE_TYPE (var_vr->min)))
1908 		{
1909 		  if (TYPE_PRECISION (TREE_TYPE (var_vr->min)) == 1
1910 		      && !TYPE_UNSIGNED (TREE_TYPE (var_vr->min)))
1911 		    min = fold_build2 (MINUS_EXPR, TREE_TYPE (var_vr->min),
1912 				       anti_max,
1913 				       build_int_cst (TREE_TYPE (var_vr->min),
1914 						      -1));
1915 		  else
1916 		    min = fold_build2 (PLUS_EXPR, TREE_TYPE (var_vr->min),
1917 				       anti_max,
1918 				       build_int_cst (TREE_TYPE (var_vr->min),
1919 						      1));
1920 		}
1921 	      else
1922 		min = fold_build_pointer_plus_hwi (anti_max, 1);
1923 	      max = real_max;
1924 	      set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1925 	    }
1926 	  /* Case 3b, the anti-range extends into the high
1927 	     part of the real range.  Thus creating a new
1928 	     higher for the real range.  */
1929 	  else if (compare_values (anti_min, real_min) == 1
1930 		   && ((cmp = compare_values (anti_min, real_max)) == -1
1931 		       || cmp == 0))
1932 	    {
1933 	      gcc_assert (!is_negative_overflow_infinity (anti_min));
1934 	      if (needs_overflow_infinity (TREE_TYPE (anti_min))
1935 		  && vrp_val_is_min (anti_min))
1936 		{
1937 		  if (!supports_overflow_infinity (TREE_TYPE (var_vr->min)))
1938 		    {
1939 		      set_value_range_to_varying (vr_p);
1940 		      return;
1941 		    }
1942 		  max = negative_overflow_infinity (TREE_TYPE (var_vr->min));
1943 		}
1944 	      else if (!POINTER_TYPE_P (TREE_TYPE (var_vr->min)))
1945 		{
1946 		  if (TYPE_PRECISION (TREE_TYPE (var_vr->min)) == 1
1947 		      && !TYPE_UNSIGNED (TREE_TYPE (var_vr->min)))
1948 		    max = fold_build2 (PLUS_EXPR, TREE_TYPE (var_vr->min),
1949 				       anti_min,
1950 				       build_int_cst (TREE_TYPE (var_vr->min),
1951 						      -1));
1952 		  else
1953 		    max = fold_build2 (MINUS_EXPR, TREE_TYPE (var_vr->min),
1954 				       anti_min,
1955 				       build_int_cst (TREE_TYPE (var_vr->min),
1956 						      1));
1957 		}
1958 	      else
1959 		max = fold_build_pointer_plus_hwi (anti_min, -1);
1960 	      min = real_min;
1961 	      set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1962 	    }
1963 	}
1964     }
1965 }
1966 
1967 
1968 /* Extract range information from SSA name VAR and store it in VR.  If
1969    VAR has an interesting range, use it.  Otherwise, create the
1970    range [VAR, VAR] and return it.  This is useful in situations where
1971    we may have conditionals testing values of VARYING names.  For
1972    instance,
1973 
1974    	x_3 = y_5;
1975 	if (x_3 > y_5)
1976 	  ...
1977 
1978     Even if y_5 is deemed VARYING, we can determine that x_3 > y_5 is
1979     always false.  */
1980 
1981 static void
1982 extract_range_from_ssa_name (value_range_t *vr, tree var)
1983 {
1984   value_range_t *var_vr = get_value_range (var);
1985 
1986   if (var_vr->type != VR_UNDEFINED && var_vr->type != VR_VARYING)
1987     copy_value_range (vr, var_vr);
1988   else
1989     set_value_range (vr, VR_RANGE, var, var, NULL);
1990 
1991   add_equivalence (&vr->equiv, var);
1992 }
1993 
1994 
1995 /* Wrapper around int_const_binop.  If the operation overflows and we
1996    are not using wrapping arithmetic, then adjust the result to be
1997    -INF or +INF depending on CODE, VAL1 and VAL2.  This can return
1998    NULL_TREE if we need to use an overflow infinity representation but
1999    the type does not support it.  */
2000 
2001 static tree
2002 vrp_int_const_binop (enum tree_code code, tree val1, tree val2)
2003 {
2004   tree res;
2005 
2006   res = int_const_binop (code, val1, val2);
2007 
2008   /* If we are using unsigned arithmetic, operate symbolically
2009      on -INF and +INF as int_const_binop only handles signed overflow.  */
2010   if (TYPE_UNSIGNED (TREE_TYPE (val1)))
2011     {
2012       int checkz = compare_values (res, val1);
2013       bool overflow = false;
2014 
2015       /* Ensure that res = val1 [+*] val2 >= val1
2016          or that res = val1 - val2 <= val1.  */
2017       if ((code == PLUS_EXPR
2018 	   && !(checkz == 1 || checkz == 0))
2019           || (code == MINUS_EXPR
2020 	      && !(checkz == 0 || checkz == -1)))
2021 	{
2022 	  overflow = true;
2023 	}
2024       /* Checking for multiplication overflow is done by dividing the
2025 	 output of the multiplication by the first input of the
2026 	 multiplication.  If the result of that division operation is
2027 	 not equal to the second input of the multiplication, then the
2028 	 multiplication overflowed.  */
2029       else if (code == MULT_EXPR && !integer_zerop (val1))
2030 	{
2031 	  tree tmp = int_const_binop (TRUNC_DIV_EXPR,
2032 				      res,
2033 				      val1);
2034 	  int check = compare_values (tmp, val2);
2035 
2036 	  if (check != 0)
2037 	    overflow = true;
2038 	}
2039 
2040       if (overflow)
2041 	{
2042 	  res = copy_node (res);
2043 	  TREE_OVERFLOW (res) = 1;
2044 	}
2045 
2046     }
2047   else if (TYPE_OVERFLOW_WRAPS (TREE_TYPE (val1)))
2048     /* If the singed operation wraps then int_const_binop has done
2049        everything we want.  */
2050     ;
2051   else if ((TREE_OVERFLOW (res)
2052 	    && !TREE_OVERFLOW (val1)
2053 	    && !TREE_OVERFLOW (val2))
2054 	   || is_overflow_infinity (val1)
2055 	   || is_overflow_infinity (val2))
2056     {
2057       /* If the operation overflowed but neither VAL1 nor VAL2 are
2058 	 overflown, return -INF or +INF depending on the operation
2059 	 and the combination of signs of the operands.  */
2060       int sgn1 = tree_int_cst_sgn (val1);
2061       int sgn2 = tree_int_cst_sgn (val2);
2062 
2063       if (needs_overflow_infinity (TREE_TYPE (res))
2064 	  && !supports_overflow_infinity (TREE_TYPE (res)))
2065 	return NULL_TREE;
2066 
2067       /* We have to punt on adding infinities of different signs,
2068 	 since we can't tell what the sign of the result should be.
2069 	 Likewise for subtracting infinities of the same sign.  */
2070       if (((code == PLUS_EXPR && sgn1 != sgn2)
2071 	   || (code == MINUS_EXPR && sgn1 == sgn2))
2072 	  && is_overflow_infinity (val1)
2073 	  && is_overflow_infinity (val2))
2074 	return NULL_TREE;
2075 
2076       /* Don't try to handle division or shifting of infinities.  */
2077       if ((code == TRUNC_DIV_EXPR
2078 	   || code == FLOOR_DIV_EXPR
2079 	   || code == CEIL_DIV_EXPR
2080 	   || code == EXACT_DIV_EXPR
2081 	   || code == ROUND_DIV_EXPR
2082 	   || code == RSHIFT_EXPR)
2083 	  && (is_overflow_infinity (val1)
2084 	      || is_overflow_infinity (val2)))
2085 	return NULL_TREE;
2086 
2087       /* Notice that we only need to handle the restricted set of
2088 	 operations handled by extract_range_from_binary_expr.
2089 	 Among them, only multiplication, addition and subtraction
2090 	 can yield overflow without overflown operands because we
2091 	 are working with integral types only... except in the
2092 	 case VAL1 = -INF and VAL2 = -1 which overflows to +INF
2093 	 for division too.  */
2094 
2095       /* For multiplication, the sign of the overflow is given
2096 	 by the comparison of the signs of the operands.  */
2097       if ((code == MULT_EXPR && sgn1 == sgn2)
2098           /* For addition, the operands must be of the same sign
2099 	     to yield an overflow.  Its sign is therefore that
2100 	     of one of the operands, for example the first.  For
2101 	     infinite operands X + -INF is negative, not positive.  */
2102 	  || (code == PLUS_EXPR
2103 	      && (sgn1 >= 0
2104 		  ? !is_negative_overflow_infinity (val2)
2105 		  : is_positive_overflow_infinity (val2)))
2106 	  /* For subtraction, non-infinite operands must be of
2107 	     different signs to yield an overflow.  Its sign is
2108 	     therefore that of the first operand or the opposite of
2109 	     that of the second operand.  A first operand of 0 counts
2110 	     as positive here, for the corner case 0 - (-INF), which
2111 	     overflows, but must yield +INF.  For infinite operands 0
2112 	     - INF is negative, not positive.  */
2113 	  || (code == MINUS_EXPR
2114 	      && (sgn1 >= 0
2115 		  ? !is_positive_overflow_infinity (val2)
2116 		  : is_negative_overflow_infinity (val2)))
2117 	  /* We only get in here with positive shift count, so the
2118 	     overflow direction is the same as the sign of val1.
2119 	     Actually rshift does not overflow at all, but we only
2120 	     handle the case of shifting overflowed -INF and +INF.  */
2121 	  || (code == RSHIFT_EXPR
2122 	      && sgn1 >= 0)
2123 	  /* For division, the only case is -INF / -1 = +INF.  */
2124 	  || code == TRUNC_DIV_EXPR
2125 	  || code == FLOOR_DIV_EXPR
2126 	  || code == CEIL_DIV_EXPR
2127 	  || code == EXACT_DIV_EXPR
2128 	  || code == ROUND_DIV_EXPR)
2129 	return (needs_overflow_infinity (TREE_TYPE (res))
2130 		? positive_overflow_infinity (TREE_TYPE (res))
2131 		: TYPE_MAX_VALUE (TREE_TYPE (res)));
2132       else
2133 	return (needs_overflow_infinity (TREE_TYPE (res))
2134 		? negative_overflow_infinity (TREE_TYPE (res))
2135 		: TYPE_MIN_VALUE (TREE_TYPE (res)));
2136     }
2137 
2138   return res;
2139 }
2140 
2141 
2142 /* For range VR compute two double_int bitmasks.  In *MAY_BE_NONZERO
2143    bitmask if some bit is unset, it means for all numbers in the range
2144    the bit is 0, otherwise it might be 0 or 1.  In *MUST_BE_NONZERO
2145    bitmask if some bit is set, it means for all numbers in the range
2146    the bit is 1, otherwise it might be 0 or 1.  */
2147 
2148 static bool
2149 zero_nonzero_bits_from_vr (value_range_t *vr,
2150 			   double_int *may_be_nonzero,
2151 			   double_int *must_be_nonzero)
2152 {
2153   *may_be_nonzero = double_int_minus_one;
2154   *must_be_nonzero = double_int_zero;
2155   if (!range_int_cst_p (vr))
2156     return false;
2157 
2158   if (range_int_cst_singleton_p (vr))
2159     {
2160       *may_be_nonzero = tree_to_double_int (vr->min);
2161       *must_be_nonzero = *may_be_nonzero;
2162     }
2163   else if (tree_int_cst_sgn (vr->min) >= 0
2164 	   || tree_int_cst_sgn (vr->max) < 0)
2165     {
2166       double_int dmin = tree_to_double_int (vr->min);
2167       double_int dmax = tree_to_double_int (vr->max);
2168       double_int xor_mask = double_int_xor (dmin, dmax);
2169       *may_be_nonzero = double_int_ior (dmin, dmax);
2170       *must_be_nonzero = double_int_and (dmin, dmax);
2171       if (xor_mask.high != 0)
2172 	{
2173 	  unsigned HOST_WIDE_INT mask
2174 	      = ((unsigned HOST_WIDE_INT) 1
2175 		 << floor_log2 (xor_mask.high)) - 1;
2176 	  may_be_nonzero->low = ALL_ONES;
2177 	  may_be_nonzero->high |= mask;
2178 	  must_be_nonzero->low = 0;
2179 	  must_be_nonzero->high &= ~mask;
2180 	}
2181       else if (xor_mask.low != 0)
2182 	{
2183 	  unsigned HOST_WIDE_INT mask
2184 	      = ((unsigned HOST_WIDE_INT) 1
2185 		 << floor_log2 (xor_mask.low)) - 1;
2186 	  may_be_nonzero->low |= mask;
2187 	  must_be_nonzero->low &= ~mask;
2188 	}
2189     }
2190 
2191   return true;
2192 }
2193 
2194 /* Helper to extract a value-range *VR for a multiplicative operation
2195    *VR0 CODE *VR1.  */
2196 
2197 static void
2198 extract_range_from_multiplicative_op_1 (value_range_t *vr,
2199 					enum tree_code code,
2200 					value_range_t *vr0, value_range_t *vr1)
2201 {
2202   enum value_range_type type;
2203   tree val[4];
2204   size_t i;
2205   tree min, max;
2206   bool sop;
2207   int cmp;
2208 
2209   /* Multiplications, divisions and shifts are a bit tricky to handle,
2210      depending on the mix of signs we have in the two ranges, we
2211      need to operate on different values to get the minimum and
2212      maximum values for the new range.  One approach is to figure
2213      out all the variations of range combinations and do the
2214      operations.
2215 
2216      However, this involves several calls to compare_values and it
2217      is pretty convoluted.  It's simpler to do the 4 operations
2218      (MIN0 OP MIN1, MIN0 OP MAX1, MAX0 OP MIN1 and MAX0 OP MAX0 OP
2219      MAX1) and then figure the smallest and largest values to form
2220      the new range.  */
2221   gcc_assert (code == MULT_EXPR
2222 	      || code == TRUNC_DIV_EXPR
2223 	      || code == FLOOR_DIV_EXPR
2224 	      || code == CEIL_DIV_EXPR
2225 	      || code == EXACT_DIV_EXPR
2226 	      || code == ROUND_DIV_EXPR
2227 	      || code == RSHIFT_EXPR);
2228   gcc_assert ((vr0->type == VR_RANGE
2229 	       || (code == MULT_EXPR && vr0->type == VR_ANTI_RANGE))
2230 	      && vr0->type == vr1->type);
2231 
2232   type = vr0->type;
2233 
2234   /* Compute the 4 cross operations.  */
2235   sop = false;
2236   val[0] = vrp_int_const_binop (code, vr0->min, vr1->min);
2237   if (val[0] == NULL_TREE)
2238     sop = true;
2239 
2240   if (vr1->max == vr1->min)
2241     val[1] = NULL_TREE;
2242   else
2243     {
2244       val[1] = vrp_int_const_binop (code, vr0->min, vr1->max);
2245       if (val[1] == NULL_TREE)
2246 	sop = true;
2247     }
2248 
2249   if (vr0->max == vr0->min)
2250     val[2] = NULL_TREE;
2251   else
2252     {
2253       val[2] = vrp_int_const_binop (code, vr0->max, vr1->min);
2254       if (val[2] == NULL_TREE)
2255 	sop = true;
2256     }
2257 
2258   if (vr0->min == vr0->max || vr1->min == vr1->max)
2259     val[3] = NULL_TREE;
2260   else
2261     {
2262       val[3] = vrp_int_const_binop (code, vr0->max, vr1->max);
2263       if (val[3] == NULL_TREE)
2264 	sop = true;
2265     }
2266 
2267   if (sop)
2268     {
2269       set_value_range_to_varying (vr);
2270       return;
2271     }
2272 
2273   /* Set MIN to the minimum of VAL[i] and MAX to the maximum
2274      of VAL[i].  */
2275   min = val[0];
2276   max = val[0];
2277   for (i = 1; i < 4; i++)
2278     {
2279       if (!is_gimple_min_invariant (min)
2280 	  || (TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2281 	  || !is_gimple_min_invariant (max)
2282 	  || (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2283 	break;
2284 
2285       if (val[i])
2286 	{
2287 	  if (!is_gimple_min_invariant (val[i])
2288 	      || (TREE_OVERFLOW (val[i])
2289 		  && !is_overflow_infinity (val[i])))
2290 	    {
2291 	      /* If we found an overflowed value, set MIN and MAX
2292 		 to it so that we set the resulting range to
2293 		 VARYING.  */
2294 	      min = max = val[i];
2295 	      break;
2296 	    }
2297 
2298 	  if (compare_values (val[i], min) == -1)
2299 	    min = val[i];
2300 
2301 	  if (compare_values (val[i], max) == 1)
2302 	    max = val[i];
2303 	}
2304     }
2305 
2306   /* If either MIN or MAX overflowed, then set the resulting range to
2307      VARYING.  But we do accept an overflow infinity
2308      representation.  */
2309   if (min == NULL_TREE
2310       || !is_gimple_min_invariant (min)
2311       || (TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2312       || max == NULL_TREE
2313       || !is_gimple_min_invariant (max)
2314       || (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2315     {
2316       set_value_range_to_varying (vr);
2317       return;
2318     }
2319 
2320   /* We punt if:
2321      1) [-INF, +INF]
2322      2) [-INF, +-INF(OVF)]
2323      3) [+-INF(OVF), +INF]
2324      4) [+-INF(OVF), +-INF(OVF)]
2325      We learn nothing when we have INF and INF(OVF) on both sides.
2326      Note that we do accept [-INF, -INF] and [+INF, +INF] without
2327      overflow.  */
2328   if ((vrp_val_is_min (min) || is_overflow_infinity (min))
2329       && (vrp_val_is_max (max) || is_overflow_infinity (max)))
2330     {
2331       set_value_range_to_varying (vr);
2332       return;
2333     }
2334 
2335   cmp = compare_values (min, max);
2336   if (cmp == -2 || cmp == 1)
2337     {
2338       /* If the new range has its limits swapped around (MIN > MAX),
2339 	 then the operation caused one of them to wrap around, mark
2340 	 the new range VARYING.  */
2341       set_value_range_to_varying (vr);
2342     }
2343   else
2344     set_value_range (vr, type, min, max, NULL);
2345 }
2346 
2347 /* Extract range information from a binary operation CODE based on
2348    the ranges of each of its operands, *VR0 and *VR1 with resulting
2349    type EXPR_TYPE.  The resulting range is stored in *VR.  */
2350 
2351 static void
2352 extract_range_from_binary_expr_1 (value_range_t *vr,
2353 				  enum tree_code code, tree expr_type,
2354 				  value_range_t *vr0_, value_range_t *vr1_)
2355 {
2356   value_range_t vr0 = *vr0_, vr1 = *vr1_;
2357   enum value_range_type type;
2358   tree min = NULL_TREE, max = NULL_TREE;
2359   int cmp;
2360 
2361   if (!INTEGRAL_TYPE_P (expr_type)
2362       && !POINTER_TYPE_P (expr_type))
2363     {
2364       set_value_range_to_varying (vr);
2365       return;
2366     }
2367 
2368   /* Not all binary expressions can be applied to ranges in a
2369      meaningful way.  Handle only arithmetic operations.  */
2370   if (code != PLUS_EXPR
2371       && code != MINUS_EXPR
2372       && code != POINTER_PLUS_EXPR
2373       && code != MULT_EXPR
2374       && code != TRUNC_DIV_EXPR
2375       && code != FLOOR_DIV_EXPR
2376       && code != CEIL_DIV_EXPR
2377       && code != EXACT_DIV_EXPR
2378       && code != ROUND_DIV_EXPR
2379       && code != TRUNC_MOD_EXPR
2380       && code != RSHIFT_EXPR
2381       && code != MIN_EXPR
2382       && code != MAX_EXPR
2383       && code != BIT_AND_EXPR
2384       && code != BIT_IOR_EXPR
2385       && code != BIT_XOR_EXPR)
2386     {
2387       set_value_range_to_varying (vr);
2388       return;
2389     }
2390 
2391   /* If both ranges are UNDEFINED, so is the result.  */
2392   if (vr0.type == VR_UNDEFINED && vr1.type == VR_UNDEFINED)
2393     {
2394       set_value_range_to_undefined (vr);
2395       return;
2396     }
2397   /* If one of the ranges is UNDEFINED drop it to VARYING for the following
2398      code.  At some point we may want to special-case operations that
2399      have UNDEFINED result for all or some value-ranges of the not UNDEFINED
2400      operand.  */
2401   else if (vr0.type == VR_UNDEFINED)
2402     set_value_range_to_varying (&vr0);
2403   else if (vr1.type == VR_UNDEFINED)
2404     set_value_range_to_varying (&vr1);
2405 
2406   /* The type of the resulting value range defaults to VR0.TYPE.  */
2407   type = vr0.type;
2408 
2409   /* Refuse to operate on VARYING ranges, ranges of different kinds
2410      and symbolic ranges.  As an exception, we allow BIT_AND_EXPR
2411      because we may be able to derive a useful range even if one of
2412      the operands is VR_VARYING or symbolic range.  Similarly for
2413      divisions.  TODO, we may be able to derive anti-ranges in
2414      some cases.  */
2415   if (code != BIT_AND_EXPR
2416       && code != BIT_IOR_EXPR
2417       && code != TRUNC_DIV_EXPR
2418       && code != FLOOR_DIV_EXPR
2419       && code != CEIL_DIV_EXPR
2420       && code != EXACT_DIV_EXPR
2421       && code != ROUND_DIV_EXPR
2422       && code != TRUNC_MOD_EXPR
2423       && (vr0.type == VR_VARYING
2424 	  || vr1.type == VR_VARYING
2425 	  || vr0.type != vr1.type
2426 	  || symbolic_range_p (&vr0)
2427 	  || symbolic_range_p (&vr1)))
2428     {
2429       set_value_range_to_varying (vr);
2430       return;
2431     }
2432 
2433   /* Now evaluate the expression to determine the new range.  */
2434   if (POINTER_TYPE_P (expr_type))
2435     {
2436       if (code == MIN_EXPR || code == MAX_EXPR)
2437 	{
2438 	  /* For MIN/MAX expressions with pointers, we only care about
2439 	     nullness, if both are non null, then the result is nonnull.
2440 	     If both are null, then the result is null. Otherwise they
2441 	     are varying.  */
2442 	  if (range_is_nonnull (&vr0) && range_is_nonnull (&vr1))
2443 	    set_value_range_to_nonnull (vr, expr_type);
2444 	  else if (range_is_null (&vr0) && range_is_null (&vr1))
2445 	    set_value_range_to_null (vr, expr_type);
2446 	  else
2447 	    set_value_range_to_varying (vr);
2448 	}
2449       else if (code == POINTER_PLUS_EXPR)
2450 	{
2451 	  /* For pointer types, we are really only interested in asserting
2452 	     whether the expression evaluates to non-NULL.  */
2453 	  if (range_is_nonnull (&vr0) || range_is_nonnull (&vr1))
2454 	    set_value_range_to_nonnull (vr, expr_type);
2455 	  else if (range_is_null (&vr0) && range_is_null (&vr1))
2456 	    set_value_range_to_null (vr, expr_type);
2457 	  else
2458 	    set_value_range_to_varying (vr);
2459 	}
2460       else if (code == BIT_AND_EXPR)
2461 	{
2462 	  /* For pointer types, we are really only interested in asserting
2463 	     whether the expression evaluates to non-NULL.  */
2464 	  if (range_is_nonnull (&vr0) && range_is_nonnull (&vr1))
2465 	    set_value_range_to_nonnull (vr, expr_type);
2466 	  else if (range_is_null (&vr0) || range_is_null (&vr1))
2467 	    set_value_range_to_null (vr, expr_type);
2468 	  else
2469 	    set_value_range_to_varying (vr);
2470 	}
2471       else
2472 	set_value_range_to_varying (vr);
2473 
2474       return;
2475     }
2476 
2477   /* For integer ranges, apply the operation to each end of the
2478      range and see what we end up with.  */
2479   if (code == PLUS_EXPR)
2480     {
2481       /* If we have a PLUS_EXPR with two VR_ANTI_RANGEs, drop to
2482 	 VR_VARYING.  It would take more effort to compute a precise
2483 	 range for such a case.  For example, if we have op0 == 1 and
2484 	 op1 == -1 with their ranges both being ~[0,0], we would have
2485 	 op0 + op1 == 0, so we cannot claim that the sum is in ~[0,0].
2486 	 Note that we are guaranteed to have vr0.type == vr1.type at
2487 	 this point.  */
2488       if (vr0.type == VR_ANTI_RANGE)
2489 	{
2490 	  set_value_range_to_varying (vr);
2491 	  return;
2492 	}
2493 
2494       /* For operations that make the resulting range directly
2495 	 proportional to the original ranges, apply the operation to
2496 	 the same end of each range.  */
2497       min = vrp_int_const_binop (code, vr0.min, vr1.min);
2498       max = vrp_int_const_binop (code, vr0.max, vr1.max);
2499 
2500       /* If both additions overflowed the range kind is still correct.
2501 	 This happens regularly with subtracting something in unsigned
2502 	 arithmetic.
2503          ???  See PR30318 for all the cases we do not handle.  */
2504       if ((TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2505 	  && (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2506 	{
2507 	  min = build_int_cst_wide (TREE_TYPE (min),
2508 				    TREE_INT_CST_LOW (min),
2509 				    TREE_INT_CST_HIGH (min));
2510 	  max = build_int_cst_wide (TREE_TYPE (max),
2511 				    TREE_INT_CST_LOW (max),
2512 				    TREE_INT_CST_HIGH (max));
2513 	}
2514     }
2515   else if (code == MIN_EXPR
2516 	   || code == MAX_EXPR)
2517     {
2518       if (vr0.type == VR_ANTI_RANGE)
2519 	{
2520 	  /* For MIN_EXPR and MAX_EXPR with two VR_ANTI_RANGEs,
2521 	     the resulting VR_ANTI_RANGE is the same - intersection
2522 	     of the two ranges.  */
2523 	  min = vrp_int_const_binop (MAX_EXPR, vr0.min, vr1.min);
2524 	  max = vrp_int_const_binop (MIN_EXPR, vr0.max, vr1.max);
2525 	}
2526       else
2527 	{
2528 	  /* For operations that make the resulting range directly
2529 	     proportional to the original ranges, apply the operation to
2530 	     the same end of each range.  */
2531 	  min = vrp_int_const_binop (code, vr0.min, vr1.min);
2532 	  max = vrp_int_const_binop (code, vr0.max, vr1.max);
2533 	}
2534     }
2535   else if (code == MULT_EXPR)
2536     {
2537       /* If we have an unsigned MULT_EXPR with two VR_ANTI_RANGEs,
2538 	 drop to VR_VARYING.  It would take more effort to compute a
2539 	 precise range for such a case.  For example, if we have
2540 	 op0 == 65536 and op1 == 65536 with their ranges both being
2541 	 ~[0,0] on a 32-bit machine, we would have op0 * op1 == 0, so
2542 	 we cannot claim that the product is in ~[0,0].  Note that we
2543 	 are guaranteed to have vr0.type == vr1.type at this
2544 	 point.  */
2545       if (vr0.type == VR_ANTI_RANGE
2546 	  && !TYPE_OVERFLOW_UNDEFINED (expr_type))
2547 	{
2548 	  set_value_range_to_varying (vr);
2549 	  return;
2550 	}
2551 
2552       extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
2553       return;
2554     }
2555   else if (code == RSHIFT_EXPR)
2556     {
2557       /* If we have a RSHIFT_EXPR with any shift values outside [0..prec-1],
2558 	 then drop to VR_VARYING.  Outside of this range we get undefined
2559 	 behavior from the shift operation.  We cannot even trust
2560 	 SHIFT_COUNT_TRUNCATED at this stage, because that applies to rtl
2561 	 shifts, and the operation at the tree level may be widened.  */
2562       if (vr1.type != VR_RANGE
2563 	  || !value_range_nonnegative_p (&vr1)
2564 	  || TREE_CODE (vr1.max) != INTEGER_CST
2565 	  || compare_tree_int (vr1.max, TYPE_PRECISION (expr_type) - 1) == 1)
2566 	{
2567 	  set_value_range_to_varying (vr);
2568 	  return;
2569 	}
2570 
2571       extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
2572       return;
2573     }
2574   else if (code == TRUNC_DIV_EXPR
2575 	   || code == FLOOR_DIV_EXPR
2576 	   || code == CEIL_DIV_EXPR
2577 	   || code == EXACT_DIV_EXPR
2578 	   || code == ROUND_DIV_EXPR)
2579     {
2580       if (vr0.type != VR_RANGE || symbolic_range_p (&vr0))
2581 	{
2582 	  /* For division, if op1 has VR_RANGE but op0 does not, something
2583 	     can be deduced just from that range.  Say [min, max] / [4, max]
2584 	     gives [min / 4, max / 4] range.  */
2585 	  if (vr1.type == VR_RANGE
2586 	      && !symbolic_range_p (&vr1)
2587 	      && range_includes_zero_p (vr1.min, vr1.max) == 0)
2588 	    {
2589 	      vr0.type = type = VR_RANGE;
2590 	      vr0.min = vrp_val_min (expr_type);
2591 	      vr0.max = vrp_val_max (expr_type);
2592 	    }
2593 	  else
2594 	    {
2595 	      set_value_range_to_varying (vr);
2596 	      return;
2597 	    }
2598 	}
2599 
2600       /* For divisions, if flag_non_call_exceptions is true, we must
2601 	 not eliminate a division by zero.  */
2602       if (cfun->can_throw_non_call_exceptions
2603 	  && (vr1.type != VR_RANGE
2604 	      || range_includes_zero_p (vr1.min, vr1.max) != 0))
2605 	{
2606 	  set_value_range_to_varying (vr);
2607 	  return;
2608 	}
2609 
2610       /* For divisions, if op0 is VR_RANGE, we can deduce a range
2611 	 even if op1 is VR_VARYING, VR_ANTI_RANGE, symbolic or can
2612 	 include 0.  */
2613       if (vr0.type == VR_RANGE
2614 	  && (vr1.type != VR_RANGE
2615 	      || range_includes_zero_p (vr1.min, vr1.max) != 0))
2616 	{
2617 	  tree zero = build_int_cst (TREE_TYPE (vr0.min), 0);
2618 	  int cmp;
2619 
2620 	  min = NULL_TREE;
2621 	  max = NULL_TREE;
2622 	  if (TYPE_UNSIGNED (expr_type)
2623 	      || value_range_nonnegative_p (&vr1))
2624 	    {
2625 	      /* For unsigned division or when divisor is known
2626 		 to be non-negative, the range has to cover
2627 		 all numbers from 0 to max for positive max
2628 		 and all numbers from min to 0 for negative min.  */
2629 	      cmp = compare_values (vr0.max, zero);
2630 	      if (cmp == -1)
2631 		max = zero;
2632 	      else if (cmp == 0 || cmp == 1)
2633 		max = vr0.max;
2634 	      else
2635 		type = VR_VARYING;
2636 	      cmp = compare_values (vr0.min, zero);
2637 	      if (cmp == 1)
2638 		min = zero;
2639 	      else if (cmp == 0 || cmp == -1)
2640 		min = vr0.min;
2641 	      else
2642 		type = VR_VARYING;
2643 	    }
2644 	  else
2645 	    {
2646 	      /* Otherwise the range is -max .. max or min .. -min
2647 		 depending on which bound is bigger in absolute value,
2648 		 as the division can change the sign.  */
2649 	      abs_extent_range (vr, vr0.min, vr0.max);
2650 	      return;
2651 	    }
2652 	  if (type == VR_VARYING)
2653 	    {
2654 	      set_value_range_to_varying (vr);
2655 	      return;
2656 	    }
2657 	}
2658       else
2659 	{
2660 	  extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
2661 	  return;
2662 	}
2663     }
2664   else if (code == TRUNC_MOD_EXPR)
2665     {
2666       if (vr1.type != VR_RANGE
2667 	  || range_includes_zero_p (vr1.min, vr1.max) != 0
2668 	  || vrp_val_is_min (vr1.min))
2669 	{
2670 	  set_value_range_to_varying (vr);
2671 	  return;
2672 	}
2673       type = VR_RANGE;
2674       /* Compute MAX <|vr1.min|, |vr1.max|> - 1.  */
2675       max = fold_unary_to_constant (ABS_EXPR, expr_type, vr1.min);
2676       if (tree_int_cst_lt (max, vr1.max))
2677 	max = vr1.max;
2678       max = int_const_binop (MINUS_EXPR, max, integer_one_node);
2679       /* If the dividend is non-negative the modulus will be
2680 	 non-negative as well.  */
2681       if (TYPE_UNSIGNED (expr_type)
2682 	  || value_range_nonnegative_p (&vr0))
2683 	min = build_int_cst (TREE_TYPE (max), 0);
2684       else
2685 	min = fold_unary_to_constant (NEGATE_EXPR, expr_type, max);
2686     }
2687   else if (code == MINUS_EXPR)
2688     {
2689       /* If we have a MINUS_EXPR with two VR_ANTI_RANGEs, drop to
2690 	 VR_VARYING.  It would take more effort to compute a precise
2691 	 range for such a case.  For example, if we have op0 == 1 and
2692 	 op1 == 1 with their ranges both being ~[0,0], we would have
2693 	 op0 - op1 == 0, so we cannot claim that the difference is in
2694 	 ~[0,0].  Note that we are guaranteed to have
2695 	 vr0.type == vr1.type at this point.  */
2696       if (vr0.type == VR_ANTI_RANGE)
2697 	{
2698 	  set_value_range_to_varying (vr);
2699 	  return;
2700 	}
2701 
2702       /* For MINUS_EXPR, apply the operation to the opposite ends of
2703 	 each range.  */
2704       min = vrp_int_const_binop (code, vr0.min, vr1.max);
2705       max = vrp_int_const_binop (code, vr0.max, vr1.min);
2706     }
2707   else if (code == BIT_AND_EXPR || code == BIT_IOR_EXPR || code == BIT_XOR_EXPR)
2708     {
2709       bool int_cst_range0, int_cst_range1;
2710       double_int may_be_nonzero0, may_be_nonzero1;
2711       double_int must_be_nonzero0, must_be_nonzero1;
2712 
2713       int_cst_range0 = zero_nonzero_bits_from_vr (&vr0, &may_be_nonzero0,
2714 						  &must_be_nonzero0);
2715       int_cst_range1 = zero_nonzero_bits_from_vr (&vr1, &may_be_nonzero1,
2716 						  &must_be_nonzero1);
2717 
2718       type = VR_RANGE;
2719       if (code == BIT_AND_EXPR)
2720 	{
2721 	  double_int dmax;
2722 	  min = double_int_to_tree (expr_type,
2723 				    double_int_and (must_be_nonzero0,
2724 						    must_be_nonzero1));
2725 	  dmax = double_int_and (may_be_nonzero0, may_be_nonzero1);
2726 	  /* If both input ranges contain only negative values we can
2727 	     truncate the result range maximum to the minimum of the
2728 	     input range maxima.  */
2729 	  if (int_cst_range0 && int_cst_range1
2730 	      && tree_int_cst_sgn (vr0.max) < 0
2731 	      && tree_int_cst_sgn (vr1.max) < 0)
2732 	    {
2733 	      dmax = double_int_min (dmax, tree_to_double_int (vr0.max),
2734 				     TYPE_UNSIGNED (expr_type));
2735 	      dmax = double_int_min (dmax, tree_to_double_int (vr1.max),
2736 				     TYPE_UNSIGNED (expr_type));
2737 	    }
2738 	  /* If either input range contains only non-negative values
2739 	     we can truncate the result range maximum to the respective
2740 	     maximum of the input range.  */
2741 	  if (int_cst_range0 && tree_int_cst_sgn (vr0.min) >= 0)
2742 	    dmax = double_int_min (dmax, tree_to_double_int (vr0.max),
2743 				   TYPE_UNSIGNED (expr_type));
2744 	  if (int_cst_range1 && tree_int_cst_sgn (vr1.min) >= 0)
2745 	    dmax = double_int_min (dmax, tree_to_double_int (vr1.max),
2746 				   TYPE_UNSIGNED (expr_type));
2747 	  max = double_int_to_tree (expr_type, dmax);
2748 	}
2749       else if (code == BIT_IOR_EXPR)
2750 	{
2751 	  double_int dmin;
2752 	  max = double_int_to_tree (expr_type,
2753 				    double_int_ior (may_be_nonzero0,
2754 						    may_be_nonzero1));
2755 	  dmin = double_int_ior (must_be_nonzero0, must_be_nonzero1);
2756 	  /* If the input ranges contain only positive values we can
2757 	     truncate the minimum of the result range to the maximum
2758 	     of the input range minima.  */
2759 	  if (int_cst_range0 && int_cst_range1
2760 	      && tree_int_cst_sgn (vr0.min) >= 0
2761 	      && tree_int_cst_sgn (vr1.min) >= 0)
2762 	    {
2763 	      dmin = double_int_max (dmin, tree_to_double_int (vr0.min),
2764 				     TYPE_UNSIGNED (expr_type));
2765 	      dmin = double_int_max (dmin, tree_to_double_int (vr1.min),
2766 				     TYPE_UNSIGNED (expr_type));
2767 	    }
2768 	  /* If either input range contains only negative values
2769 	     we can truncate the minimum of the result range to the
2770 	     respective minimum range.  */
2771 	  if (int_cst_range0 && tree_int_cst_sgn (vr0.max) < 0)
2772 	    dmin = double_int_max (dmin, tree_to_double_int (vr0.min),
2773 				   TYPE_UNSIGNED (expr_type));
2774 	  if (int_cst_range1 && tree_int_cst_sgn (vr1.max) < 0)
2775 	    dmin = double_int_max (dmin, tree_to_double_int (vr1.min),
2776 				   TYPE_UNSIGNED (expr_type));
2777 	  min = double_int_to_tree (expr_type, dmin);
2778 	}
2779       else if (code == BIT_XOR_EXPR)
2780 	{
2781 	  double_int result_zero_bits, result_one_bits;
2782 	  result_zero_bits
2783 	    = double_int_ior (double_int_and (must_be_nonzero0,
2784 					      must_be_nonzero1),
2785 			      double_int_not
2786 			        (double_int_ior (may_be_nonzero0,
2787 						 may_be_nonzero1)));
2788 	  result_one_bits
2789 	    = double_int_ior (double_int_and
2790 			        (must_be_nonzero0,
2791 				 double_int_not (may_be_nonzero1)),
2792 			      double_int_and
2793 			        (must_be_nonzero1,
2794 				 double_int_not (may_be_nonzero0)));
2795 	  max = double_int_to_tree (expr_type,
2796 				    double_int_not (result_zero_bits));
2797 	  min = double_int_to_tree (expr_type, result_one_bits);
2798 	  /* If the range has all positive or all negative values the
2799 	     result is better than VARYING.  */
2800 	  if (tree_int_cst_sgn (min) < 0
2801 	      || tree_int_cst_sgn (max) >= 0)
2802 	    ;
2803 	  else
2804 	    max = min = NULL_TREE;
2805 	}
2806     }
2807   else
2808     gcc_unreachable ();
2809 
2810   /* If either MIN or MAX overflowed, then set the resulting range to
2811      VARYING.  But we do accept an overflow infinity
2812      representation.  */
2813   if (min == NULL_TREE
2814       || !is_gimple_min_invariant (min)
2815       || (TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2816       || max == NULL_TREE
2817       || !is_gimple_min_invariant (max)
2818       || (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2819     {
2820       set_value_range_to_varying (vr);
2821       return;
2822     }
2823 
2824   /* We punt if:
2825      1) [-INF, +INF]
2826      2) [-INF, +-INF(OVF)]
2827      3) [+-INF(OVF), +INF]
2828      4) [+-INF(OVF), +-INF(OVF)]
2829      We learn nothing when we have INF and INF(OVF) on both sides.
2830      Note that we do accept [-INF, -INF] and [+INF, +INF] without
2831      overflow.  */
2832   if ((vrp_val_is_min (min) || is_overflow_infinity (min))
2833       && (vrp_val_is_max (max) || is_overflow_infinity (max)))
2834     {
2835       set_value_range_to_varying (vr);
2836       return;
2837     }
2838 
2839   cmp = compare_values (min, max);
2840   if (cmp == -2 || cmp == 1)
2841     {
2842       /* If the new range has its limits swapped around (MIN > MAX),
2843 	 then the operation caused one of them to wrap around, mark
2844 	 the new range VARYING.  */
2845       set_value_range_to_varying (vr);
2846     }
2847   else
2848     set_value_range (vr, type, min, max, NULL);
2849 }
2850 
2851 /* Extract range information from a binary expression OP0 CODE OP1 based on
2852    the ranges of each of its operands with resulting type EXPR_TYPE.
2853    The resulting range is stored in *VR.  */
2854 
2855 static void
2856 extract_range_from_binary_expr (value_range_t *vr,
2857 				enum tree_code code,
2858 				tree expr_type, tree op0, tree op1)
2859 {
2860   value_range_t vr0 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
2861   value_range_t vr1 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
2862 
2863   /* Get value ranges for each operand.  For constant operands, create
2864      a new value range with the operand to simplify processing.  */
2865   if (TREE_CODE (op0) == SSA_NAME)
2866     vr0 = *(get_value_range (op0));
2867   else if (is_gimple_min_invariant (op0))
2868     set_value_range_to_value (&vr0, op0, NULL);
2869   else
2870     set_value_range_to_varying (&vr0);
2871 
2872   if (TREE_CODE (op1) == SSA_NAME)
2873     vr1 = *(get_value_range (op1));
2874   else if (is_gimple_min_invariant (op1))
2875     set_value_range_to_value (&vr1, op1, NULL);
2876   else
2877     set_value_range_to_varying (&vr1);
2878 
2879   extract_range_from_binary_expr_1 (vr, code, expr_type, &vr0, &vr1);
2880 }
2881 
2882 /* Extract range information from a unary operation CODE based on
2883    the range of its operand *VR0 with type OP0_TYPE with resulting type TYPE.
2884    The The resulting range is stored in *VR.  */
2885 
2886 static void
2887 extract_range_from_unary_expr_1 (value_range_t *vr,
2888 				 enum tree_code code, tree type,
2889 				 value_range_t *vr0_, tree op0_type)
2890 {
2891   value_range_t vr0 = *vr0_;
2892 
2893   /* VRP only operates on integral and pointer types.  */
2894   if (!(INTEGRAL_TYPE_P (op0_type)
2895 	|| POINTER_TYPE_P (op0_type))
2896       || !(INTEGRAL_TYPE_P (type)
2897 	   || POINTER_TYPE_P (type)))
2898     {
2899       set_value_range_to_varying (vr);
2900       return;
2901     }
2902 
2903   /* If VR0 is UNDEFINED, so is the result.  */
2904   if (vr0.type == VR_UNDEFINED)
2905     {
2906       set_value_range_to_undefined (vr);
2907       return;
2908     }
2909 
2910   if (CONVERT_EXPR_CODE_P (code))
2911     {
2912       tree inner_type = op0_type;
2913       tree outer_type = type;
2914 
2915       /* If the expression evaluates to a pointer, we are only interested in
2916 	 determining if it evaluates to NULL [0, 0] or non-NULL (~[0, 0]).  */
2917       if (POINTER_TYPE_P (type))
2918 	{
2919 	  if (range_is_nonnull (&vr0))
2920 	    set_value_range_to_nonnull (vr, type);
2921 	  else if (range_is_null (&vr0))
2922 	    set_value_range_to_null (vr, type);
2923 	  else
2924 	    set_value_range_to_varying (vr);
2925 	  return;
2926 	}
2927 
2928       /* If VR0 is varying and we increase the type precision, assume
2929 	 a full range for the following transformation.  */
2930       if (vr0.type == VR_VARYING
2931 	  && INTEGRAL_TYPE_P (inner_type)
2932 	  && TYPE_PRECISION (inner_type) < TYPE_PRECISION (outer_type))
2933 	{
2934 	  vr0.type = VR_RANGE;
2935 	  vr0.min = TYPE_MIN_VALUE (inner_type);
2936 	  vr0.max = TYPE_MAX_VALUE (inner_type);
2937 	}
2938 
2939       /* If VR0 is a constant range or anti-range and the conversion is
2940 	 not truncating we can convert the min and max values and
2941 	 canonicalize the resulting range.  Otherwise we can do the
2942 	 conversion if the size of the range is less than what the
2943 	 precision of the target type can represent and the range is
2944 	 not an anti-range.  */
2945       if ((vr0.type == VR_RANGE
2946 	   || vr0.type == VR_ANTI_RANGE)
2947 	  && TREE_CODE (vr0.min) == INTEGER_CST
2948 	  && TREE_CODE (vr0.max) == INTEGER_CST
2949 	  && (!is_overflow_infinity (vr0.min)
2950 	      || (vr0.type == VR_RANGE
2951 		  && TYPE_PRECISION (outer_type) > TYPE_PRECISION (inner_type)
2952 		  && needs_overflow_infinity (outer_type)
2953 		  && supports_overflow_infinity (outer_type)))
2954 	  && (!is_overflow_infinity (vr0.max)
2955 	      || (vr0.type == VR_RANGE
2956 		  && TYPE_PRECISION (outer_type) > TYPE_PRECISION (inner_type)
2957 		  && needs_overflow_infinity (outer_type)
2958 		  && supports_overflow_infinity (outer_type)))
2959 	  && (TYPE_PRECISION (outer_type) >= TYPE_PRECISION (inner_type)
2960 	      || (vr0.type == VR_RANGE
2961 		  && integer_zerop (int_const_binop (RSHIFT_EXPR,
2962 		       int_const_binop (MINUS_EXPR, vr0.max, vr0.min),
2963 		         size_int (TYPE_PRECISION (outer_type)))))))
2964 	{
2965 	  tree new_min, new_max;
2966 	  if (is_overflow_infinity (vr0.min))
2967 	    new_min = negative_overflow_infinity (outer_type);
2968 	  else
2969 	    new_min = force_fit_type_double (outer_type,
2970 					     tree_to_double_int (vr0.min),
2971 					     0, false);
2972 	  if (is_overflow_infinity (vr0.max))
2973 	    new_max = positive_overflow_infinity (outer_type);
2974 	  else
2975 	    new_max = force_fit_type_double (outer_type,
2976 					     tree_to_double_int (vr0.max),
2977 					     0, false);
2978 	  set_and_canonicalize_value_range (vr, vr0.type,
2979 					    new_min, new_max, NULL);
2980 	  return;
2981 	}
2982 
2983       set_value_range_to_varying (vr);
2984       return;
2985     }
2986   else if (code == NEGATE_EXPR)
2987     {
2988       /* -X is simply 0 - X, so re-use existing code that also handles
2989          anti-ranges fine.  */
2990       value_range_t zero = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
2991       set_value_range_to_value (&zero, build_int_cst (type, 0), NULL);
2992       extract_range_from_binary_expr_1 (vr, MINUS_EXPR, type, &zero, &vr0);
2993       return;
2994     }
2995   else if (code == ABS_EXPR)
2996     {
2997       tree min, max;
2998       int cmp;
2999 
3000       /* Pass through vr0 in the easy cases.  */
3001       if (TYPE_UNSIGNED (type)
3002 	  || value_range_nonnegative_p (&vr0))
3003 	{
3004 	  copy_value_range (vr, &vr0);
3005 	  return;
3006 	}
3007 
3008       /* For the remaining varying or symbolic ranges we can't do anything
3009 	 useful.  */
3010       if (vr0.type == VR_VARYING
3011 	  || symbolic_range_p (&vr0))
3012 	{
3013 	  set_value_range_to_varying (vr);
3014 	  return;
3015 	}
3016 
3017       /* -TYPE_MIN_VALUE = TYPE_MIN_VALUE with flag_wrapv so we can't get a
3018          useful range.  */
3019       if (!TYPE_OVERFLOW_UNDEFINED (type)
3020 	  && ((vr0.type == VR_RANGE
3021 	       && vrp_val_is_min (vr0.min))
3022 	      || (vr0.type == VR_ANTI_RANGE
3023 		  && !vrp_val_is_min (vr0.min))))
3024 	{
3025 	  set_value_range_to_varying (vr);
3026 	  return;
3027 	}
3028 
3029       /* ABS_EXPR may flip the range around, if the original range
3030 	 included negative values.  */
3031       if (is_overflow_infinity (vr0.min))
3032 	min = positive_overflow_infinity (type);
3033       else if (!vrp_val_is_min (vr0.min))
3034 	min = fold_unary_to_constant (code, type, vr0.min);
3035       else if (!needs_overflow_infinity (type))
3036 	min = TYPE_MAX_VALUE (type);
3037       else if (supports_overflow_infinity (type))
3038 	min = positive_overflow_infinity (type);
3039       else
3040 	{
3041 	  set_value_range_to_varying (vr);
3042 	  return;
3043 	}
3044 
3045       if (is_overflow_infinity (vr0.max))
3046 	max = positive_overflow_infinity (type);
3047       else if (!vrp_val_is_min (vr0.max))
3048 	max = fold_unary_to_constant (code, type, vr0.max);
3049       else if (!needs_overflow_infinity (type))
3050 	max = TYPE_MAX_VALUE (type);
3051       else if (supports_overflow_infinity (type)
3052 	       /* We shouldn't generate [+INF, +INF] as set_value_range
3053 		  doesn't like this and ICEs.  */
3054 	       && !is_positive_overflow_infinity (min))
3055 	max = positive_overflow_infinity (type);
3056       else
3057 	{
3058 	  set_value_range_to_varying (vr);
3059 	  return;
3060 	}
3061 
3062       cmp = compare_values (min, max);
3063 
3064       /* If a VR_ANTI_RANGEs contains zero, then we have
3065 	 ~[-INF, min(MIN, MAX)].  */
3066       if (vr0.type == VR_ANTI_RANGE)
3067 	{
3068 	  if (range_includes_zero_p (vr0.min, vr0.max) == 1)
3069 	    {
3070 	      /* Take the lower of the two values.  */
3071 	      if (cmp != 1)
3072 		max = min;
3073 
3074 	      /* Create ~[-INF, min (abs(MIN), abs(MAX))]
3075 	         or ~[-INF + 1, min (abs(MIN), abs(MAX))] when
3076 		 flag_wrapv is set and the original anti-range doesn't include
3077 	         TYPE_MIN_VALUE, remember -TYPE_MIN_VALUE = TYPE_MIN_VALUE.  */
3078 	      if (TYPE_OVERFLOW_WRAPS (type))
3079 		{
3080 		  tree type_min_value = TYPE_MIN_VALUE (type);
3081 
3082 		  min = (vr0.min != type_min_value
3083 			 ? int_const_binop (PLUS_EXPR, type_min_value,
3084 					    integer_one_node)
3085 			 : type_min_value);
3086 		}
3087 	      else
3088 		{
3089 		  if (overflow_infinity_range_p (&vr0))
3090 		    min = negative_overflow_infinity (type);
3091 		  else
3092 		    min = TYPE_MIN_VALUE (type);
3093 		}
3094 	    }
3095 	  else
3096 	    {
3097 	      /* All else has failed, so create the range [0, INF], even for
3098 	         flag_wrapv since TYPE_MIN_VALUE is in the original
3099 	         anti-range.  */
3100 	      vr0.type = VR_RANGE;
3101 	      min = build_int_cst (type, 0);
3102 	      if (needs_overflow_infinity (type))
3103 		{
3104 		  if (supports_overflow_infinity (type))
3105 		    max = positive_overflow_infinity (type);
3106 		  else
3107 		    {
3108 		      set_value_range_to_varying (vr);
3109 		      return;
3110 		    }
3111 		}
3112 	      else
3113 		max = TYPE_MAX_VALUE (type);
3114 	    }
3115 	}
3116 
3117       /* If the range contains zero then we know that the minimum value in the
3118          range will be zero.  */
3119       else if (range_includes_zero_p (vr0.min, vr0.max) == 1)
3120 	{
3121 	  if (cmp == 1)
3122 	    max = min;
3123 	  min = build_int_cst (type, 0);
3124 	}
3125       else
3126 	{
3127           /* If the range was reversed, swap MIN and MAX.  */
3128 	  if (cmp == 1)
3129 	    {
3130 	      tree t = min;
3131 	      min = max;
3132 	      max = t;
3133 	    }
3134 	}
3135 
3136       cmp = compare_values (min, max);
3137       if (cmp == -2 || cmp == 1)
3138 	{
3139 	  /* If the new range has its limits swapped around (MIN > MAX),
3140 	     then the operation caused one of them to wrap around, mark
3141 	     the new range VARYING.  */
3142 	  set_value_range_to_varying (vr);
3143 	}
3144       else
3145 	set_value_range (vr, vr0.type, min, max, NULL);
3146       return;
3147     }
3148   else if (code == BIT_NOT_EXPR)
3149     {
3150       /* ~X is simply -1 - X, so re-use existing code that also handles
3151          anti-ranges fine.  */
3152       value_range_t minusone = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
3153       set_value_range_to_value (&minusone, build_int_cst (type, -1), NULL);
3154       extract_range_from_binary_expr_1 (vr, MINUS_EXPR,
3155 					type, &minusone, &vr0);
3156       return;
3157     }
3158   else if (code == PAREN_EXPR)
3159     {
3160       copy_value_range (vr, &vr0);
3161       return;
3162     }
3163 
3164   /* For unhandled operations fall back to varying.  */
3165   set_value_range_to_varying (vr);
3166   return;
3167 }
3168 
3169 
3170 /* Extract range information from a unary expression CODE OP0 based on
3171    the range of its operand with resulting type TYPE.
3172    The resulting range is stored in *VR.  */
3173 
3174 static void
3175 extract_range_from_unary_expr (value_range_t *vr, enum tree_code code,
3176 			       tree type, tree op0)
3177 {
3178   value_range_t vr0 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
3179 
3180   /* Get value ranges for the operand.  For constant operands, create
3181      a new value range with the operand to simplify processing.  */
3182   if (TREE_CODE (op0) == SSA_NAME)
3183     vr0 = *(get_value_range (op0));
3184   else if (is_gimple_min_invariant (op0))
3185     set_value_range_to_value (&vr0, op0, NULL);
3186   else
3187     set_value_range_to_varying (&vr0);
3188 
3189   extract_range_from_unary_expr_1 (vr, code, type, &vr0, TREE_TYPE (op0));
3190 }
3191 
3192 
3193 /* Extract range information from a conditional expression STMT based on
3194    the ranges of each of its operands and the expression code.  */
3195 
3196 static void
3197 extract_range_from_cond_expr (value_range_t *vr, gimple stmt)
3198 {
3199   tree op0, op1;
3200   value_range_t vr0 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
3201   value_range_t vr1 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
3202 
3203   /* Get value ranges for each operand.  For constant operands, create
3204      a new value range with the operand to simplify processing.  */
3205   op0 = gimple_assign_rhs2 (stmt);
3206   if (TREE_CODE (op0) == SSA_NAME)
3207     vr0 = *(get_value_range (op0));
3208   else if (is_gimple_min_invariant (op0))
3209     set_value_range_to_value (&vr0, op0, NULL);
3210   else
3211     set_value_range_to_varying (&vr0);
3212 
3213   op1 = gimple_assign_rhs3 (stmt);
3214   if (TREE_CODE (op1) == SSA_NAME)
3215     vr1 = *(get_value_range (op1));
3216   else if (is_gimple_min_invariant (op1))
3217     set_value_range_to_value (&vr1, op1, NULL);
3218   else
3219     set_value_range_to_varying (&vr1);
3220 
3221   /* The resulting value range is the union of the operand ranges */
3222   copy_value_range (vr, &vr0);
3223   vrp_meet (vr, &vr1);
3224 }
3225 
3226 
3227 /* Extract range information from a comparison expression EXPR based
3228    on the range of its operand and the expression code.  */
3229 
3230 static void
3231 extract_range_from_comparison (value_range_t *vr, enum tree_code code,
3232 			       tree type, tree op0, tree op1)
3233 {
3234   bool sop = false;
3235   tree val;
3236 
3237   val = vrp_evaluate_conditional_warnv_with_ops (code, op0, op1, false, &sop,
3238   						 NULL);
3239 
3240   /* A disadvantage of using a special infinity as an overflow
3241      representation is that we lose the ability to record overflow
3242      when we don't have an infinity.  So we have to ignore a result
3243      which relies on overflow.  */
3244 
3245   if (val && !is_overflow_infinity (val) && !sop)
3246     {
3247       /* Since this expression was found on the RHS of an assignment,
3248 	 its type may be different from _Bool.  Convert VAL to EXPR's
3249 	 type.  */
3250       val = fold_convert (type, val);
3251       if (is_gimple_min_invariant (val))
3252 	set_value_range_to_value (vr, val, vr->equiv);
3253       else
3254 	set_value_range (vr, VR_RANGE, val, val, vr->equiv);
3255     }
3256   else
3257     /* The result of a comparison is always true or false.  */
3258     set_value_range_to_truthvalue (vr, type);
3259 }
3260 
3261 /* Try to derive a nonnegative or nonzero range out of STMT relying
3262    primarily on generic routines in fold in conjunction with range data.
3263    Store the result in *VR */
3264 
3265 static void
3266 extract_range_basic (value_range_t *vr, gimple stmt)
3267 {
3268   bool sop = false;
3269   tree type = gimple_expr_type (stmt);
3270 
3271   if (INTEGRAL_TYPE_P (type)
3272       && gimple_stmt_nonnegative_warnv_p (stmt, &sop))
3273     set_value_range_to_nonnegative (vr, type,
3274 				    sop || stmt_overflow_infinity (stmt));
3275   else if (vrp_stmt_computes_nonzero (stmt, &sop)
3276 	   && !sop)
3277     set_value_range_to_nonnull (vr, type);
3278   else
3279     set_value_range_to_varying (vr);
3280 }
3281 
3282 
3283 /* Try to compute a useful range out of assignment STMT and store it
3284    in *VR.  */
3285 
3286 static void
3287 extract_range_from_assignment (value_range_t *vr, gimple stmt)
3288 {
3289   enum tree_code code = gimple_assign_rhs_code (stmt);
3290 
3291   if (code == ASSERT_EXPR)
3292     extract_range_from_assert (vr, gimple_assign_rhs1 (stmt));
3293   else if (code == SSA_NAME)
3294     extract_range_from_ssa_name (vr, gimple_assign_rhs1 (stmt));
3295   else if (TREE_CODE_CLASS (code) == tcc_binary)
3296     extract_range_from_binary_expr (vr, gimple_assign_rhs_code (stmt),
3297 				    gimple_expr_type (stmt),
3298 				    gimple_assign_rhs1 (stmt),
3299 				    gimple_assign_rhs2 (stmt));
3300   else if (TREE_CODE_CLASS (code) == tcc_unary)
3301     extract_range_from_unary_expr (vr, gimple_assign_rhs_code (stmt),
3302 				   gimple_expr_type (stmt),
3303 				   gimple_assign_rhs1 (stmt));
3304   else if (code == COND_EXPR)
3305     extract_range_from_cond_expr (vr, stmt);
3306   else if (TREE_CODE_CLASS (code) == tcc_comparison)
3307     extract_range_from_comparison (vr, gimple_assign_rhs_code (stmt),
3308 				   gimple_expr_type (stmt),
3309 				   gimple_assign_rhs1 (stmt),
3310 				   gimple_assign_rhs2 (stmt));
3311   else if (get_gimple_rhs_class (code) == GIMPLE_SINGLE_RHS
3312 	   && is_gimple_min_invariant (gimple_assign_rhs1 (stmt)))
3313     set_value_range_to_value (vr, gimple_assign_rhs1 (stmt), NULL);
3314   else
3315     set_value_range_to_varying (vr);
3316 
3317   if (vr->type == VR_VARYING)
3318     extract_range_basic (vr, stmt);
3319 }
3320 
3321 /* Given a range VR, a LOOP and a variable VAR, determine whether it
3322    would be profitable to adjust VR using scalar evolution information
3323    for VAR.  If so, update VR with the new limits.  */
3324 
3325 static void
3326 adjust_range_with_scev (value_range_t *vr, struct loop *loop,
3327 			gimple stmt, tree var)
3328 {
3329   tree init, step, chrec, tmin, tmax, min, max, type, tem;
3330   enum ev_direction dir;
3331 
3332   /* TODO.  Don't adjust anti-ranges.  An anti-range may provide
3333      better opportunities than a regular range, but I'm not sure.  */
3334   if (vr->type == VR_ANTI_RANGE)
3335     return;
3336 
3337   chrec = instantiate_parameters (loop, analyze_scalar_evolution (loop, var));
3338 
3339   /* Like in PR19590, scev can return a constant function.  */
3340   if (is_gimple_min_invariant (chrec))
3341     {
3342       set_value_range_to_value (vr, chrec, vr->equiv);
3343       return;
3344     }
3345 
3346   if (TREE_CODE (chrec) != POLYNOMIAL_CHREC)
3347     return;
3348 
3349   init = initial_condition_in_loop_num (chrec, loop->num);
3350   tem = op_with_constant_singleton_value_range (init);
3351   if (tem)
3352     init = tem;
3353   step = evolution_part_in_loop_num (chrec, loop->num);
3354   tem = op_with_constant_singleton_value_range (step);
3355   if (tem)
3356     step = tem;
3357 
3358   /* If STEP is symbolic, we can't know whether INIT will be the
3359      minimum or maximum value in the range.  Also, unless INIT is
3360      a simple expression, compare_values and possibly other functions
3361      in tree-vrp won't be able to handle it.  */
3362   if (step == NULL_TREE
3363       || !is_gimple_min_invariant (step)
3364       || !valid_value_p (init))
3365     return;
3366 
3367   dir = scev_direction (chrec);
3368   if (/* Do not adjust ranges if we do not know whether the iv increases
3369 	 or decreases,  ... */
3370       dir == EV_DIR_UNKNOWN
3371       /* ... or if it may wrap.  */
3372       || scev_probably_wraps_p (init, step, stmt, get_chrec_loop (chrec),
3373 				true))
3374     return;
3375 
3376   /* We use TYPE_MIN_VALUE and TYPE_MAX_VALUE here instead of
3377      negative_overflow_infinity and positive_overflow_infinity,
3378      because we have concluded that the loop probably does not
3379      wrap.  */
3380 
3381   type = TREE_TYPE (var);
3382   if (POINTER_TYPE_P (type) || !TYPE_MIN_VALUE (type))
3383     tmin = lower_bound_in_type (type, type);
3384   else
3385     tmin = TYPE_MIN_VALUE (type);
3386   if (POINTER_TYPE_P (type) || !TYPE_MAX_VALUE (type))
3387     tmax = upper_bound_in_type (type, type);
3388   else
3389     tmax = TYPE_MAX_VALUE (type);
3390 
3391   /* Try to use estimated number of iterations for the loop to constrain the
3392      final value in the evolution.  */
3393   if (TREE_CODE (step) == INTEGER_CST
3394       && is_gimple_val (init)
3395       && (TREE_CODE (init) != SSA_NAME
3396 	  || get_value_range (init)->type == VR_RANGE))
3397     {
3398       double_int nit;
3399 
3400       if (estimated_loop_iterations (loop, true, &nit))
3401 	{
3402 	  value_range_t maxvr = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
3403 	  double_int dtmp;
3404 	  bool unsigned_p = TYPE_UNSIGNED (TREE_TYPE (step));
3405 	  int overflow = 0;
3406 
3407 	  dtmp = double_int_mul_with_sign (tree_to_double_int (step), nit,
3408 					   unsigned_p, &overflow);
3409 	  /* If the multiplication overflowed we can't do a meaningful
3410 	     adjustment.  Likewise if the result doesn't fit in the type
3411 	     of the induction variable.  For a signed type we have to
3412 	     check whether the result has the expected signedness which
3413 	     is that of the step as number of iterations is unsigned.  */
3414 	  if (!overflow
3415 	      && double_int_fits_to_tree_p (TREE_TYPE (init), dtmp)
3416 	      && (unsigned_p
3417 		  || ((dtmp.high ^ TREE_INT_CST_HIGH (step)) >= 0)))
3418 	    {
3419 	      tem = double_int_to_tree (TREE_TYPE (init), dtmp);
3420 	      extract_range_from_binary_expr (&maxvr, PLUS_EXPR,
3421 					      TREE_TYPE (init), init, tem);
3422 	      /* Likewise if the addition did.  */
3423 	      if (maxvr.type == VR_RANGE)
3424 		{
3425 		  tmin = maxvr.min;
3426 		  tmax = maxvr.max;
3427 		}
3428 	    }
3429 	}
3430     }
3431 
3432   if (vr->type == VR_VARYING || vr->type == VR_UNDEFINED)
3433     {
3434       min = tmin;
3435       max = tmax;
3436 
3437       /* For VARYING or UNDEFINED ranges, just about anything we get
3438 	 from scalar evolutions should be better.  */
3439 
3440       if (dir == EV_DIR_DECREASES)
3441 	max = init;
3442       else
3443 	min = init;
3444 
3445       /* If we would create an invalid range, then just assume we
3446 	 know absolutely nothing.  This may be over-conservative,
3447 	 but it's clearly safe, and should happen only in unreachable
3448          parts of code, or for invalid programs.  */
3449       if (compare_values (min, max) == 1)
3450 	return;
3451 
3452       set_value_range (vr, VR_RANGE, min, max, vr->equiv);
3453     }
3454   else if (vr->type == VR_RANGE)
3455     {
3456       min = vr->min;
3457       max = vr->max;
3458 
3459       if (dir == EV_DIR_DECREASES)
3460 	{
3461 	  /* INIT is the maximum value.  If INIT is lower than VR->MAX
3462 	     but no smaller than VR->MIN, set VR->MAX to INIT.  */
3463 	  if (compare_values (init, max) == -1)
3464 	    max = init;
3465 
3466 	  /* According to the loop information, the variable does not
3467 	     overflow.  If we think it does, probably because of an
3468 	     overflow due to arithmetic on a different INF value,
3469 	     reset now.  */
3470 	  if (is_negative_overflow_infinity (min)
3471 	      || compare_values (min, tmin) == -1)
3472 	    min = tmin;
3473 
3474 	}
3475       else
3476 	{
3477 	  /* If INIT is bigger than VR->MIN, set VR->MIN to INIT.  */
3478 	  if (compare_values (init, min) == 1)
3479 	    min = init;
3480 
3481 	  if (is_positive_overflow_infinity (max)
3482 	      || compare_values (tmax, max) == -1)
3483 	    max = tmax;
3484 	}
3485 
3486       /* If we just created an invalid range with the minimum
3487 	 greater than the maximum, we fail conservatively.
3488 	 This should happen only in unreachable
3489 	 parts of code, or for invalid programs.  */
3490       if (compare_values (min, max) == 1)
3491 	return;
3492 
3493       set_value_range (vr, VR_RANGE, min, max, vr->equiv);
3494     }
3495 }
3496 
3497 /* Return true if VAR may overflow at STMT.  This checks any available
3498    loop information to see if we can determine that VAR does not
3499    overflow.  */
3500 
3501 static bool
3502 vrp_var_may_overflow (tree var, gimple stmt)
3503 {
3504   struct loop *l;
3505   tree chrec, init, step;
3506 
3507   if (current_loops == NULL)
3508     return true;
3509 
3510   l = loop_containing_stmt (stmt);
3511   if (l == NULL
3512       || !loop_outer (l))
3513     return true;
3514 
3515   chrec = instantiate_parameters (l, analyze_scalar_evolution (l, var));
3516   if (TREE_CODE (chrec) != POLYNOMIAL_CHREC)
3517     return true;
3518 
3519   init = initial_condition_in_loop_num (chrec, l->num);
3520   step = evolution_part_in_loop_num (chrec, l->num);
3521 
3522   if (step == NULL_TREE
3523       || !is_gimple_min_invariant (step)
3524       || !valid_value_p (init))
3525     return true;
3526 
3527   /* If we get here, we know something useful about VAR based on the
3528      loop information.  If it wraps, it may overflow.  */
3529 
3530   if (scev_probably_wraps_p (init, step, stmt, get_chrec_loop (chrec),
3531 			     true))
3532     return true;
3533 
3534   if (dump_file && (dump_flags & TDF_DETAILS) != 0)
3535     {
3536       print_generic_expr (dump_file, var, 0);
3537       fprintf (dump_file, ": loop information indicates does not overflow\n");
3538     }
3539 
3540   return false;
3541 }
3542 
3543 
3544 /* Given two numeric value ranges VR0, VR1 and a comparison code COMP:
3545 
3546    - Return BOOLEAN_TRUE_NODE if VR0 COMP VR1 always returns true for
3547      all the values in the ranges.
3548 
3549    - Return BOOLEAN_FALSE_NODE if the comparison always returns false.
3550 
3551    - Return NULL_TREE if it is not always possible to determine the
3552      value of the comparison.
3553 
3554    Also set *STRICT_OVERFLOW_P to indicate whether a range with an
3555    overflow infinity was used in the test.  */
3556 
3557 
3558 static tree
3559 compare_ranges (enum tree_code comp, value_range_t *vr0, value_range_t *vr1,
3560 		bool *strict_overflow_p)
3561 {
3562   /* VARYING or UNDEFINED ranges cannot be compared.  */
3563   if (vr0->type == VR_VARYING
3564       || vr0->type == VR_UNDEFINED
3565       || vr1->type == VR_VARYING
3566       || vr1->type == VR_UNDEFINED)
3567     return NULL_TREE;
3568 
3569   /* Anti-ranges need to be handled separately.  */
3570   if (vr0->type == VR_ANTI_RANGE || vr1->type == VR_ANTI_RANGE)
3571     {
3572       /* If both are anti-ranges, then we cannot compute any
3573 	 comparison.  */
3574       if (vr0->type == VR_ANTI_RANGE && vr1->type == VR_ANTI_RANGE)
3575 	return NULL_TREE;
3576 
3577       /* These comparisons are never statically computable.  */
3578       if (comp == GT_EXPR
3579 	  || comp == GE_EXPR
3580 	  || comp == LT_EXPR
3581 	  || comp == LE_EXPR)
3582 	return NULL_TREE;
3583 
3584       /* Equality can be computed only between a range and an
3585 	 anti-range.  ~[VAL1, VAL2] == [VAL1, VAL2] is always false.  */
3586       if (vr0->type == VR_RANGE)
3587 	{
3588 	  /* To simplify processing, make VR0 the anti-range.  */
3589 	  value_range_t *tmp = vr0;
3590 	  vr0 = vr1;
3591 	  vr1 = tmp;
3592 	}
3593 
3594       gcc_assert (comp == NE_EXPR || comp == EQ_EXPR);
3595 
3596       if (compare_values_warnv (vr0->min, vr1->min, strict_overflow_p) == 0
3597 	  && compare_values_warnv (vr0->max, vr1->max, strict_overflow_p) == 0)
3598 	return (comp == NE_EXPR) ? boolean_true_node : boolean_false_node;
3599 
3600       return NULL_TREE;
3601     }
3602 
3603   if (!usable_range_p (vr0, strict_overflow_p)
3604       || !usable_range_p (vr1, strict_overflow_p))
3605     return NULL_TREE;
3606 
3607   /* Simplify processing.  If COMP is GT_EXPR or GE_EXPR, switch the
3608      operands around and change the comparison code.  */
3609   if (comp == GT_EXPR || comp == GE_EXPR)
3610     {
3611       value_range_t *tmp;
3612       comp = (comp == GT_EXPR) ? LT_EXPR : LE_EXPR;
3613       tmp = vr0;
3614       vr0 = vr1;
3615       vr1 = tmp;
3616     }
3617 
3618   if (comp == EQ_EXPR)
3619     {
3620       /* Equality may only be computed if both ranges represent
3621 	 exactly one value.  */
3622       if (compare_values_warnv (vr0->min, vr0->max, strict_overflow_p) == 0
3623 	  && compare_values_warnv (vr1->min, vr1->max, strict_overflow_p) == 0)
3624 	{
3625 	  int cmp_min = compare_values_warnv (vr0->min, vr1->min,
3626 					      strict_overflow_p);
3627 	  int cmp_max = compare_values_warnv (vr0->max, vr1->max,
3628 					      strict_overflow_p);
3629 	  if (cmp_min == 0 && cmp_max == 0)
3630 	    return boolean_true_node;
3631 	  else if (cmp_min != -2 && cmp_max != -2)
3632 	    return boolean_false_node;
3633 	}
3634       /* If [V0_MIN, V1_MAX] < [V1_MIN, V1_MAX] then V0 != V1.  */
3635       else if (compare_values_warnv (vr0->min, vr1->max,
3636 				     strict_overflow_p) == 1
3637 	       || compare_values_warnv (vr1->min, vr0->max,
3638 					strict_overflow_p) == 1)
3639 	return boolean_false_node;
3640 
3641       return NULL_TREE;
3642     }
3643   else if (comp == NE_EXPR)
3644     {
3645       int cmp1, cmp2;
3646 
3647       /* If VR0 is completely to the left or completely to the right
3648 	 of VR1, they are always different.  Notice that we need to
3649 	 make sure that both comparisons yield similar results to
3650 	 avoid comparing values that cannot be compared at
3651 	 compile-time.  */
3652       cmp1 = compare_values_warnv (vr0->max, vr1->min, strict_overflow_p);
3653       cmp2 = compare_values_warnv (vr0->min, vr1->max, strict_overflow_p);
3654       if ((cmp1 == -1 && cmp2 == -1) || (cmp1 == 1 && cmp2 == 1))
3655 	return boolean_true_node;
3656 
3657       /* If VR0 and VR1 represent a single value and are identical,
3658 	 return false.  */
3659       else if (compare_values_warnv (vr0->min, vr0->max,
3660 				     strict_overflow_p) == 0
3661 	       && compare_values_warnv (vr1->min, vr1->max,
3662 					strict_overflow_p) == 0
3663 	       && compare_values_warnv (vr0->min, vr1->min,
3664 					strict_overflow_p) == 0
3665 	       && compare_values_warnv (vr0->max, vr1->max,
3666 					strict_overflow_p) == 0)
3667 	return boolean_false_node;
3668 
3669       /* Otherwise, they may or may not be different.  */
3670       else
3671 	return NULL_TREE;
3672     }
3673   else if (comp == LT_EXPR || comp == LE_EXPR)
3674     {
3675       int tst;
3676 
3677       /* If VR0 is to the left of VR1, return true.  */
3678       tst = compare_values_warnv (vr0->max, vr1->min, strict_overflow_p);
3679       if ((comp == LT_EXPR && tst == -1)
3680 	  || (comp == LE_EXPR && (tst == -1 || tst == 0)))
3681 	{
3682 	  if (overflow_infinity_range_p (vr0)
3683 	      || overflow_infinity_range_p (vr1))
3684 	    *strict_overflow_p = true;
3685 	  return boolean_true_node;
3686 	}
3687 
3688       /* If VR0 is to the right of VR1, return false.  */
3689       tst = compare_values_warnv (vr0->min, vr1->max, strict_overflow_p);
3690       if ((comp == LT_EXPR && (tst == 0 || tst == 1))
3691 	  || (comp == LE_EXPR && tst == 1))
3692 	{
3693 	  if (overflow_infinity_range_p (vr0)
3694 	      || overflow_infinity_range_p (vr1))
3695 	    *strict_overflow_p = true;
3696 	  return boolean_false_node;
3697 	}
3698 
3699       /* Otherwise, we don't know.  */
3700       return NULL_TREE;
3701     }
3702 
3703   gcc_unreachable ();
3704 }
3705 
3706 
3707 /* Given a value range VR, a value VAL and a comparison code COMP, return
3708    BOOLEAN_TRUE_NODE if VR COMP VAL always returns true for all the
3709    values in VR.  Return BOOLEAN_FALSE_NODE if the comparison
3710    always returns false.  Return NULL_TREE if it is not always
3711    possible to determine the value of the comparison.  Also set
3712    *STRICT_OVERFLOW_P to indicate whether a range with an overflow
3713    infinity was used in the test.  */
3714 
3715 static tree
3716 compare_range_with_value (enum tree_code comp, value_range_t *vr, tree val,
3717 			  bool *strict_overflow_p)
3718 {
3719   if (vr->type == VR_VARYING || vr->type == VR_UNDEFINED)
3720     return NULL_TREE;
3721 
3722   /* Anti-ranges need to be handled separately.  */
3723   if (vr->type == VR_ANTI_RANGE)
3724     {
3725       /* For anti-ranges, the only predicates that we can compute at
3726 	 compile time are equality and inequality.  */
3727       if (comp == GT_EXPR
3728 	  || comp == GE_EXPR
3729 	  || comp == LT_EXPR
3730 	  || comp == LE_EXPR)
3731 	return NULL_TREE;
3732 
3733       /* ~[VAL_1, VAL_2] OP VAL is known if VAL_1 <= VAL <= VAL_2.  */
3734       if (value_inside_range (val, vr->min, vr->max) == 1)
3735 	return (comp == NE_EXPR) ? boolean_true_node : boolean_false_node;
3736 
3737       return NULL_TREE;
3738     }
3739 
3740   if (!usable_range_p (vr, strict_overflow_p))
3741     return NULL_TREE;
3742 
3743   if (comp == EQ_EXPR)
3744     {
3745       /* EQ_EXPR may only be computed if VR represents exactly
3746 	 one value.  */
3747       if (compare_values_warnv (vr->min, vr->max, strict_overflow_p) == 0)
3748 	{
3749 	  int cmp = compare_values_warnv (vr->min, val, strict_overflow_p);
3750 	  if (cmp == 0)
3751 	    return boolean_true_node;
3752 	  else if (cmp == -1 || cmp == 1 || cmp == 2)
3753 	    return boolean_false_node;
3754 	}
3755       else if (compare_values_warnv (val, vr->min, strict_overflow_p) == -1
3756 	       || compare_values_warnv (vr->max, val, strict_overflow_p) == -1)
3757 	return boolean_false_node;
3758 
3759       return NULL_TREE;
3760     }
3761   else if (comp == NE_EXPR)
3762     {
3763       /* If VAL is not inside VR, then they are always different.  */
3764       if (compare_values_warnv (vr->max, val, strict_overflow_p) == -1
3765 	  || compare_values_warnv (vr->min, val, strict_overflow_p) == 1)
3766 	return boolean_true_node;
3767 
3768       /* If VR represents exactly one value equal to VAL, then return
3769 	 false.  */
3770       if (compare_values_warnv (vr->min, vr->max, strict_overflow_p) == 0
3771 	  && compare_values_warnv (vr->min, val, strict_overflow_p) == 0)
3772 	return boolean_false_node;
3773 
3774       /* Otherwise, they may or may not be different.  */
3775       return NULL_TREE;
3776     }
3777   else if (comp == LT_EXPR || comp == LE_EXPR)
3778     {
3779       int tst;
3780 
3781       /* If VR is to the left of VAL, return true.  */
3782       tst = compare_values_warnv (vr->max, val, strict_overflow_p);
3783       if ((comp == LT_EXPR && tst == -1)
3784 	  || (comp == LE_EXPR && (tst == -1 || tst == 0)))
3785 	{
3786 	  if (overflow_infinity_range_p (vr))
3787 	    *strict_overflow_p = true;
3788 	  return boolean_true_node;
3789 	}
3790 
3791       /* If VR is to the right of VAL, return false.  */
3792       tst = compare_values_warnv (vr->min, val, strict_overflow_p);
3793       if ((comp == LT_EXPR && (tst == 0 || tst == 1))
3794 	  || (comp == LE_EXPR && tst == 1))
3795 	{
3796 	  if (overflow_infinity_range_p (vr))
3797 	    *strict_overflow_p = true;
3798 	  return boolean_false_node;
3799 	}
3800 
3801       /* Otherwise, we don't know.  */
3802       return NULL_TREE;
3803     }
3804   else if (comp == GT_EXPR || comp == GE_EXPR)
3805     {
3806       int tst;
3807 
3808       /* If VR is to the right of VAL, return true.  */
3809       tst = compare_values_warnv (vr->min, val, strict_overflow_p);
3810       if ((comp == GT_EXPR && tst == 1)
3811 	  || (comp == GE_EXPR && (tst == 0 || tst == 1)))
3812 	{
3813 	  if (overflow_infinity_range_p (vr))
3814 	    *strict_overflow_p = true;
3815 	  return boolean_true_node;
3816 	}
3817 
3818       /* If VR is to the left of VAL, return false.  */
3819       tst = compare_values_warnv (vr->max, val, strict_overflow_p);
3820       if ((comp == GT_EXPR && (tst == -1 || tst == 0))
3821 	  || (comp == GE_EXPR && tst == -1))
3822 	{
3823 	  if (overflow_infinity_range_p (vr))
3824 	    *strict_overflow_p = true;
3825 	  return boolean_false_node;
3826 	}
3827 
3828       /* Otherwise, we don't know.  */
3829       return NULL_TREE;
3830     }
3831 
3832   gcc_unreachable ();
3833 }
3834 
3835 
3836 /* Debugging dumps.  */
3837 
3838 void dump_value_range (FILE *, value_range_t *);
3839 void debug_value_range (value_range_t *);
3840 void dump_all_value_ranges (FILE *);
3841 void debug_all_value_ranges (void);
3842 void dump_vr_equiv (FILE *, bitmap);
3843 void debug_vr_equiv (bitmap);
3844 
3845 
3846 /* Dump value range VR to FILE.  */
3847 
3848 void
3849 dump_value_range (FILE *file, value_range_t *vr)
3850 {
3851   if (vr == NULL)
3852     fprintf (file, "[]");
3853   else if (vr->type == VR_UNDEFINED)
3854     fprintf (file, "UNDEFINED");
3855   else if (vr->type == VR_RANGE || vr->type == VR_ANTI_RANGE)
3856     {
3857       tree type = TREE_TYPE (vr->min);
3858 
3859       fprintf (file, "%s[", (vr->type == VR_ANTI_RANGE) ? "~" : "");
3860 
3861       if (is_negative_overflow_infinity (vr->min))
3862 	fprintf (file, "-INF(OVF)");
3863       else if (INTEGRAL_TYPE_P (type)
3864 	       && !TYPE_UNSIGNED (type)
3865 	       && vrp_val_is_min (vr->min))
3866 	fprintf (file, "-INF");
3867       else
3868 	print_generic_expr (file, vr->min, 0);
3869 
3870       fprintf (file, ", ");
3871 
3872       if (is_positive_overflow_infinity (vr->max))
3873 	fprintf (file, "+INF(OVF)");
3874       else if (INTEGRAL_TYPE_P (type)
3875 	       && vrp_val_is_max (vr->max))
3876 	fprintf (file, "+INF");
3877       else
3878 	print_generic_expr (file, vr->max, 0);
3879 
3880       fprintf (file, "]");
3881 
3882       if (vr->equiv)
3883 	{
3884 	  bitmap_iterator bi;
3885 	  unsigned i, c = 0;
3886 
3887 	  fprintf (file, "  EQUIVALENCES: { ");
3888 
3889 	  EXECUTE_IF_SET_IN_BITMAP (vr->equiv, 0, i, bi)
3890 	    {
3891 	      print_generic_expr (file, ssa_name (i), 0);
3892 	      fprintf (file, " ");
3893 	      c++;
3894 	    }
3895 
3896 	  fprintf (file, "} (%u elements)", c);
3897 	}
3898     }
3899   else if (vr->type == VR_VARYING)
3900     fprintf (file, "VARYING");
3901   else
3902     fprintf (file, "INVALID RANGE");
3903 }
3904 
3905 
3906 /* Dump value range VR to stderr.  */
3907 
3908 DEBUG_FUNCTION void
3909 debug_value_range (value_range_t *vr)
3910 {
3911   dump_value_range (stderr, vr);
3912   fprintf (stderr, "\n");
3913 }
3914 
3915 
3916 /* Dump value ranges of all SSA_NAMEs to FILE.  */
3917 
3918 void
3919 dump_all_value_ranges (FILE *file)
3920 {
3921   size_t i;
3922 
3923   for (i = 0; i < num_vr_values; i++)
3924     {
3925       if (vr_value[i])
3926 	{
3927 	  print_generic_expr (file, ssa_name (i), 0);
3928 	  fprintf (file, ": ");
3929 	  dump_value_range (file, vr_value[i]);
3930 	  fprintf (file, "\n");
3931 	}
3932     }
3933 
3934   fprintf (file, "\n");
3935 }
3936 
3937 
3938 /* Dump all value ranges to stderr.  */
3939 
3940 DEBUG_FUNCTION void
3941 debug_all_value_ranges (void)
3942 {
3943   dump_all_value_ranges (stderr);
3944 }
3945 
3946 
3947 /* Given a COND_EXPR COND of the form 'V OP W', and an SSA name V,
3948    create a new SSA name N and return the assertion assignment
3949    'V = ASSERT_EXPR <V, V OP W>'.  */
3950 
3951 static gimple
3952 build_assert_expr_for (tree cond, tree v)
3953 {
3954   tree n;
3955   gimple assertion;
3956 
3957   gcc_assert (TREE_CODE (v) == SSA_NAME);
3958   n = duplicate_ssa_name (v, NULL);
3959 
3960   if (COMPARISON_CLASS_P (cond))
3961     {
3962       tree a = build2 (ASSERT_EXPR, TREE_TYPE (v), v, cond);
3963       assertion = gimple_build_assign (n, a);
3964     }
3965   else if (TREE_CODE (cond) == SSA_NAME)
3966     {
3967       /* Given V, build the assignment N = true.  */
3968       gcc_assert (v == cond);
3969       assertion = gimple_build_assign (n, boolean_true_node);
3970     }
3971   else
3972     gcc_unreachable ();
3973 
3974   SSA_NAME_DEF_STMT (n) = assertion;
3975 
3976   /* The new ASSERT_EXPR, creates a new SSA name that replaces the
3977      operand of the ASSERT_EXPR. Register the new name and the old one
3978      in the replacement table so that we can fix the SSA web after
3979      adding all the ASSERT_EXPRs.  */
3980   register_new_name_mapping (n, v);
3981 
3982   return assertion;
3983 }
3984 
3985 
3986 /* Return false if EXPR is a predicate expression involving floating
3987    point values.  */
3988 
3989 static inline bool
3990 fp_predicate (gimple stmt)
3991 {
3992   GIMPLE_CHECK (stmt, GIMPLE_COND);
3993 
3994   return FLOAT_TYPE_P (TREE_TYPE (gimple_cond_lhs (stmt)));
3995 }
3996 
3997 
3998 /* If the range of values taken by OP can be inferred after STMT executes,
3999    return the comparison code (COMP_CODE_P) and value (VAL_P) that
4000    describes the inferred range.  Return true if a range could be
4001    inferred.  */
4002 
4003 static bool
4004 infer_value_range (gimple stmt, tree op, enum tree_code *comp_code_p, tree *val_p)
4005 {
4006   *val_p = NULL_TREE;
4007   *comp_code_p = ERROR_MARK;
4008 
4009   /* Do not attempt to infer anything in names that flow through
4010      abnormal edges.  */
4011   if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (op))
4012     return false;
4013 
4014   /* Similarly, don't infer anything from statements that may throw
4015      exceptions.  */
4016   if (stmt_could_throw_p (stmt))
4017     return false;
4018 
4019   /* If STMT is the last statement of a basic block with no
4020      successors, there is no point inferring anything about any of its
4021      operands.  We would not be able to find a proper insertion point
4022      for the assertion, anyway.  */
4023   if (stmt_ends_bb_p (stmt) && EDGE_COUNT (gimple_bb (stmt)->succs) == 0)
4024     return false;
4025 
4026   /* We can only assume that a pointer dereference will yield
4027      non-NULL if -fdelete-null-pointer-checks is enabled.  */
4028   if (flag_delete_null_pointer_checks
4029       && POINTER_TYPE_P (TREE_TYPE (op))
4030       && gimple_code (stmt) != GIMPLE_ASM)
4031     {
4032       unsigned num_uses, num_loads, num_stores;
4033 
4034       count_uses_and_derefs (op, stmt, &num_uses, &num_loads, &num_stores);
4035       if (num_loads + num_stores > 0)
4036 	{
4037 	  *val_p = build_int_cst (TREE_TYPE (op), 0);
4038 	  *comp_code_p = NE_EXPR;
4039 	  return true;
4040 	}
4041     }
4042 
4043   return false;
4044 }
4045 
4046 
4047 void dump_asserts_for (FILE *, tree);
4048 void debug_asserts_for (tree);
4049 void dump_all_asserts (FILE *);
4050 void debug_all_asserts (void);
4051 
4052 /* Dump all the registered assertions for NAME to FILE.  */
4053 
4054 void
4055 dump_asserts_for (FILE *file, tree name)
4056 {
4057   assert_locus_t loc;
4058 
4059   fprintf (file, "Assertions to be inserted for ");
4060   print_generic_expr (file, name, 0);
4061   fprintf (file, "\n");
4062 
4063   loc = asserts_for[SSA_NAME_VERSION (name)];
4064   while (loc)
4065     {
4066       fprintf (file, "\t");
4067       print_gimple_stmt (file, gsi_stmt (loc->si), 0, 0);
4068       fprintf (file, "\n\tBB #%d", loc->bb->index);
4069       if (loc->e)
4070 	{
4071 	  fprintf (file, "\n\tEDGE %d->%d", loc->e->src->index,
4072 	           loc->e->dest->index);
4073 	  dump_edge_info (file, loc->e, 0);
4074 	}
4075       fprintf (file, "\n\tPREDICATE: ");
4076       print_generic_expr (file, name, 0);
4077       fprintf (file, " %s ", tree_code_name[(int)loc->comp_code]);
4078       print_generic_expr (file, loc->val, 0);
4079       fprintf (file, "\n\n");
4080       loc = loc->next;
4081     }
4082 
4083   fprintf (file, "\n");
4084 }
4085 
4086 
4087 /* Dump all the registered assertions for NAME to stderr.  */
4088 
4089 DEBUG_FUNCTION void
4090 debug_asserts_for (tree name)
4091 {
4092   dump_asserts_for (stderr, name);
4093 }
4094 
4095 
4096 /* Dump all the registered assertions for all the names to FILE.  */
4097 
4098 void
4099 dump_all_asserts (FILE *file)
4100 {
4101   unsigned i;
4102   bitmap_iterator bi;
4103 
4104   fprintf (file, "\nASSERT_EXPRs to be inserted\n\n");
4105   EXECUTE_IF_SET_IN_BITMAP (need_assert_for, 0, i, bi)
4106     dump_asserts_for (file, ssa_name (i));
4107   fprintf (file, "\n");
4108 }
4109 
4110 
4111 /* Dump all the registered assertions for all the names to stderr.  */
4112 
4113 DEBUG_FUNCTION void
4114 debug_all_asserts (void)
4115 {
4116   dump_all_asserts (stderr);
4117 }
4118 
4119 
4120 /* If NAME doesn't have an ASSERT_EXPR registered for asserting
4121    'EXPR COMP_CODE VAL' at a location that dominates block BB or
4122    E->DEST, then register this location as a possible insertion point
4123    for ASSERT_EXPR <NAME, EXPR COMP_CODE VAL>.
4124 
4125    BB, E and SI provide the exact insertion point for the new
4126    ASSERT_EXPR.  If BB is NULL, then the ASSERT_EXPR is to be inserted
4127    on edge E.  Otherwise, if E is NULL, the ASSERT_EXPR is inserted on
4128    BB.  If SI points to a COND_EXPR or a SWITCH_EXPR statement, then E
4129    must not be NULL.  */
4130 
4131 static void
4132 register_new_assert_for (tree name, tree expr,
4133 			 enum tree_code comp_code,
4134 			 tree val,
4135 			 basic_block bb,
4136 			 edge e,
4137 			 gimple_stmt_iterator si)
4138 {
4139   assert_locus_t n, loc, last_loc;
4140   basic_block dest_bb;
4141 
4142   gcc_checking_assert (bb == NULL || e == NULL);
4143 
4144   if (e == NULL)
4145     gcc_checking_assert (gimple_code (gsi_stmt (si)) != GIMPLE_COND
4146 			 && gimple_code (gsi_stmt (si)) != GIMPLE_SWITCH);
4147 
4148   /* Never build an assert comparing against an integer constant with
4149      TREE_OVERFLOW set.  This confuses our undefined overflow warning
4150      machinery.  */
4151   if (TREE_CODE (val) == INTEGER_CST
4152       && TREE_OVERFLOW (val))
4153     val = build_int_cst_wide (TREE_TYPE (val),
4154 			      TREE_INT_CST_LOW (val), TREE_INT_CST_HIGH (val));
4155 
4156   /* The new assertion A will be inserted at BB or E.  We need to
4157      determine if the new location is dominated by a previously
4158      registered location for A.  If we are doing an edge insertion,
4159      assume that A will be inserted at E->DEST.  Note that this is not
4160      necessarily true.
4161 
4162      If E is a critical edge, it will be split.  But even if E is
4163      split, the new block will dominate the same set of blocks that
4164      E->DEST dominates.
4165 
4166      The reverse, however, is not true, blocks dominated by E->DEST
4167      will not be dominated by the new block created to split E.  So,
4168      if the insertion location is on a critical edge, we will not use
4169      the new location to move another assertion previously registered
4170      at a block dominated by E->DEST.  */
4171   dest_bb = (bb) ? bb : e->dest;
4172 
4173   /* If NAME already has an ASSERT_EXPR registered for COMP_CODE and
4174      VAL at a block dominating DEST_BB, then we don't need to insert a new
4175      one.  Similarly, if the same assertion already exists at a block
4176      dominated by DEST_BB and the new location is not on a critical
4177      edge, then update the existing location for the assertion (i.e.,
4178      move the assertion up in the dominance tree).
4179 
4180      Note, this is implemented as a simple linked list because there
4181      should not be more than a handful of assertions registered per
4182      name.  If this becomes a performance problem, a table hashed by
4183      COMP_CODE and VAL could be implemented.  */
4184   loc = asserts_for[SSA_NAME_VERSION (name)];
4185   last_loc = loc;
4186   while (loc)
4187     {
4188       if (loc->comp_code == comp_code
4189 	  && (loc->val == val
4190 	      || operand_equal_p (loc->val, val, 0))
4191 	  && (loc->expr == expr
4192 	      || operand_equal_p (loc->expr, expr, 0)))
4193 	{
4194 	  /* If the assertion NAME COMP_CODE VAL has already been
4195 	     registered at a basic block that dominates DEST_BB, then
4196 	     we don't need to insert the same assertion again.  Note
4197 	     that we don't check strict dominance here to avoid
4198 	     replicating the same assertion inside the same basic
4199 	     block more than once (e.g., when a pointer is
4200 	     dereferenced several times inside a block).
4201 
4202 	     An exception to this rule are edge insertions.  If the
4203 	     new assertion is to be inserted on edge E, then it will
4204 	     dominate all the other insertions that we may want to
4205 	     insert in DEST_BB.  So, if we are doing an edge
4206 	     insertion, don't do this dominance check.  */
4207           if (e == NULL
4208 	      && dominated_by_p (CDI_DOMINATORS, dest_bb, loc->bb))
4209 	    return;
4210 
4211 	  /* Otherwise, if E is not a critical edge and DEST_BB
4212 	     dominates the existing location for the assertion, move
4213 	     the assertion up in the dominance tree by updating its
4214 	     location information.  */
4215 	  if ((e == NULL || !EDGE_CRITICAL_P (e))
4216 	      && dominated_by_p (CDI_DOMINATORS, loc->bb, dest_bb))
4217 	    {
4218 	      loc->bb = dest_bb;
4219 	      loc->e = e;
4220 	      loc->si = si;
4221 	      return;
4222 	    }
4223 	}
4224 
4225       /* Update the last node of the list and move to the next one.  */
4226       last_loc = loc;
4227       loc = loc->next;
4228     }
4229 
4230   /* If we didn't find an assertion already registered for
4231      NAME COMP_CODE VAL, add a new one at the end of the list of
4232      assertions associated with NAME.  */
4233   n = XNEW (struct assert_locus_d);
4234   n->bb = dest_bb;
4235   n->e = e;
4236   n->si = si;
4237   n->comp_code = comp_code;
4238   n->val = val;
4239   n->expr = expr;
4240   n->next = NULL;
4241 
4242   if (last_loc)
4243     last_loc->next = n;
4244   else
4245     asserts_for[SSA_NAME_VERSION (name)] = n;
4246 
4247   bitmap_set_bit (need_assert_for, SSA_NAME_VERSION (name));
4248 }
4249 
4250 /* (COND_OP0 COND_CODE COND_OP1) is a predicate which uses NAME.
4251    Extract a suitable test code and value and store them into *CODE_P and
4252    *VAL_P so the predicate is normalized to NAME *CODE_P *VAL_P.
4253 
4254    If no extraction was possible, return FALSE, otherwise return TRUE.
4255 
4256    If INVERT is true, then we invert the result stored into *CODE_P.  */
4257 
4258 static bool
4259 extract_code_and_val_from_cond_with_ops (tree name, enum tree_code cond_code,
4260 					 tree cond_op0, tree cond_op1,
4261 					 bool invert, enum tree_code *code_p,
4262 					 tree *val_p)
4263 {
4264   enum tree_code comp_code;
4265   tree val;
4266 
4267   /* Otherwise, we have a comparison of the form NAME COMP VAL
4268      or VAL COMP NAME.  */
4269   if (name == cond_op1)
4270     {
4271       /* If the predicate is of the form VAL COMP NAME, flip
4272 	 COMP around because we need to register NAME as the
4273 	 first operand in the predicate.  */
4274       comp_code = swap_tree_comparison (cond_code);
4275       val = cond_op0;
4276     }
4277   else
4278     {
4279       /* The comparison is of the form NAME COMP VAL, so the
4280 	 comparison code remains unchanged.  */
4281       comp_code = cond_code;
4282       val = cond_op1;
4283     }
4284 
4285   /* Invert the comparison code as necessary.  */
4286   if (invert)
4287     comp_code = invert_tree_comparison (comp_code, 0);
4288 
4289   /* VRP does not handle float types.  */
4290   if (SCALAR_FLOAT_TYPE_P (TREE_TYPE (val)))
4291     return false;
4292 
4293   /* Do not register always-false predicates.
4294      FIXME:  this works around a limitation in fold() when dealing with
4295      enumerations.  Given 'enum { N1, N2 } x;', fold will not
4296      fold 'if (x > N2)' to 'if (0)'.  */
4297   if ((comp_code == GT_EXPR || comp_code == LT_EXPR)
4298       && INTEGRAL_TYPE_P (TREE_TYPE (val)))
4299     {
4300       tree min = TYPE_MIN_VALUE (TREE_TYPE (val));
4301       tree max = TYPE_MAX_VALUE (TREE_TYPE (val));
4302 
4303       if (comp_code == GT_EXPR
4304 	  && (!max
4305 	      || compare_values (val, max) == 0))
4306 	return false;
4307 
4308       if (comp_code == LT_EXPR
4309 	  && (!min
4310 	      || compare_values (val, min) == 0))
4311 	return false;
4312     }
4313   *code_p = comp_code;
4314   *val_p = val;
4315   return true;
4316 }
4317 
4318 /* Try to register an edge assertion for SSA name NAME on edge E for
4319    the condition COND contributing to the conditional jump pointed to by BSI.
4320    Invert the condition COND if INVERT is true.
4321    Return true if an assertion for NAME could be registered.  */
4322 
4323 static bool
4324 register_edge_assert_for_2 (tree name, edge e, gimple_stmt_iterator bsi,
4325 			    enum tree_code cond_code,
4326 			    tree cond_op0, tree cond_op1, bool invert)
4327 {
4328   tree val;
4329   enum tree_code comp_code;
4330   bool retval = false;
4331 
4332   if (!extract_code_and_val_from_cond_with_ops (name, cond_code,
4333 						cond_op0,
4334 						cond_op1,
4335 						invert, &comp_code, &val))
4336     return false;
4337 
4338   /* Only register an ASSERT_EXPR if NAME was found in the sub-graph
4339      reachable from E.  */
4340   if (live_on_edge (e, name)
4341       && !has_single_use (name))
4342     {
4343       register_new_assert_for (name, name, comp_code, val, NULL, e, bsi);
4344       retval = true;
4345     }
4346 
4347   /* In the case of NAME <= CST and NAME being defined as
4348      NAME = (unsigned) NAME2 + CST2 we can assert NAME2 >= -CST2
4349      and NAME2 <= CST - CST2.  We can do the same for NAME > CST.
4350      This catches range and anti-range tests.  */
4351   if ((comp_code == LE_EXPR
4352        || comp_code == GT_EXPR)
4353       && TREE_CODE (val) == INTEGER_CST
4354       && TYPE_UNSIGNED (TREE_TYPE (val)))
4355     {
4356       gimple def_stmt = SSA_NAME_DEF_STMT (name);
4357       tree cst2 = NULL_TREE, name2 = NULL_TREE, name3 = NULL_TREE;
4358 
4359       /* Extract CST2 from the (optional) addition.  */
4360       if (is_gimple_assign (def_stmt)
4361 	  && gimple_assign_rhs_code (def_stmt) == PLUS_EXPR)
4362 	{
4363 	  name2 = gimple_assign_rhs1 (def_stmt);
4364 	  cst2 = gimple_assign_rhs2 (def_stmt);
4365 	  if (TREE_CODE (name2) == SSA_NAME
4366 	      && TREE_CODE (cst2) == INTEGER_CST)
4367 	    def_stmt = SSA_NAME_DEF_STMT (name2);
4368 	}
4369 
4370       /* Extract NAME2 from the (optional) sign-changing cast.  */
4371       if (gimple_assign_cast_p (def_stmt))
4372 	{
4373 	  if (CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt))
4374 	      && ! TYPE_UNSIGNED (TREE_TYPE (gimple_assign_rhs1 (def_stmt)))
4375 	      && (TYPE_PRECISION (gimple_expr_type (def_stmt))
4376 		  == TYPE_PRECISION (TREE_TYPE (gimple_assign_rhs1 (def_stmt)))))
4377 	    name3 = gimple_assign_rhs1 (def_stmt);
4378 	}
4379 
4380       /* If name3 is used later, create an ASSERT_EXPR for it.  */
4381       if (name3 != NULL_TREE
4382       	  && TREE_CODE (name3) == SSA_NAME
4383 	  && (cst2 == NULL_TREE
4384 	      || TREE_CODE (cst2) == INTEGER_CST)
4385 	  && INTEGRAL_TYPE_P (TREE_TYPE (name3))
4386 	  && live_on_edge (e, name3)
4387 	  && !has_single_use (name3))
4388 	{
4389 	  tree tmp;
4390 
4391 	  /* Build an expression for the range test.  */
4392 	  tmp = build1 (NOP_EXPR, TREE_TYPE (name), name3);
4393 	  if (cst2 != NULL_TREE)
4394 	    tmp = build2 (PLUS_EXPR, TREE_TYPE (name), tmp, cst2);
4395 
4396 	  if (dump_file)
4397 	    {
4398 	      fprintf (dump_file, "Adding assert for ");
4399 	      print_generic_expr (dump_file, name3, 0);
4400 	      fprintf (dump_file, " from ");
4401 	      print_generic_expr (dump_file, tmp, 0);
4402 	      fprintf (dump_file, "\n");
4403 	    }
4404 
4405 	  register_new_assert_for (name3, tmp, comp_code, val, NULL, e, bsi);
4406 
4407 	  retval = true;
4408 	}
4409 
4410       /* If name2 is used later, create an ASSERT_EXPR for it.  */
4411       if (name2 != NULL_TREE
4412       	  && TREE_CODE (name2) == SSA_NAME
4413 	  && TREE_CODE (cst2) == INTEGER_CST
4414 	  && INTEGRAL_TYPE_P (TREE_TYPE (name2))
4415 	  && live_on_edge (e, name2)
4416 	  && !has_single_use (name2))
4417 	{
4418 	  tree tmp;
4419 
4420 	  /* Build an expression for the range test.  */
4421 	  tmp = name2;
4422 	  if (TREE_TYPE (name) != TREE_TYPE (name2))
4423 	    tmp = build1 (NOP_EXPR, TREE_TYPE (name), tmp);
4424 	  if (cst2 != NULL_TREE)
4425 	    tmp = build2 (PLUS_EXPR, TREE_TYPE (name), tmp, cst2);
4426 
4427 	  if (dump_file)
4428 	    {
4429 	      fprintf (dump_file, "Adding assert for ");
4430 	      print_generic_expr (dump_file, name2, 0);
4431 	      fprintf (dump_file, " from ");
4432 	      print_generic_expr (dump_file, tmp, 0);
4433 	      fprintf (dump_file, "\n");
4434 	    }
4435 
4436 	  register_new_assert_for (name2, tmp, comp_code, val, NULL, e, bsi);
4437 
4438 	  retval = true;
4439 	}
4440     }
4441 
4442   return retval;
4443 }
4444 
4445 /* OP is an operand of a truth value expression which is known to have
4446    a particular value.  Register any asserts for OP and for any
4447    operands in OP's defining statement.
4448 
4449    If CODE is EQ_EXPR, then we want to register OP is zero (false),
4450    if CODE is NE_EXPR, then we want to register OP is nonzero (true).   */
4451 
4452 static bool
4453 register_edge_assert_for_1 (tree op, enum tree_code code,
4454 			    edge e, gimple_stmt_iterator bsi)
4455 {
4456   bool retval = false;
4457   gimple op_def;
4458   tree val;
4459   enum tree_code rhs_code;
4460 
4461   /* We only care about SSA_NAMEs.  */
4462   if (TREE_CODE (op) != SSA_NAME)
4463     return false;
4464 
4465   /* We know that OP will have a zero or nonzero value.  If OP is used
4466      more than once go ahead and register an assert for OP.
4467 
4468      The FOUND_IN_SUBGRAPH support is not helpful in this situation as
4469      it will always be set for OP (because OP is used in a COND_EXPR in
4470      the subgraph).  */
4471   if (!has_single_use (op))
4472     {
4473       val = build_int_cst (TREE_TYPE (op), 0);
4474       register_new_assert_for (op, op, code, val, NULL, e, bsi);
4475       retval = true;
4476     }
4477 
4478   /* Now look at how OP is set.  If it's set from a comparison,
4479      a truth operation or some bit operations, then we may be able
4480      to register information about the operands of that assignment.  */
4481   op_def = SSA_NAME_DEF_STMT (op);
4482   if (gimple_code (op_def) != GIMPLE_ASSIGN)
4483     return retval;
4484 
4485   rhs_code = gimple_assign_rhs_code (op_def);
4486 
4487   if (TREE_CODE_CLASS (rhs_code) == tcc_comparison)
4488     {
4489       bool invert = (code == EQ_EXPR ? true : false);
4490       tree op0 = gimple_assign_rhs1 (op_def);
4491       tree op1 = gimple_assign_rhs2 (op_def);
4492 
4493       if (TREE_CODE (op0) == SSA_NAME)
4494         retval |= register_edge_assert_for_2 (op0, e, bsi, rhs_code, op0, op1,
4495 					      invert);
4496       if (TREE_CODE (op1) == SSA_NAME)
4497         retval |= register_edge_assert_for_2 (op1, e, bsi, rhs_code, op0, op1,
4498 					      invert);
4499     }
4500   else if ((code == NE_EXPR
4501 	    && gimple_assign_rhs_code (op_def) == BIT_AND_EXPR)
4502 	   || (code == EQ_EXPR
4503 	       && gimple_assign_rhs_code (op_def) == BIT_IOR_EXPR))
4504     {
4505       /* Recurse on each operand.  */
4506       retval |= register_edge_assert_for_1 (gimple_assign_rhs1 (op_def),
4507 					    code, e, bsi);
4508       retval |= register_edge_assert_for_1 (gimple_assign_rhs2 (op_def),
4509 					    code, e, bsi);
4510     }
4511   else if (gimple_assign_rhs_code (op_def) == BIT_NOT_EXPR
4512 	   && TYPE_PRECISION (TREE_TYPE (gimple_assign_lhs (op_def))) == 1)
4513     {
4514       /* Recurse, flipping CODE.  */
4515       code = invert_tree_comparison (code, false);
4516       retval |= register_edge_assert_for_1 (gimple_assign_rhs1 (op_def),
4517 					    code, e, bsi);
4518     }
4519   else if (gimple_assign_rhs_code (op_def) == SSA_NAME)
4520     {
4521       /* Recurse through the copy.  */
4522       retval |= register_edge_assert_for_1 (gimple_assign_rhs1 (op_def),
4523 					    code, e, bsi);
4524     }
4525   else if (CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (op_def)))
4526     {
4527       /* Recurse through the type conversion.  */
4528       retval |= register_edge_assert_for_1 (gimple_assign_rhs1 (op_def),
4529 					    code, e, bsi);
4530     }
4531 
4532   return retval;
4533 }
4534 
4535 /* Try to register an edge assertion for SSA name NAME on edge E for
4536    the condition COND contributing to the conditional jump pointed to by SI.
4537    Return true if an assertion for NAME could be registered.  */
4538 
4539 static bool
4540 register_edge_assert_for (tree name, edge e, gimple_stmt_iterator si,
4541 			  enum tree_code cond_code, tree cond_op0,
4542 			  tree cond_op1)
4543 {
4544   tree val;
4545   enum tree_code comp_code;
4546   bool retval = false;
4547   bool is_else_edge = (e->flags & EDGE_FALSE_VALUE) != 0;
4548 
4549   /* Do not attempt to infer anything in names that flow through
4550      abnormal edges.  */
4551   if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (name))
4552     return false;
4553 
4554   if (!extract_code_and_val_from_cond_with_ops (name, cond_code,
4555 						cond_op0, cond_op1,
4556 						is_else_edge,
4557 						&comp_code, &val))
4558     return false;
4559 
4560   /* Register ASSERT_EXPRs for name.  */
4561   retval |= register_edge_assert_for_2 (name, e, si, cond_code, cond_op0,
4562 					cond_op1, is_else_edge);
4563 
4564 
4565   /* If COND is effectively an equality test of an SSA_NAME against
4566      the value zero or one, then we may be able to assert values
4567      for SSA_NAMEs which flow into COND.  */
4568 
4569   /* In the case of NAME == 1 or NAME != 0, for BIT_AND_EXPR defining
4570      statement of NAME we can assert both operands of the BIT_AND_EXPR
4571      have nonzero value.  */
4572   if (((comp_code == EQ_EXPR && integer_onep (val))
4573        || (comp_code == NE_EXPR && integer_zerop (val))))
4574     {
4575       gimple def_stmt = SSA_NAME_DEF_STMT (name);
4576 
4577       if (is_gimple_assign (def_stmt)
4578 	  && gimple_assign_rhs_code (def_stmt) == BIT_AND_EXPR)
4579 	{
4580 	  tree op0 = gimple_assign_rhs1 (def_stmt);
4581 	  tree op1 = gimple_assign_rhs2 (def_stmt);
4582 	  retval |= register_edge_assert_for_1 (op0, NE_EXPR, e, si);
4583 	  retval |= register_edge_assert_for_1 (op1, NE_EXPR, e, si);
4584 	}
4585     }
4586 
4587   /* In the case of NAME == 0 or NAME != 1, for BIT_IOR_EXPR defining
4588      statement of NAME we can assert both operands of the BIT_IOR_EXPR
4589      have zero value.  */
4590   if (((comp_code == EQ_EXPR && integer_zerop (val))
4591        || (comp_code == NE_EXPR && integer_onep (val))))
4592     {
4593       gimple def_stmt = SSA_NAME_DEF_STMT (name);
4594 
4595       /* For BIT_IOR_EXPR only if NAME == 0 both operands have
4596 	 necessarily zero value, or if type-precision is one.  */
4597       if (is_gimple_assign (def_stmt)
4598 	  && (gimple_assign_rhs_code (def_stmt) == BIT_IOR_EXPR
4599 	      && (TYPE_PRECISION (TREE_TYPE (name)) == 1
4600 	          || comp_code == EQ_EXPR)))
4601 	{
4602 	  tree op0 = gimple_assign_rhs1 (def_stmt);
4603 	  tree op1 = gimple_assign_rhs2 (def_stmt);
4604 	  retval |= register_edge_assert_for_1 (op0, EQ_EXPR, e, si);
4605 	  retval |= register_edge_assert_for_1 (op1, EQ_EXPR, e, si);
4606 	}
4607     }
4608 
4609   return retval;
4610 }
4611 
4612 
4613 /* Determine whether the outgoing edges of BB should receive an
4614    ASSERT_EXPR for each of the operands of BB's LAST statement.
4615    The last statement of BB must be a COND_EXPR.
4616 
4617    If any of the sub-graphs rooted at BB have an interesting use of
4618    the predicate operands, an assert location node is added to the
4619    list of assertions for the corresponding operands.  */
4620 
4621 static bool
4622 find_conditional_asserts (basic_block bb, gimple last)
4623 {
4624   bool need_assert;
4625   gimple_stmt_iterator bsi;
4626   tree op;
4627   edge_iterator ei;
4628   edge e;
4629   ssa_op_iter iter;
4630 
4631   need_assert = false;
4632   bsi = gsi_for_stmt (last);
4633 
4634   /* Look for uses of the operands in each of the sub-graphs
4635      rooted at BB.  We need to check each of the outgoing edges
4636      separately, so that we know what kind of ASSERT_EXPR to
4637      insert.  */
4638   FOR_EACH_EDGE (e, ei, bb->succs)
4639     {
4640       if (e->dest == bb)
4641 	continue;
4642 
4643       /* Register the necessary assertions for each operand in the
4644 	 conditional predicate.  */
4645       FOR_EACH_SSA_TREE_OPERAND (op, last, iter, SSA_OP_USE)
4646 	{
4647 	  need_assert |= register_edge_assert_for (op, e, bsi,
4648 						   gimple_cond_code (last),
4649 						   gimple_cond_lhs (last),
4650 						   gimple_cond_rhs (last));
4651 	}
4652     }
4653 
4654   return need_assert;
4655 }
4656 
4657 struct case_info
4658 {
4659   tree expr;
4660   basic_block bb;
4661 };
4662 
4663 /* Compare two case labels sorting first by the destination bb index
4664    and then by the case value.  */
4665 
4666 static int
4667 compare_case_labels (const void *p1, const void *p2)
4668 {
4669   const struct case_info *ci1 = (const struct case_info *) p1;
4670   const struct case_info *ci2 = (const struct case_info *) p2;
4671   int idx1 = ci1->bb->index;
4672   int idx2 = ci2->bb->index;
4673 
4674   if (idx1 < idx2)
4675     return -1;
4676   else if (idx1 == idx2)
4677     {
4678       /* Make sure the default label is first in a group.  */
4679       if (!CASE_LOW (ci1->expr))
4680 	return -1;
4681       else if (!CASE_LOW (ci2->expr))
4682 	return 1;
4683       else
4684 	return tree_int_cst_compare (CASE_LOW (ci1->expr),
4685 				     CASE_LOW (ci2->expr));
4686     }
4687   else
4688     return 1;
4689 }
4690 
4691 /* Determine whether the outgoing edges of BB should receive an
4692    ASSERT_EXPR for each of the operands of BB's LAST statement.
4693    The last statement of BB must be a SWITCH_EXPR.
4694 
4695    If any of the sub-graphs rooted at BB have an interesting use of
4696    the predicate operands, an assert location node is added to the
4697    list of assertions for the corresponding operands.  */
4698 
4699 static bool
4700 find_switch_asserts (basic_block bb, gimple last)
4701 {
4702   bool need_assert;
4703   gimple_stmt_iterator bsi;
4704   tree op;
4705   edge e;
4706   struct case_info *ci;
4707   size_t n = gimple_switch_num_labels (last);
4708 #if GCC_VERSION >= 4000
4709   unsigned int idx;
4710 #else
4711   /* Work around GCC 3.4 bug (PR 37086).  */
4712   volatile unsigned int idx;
4713 #endif
4714 
4715   need_assert = false;
4716   bsi = gsi_for_stmt (last);
4717   op = gimple_switch_index (last);
4718   if (TREE_CODE (op) != SSA_NAME)
4719     return false;
4720 
4721   /* Build a vector of case labels sorted by destination label.  */
4722   ci = XNEWVEC (struct case_info, n);
4723   for (idx = 0; idx < n; ++idx)
4724     {
4725       ci[idx].expr = gimple_switch_label (last, idx);
4726       ci[idx].bb = label_to_block (CASE_LABEL (ci[idx].expr));
4727     }
4728   qsort (ci, n, sizeof (struct case_info), compare_case_labels);
4729 
4730   for (idx = 0; idx < n; ++idx)
4731     {
4732       tree min, max;
4733       tree cl = ci[idx].expr;
4734       basic_block cbb = ci[idx].bb;
4735 
4736       min = CASE_LOW (cl);
4737       max = CASE_HIGH (cl);
4738 
4739       /* If there are multiple case labels with the same destination
4740 	 we need to combine them to a single value range for the edge.  */
4741       if (idx + 1 < n && cbb == ci[idx + 1].bb)
4742 	{
4743 	  /* Skip labels until the last of the group.  */
4744 	  do {
4745 	    ++idx;
4746 	  } while (idx < n && cbb == ci[idx].bb);
4747 	  --idx;
4748 
4749 	  /* Pick up the maximum of the case label range.  */
4750 	  if (CASE_HIGH (ci[idx].expr))
4751 	    max = CASE_HIGH (ci[idx].expr);
4752 	  else
4753 	    max = CASE_LOW (ci[idx].expr);
4754 	}
4755 
4756       /* Nothing to do if the range includes the default label until we
4757 	 can register anti-ranges.  */
4758       if (min == NULL_TREE)
4759 	continue;
4760 
4761       /* Find the edge to register the assert expr on.  */
4762       e = find_edge (bb, cbb);
4763 
4764       /* Register the necessary assertions for the operand in the
4765 	 SWITCH_EXPR.  */
4766       need_assert |= register_edge_assert_for (op, e, bsi,
4767 					       max ? GE_EXPR : EQ_EXPR,
4768 					       op,
4769 					       fold_convert (TREE_TYPE (op),
4770 							     min));
4771       if (max)
4772 	{
4773 	  need_assert |= register_edge_assert_for (op, e, bsi, LE_EXPR,
4774 						   op,
4775 						   fold_convert (TREE_TYPE (op),
4776 								 max));
4777 	}
4778     }
4779 
4780   XDELETEVEC (ci);
4781   return need_assert;
4782 }
4783 
4784 
4785 /* Traverse all the statements in block BB looking for statements that
4786    may generate useful assertions for the SSA names in their operand.
4787    If a statement produces a useful assertion A for name N_i, then the
4788    list of assertions already generated for N_i is scanned to
4789    determine if A is actually needed.
4790 
4791    If N_i already had the assertion A at a location dominating the
4792    current location, then nothing needs to be done.  Otherwise, the
4793    new location for A is recorded instead.
4794 
4795    1- For every statement S in BB, all the variables used by S are
4796       added to bitmap FOUND_IN_SUBGRAPH.
4797 
4798    2- If statement S uses an operand N in a way that exposes a known
4799       value range for N, then if N was not already generated by an
4800       ASSERT_EXPR, create a new assert location for N.  For instance,
4801       if N is a pointer and the statement dereferences it, we can
4802       assume that N is not NULL.
4803 
4804    3- COND_EXPRs are a special case of #2.  We can derive range
4805       information from the predicate but need to insert different
4806       ASSERT_EXPRs for each of the sub-graphs rooted at the
4807       conditional block.  If the last statement of BB is a conditional
4808       expression of the form 'X op Y', then
4809 
4810       a) Remove X and Y from the set FOUND_IN_SUBGRAPH.
4811 
4812       b) If the conditional is the only entry point to the sub-graph
4813 	 corresponding to the THEN_CLAUSE, recurse into it.  On
4814 	 return, if X and/or Y are marked in FOUND_IN_SUBGRAPH, then
4815 	 an ASSERT_EXPR is added for the corresponding variable.
4816 
4817       c) Repeat step (b) on the ELSE_CLAUSE.
4818 
4819       d) Mark X and Y in FOUND_IN_SUBGRAPH.
4820 
4821       For instance,
4822 
4823 	    if (a == 9)
4824 	      b = a;
4825 	    else
4826 	      b = c + 1;
4827 
4828       In this case, an assertion on the THEN clause is useful to
4829       determine that 'a' is always 9 on that edge.  However, an assertion
4830       on the ELSE clause would be unnecessary.
4831 
4832    4- If BB does not end in a conditional expression, then we recurse
4833       into BB's dominator children.
4834 
4835    At the end of the recursive traversal, every SSA name will have a
4836    list of locations where ASSERT_EXPRs should be added.  When a new
4837    location for name N is found, it is registered by calling
4838    register_new_assert_for.  That function keeps track of all the
4839    registered assertions to prevent adding unnecessary assertions.
4840    For instance, if a pointer P_4 is dereferenced more than once in a
4841    dominator tree, only the location dominating all the dereference of
4842    P_4 will receive an ASSERT_EXPR.
4843 
4844    If this function returns true, then it means that there are names
4845    for which we need to generate ASSERT_EXPRs.  Those assertions are
4846    inserted by process_assert_insertions.  */
4847 
4848 static bool
4849 find_assert_locations_1 (basic_block bb, sbitmap live)
4850 {
4851   gimple_stmt_iterator si;
4852   gimple last;
4853   gimple phi;
4854   bool need_assert;
4855 
4856   need_assert = false;
4857   last = last_stmt (bb);
4858 
4859   /* If BB's last statement is a conditional statement involving integer
4860      operands, determine if we need to add ASSERT_EXPRs.  */
4861   if (last
4862       && gimple_code (last) == GIMPLE_COND
4863       && !fp_predicate (last)
4864       && !ZERO_SSA_OPERANDS (last, SSA_OP_USE))
4865     need_assert |= find_conditional_asserts (bb, last);
4866 
4867   /* If BB's last statement is a switch statement involving integer
4868      operands, determine if we need to add ASSERT_EXPRs.  */
4869   if (last
4870       && gimple_code (last) == GIMPLE_SWITCH
4871       && !ZERO_SSA_OPERANDS (last, SSA_OP_USE))
4872     need_assert |= find_switch_asserts (bb, last);
4873 
4874   /* Traverse all the statements in BB marking used names and looking
4875      for statements that may infer assertions for their used operands.  */
4876   for (si = gsi_start_bb (bb); !gsi_end_p (si); gsi_next (&si))
4877     {
4878       gimple stmt;
4879       tree op;
4880       ssa_op_iter i;
4881 
4882       stmt = gsi_stmt (si);
4883 
4884       if (is_gimple_debug (stmt))
4885 	continue;
4886 
4887       /* See if we can derive an assertion for any of STMT's operands.  */
4888       FOR_EACH_SSA_TREE_OPERAND (op, stmt, i, SSA_OP_USE)
4889 	{
4890 	  tree value;
4891 	  enum tree_code comp_code;
4892 
4893 	  /* Mark OP in our live bitmap.  */
4894 	  SET_BIT (live, SSA_NAME_VERSION (op));
4895 
4896 	  /* If OP is used in such a way that we can infer a value
4897 	     range for it, and we don't find a previous assertion for
4898 	     it, create a new assertion location node for OP.  */
4899 	  if (infer_value_range (stmt, op, &comp_code, &value))
4900 	    {
4901 	      /* If we are able to infer a nonzero value range for OP,
4902 		 then walk backwards through the use-def chain to see if OP
4903 		 was set via a typecast.
4904 
4905 		 If so, then we can also infer a nonzero value range
4906 		 for the operand of the NOP_EXPR.  */
4907 	      if (comp_code == NE_EXPR && integer_zerop (value))
4908 		{
4909 		  tree t = op;
4910 		  gimple def_stmt = SSA_NAME_DEF_STMT (t);
4911 
4912 		  while (is_gimple_assign (def_stmt)
4913 			 && gimple_assign_rhs_code (def_stmt)  == NOP_EXPR
4914 			 && TREE_CODE
4915 			     (gimple_assign_rhs1 (def_stmt)) == SSA_NAME
4916 			 && POINTER_TYPE_P
4917 			     (TREE_TYPE (gimple_assign_rhs1 (def_stmt))))
4918 		    {
4919 		      t = gimple_assign_rhs1 (def_stmt);
4920 		      def_stmt = SSA_NAME_DEF_STMT (t);
4921 
4922 		      /* Note we want to register the assert for the
4923 			 operand of the NOP_EXPR after SI, not after the
4924 			 conversion.  */
4925 		      if (! has_single_use (t))
4926 			{
4927 			  register_new_assert_for (t, t, comp_code, value,
4928 						   bb, NULL, si);
4929 			  need_assert = true;
4930 			}
4931 		    }
4932 		}
4933 
4934 	      /* If OP is used only once, namely in this STMT, don't
4935 		 bother creating an ASSERT_EXPR for it.  Such an
4936 		 ASSERT_EXPR would do nothing but increase compile time.  */
4937 	      if (!has_single_use (op))
4938 		{
4939 		  register_new_assert_for (op, op, comp_code, value,
4940 					   bb, NULL, si);
4941 		  need_assert = true;
4942 		}
4943 	    }
4944 	}
4945     }
4946 
4947   /* Traverse all PHI nodes in BB marking used operands.  */
4948   for (si = gsi_start_phis (bb); !gsi_end_p(si); gsi_next (&si))
4949     {
4950       use_operand_p arg_p;
4951       ssa_op_iter i;
4952       phi = gsi_stmt (si);
4953 
4954       FOR_EACH_PHI_ARG (arg_p, phi, i, SSA_OP_USE)
4955 	{
4956 	  tree arg = USE_FROM_PTR (arg_p);
4957 	  if (TREE_CODE (arg) == SSA_NAME)
4958 	    SET_BIT (live, SSA_NAME_VERSION (arg));
4959 	}
4960     }
4961 
4962   return need_assert;
4963 }
4964 
4965 /* Do an RPO walk over the function computing SSA name liveness
4966    on-the-fly and deciding on assert expressions to insert.
4967    Returns true if there are assert expressions to be inserted.  */
4968 
4969 static bool
4970 find_assert_locations (void)
4971 {
4972   int *rpo = XCNEWVEC (int, last_basic_block + NUM_FIXED_BLOCKS);
4973   int *bb_rpo = XCNEWVEC (int, last_basic_block + NUM_FIXED_BLOCKS);
4974   int *last_rpo = XCNEWVEC (int, last_basic_block + NUM_FIXED_BLOCKS);
4975   int rpo_cnt, i;
4976   bool need_asserts;
4977 
4978   live = XCNEWVEC (sbitmap, last_basic_block + NUM_FIXED_BLOCKS);
4979   rpo_cnt = pre_and_rev_post_order_compute (NULL, rpo, false);
4980   for (i = 0; i < rpo_cnt; ++i)
4981     bb_rpo[rpo[i]] = i;
4982 
4983   need_asserts = false;
4984   for (i = rpo_cnt-1; i >= 0; --i)
4985     {
4986       basic_block bb = BASIC_BLOCK (rpo[i]);
4987       edge e;
4988       edge_iterator ei;
4989 
4990       if (!live[rpo[i]])
4991 	{
4992 	  live[rpo[i]] = sbitmap_alloc (num_ssa_names);
4993 	  sbitmap_zero (live[rpo[i]]);
4994 	}
4995 
4996       /* Process BB and update the live information with uses in
4997          this block.  */
4998       need_asserts |= find_assert_locations_1 (bb, live[rpo[i]]);
4999 
5000       /* Merge liveness into the predecessor blocks and free it.  */
5001       if (!sbitmap_empty_p (live[rpo[i]]))
5002 	{
5003 	  int pred_rpo = i;
5004 	  FOR_EACH_EDGE (e, ei, bb->preds)
5005 	    {
5006 	      int pred = e->src->index;
5007 	      if (e->flags & EDGE_DFS_BACK)
5008 		continue;
5009 
5010 	      if (!live[pred])
5011 		{
5012 		  live[pred] = sbitmap_alloc (num_ssa_names);
5013 		  sbitmap_zero (live[pred]);
5014 		}
5015 	      sbitmap_a_or_b (live[pred], live[pred], live[rpo[i]]);
5016 
5017 	      if (bb_rpo[pred] < pred_rpo)
5018 		pred_rpo = bb_rpo[pred];
5019 	    }
5020 
5021 	  /* Record the RPO number of the last visited block that needs
5022 	     live information from this block.  */
5023 	  last_rpo[rpo[i]] = pred_rpo;
5024 	}
5025       else
5026 	{
5027 	  sbitmap_free (live[rpo[i]]);
5028 	  live[rpo[i]] = NULL;
5029 	}
5030 
5031       /* We can free all successors live bitmaps if all their
5032          predecessors have been visited already.  */
5033       FOR_EACH_EDGE (e, ei, bb->succs)
5034 	if (last_rpo[e->dest->index] == i
5035 	    && live[e->dest->index])
5036 	  {
5037 	    sbitmap_free (live[e->dest->index]);
5038 	    live[e->dest->index] = NULL;
5039 	  }
5040     }
5041 
5042   XDELETEVEC (rpo);
5043   XDELETEVEC (bb_rpo);
5044   XDELETEVEC (last_rpo);
5045   for (i = 0; i < last_basic_block + NUM_FIXED_BLOCKS; ++i)
5046     if (live[i])
5047       sbitmap_free (live[i]);
5048   XDELETEVEC (live);
5049 
5050   return need_asserts;
5051 }
5052 
5053 /* Create an ASSERT_EXPR for NAME and insert it in the location
5054    indicated by LOC.  Return true if we made any edge insertions.  */
5055 
5056 static bool
5057 process_assert_insertions_for (tree name, assert_locus_t loc)
5058 {
5059   /* Build the comparison expression NAME_i COMP_CODE VAL.  */
5060   gimple stmt;
5061   tree cond;
5062   gimple assert_stmt;
5063   edge_iterator ei;
5064   edge e;
5065 
5066   /* If we have X <=> X do not insert an assert expr for that.  */
5067   if (loc->expr == loc->val)
5068     return false;
5069 
5070   cond = build2 (loc->comp_code, boolean_type_node, loc->expr, loc->val);
5071   assert_stmt = build_assert_expr_for (cond, name);
5072   if (loc->e)
5073     {
5074       /* We have been asked to insert the assertion on an edge.  This
5075 	 is used only by COND_EXPR and SWITCH_EXPR assertions.  */
5076       gcc_checking_assert (gimple_code (gsi_stmt (loc->si)) == GIMPLE_COND
5077 			   || (gimple_code (gsi_stmt (loc->si))
5078 			       == GIMPLE_SWITCH));
5079 
5080       gsi_insert_on_edge (loc->e, assert_stmt);
5081       return true;
5082     }
5083 
5084   /* Otherwise, we can insert right after LOC->SI iff the
5085      statement must not be the last statement in the block.  */
5086   stmt = gsi_stmt (loc->si);
5087   if (!stmt_ends_bb_p (stmt))
5088     {
5089       gsi_insert_after (&loc->si, assert_stmt, GSI_SAME_STMT);
5090       return false;
5091     }
5092 
5093   /* If STMT must be the last statement in BB, we can only insert new
5094      assertions on the non-abnormal edge out of BB.  Note that since
5095      STMT is not control flow, there may only be one non-abnormal edge
5096      out of BB.  */
5097   FOR_EACH_EDGE (e, ei, loc->bb->succs)
5098     if (!(e->flags & EDGE_ABNORMAL))
5099       {
5100 	gsi_insert_on_edge (e, assert_stmt);
5101 	return true;
5102       }
5103 
5104   gcc_unreachable ();
5105 }
5106 
5107 
5108 /* Process all the insertions registered for every name N_i registered
5109    in NEED_ASSERT_FOR.  The list of assertions to be inserted are
5110    found in ASSERTS_FOR[i].  */
5111 
5112 static void
5113 process_assert_insertions (void)
5114 {
5115   unsigned i;
5116   bitmap_iterator bi;
5117   bool update_edges_p = false;
5118   int num_asserts = 0;
5119 
5120   if (dump_file && (dump_flags & TDF_DETAILS))
5121     dump_all_asserts (dump_file);
5122 
5123   EXECUTE_IF_SET_IN_BITMAP (need_assert_for, 0, i, bi)
5124     {
5125       assert_locus_t loc = asserts_for[i];
5126       gcc_assert (loc);
5127 
5128       while (loc)
5129 	{
5130 	  assert_locus_t next = loc->next;
5131 	  update_edges_p |= process_assert_insertions_for (ssa_name (i), loc);
5132 	  free (loc);
5133 	  loc = next;
5134 	  num_asserts++;
5135 	}
5136     }
5137 
5138   if (update_edges_p)
5139     gsi_commit_edge_inserts ();
5140 
5141   statistics_counter_event (cfun, "Number of ASSERT_EXPR expressions inserted",
5142 			    num_asserts);
5143 }
5144 
5145 
5146 /* Traverse the flowgraph looking for conditional jumps to insert range
5147    expressions.  These range expressions are meant to provide information
5148    to optimizations that need to reason in terms of value ranges.  They
5149    will not be expanded into RTL.  For instance, given:
5150 
5151    x = ...
5152    y = ...
5153    if (x < y)
5154      y = x - 2;
5155    else
5156      x = y + 3;
5157 
5158    this pass will transform the code into:
5159 
5160    x = ...
5161    y = ...
5162    if (x < y)
5163     {
5164       x = ASSERT_EXPR <x, x < y>
5165       y = x - 2
5166     }
5167    else
5168     {
5169       y = ASSERT_EXPR <y, x <= y>
5170       x = y + 3
5171     }
5172 
5173    The idea is that once copy and constant propagation have run, other
5174    optimizations will be able to determine what ranges of values can 'x'
5175    take in different paths of the code, simply by checking the reaching
5176    definition of 'x'.  */
5177 
5178 static void
5179 insert_range_assertions (void)
5180 {
5181   need_assert_for = BITMAP_ALLOC (NULL);
5182   asserts_for = XCNEWVEC (assert_locus_t, num_ssa_names);
5183 
5184   calculate_dominance_info (CDI_DOMINATORS);
5185 
5186   if (find_assert_locations ())
5187     {
5188       process_assert_insertions ();
5189       update_ssa (TODO_update_ssa_no_phi);
5190     }
5191 
5192   if (dump_file && (dump_flags & TDF_DETAILS))
5193     {
5194       fprintf (dump_file, "\nSSA form after inserting ASSERT_EXPRs\n");
5195       dump_function_to_file (current_function_decl, dump_file, dump_flags);
5196     }
5197 
5198   free (asserts_for);
5199   BITMAP_FREE (need_assert_for);
5200 }
5201 
5202 /* Checks one ARRAY_REF in REF, located at LOCUS. Ignores flexible arrays
5203    and "struct" hacks. If VRP can determine that the
5204    array subscript is a constant, check if it is outside valid
5205    range. If the array subscript is a RANGE, warn if it is
5206    non-overlapping with valid range.
5207    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
5208 
5209 static void
5210 check_array_ref (location_t location, tree ref, bool ignore_off_by_one)
5211 {
5212   value_range_t* vr = NULL;
5213   tree low_sub, up_sub;
5214   tree low_bound, up_bound, up_bound_p1;
5215   tree base;
5216 
5217   if (TREE_NO_WARNING (ref))
5218     return;
5219 
5220   low_sub = up_sub = TREE_OPERAND (ref, 1);
5221   up_bound = array_ref_up_bound (ref);
5222 
5223   /* Can not check flexible arrays.  */
5224   if (!up_bound
5225       || TREE_CODE (up_bound) != INTEGER_CST)
5226     return;
5227 
5228   /* Accesses to trailing arrays via pointers may access storage
5229      beyond the types array bounds.  */
5230   base = get_base_address (ref);
5231   if (base && TREE_CODE (base) == MEM_REF)
5232     {
5233       tree cref, next = NULL_TREE;
5234 
5235       if (TREE_CODE (TREE_OPERAND (ref, 0)) != COMPONENT_REF)
5236 	return;
5237 
5238       cref = TREE_OPERAND (ref, 0);
5239       if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
5240 	for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
5241 	     next && TREE_CODE (next) != FIELD_DECL;
5242 	     next = DECL_CHAIN (next))
5243 	  ;
5244 
5245       /* If this is the last field in a struct type or a field in a
5246 	 union type do not warn.  */
5247       if (!next)
5248 	return;
5249     }
5250 
5251   low_bound = array_ref_low_bound (ref);
5252   up_bound_p1 = int_const_binop (PLUS_EXPR, up_bound, integer_one_node);
5253 
5254   if (TREE_CODE (low_sub) == SSA_NAME)
5255     {
5256       vr = get_value_range (low_sub);
5257       if (vr->type == VR_RANGE || vr->type == VR_ANTI_RANGE)
5258         {
5259           low_sub = vr->type == VR_RANGE ? vr->max : vr->min;
5260           up_sub = vr->type == VR_RANGE ? vr->min : vr->max;
5261         }
5262     }
5263 
5264   if (vr && vr->type == VR_ANTI_RANGE)
5265     {
5266       if (TREE_CODE (up_sub) == INTEGER_CST
5267           && tree_int_cst_lt (up_bound, up_sub)
5268           && TREE_CODE (low_sub) == INTEGER_CST
5269           && tree_int_cst_lt (low_sub, low_bound))
5270         {
5271           warning_at (location, OPT_Warray_bounds,
5272 		      "array subscript is outside array bounds");
5273           TREE_NO_WARNING (ref) = 1;
5274         }
5275     }
5276   else if (TREE_CODE (up_sub) == INTEGER_CST
5277 	   && (ignore_off_by_one
5278 	       ? (tree_int_cst_lt (up_bound, up_sub)
5279 		  && !tree_int_cst_equal (up_bound_p1, up_sub))
5280 	       : (tree_int_cst_lt (up_bound, up_sub)
5281 		  || tree_int_cst_equal (up_bound_p1, up_sub))))
5282     {
5283       warning_at (location, OPT_Warray_bounds,
5284 		  "array subscript is above array bounds");
5285       TREE_NO_WARNING (ref) = 1;
5286     }
5287   else if (TREE_CODE (low_sub) == INTEGER_CST
5288            && tree_int_cst_lt (low_sub, low_bound))
5289     {
5290       warning_at (location, OPT_Warray_bounds,
5291 		  "array subscript is below array bounds");
5292       TREE_NO_WARNING (ref) = 1;
5293     }
5294 }
5295 
5296 /* Searches if the expr T, located at LOCATION computes
5297    address of an ARRAY_REF, and call check_array_ref on it.  */
5298 
5299 static void
5300 search_for_addr_array (tree t, location_t location)
5301 {
5302   while (TREE_CODE (t) == SSA_NAME)
5303     {
5304       gimple g = SSA_NAME_DEF_STMT (t);
5305 
5306       if (gimple_code (g) != GIMPLE_ASSIGN)
5307 	return;
5308 
5309       if (get_gimple_rhs_class (gimple_assign_rhs_code (g))
5310 	  != GIMPLE_SINGLE_RHS)
5311 	return;
5312 
5313       t = gimple_assign_rhs1 (g);
5314     }
5315 
5316 
5317   /* We are only interested in addresses of ARRAY_REF's.  */
5318   if (TREE_CODE (t) != ADDR_EXPR)
5319     return;
5320 
5321   /* Check each ARRAY_REFs in the reference chain. */
5322   do
5323     {
5324       if (TREE_CODE (t) == ARRAY_REF)
5325 	check_array_ref (location, t, true /*ignore_off_by_one*/);
5326 
5327       t = TREE_OPERAND (t, 0);
5328     }
5329   while (handled_component_p (t));
5330 
5331   if (TREE_CODE (t) == MEM_REF
5332       && TREE_CODE (TREE_OPERAND (t, 0)) == ADDR_EXPR
5333       && !TREE_NO_WARNING (t))
5334     {
5335       tree tem = TREE_OPERAND (TREE_OPERAND (t, 0), 0);
5336       tree low_bound, up_bound, el_sz;
5337       double_int idx;
5338       if (TREE_CODE (TREE_TYPE (tem)) != ARRAY_TYPE
5339 	  || TREE_CODE (TREE_TYPE (TREE_TYPE (tem))) == ARRAY_TYPE
5340 	  || !TYPE_DOMAIN (TREE_TYPE (tem)))
5341 	return;
5342 
5343       low_bound = TYPE_MIN_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
5344       up_bound = TYPE_MAX_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
5345       el_sz = TYPE_SIZE_UNIT (TREE_TYPE (TREE_TYPE (tem)));
5346       if (!low_bound
5347 	  || TREE_CODE (low_bound) != INTEGER_CST
5348 	  || !up_bound
5349 	  || TREE_CODE (up_bound) != INTEGER_CST
5350 	  || !el_sz
5351 	  || TREE_CODE (el_sz) != INTEGER_CST)
5352 	return;
5353 
5354       idx = mem_ref_offset (t);
5355       idx = double_int_sdiv (idx, tree_to_double_int (el_sz), TRUNC_DIV_EXPR);
5356       if (double_int_scmp (idx, double_int_zero) < 0)
5357 	{
5358 	  warning_at (location, OPT_Warray_bounds,
5359 		      "array subscript is below array bounds");
5360 	  TREE_NO_WARNING (t) = 1;
5361 	}
5362       else if (double_int_scmp (idx,
5363 				double_int_add
5364 				  (double_int_add
5365 				    (tree_to_double_int (up_bound),
5366 				     double_int_neg
5367 				       (tree_to_double_int (low_bound))),
5368 				    double_int_one)) > 0)
5369 	{
5370 	  warning_at (location, OPT_Warray_bounds,
5371 		      "array subscript is above array bounds");
5372 	  TREE_NO_WARNING (t) = 1;
5373 	}
5374     }
5375 }
5376 
5377 /* walk_tree() callback that checks if *TP is
5378    an ARRAY_REF inside an ADDR_EXPR (in which an array
5379    subscript one outside the valid range is allowed). Call
5380    check_array_ref for each ARRAY_REF found. The location is
5381    passed in DATA.  */
5382 
5383 static tree
5384 check_array_bounds (tree *tp, int *walk_subtree, void *data)
5385 {
5386   tree t = *tp;
5387   struct walk_stmt_info *wi = (struct walk_stmt_info *) data;
5388   location_t location;
5389 
5390   if (EXPR_HAS_LOCATION (t))
5391     location = EXPR_LOCATION (t);
5392   else
5393     {
5394       location_t *locp = (location_t *) wi->info;
5395       location = *locp;
5396     }
5397 
5398   *walk_subtree = TRUE;
5399 
5400   if (TREE_CODE (t) == ARRAY_REF)
5401     check_array_ref (location, t, false /*ignore_off_by_one*/);
5402 
5403   if (TREE_CODE (t) == MEM_REF
5404       || (TREE_CODE (t) == RETURN_EXPR && TREE_OPERAND (t, 0)))
5405     search_for_addr_array (TREE_OPERAND (t, 0), location);
5406 
5407   if (TREE_CODE (t) == ADDR_EXPR)
5408     *walk_subtree = FALSE;
5409 
5410   return NULL_TREE;
5411 }
5412 
5413 /* Walk over all statements of all reachable BBs and call check_array_bounds
5414    on them.  */
5415 
5416 static void
5417 check_all_array_refs (void)
5418 {
5419   basic_block bb;
5420   gimple_stmt_iterator si;
5421 
5422   FOR_EACH_BB (bb)
5423     {
5424       edge_iterator ei;
5425       edge e;
5426       bool executable = false;
5427 
5428       /* Skip blocks that were found to be unreachable.  */
5429       FOR_EACH_EDGE (e, ei, bb->preds)
5430 	executable |= !!(e->flags & EDGE_EXECUTABLE);
5431       if (!executable)
5432 	continue;
5433 
5434       for (si = gsi_start_bb (bb); !gsi_end_p (si); gsi_next (&si))
5435 	{
5436 	  gimple stmt = gsi_stmt (si);
5437 	  struct walk_stmt_info wi;
5438 	  if (!gimple_has_location (stmt))
5439 	    continue;
5440 
5441 	  if (is_gimple_call (stmt))
5442 	    {
5443 	      size_t i;
5444 	      size_t n = gimple_call_num_args (stmt);
5445 	      for (i = 0; i < n; i++)
5446 		{
5447 		  tree arg = gimple_call_arg (stmt, i);
5448 		  search_for_addr_array (arg, gimple_location (stmt));
5449 		}
5450 	    }
5451 	  else
5452 	    {
5453 	      memset (&wi, 0, sizeof (wi));
5454 	      wi.info = CONST_CAST (void *, (const void *)
5455 				    gimple_location_ptr (stmt));
5456 
5457 	      walk_gimple_op (gsi_stmt (si),
5458 			      check_array_bounds,
5459 			      &wi);
5460 	    }
5461 	}
5462     }
5463 }
5464 
5465 /* Convert range assertion expressions into the implied copies and
5466    copy propagate away the copies.  Doing the trivial copy propagation
5467    here avoids the need to run the full copy propagation pass after
5468    VRP.
5469 
5470    FIXME, this will eventually lead to copy propagation removing the
5471    names that had useful range information attached to them.  For
5472    instance, if we had the assertion N_i = ASSERT_EXPR <N_j, N_j > 3>,
5473    then N_i will have the range [3, +INF].
5474 
5475    However, by converting the assertion into the implied copy
5476    operation N_i = N_j, we will then copy-propagate N_j into the uses
5477    of N_i and lose the range information.  We may want to hold on to
5478    ASSERT_EXPRs a little while longer as the ranges could be used in
5479    things like jump threading.
5480 
5481    The problem with keeping ASSERT_EXPRs around is that passes after
5482    VRP need to handle them appropriately.
5483 
5484    Another approach would be to make the range information a first
5485    class property of the SSA_NAME so that it can be queried from
5486    any pass.  This is made somewhat more complex by the need for
5487    multiple ranges to be associated with one SSA_NAME.  */
5488 
5489 static void
5490 remove_range_assertions (void)
5491 {
5492   basic_block bb;
5493   gimple_stmt_iterator si;
5494 
5495   /* Note that the BSI iterator bump happens at the bottom of the
5496      loop and no bump is necessary if we're removing the statement
5497      referenced by the current BSI.  */
5498   FOR_EACH_BB (bb)
5499     for (si = gsi_start_bb (bb); !gsi_end_p (si);)
5500       {
5501 	gimple stmt = gsi_stmt (si);
5502 	gimple use_stmt;
5503 
5504 	if (is_gimple_assign (stmt)
5505 	    && gimple_assign_rhs_code (stmt) == ASSERT_EXPR)
5506 	  {
5507 	    tree rhs = gimple_assign_rhs1 (stmt);
5508 	    tree var;
5509 	    tree cond = fold (ASSERT_EXPR_COND (rhs));
5510 	    use_operand_p use_p;
5511 	    imm_use_iterator iter;
5512 
5513 	    gcc_assert (cond != boolean_false_node);
5514 
5515 	    /* Propagate the RHS into every use of the LHS.  */
5516 	    var = ASSERT_EXPR_VAR (rhs);
5517 	    FOR_EACH_IMM_USE_STMT (use_stmt, iter,
5518 				   gimple_assign_lhs (stmt))
5519 	      FOR_EACH_IMM_USE_ON_STMT (use_p, iter)
5520 		{
5521 		  SET_USE (use_p, var);
5522 		  gcc_assert (TREE_CODE (var) == SSA_NAME);
5523 		}
5524 
5525 	    /* And finally, remove the copy, it is not needed.  */
5526 	    gsi_remove (&si, true);
5527 	    release_defs (stmt);
5528 	  }
5529 	else
5530 	  gsi_next (&si);
5531       }
5532 }
5533 
5534 
5535 /* Return true if STMT is interesting for VRP.  */
5536 
5537 static bool
5538 stmt_interesting_for_vrp (gimple stmt)
5539 {
5540   if (gimple_code (stmt) == GIMPLE_PHI
5541       && is_gimple_reg (gimple_phi_result (stmt))
5542       && (INTEGRAL_TYPE_P (TREE_TYPE (gimple_phi_result (stmt)))
5543 	  || POINTER_TYPE_P (TREE_TYPE (gimple_phi_result (stmt)))))
5544     return true;
5545   else if (is_gimple_assign (stmt) || is_gimple_call (stmt))
5546     {
5547       tree lhs = gimple_get_lhs (stmt);
5548 
5549       /* In general, assignments with virtual operands are not useful
5550 	 for deriving ranges, with the obvious exception of calls to
5551 	 builtin functions.  */
5552       if (lhs && TREE_CODE (lhs) == SSA_NAME
5553 	  && (INTEGRAL_TYPE_P (TREE_TYPE (lhs))
5554 	      || POINTER_TYPE_P (TREE_TYPE (lhs)))
5555 	  && ((is_gimple_call (stmt)
5556 	       && gimple_call_fndecl (stmt) != NULL_TREE
5557 	       && DECL_BUILT_IN (gimple_call_fndecl (stmt)))
5558 	      || !gimple_vuse (stmt)))
5559 	return true;
5560     }
5561   else if (gimple_code (stmt) == GIMPLE_COND
5562 	   || gimple_code (stmt) == GIMPLE_SWITCH)
5563     return true;
5564 
5565   return false;
5566 }
5567 
5568 
5569 /* Initialize local data structures for VRP.  */
5570 
5571 static void
5572 vrp_initialize (void)
5573 {
5574   basic_block bb;
5575 
5576   values_propagated = false;
5577   num_vr_values = num_ssa_names;
5578   vr_value = XCNEWVEC (value_range_t *, num_vr_values);
5579   vr_phi_edge_counts = XCNEWVEC (int, num_ssa_names);
5580 
5581   FOR_EACH_BB (bb)
5582     {
5583       gimple_stmt_iterator si;
5584 
5585       for (si = gsi_start_phis (bb); !gsi_end_p (si); gsi_next (&si))
5586 	{
5587 	  gimple phi = gsi_stmt (si);
5588 	  if (!stmt_interesting_for_vrp (phi))
5589 	    {
5590 	      tree lhs = PHI_RESULT (phi);
5591 	      set_value_range_to_varying (get_value_range (lhs));
5592 	      prop_set_simulate_again (phi, false);
5593 	    }
5594 	  else
5595 	    prop_set_simulate_again (phi, true);
5596 	}
5597 
5598       for (si = gsi_start_bb (bb); !gsi_end_p (si); gsi_next (&si))
5599         {
5600 	  gimple stmt = gsi_stmt (si);
5601 
5602  	  /* If the statement is a control insn, then we do not
5603  	     want to avoid simulating the statement once.  Failure
5604  	     to do so means that those edges will never get added.  */
5605 	  if (stmt_ends_bb_p (stmt))
5606 	    prop_set_simulate_again (stmt, true);
5607 	  else if (!stmt_interesting_for_vrp (stmt))
5608 	    {
5609 	      ssa_op_iter i;
5610 	      tree def;
5611 	      FOR_EACH_SSA_TREE_OPERAND (def, stmt, i, SSA_OP_DEF)
5612 		set_value_range_to_varying (get_value_range (def));
5613 	      prop_set_simulate_again (stmt, false);
5614 	    }
5615 	  else
5616 	    prop_set_simulate_again (stmt, true);
5617 	}
5618     }
5619 }
5620 
5621 /* Return the singleton value-range for NAME or NAME.  */
5622 
5623 static inline tree
5624 vrp_valueize (tree name)
5625 {
5626   if (TREE_CODE (name) == SSA_NAME)
5627     {
5628       value_range_t *vr = get_value_range (name);
5629       if (vr->type == VR_RANGE
5630 	  && (vr->min == vr->max
5631 	      || operand_equal_p (vr->min, vr->max, 0)))
5632 	return vr->min;
5633     }
5634   return name;
5635 }
5636 
5637 /* Visit assignment STMT.  If it produces an interesting range, record
5638    the SSA name in *OUTPUT_P.  */
5639 
5640 static enum ssa_prop_result
5641 vrp_visit_assignment_or_call (gimple stmt, tree *output_p)
5642 {
5643   tree def, lhs;
5644   ssa_op_iter iter;
5645   enum gimple_code code = gimple_code (stmt);
5646   lhs = gimple_get_lhs (stmt);
5647 
5648   /* We only keep track of ranges in integral and pointer types.  */
5649   if (TREE_CODE (lhs) == SSA_NAME
5650       && ((INTEGRAL_TYPE_P (TREE_TYPE (lhs))
5651 	   /* It is valid to have NULL MIN/MAX values on a type.  See
5652 	      build_range_type.  */
5653 	   && TYPE_MIN_VALUE (TREE_TYPE (lhs))
5654 	   && TYPE_MAX_VALUE (TREE_TYPE (lhs)))
5655 	  || POINTER_TYPE_P (TREE_TYPE (lhs))))
5656     {
5657       value_range_t new_vr = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
5658 
5659       /* Try folding the statement to a constant first.  */
5660       tree tem = gimple_fold_stmt_to_constant (stmt, vrp_valueize);
5661       if (tem && !is_overflow_infinity (tem))
5662 	set_value_range (&new_vr, VR_RANGE, tem, tem, NULL);
5663       /* Then dispatch to value-range extracting functions.  */
5664       else if (code == GIMPLE_CALL)
5665 	extract_range_basic (&new_vr, stmt);
5666       else
5667 	extract_range_from_assignment (&new_vr, stmt);
5668 
5669       if (update_value_range (lhs, &new_vr))
5670 	{
5671 	  *output_p = lhs;
5672 
5673 	  if (dump_file && (dump_flags & TDF_DETAILS))
5674 	    {
5675 	      fprintf (dump_file, "Found new range for ");
5676 	      print_generic_expr (dump_file, lhs, 0);
5677 	      fprintf (dump_file, ": ");
5678 	      dump_value_range (dump_file, &new_vr);
5679 	      fprintf (dump_file, "\n\n");
5680 	    }
5681 
5682 	  if (new_vr.type == VR_VARYING)
5683 	    return SSA_PROP_VARYING;
5684 
5685 	  return SSA_PROP_INTERESTING;
5686 	}
5687 
5688       return SSA_PROP_NOT_INTERESTING;
5689     }
5690 
5691   /* Every other statement produces no useful ranges.  */
5692   FOR_EACH_SSA_TREE_OPERAND (def, stmt, iter, SSA_OP_DEF)
5693     set_value_range_to_varying (get_value_range (def));
5694 
5695   return SSA_PROP_VARYING;
5696 }
5697 
5698 /* Helper that gets the value range of the SSA_NAME with version I
5699    or a symbolic range containing the SSA_NAME only if the value range
5700    is varying or undefined.  */
5701 
5702 static inline value_range_t
5703 get_vr_for_comparison (int i)
5704 {
5705   value_range_t vr = *get_value_range (ssa_name (i));
5706 
5707   /* If name N_i does not have a valid range, use N_i as its own
5708      range.  This allows us to compare against names that may
5709      have N_i in their ranges.  */
5710   if (vr.type == VR_VARYING || vr.type == VR_UNDEFINED)
5711     {
5712       vr.type = VR_RANGE;
5713       vr.min = ssa_name (i);
5714       vr.max = ssa_name (i);
5715     }
5716 
5717   return vr;
5718 }
5719 
5720 /* Compare all the value ranges for names equivalent to VAR with VAL
5721    using comparison code COMP.  Return the same value returned by
5722    compare_range_with_value, including the setting of
5723    *STRICT_OVERFLOW_P.  */
5724 
5725 static tree
5726 compare_name_with_value (enum tree_code comp, tree var, tree val,
5727 			 bool *strict_overflow_p)
5728 {
5729   bitmap_iterator bi;
5730   unsigned i;
5731   bitmap e;
5732   tree retval, t;
5733   int used_strict_overflow;
5734   bool sop;
5735   value_range_t equiv_vr;
5736 
5737   /* Get the set of equivalences for VAR.  */
5738   e = get_value_range (var)->equiv;
5739 
5740   /* Start at -1.  Set it to 0 if we do a comparison without relying
5741      on overflow, or 1 if all comparisons rely on overflow.  */
5742   used_strict_overflow = -1;
5743 
5744   /* Compare vars' value range with val.  */
5745   equiv_vr = get_vr_for_comparison (SSA_NAME_VERSION (var));
5746   sop = false;
5747   retval = compare_range_with_value (comp, &equiv_vr, val, &sop);
5748   if (retval)
5749     used_strict_overflow = sop ? 1 : 0;
5750 
5751   /* If the equiv set is empty we have done all work we need to do.  */
5752   if (e == NULL)
5753     {
5754       if (retval
5755 	  && used_strict_overflow > 0)
5756 	*strict_overflow_p = true;
5757       return retval;
5758     }
5759 
5760   EXECUTE_IF_SET_IN_BITMAP (e, 0, i, bi)
5761     {
5762       equiv_vr = get_vr_for_comparison (i);
5763       sop = false;
5764       t = compare_range_with_value (comp, &equiv_vr, val, &sop);
5765       if (t)
5766 	{
5767 	  /* If we get different answers from different members
5768 	     of the equivalence set this check must be in a dead
5769 	     code region.  Folding it to a trap representation
5770 	     would be correct here.  For now just return don't-know.  */
5771 	  if (retval != NULL
5772 	      && t != retval)
5773 	    {
5774 	      retval = NULL_TREE;
5775 	      break;
5776 	    }
5777 	  retval = t;
5778 
5779 	  if (!sop)
5780 	    used_strict_overflow = 0;
5781 	  else if (used_strict_overflow < 0)
5782 	    used_strict_overflow = 1;
5783 	}
5784     }
5785 
5786   if (retval
5787       && used_strict_overflow > 0)
5788     *strict_overflow_p = true;
5789 
5790   return retval;
5791 }
5792 
5793 
5794 /* Given a comparison code COMP and names N1 and N2, compare all the
5795    ranges equivalent to N1 against all the ranges equivalent to N2
5796    to determine the value of N1 COMP N2.  Return the same value
5797    returned by compare_ranges.  Set *STRICT_OVERFLOW_P to indicate
5798    whether we relied on an overflow infinity in the comparison.  */
5799 
5800 
5801 static tree
5802 compare_names (enum tree_code comp, tree n1, tree n2,
5803 	       bool *strict_overflow_p)
5804 {
5805   tree t, retval;
5806   bitmap e1, e2;
5807   bitmap_iterator bi1, bi2;
5808   unsigned i1, i2;
5809   int used_strict_overflow;
5810   static bitmap_obstack *s_obstack = NULL;
5811   static bitmap s_e1 = NULL, s_e2 = NULL;
5812 
5813   /* Compare the ranges of every name equivalent to N1 against the
5814      ranges of every name equivalent to N2.  */
5815   e1 = get_value_range (n1)->equiv;
5816   e2 = get_value_range (n2)->equiv;
5817 
5818   /* Use the fake bitmaps if e1 or e2 are not available.  */
5819   if (s_obstack == NULL)
5820     {
5821       s_obstack = XNEW (bitmap_obstack);
5822       bitmap_obstack_initialize (s_obstack);
5823       s_e1 = BITMAP_ALLOC (s_obstack);
5824       s_e2 = BITMAP_ALLOC (s_obstack);
5825     }
5826   if (e1 == NULL)
5827     e1 = s_e1;
5828   if (e2 == NULL)
5829     e2 = s_e2;
5830 
5831   /* Add N1 and N2 to their own set of equivalences to avoid
5832      duplicating the body of the loop just to check N1 and N2
5833      ranges.  */
5834   bitmap_set_bit (e1, SSA_NAME_VERSION (n1));
5835   bitmap_set_bit (e2, SSA_NAME_VERSION (n2));
5836 
5837   /* If the equivalence sets have a common intersection, then the two
5838      names can be compared without checking their ranges.  */
5839   if (bitmap_intersect_p (e1, e2))
5840     {
5841       bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
5842       bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
5843 
5844       return (comp == EQ_EXPR || comp == GE_EXPR || comp == LE_EXPR)
5845 	     ? boolean_true_node
5846 	     : boolean_false_node;
5847     }
5848 
5849   /* Start at -1.  Set it to 0 if we do a comparison without relying
5850      on overflow, or 1 if all comparisons rely on overflow.  */
5851   used_strict_overflow = -1;
5852 
5853   /* Otherwise, compare all the equivalent ranges.  First, add N1 and
5854      N2 to their own set of equivalences to avoid duplicating the body
5855      of the loop just to check N1 and N2 ranges.  */
5856   EXECUTE_IF_SET_IN_BITMAP (e1, 0, i1, bi1)
5857     {
5858       value_range_t vr1 = get_vr_for_comparison (i1);
5859 
5860       t = retval = NULL_TREE;
5861       EXECUTE_IF_SET_IN_BITMAP (e2, 0, i2, bi2)
5862 	{
5863 	  bool sop = false;
5864 
5865 	  value_range_t vr2 = get_vr_for_comparison (i2);
5866 
5867 	  t = compare_ranges (comp, &vr1, &vr2, &sop);
5868 	  if (t)
5869 	    {
5870 	      /* If we get different answers from different members
5871 		 of the equivalence set this check must be in a dead
5872 		 code region.  Folding it to a trap representation
5873 		 would be correct here.  For now just return don't-know.  */
5874 	      if (retval != NULL
5875 		  && t != retval)
5876 		{
5877 		  bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
5878 		  bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
5879 		  return NULL_TREE;
5880 		}
5881 	      retval = t;
5882 
5883 	      if (!sop)
5884 		used_strict_overflow = 0;
5885 	      else if (used_strict_overflow < 0)
5886 		used_strict_overflow = 1;
5887 	    }
5888 	}
5889 
5890       if (retval)
5891 	{
5892 	  bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
5893 	  bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
5894 	  if (used_strict_overflow > 0)
5895 	    *strict_overflow_p = true;
5896 	  return retval;
5897 	}
5898     }
5899 
5900   /* None of the equivalent ranges are useful in computing this
5901      comparison.  */
5902   bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
5903   bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
5904   return NULL_TREE;
5905 }
5906 
5907 /* Helper function for vrp_evaluate_conditional_warnv.  */
5908 
5909 static tree
5910 vrp_evaluate_conditional_warnv_with_ops_using_ranges (enum tree_code code,
5911 						      tree op0, tree op1,
5912 						      bool * strict_overflow_p)
5913 {
5914   value_range_t *vr0, *vr1;
5915 
5916   vr0 = (TREE_CODE (op0) == SSA_NAME) ? get_value_range (op0) : NULL;
5917   vr1 = (TREE_CODE (op1) == SSA_NAME) ? get_value_range (op1) : NULL;
5918 
5919   if (vr0 && vr1)
5920     return compare_ranges (code, vr0, vr1, strict_overflow_p);
5921   else if (vr0 && vr1 == NULL)
5922     return compare_range_with_value (code, vr0, op1, strict_overflow_p);
5923   else if (vr0 == NULL && vr1)
5924     return (compare_range_with_value
5925 	    (swap_tree_comparison (code), vr1, op0, strict_overflow_p));
5926   return NULL;
5927 }
5928 
5929 /* Helper function for vrp_evaluate_conditional_warnv. */
5930 
5931 static tree
5932 vrp_evaluate_conditional_warnv_with_ops (enum tree_code code, tree op0,
5933 					 tree op1, bool use_equiv_p,
5934 					 bool *strict_overflow_p, bool *only_ranges)
5935 {
5936   tree ret;
5937   if (only_ranges)
5938     *only_ranges = true;
5939 
5940   /* We only deal with integral and pointer types.  */
5941   if (!INTEGRAL_TYPE_P (TREE_TYPE (op0))
5942       && !POINTER_TYPE_P (TREE_TYPE (op0)))
5943     return NULL_TREE;
5944 
5945   if (use_equiv_p)
5946     {
5947       if (only_ranges
5948           && (ret = vrp_evaluate_conditional_warnv_with_ops_using_ranges
5949 	              (code, op0, op1, strict_overflow_p)))
5950 	return ret;
5951       *only_ranges = false;
5952       if (TREE_CODE (op0) == SSA_NAME && TREE_CODE (op1) == SSA_NAME)
5953 	return compare_names (code, op0, op1, strict_overflow_p);
5954       else if (TREE_CODE (op0) == SSA_NAME)
5955 	return compare_name_with_value (code, op0, op1, strict_overflow_p);
5956       else if (TREE_CODE (op1) == SSA_NAME)
5957 	return (compare_name_with_value
5958 		(swap_tree_comparison (code), op1, op0, strict_overflow_p));
5959     }
5960   else
5961     return vrp_evaluate_conditional_warnv_with_ops_using_ranges (code, op0, op1,
5962 								 strict_overflow_p);
5963   return NULL_TREE;
5964 }
5965 
5966 /* Given (CODE OP0 OP1) within STMT, try to simplify it based on value range
5967    information.  Return NULL if the conditional can not be evaluated.
5968    The ranges of all the names equivalent with the operands in COND
5969    will be used when trying to compute the value.  If the result is
5970    based on undefined signed overflow, issue a warning if
5971    appropriate.  */
5972 
5973 static tree
5974 vrp_evaluate_conditional (enum tree_code code, tree op0, tree op1, gimple stmt)
5975 {
5976   bool sop;
5977   tree ret;
5978   bool only_ranges;
5979 
5980   /* Some passes and foldings leak constants with overflow flag set
5981      into the IL.  Avoid doing wrong things with these and bail out.  */
5982   if ((TREE_CODE (op0) == INTEGER_CST
5983        && TREE_OVERFLOW (op0))
5984       || (TREE_CODE (op1) == INTEGER_CST
5985 	  && TREE_OVERFLOW (op1)))
5986     return NULL_TREE;
5987 
5988   sop = false;
5989   ret = vrp_evaluate_conditional_warnv_with_ops (code, op0, op1, true, &sop,
5990   						 &only_ranges);
5991 
5992   if (ret && sop)
5993     {
5994       enum warn_strict_overflow_code wc;
5995       const char* warnmsg;
5996 
5997       if (is_gimple_min_invariant (ret))
5998 	{
5999 	  wc = WARN_STRICT_OVERFLOW_CONDITIONAL;
6000 	  warnmsg = G_("assuming signed overflow does not occur when "
6001 		       "simplifying conditional to constant");
6002 	}
6003       else
6004 	{
6005 	  wc = WARN_STRICT_OVERFLOW_COMPARISON;
6006 	  warnmsg = G_("assuming signed overflow does not occur when "
6007 		       "simplifying conditional");
6008 	}
6009 
6010       if (issue_strict_overflow_warning (wc))
6011 	{
6012 	  location_t location;
6013 
6014 	  if (!gimple_has_location (stmt))
6015 	    location = input_location;
6016 	  else
6017 	    location = gimple_location (stmt);
6018 	  warning_at (location, OPT_Wstrict_overflow, "%s", warnmsg);
6019 	}
6020     }
6021 
6022   if (warn_type_limits
6023       && ret && only_ranges
6024       && TREE_CODE_CLASS (code) == tcc_comparison
6025       && TREE_CODE (op0) == SSA_NAME)
6026     {
6027       /* If the comparison is being folded and the operand on the LHS
6028 	 is being compared against a constant value that is outside of
6029 	 the natural range of OP0's type, then the predicate will
6030 	 always fold regardless of the value of OP0.  If -Wtype-limits
6031 	 was specified, emit a warning.  */
6032       tree type = TREE_TYPE (op0);
6033       value_range_t *vr0 = get_value_range (op0);
6034 
6035       if (vr0->type != VR_VARYING
6036 	  && INTEGRAL_TYPE_P (type)
6037 	  && vrp_val_is_min (vr0->min)
6038 	  && vrp_val_is_max (vr0->max)
6039 	  && is_gimple_min_invariant (op1))
6040 	{
6041 	  location_t location;
6042 
6043 	  if (!gimple_has_location (stmt))
6044 	    location = input_location;
6045 	  else
6046 	    location = gimple_location (stmt);
6047 
6048 	  warning_at (location, OPT_Wtype_limits,
6049 		      integer_zerop (ret)
6050 		      ? G_("comparison always false "
6051                            "due to limited range of data type")
6052 		      : G_("comparison always true "
6053                            "due to limited range of data type"));
6054 	}
6055     }
6056 
6057   return ret;
6058 }
6059 
6060 
6061 /* Visit conditional statement STMT.  If we can determine which edge
6062    will be taken out of STMT's basic block, record it in
6063    *TAKEN_EDGE_P and return SSA_PROP_INTERESTING.  Otherwise, return
6064    SSA_PROP_VARYING.  */
6065 
6066 static enum ssa_prop_result
6067 vrp_visit_cond_stmt (gimple stmt, edge *taken_edge_p)
6068 {
6069   tree val;
6070   bool sop;
6071 
6072   *taken_edge_p = NULL;
6073 
6074   if (dump_file && (dump_flags & TDF_DETAILS))
6075     {
6076       tree use;
6077       ssa_op_iter i;
6078 
6079       fprintf (dump_file, "\nVisiting conditional with predicate: ");
6080       print_gimple_stmt (dump_file, stmt, 0, 0);
6081       fprintf (dump_file, "\nWith known ranges\n");
6082 
6083       FOR_EACH_SSA_TREE_OPERAND (use, stmt, i, SSA_OP_USE)
6084 	{
6085 	  fprintf (dump_file, "\t");
6086 	  print_generic_expr (dump_file, use, 0);
6087 	  fprintf (dump_file, ": ");
6088 	  dump_value_range (dump_file, vr_value[SSA_NAME_VERSION (use)]);
6089 	}
6090 
6091       fprintf (dump_file, "\n");
6092     }
6093 
6094   /* Compute the value of the predicate COND by checking the known
6095      ranges of each of its operands.
6096 
6097      Note that we cannot evaluate all the equivalent ranges here
6098      because those ranges may not yet be final and with the current
6099      propagation strategy, we cannot determine when the value ranges
6100      of the names in the equivalence set have changed.
6101 
6102      For instance, given the following code fragment
6103 
6104         i_5 = PHI <8, i_13>
6105 	...
6106      	i_14 = ASSERT_EXPR <i_5, i_5 != 0>
6107 	if (i_14 == 1)
6108 	  ...
6109 
6110      Assume that on the first visit to i_14, i_5 has the temporary
6111      range [8, 8] because the second argument to the PHI function is
6112      not yet executable.  We derive the range ~[0, 0] for i_14 and the
6113      equivalence set { i_5 }.  So, when we visit 'if (i_14 == 1)' for
6114      the first time, since i_14 is equivalent to the range [8, 8], we
6115      determine that the predicate is always false.
6116 
6117      On the next round of propagation, i_13 is determined to be
6118      VARYING, which causes i_5 to drop down to VARYING.  So, another
6119      visit to i_14 is scheduled.  In this second visit, we compute the
6120      exact same range and equivalence set for i_14, namely ~[0, 0] and
6121      { i_5 }.  But we did not have the previous range for i_5
6122      registered, so vrp_visit_assignment thinks that the range for
6123      i_14 has not changed.  Therefore, the predicate 'if (i_14 == 1)'
6124      is not visited again, which stops propagation from visiting
6125      statements in the THEN clause of that if().
6126 
6127      To properly fix this we would need to keep the previous range
6128      value for the names in the equivalence set.  This way we would've
6129      discovered that from one visit to the other i_5 changed from
6130      range [8, 8] to VR_VARYING.
6131 
6132      However, fixing this apparent limitation may not be worth the
6133      additional checking.  Testing on several code bases (GCC, DLV,
6134      MICO, TRAMP3D and SPEC2000) showed that doing this results in
6135      4 more predicates folded in SPEC.  */
6136   sop = false;
6137 
6138   val = vrp_evaluate_conditional_warnv_with_ops (gimple_cond_code (stmt),
6139 						 gimple_cond_lhs (stmt),
6140 						 gimple_cond_rhs (stmt),
6141 						 false, &sop, NULL);
6142   if (val)
6143     {
6144       if (!sop)
6145 	*taken_edge_p = find_taken_edge (gimple_bb (stmt), val);
6146       else
6147 	{
6148 	  if (dump_file && (dump_flags & TDF_DETAILS))
6149 	    fprintf (dump_file,
6150 		     "\nIgnoring predicate evaluation because "
6151 		     "it assumes that signed overflow is undefined");
6152 	  val = NULL_TREE;
6153 	}
6154     }
6155 
6156   if (dump_file && (dump_flags & TDF_DETAILS))
6157     {
6158       fprintf (dump_file, "\nPredicate evaluates to: ");
6159       if (val == NULL_TREE)
6160 	fprintf (dump_file, "DON'T KNOW\n");
6161       else
6162 	print_generic_stmt (dump_file, val, 0);
6163     }
6164 
6165   return (*taken_edge_p) ? SSA_PROP_INTERESTING : SSA_PROP_VARYING;
6166 }
6167 
6168 /* Searches the case label vector VEC for the index *IDX of the CASE_LABEL
6169    that includes the value VAL.  The search is restricted to the range
6170    [START_IDX, n - 1] where n is the size of VEC.
6171 
6172    If there is a CASE_LABEL for VAL, its index is placed in IDX and true is
6173    returned.
6174 
6175    If there is no CASE_LABEL for VAL and there is one that is larger than VAL,
6176    it is placed in IDX and false is returned.
6177 
6178    If VAL is larger than any CASE_LABEL, n is placed on IDX and false is
6179    returned. */
6180 
6181 static bool
6182 find_case_label_index (gimple stmt, size_t start_idx, tree val, size_t *idx)
6183 {
6184   size_t n = gimple_switch_num_labels (stmt);
6185   size_t low, high;
6186 
6187   /* Find case label for minimum of the value range or the next one.
6188      At each iteration we are searching in [low, high - 1]. */
6189 
6190   for (low = start_idx, high = n; high != low; )
6191     {
6192       tree t;
6193       int cmp;
6194       /* Note that i != high, so we never ask for n. */
6195       size_t i = (high + low) / 2;
6196       t = gimple_switch_label (stmt, i);
6197 
6198       /* Cache the result of comparing CASE_LOW and val.  */
6199       cmp = tree_int_cst_compare (CASE_LOW (t), val);
6200 
6201       if (cmp == 0)
6202 	{
6203 	  /* Ranges cannot be empty. */
6204 	  *idx = i;
6205 	  return true;
6206 	}
6207       else if (cmp > 0)
6208         high = i;
6209       else
6210 	{
6211 	  low = i + 1;
6212 	  if (CASE_HIGH (t) != NULL
6213 	      && tree_int_cst_compare (CASE_HIGH (t), val) >= 0)
6214 	    {
6215 	      *idx = i;
6216 	      return true;
6217 	    }
6218         }
6219     }
6220 
6221   *idx = high;
6222   return false;
6223 }
6224 
6225 /* Searches the case label vector VEC for the range of CASE_LABELs that is used
6226    for values between MIN and MAX. The first index is placed in MIN_IDX. The
6227    last index is placed in MAX_IDX. If the range of CASE_LABELs is empty
6228    then MAX_IDX < MIN_IDX.
6229    Returns true if the default label is not needed. */
6230 
6231 static bool
6232 find_case_label_range (gimple stmt, tree min, tree max, size_t *min_idx,
6233 		       size_t *max_idx)
6234 {
6235   size_t i, j;
6236   bool min_take_default = !find_case_label_index (stmt, 1, min, &i);
6237   bool max_take_default = !find_case_label_index (stmt, i, max, &j);
6238 
6239   if (i == j
6240       && min_take_default
6241       && max_take_default)
6242     {
6243       /* Only the default case label reached.
6244          Return an empty range. */
6245       *min_idx = 1;
6246       *max_idx = 0;
6247       return false;
6248     }
6249   else
6250     {
6251       bool take_default = min_take_default || max_take_default;
6252       tree low, high;
6253       size_t k;
6254 
6255       if (max_take_default)
6256 	j--;
6257 
6258       /* If the case label range is continuous, we do not need
6259 	 the default case label.  Verify that.  */
6260       high = CASE_LOW (gimple_switch_label (stmt, i));
6261       if (CASE_HIGH (gimple_switch_label (stmt, i)))
6262 	high = CASE_HIGH (gimple_switch_label (stmt, i));
6263       for (k = i + 1; k <= j; ++k)
6264 	{
6265 	  low = CASE_LOW (gimple_switch_label (stmt, k));
6266 	  if (!integer_onep (int_const_binop (MINUS_EXPR, low, high)))
6267 	    {
6268 	      take_default = true;
6269 	      break;
6270 	    }
6271 	  high = low;
6272 	  if (CASE_HIGH (gimple_switch_label (stmt, k)))
6273 	    high = CASE_HIGH (gimple_switch_label (stmt, k));
6274 	}
6275 
6276       *min_idx = i;
6277       *max_idx = j;
6278       return !take_default;
6279     }
6280 }
6281 
6282 /* Visit switch statement STMT.  If we can determine which edge
6283    will be taken out of STMT's basic block, record it in
6284    *TAKEN_EDGE_P and return SSA_PROP_INTERESTING.  Otherwise, return
6285    SSA_PROP_VARYING.  */
6286 
6287 static enum ssa_prop_result
6288 vrp_visit_switch_stmt (gimple stmt, edge *taken_edge_p)
6289 {
6290   tree op, val;
6291   value_range_t *vr;
6292   size_t i = 0, j = 0;
6293   bool take_default;
6294 
6295   *taken_edge_p = NULL;
6296   op = gimple_switch_index (stmt);
6297   if (TREE_CODE (op) != SSA_NAME)
6298     return SSA_PROP_VARYING;
6299 
6300   vr = get_value_range (op);
6301   if (dump_file && (dump_flags & TDF_DETAILS))
6302     {
6303       fprintf (dump_file, "\nVisiting switch expression with operand ");
6304       print_generic_expr (dump_file, op, 0);
6305       fprintf (dump_file, " with known range ");
6306       dump_value_range (dump_file, vr);
6307       fprintf (dump_file, "\n");
6308     }
6309 
6310   if (vr->type != VR_RANGE
6311       || symbolic_range_p (vr))
6312     return SSA_PROP_VARYING;
6313 
6314   /* Find the single edge that is taken from the switch expression.  */
6315   take_default = !find_case_label_range (stmt, vr->min, vr->max, &i, &j);
6316 
6317   /* Check if the range spans no CASE_LABEL. If so, we only reach the default
6318      label */
6319   if (j < i)
6320     {
6321       gcc_assert (take_default);
6322       val = gimple_switch_default_label (stmt);
6323     }
6324   else
6325     {
6326       /* Check if labels with index i to j and maybe the default label
6327 	 are all reaching the same label.  */
6328 
6329       val = gimple_switch_label (stmt, i);
6330       if (take_default
6331 	  && CASE_LABEL (gimple_switch_default_label (stmt))
6332 	  != CASE_LABEL (val))
6333 	{
6334 	  if (dump_file && (dump_flags & TDF_DETAILS))
6335 	    fprintf (dump_file, "  not a single destination for this "
6336 		     "range\n");
6337           return SSA_PROP_VARYING;
6338 	}
6339       for (++i; i <= j; ++i)
6340         {
6341           if (CASE_LABEL (gimple_switch_label (stmt, i)) != CASE_LABEL (val))
6342 	    {
6343 	      if (dump_file && (dump_flags & TDF_DETAILS))
6344 		fprintf (dump_file, "  not a single destination for this "
6345 			 "range\n");
6346 	      return SSA_PROP_VARYING;
6347 	    }
6348         }
6349     }
6350 
6351   *taken_edge_p = find_edge (gimple_bb (stmt),
6352 			     label_to_block (CASE_LABEL (val)));
6353 
6354   if (dump_file && (dump_flags & TDF_DETAILS))
6355     {
6356       fprintf (dump_file, "  will take edge to ");
6357       print_generic_stmt (dump_file, CASE_LABEL (val), 0);
6358     }
6359 
6360   return SSA_PROP_INTERESTING;
6361 }
6362 
6363 
6364 /* Evaluate statement STMT.  If the statement produces a useful range,
6365    return SSA_PROP_INTERESTING and record the SSA name with the
6366    interesting range into *OUTPUT_P.
6367 
6368    If STMT is a conditional branch and we can determine its truth
6369    value, the taken edge is recorded in *TAKEN_EDGE_P.
6370 
6371    If STMT produces a varying value, return SSA_PROP_VARYING.  */
6372 
6373 static enum ssa_prop_result
6374 vrp_visit_stmt (gimple stmt, edge *taken_edge_p, tree *output_p)
6375 {
6376   tree def;
6377   ssa_op_iter iter;
6378 
6379   if (dump_file && (dump_flags & TDF_DETAILS))
6380     {
6381       fprintf (dump_file, "\nVisiting statement:\n");
6382       print_gimple_stmt (dump_file, stmt, 0, dump_flags);
6383       fprintf (dump_file, "\n");
6384     }
6385 
6386   if (!stmt_interesting_for_vrp (stmt))
6387     gcc_assert (stmt_ends_bb_p (stmt));
6388   else if (is_gimple_assign (stmt) || is_gimple_call (stmt))
6389     {
6390       /* In general, assignments with virtual operands are not useful
6391 	 for deriving ranges, with the obvious exception of calls to
6392 	 builtin functions.  */
6393       if ((is_gimple_call (stmt)
6394 	   && gimple_call_fndecl (stmt) != NULL_TREE
6395 	   && DECL_BUILT_IN (gimple_call_fndecl (stmt)))
6396 	  || !gimple_vuse (stmt))
6397 	return vrp_visit_assignment_or_call (stmt, output_p);
6398     }
6399   else if (gimple_code (stmt) == GIMPLE_COND)
6400     return vrp_visit_cond_stmt (stmt, taken_edge_p);
6401   else if (gimple_code (stmt) == GIMPLE_SWITCH)
6402     return vrp_visit_switch_stmt (stmt, taken_edge_p);
6403 
6404   /* All other statements produce nothing of interest for VRP, so mark
6405      their outputs varying and prevent further simulation.  */
6406   FOR_EACH_SSA_TREE_OPERAND (def, stmt, iter, SSA_OP_DEF)
6407     set_value_range_to_varying (get_value_range (def));
6408 
6409   return SSA_PROP_VARYING;
6410 }
6411 
6412 
6413 /* Meet operation for value ranges.  Given two value ranges VR0 and
6414    VR1, store in VR0 a range that contains both VR0 and VR1.  This
6415    may not be the smallest possible such range.  */
6416 
6417 static void
6418 vrp_meet (value_range_t *vr0, value_range_t *vr1)
6419 {
6420   if (vr0->type == VR_UNDEFINED)
6421     {
6422       /* Drop equivalences.  See PR53465.  */
6423       set_value_range (vr0, vr1->type, vr1->min, vr1->max, NULL);
6424       return;
6425     }
6426 
6427   if (vr1->type == VR_UNDEFINED)
6428     {
6429       /* VR0 already has the resulting range, just drop equivalences.
6430 	 See PR53465.  */
6431       if (vr0->equiv)
6432 	bitmap_clear (vr0->equiv);
6433       return;
6434     }
6435 
6436   if (vr0->type == VR_VARYING)
6437     {
6438       /* Nothing to do.  VR0 already has the resulting range.  */
6439       return;
6440     }
6441 
6442   if (vr1->type == VR_VARYING)
6443     {
6444       set_value_range_to_varying (vr0);
6445       return;
6446     }
6447 
6448   if (vr0->type == VR_RANGE && vr1->type == VR_RANGE)
6449     {
6450       int cmp;
6451       tree min, max;
6452 
6453       /* Compute the convex hull of the ranges.  The lower limit of
6454          the new range is the minimum of the two ranges.  If they
6455 	 cannot be compared, then give up.  */
6456       cmp = compare_values (vr0->min, vr1->min);
6457       if (cmp == 0 || cmp == 1)
6458         min = vr1->min;
6459       else if (cmp == -1)
6460         min = vr0->min;
6461       else
6462 	goto give_up;
6463 
6464       /* Similarly, the upper limit of the new range is the maximum
6465          of the two ranges.  If they cannot be compared, then
6466 	 give up.  */
6467       cmp = compare_values (vr0->max, vr1->max);
6468       if (cmp == 0 || cmp == -1)
6469         max = vr1->max;
6470       else if (cmp == 1)
6471         max = vr0->max;
6472       else
6473 	goto give_up;
6474 
6475       /* Check for useless ranges.  */
6476       if (INTEGRAL_TYPE_P (TREE_TYPE (min))
6477 	  && ((vrp_val_is_min (min) || is_overflow_infinity (min))
6478 	      && (vrp_val_is_max (max) || is_overflow_infinity (max))))
6479 	goto give_up;
6480 
6481       /* The resulting set of equivalences is the intersection of
6482 	 the two sets.  */
6483       if (vr0->equiv && vr1->equiv && vr0->equiv != vr1->equiv)
6484         bitmap_and_into (vr0->equiv, vr1->equiv);
6485       else if (vr0->equiv && !vr1->equiv)
6486         bitmap_clear (vr0->equiv);
6487 
6488       set_value_range (vr0, vr0->type, min, max, vr0->equiv);
6489     }
6490   else if (vr0->type == VR_ANTI_RANGE && vr1->type == VR_ANTI_RANGE)
6491     {
6492       /* Two anti-ranges meet only if their complements intersect.
6493          Only handle the case of identical ranges.  */
6494       if (compare_values (vr0->min, vr1->min) == 0
6495 	  && compare_values (vr0->max, vr1->max) == 0
6496 	  && compare_values (vr0->min, vr0->max) == 0)
6497 	{
6498 	  /* The resulting set of equivalences is the intersection of
6499 	     the two sets.  */
6500 	  if (vr0->equiv && vr1->equiv && vr0->equiv != vr1->equiv)
6501 	    bitmap_and_into (vr0->equiv, vr1->equiv);
6502 	  else if (vr0->equiv && !vr1->equiv)
6503 	    bitmap_clear (vr0->equiv);
6504 	}
6505       else
6506 	goto give_up;
6507     }
6508   else if (vr0->type == VR_ANTI_RANGE || vr1->type == VR_ANTI_RANGE)
6509     {
6510       /* For a numeric range [VAL1, VAL2] and an anti-range ~[VAL3, VAL4],
6511          only handle the case where the ranges have an empty intersection.
6512 	 The result of the meet operation is the anti-range.  */
6513       if (!symbolic_range_p (vr0)
6514 	  && !symbolic_range_p (vr1)
6515 	  && !value_ranges_intersect_p (vr0, vr1))
6516 	{
6517 	  /* Copy most of VR1 into VR0.  Don't copy VR1's equivalence
6518 	     set.  We need to compute the intersection of the two
6519 	     equivalence sets.  */
6520 	  if (vr1->type == VR_ANTI_RANGE)
6521 	    set_value_range (vr0, vr1->type, vr1->min, vr1->max, vr0->equiv);
6522 
6523 	  /* The resulting set of equivalences is the intersection of
6524 	     the two sets.  */
6525 	  if (vr0->equiv && vr1->equiv && vr0->equiv != vr1->equiv)
6526 	    bitmap_and_into (vr0->equiv, vr1->equiv);
6527 	  else if (vr0->equiv && !vr1->equiv)
6528 	    bitmap_clear (vr0->equiv);
6529 	}
6530       else
6531 	goto give_up;
6532     }
6533   else
6534     gcc_unreachable ();
6535 
6536   return;
6537 
6538 give_up:
6539   /* Failed to find an efficient meet.  Before giving up and setting
6540      the result to VARYING, see if we can at least derive a useful
6541      anti-range.  FIXME, all this nonsense about distinguishing
6542      anti-ranges from ranges is necessary because of the odd
6543      semantics of range_includes_zero_p and friends.  */
6544   if (!symbolic_range_p (vr0)
6545       && ((vr0->type == VR_RANGE
6546 	   && range_includes_zero_p (vr0->min, vr0->max) == 0)
6547 	  || (vr0->type == VR_ANTI_RANGE
6548 	      && range_includes_zero_p (vr0->min, vr0->max) == 1))
6549       && !symbolic_range_p (vr1)
6550       && ((vr1->type == VR_RANGE
6551 	   && range_includes_zero_p (vr1->min, vr1->max) == 0)
6552 	  || (vr1->type == VR_ANTI_RANGE
6553 	      && range_includes_zero_p (vr1->min, vr1->max) == 1)))
6554     {
6555       set_value_range_to_nonnull (vr0, TREE_TYPE (vr0->min));
6556 
6557       /* Since this meet operation did not result from the meeting of
6558 	 two equivalent names, VR0 cannot have any equivalences.  */
6559       if (vr0->equiv)
6560 	bitmap_clear (vr0->equiv);
6561     }
6562   else
6563     set_value_range_to_varying (vr0);
6564 }
6565 
6566 
6567 /* Visit all arguments for PHI node PHI that flow through executable
6568    edges.  If a valid value range can be derived from all the incoming
6569    value ranges, set a new range for the LHS of PHI.  */
6570 
6571 static enum ssa_prop_result
6572 vrp_visit_phi_node (gimple phi)
6573 {
6574   size_t i;
6575   tree lhs = PHI_RESULT (phi);
6576   value_range_t *lhs_vr = get_value_range (lhs);
6577   value_range_t vr_result = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
6578   bool first = true;
6579   int edges, old_edges;
6580   struct loop *l;
6581 
6582   if (dump_file && (dump_flags & TDF_DETAILS))
6583     {
6584       fprintf (dump_file, "\nVisiting PHI node: ");
6585       print_gimple_stmt (dump_file, phi, 0, dump_flags);
6586     }
6587 
6588   edges = 0;
6589   for (i = 0; i < gimple_phi_num_args (phi); i++)
6590     {
6591       edge e = gimple_phi_arg_edge (phi, i);
6592 
6593       if (dump_file && (dump_flags & TDF_DETAILS))
6594 	{
6595 	  fprintf (dump_file,
6596 	      "\n    Argument #%d (%d -> %d %sexecutable)\n",
6597 	      (int) i, e->src->index, e->dest->index,
6598 	      (e->flags & EDGE_EXECUTABLE) ? "" : "not ");
6599 	}
6600 
6601       if (e->flags & EDGE_EXECUTABLE)
6602 	{
6603 	  tree arg = PHI_ARG_DEF (phi, i);
6604 	  value_range_t vr_arg;
6605 
6606 	  ++edges;
6607 
6608 	  if (TREE_CODE (arg) == SSA_NAME)
6609 	    {
6610 	      vr_arg = *(get_value_range (arg));
6611 	    }
6612 	  else
6613 	    {
6614 	      if (is_overflow_infinity (arg))
6615 		{
6616 		  arg = copy_node (arg);
6617 		  TREE_OVERFLOW (arg) = 0;
6618 		}
6619 
6620 	      vr_arg.type = VR_RANGE;
6621 	      vr_arg.min = arg;
6622 	      vr_arg.max = arg;
6623 	      vr_arg.equiv = NULL;
6624 	    }
6625 
6626 	  if (dump_file && (dump_flags & TDF_DETAILS))
6627 	    {
6628 	      fprintf (dump_file, "\t");
6629 	      print_generic_expr (dump_file, arg, dump_flags);
6630 	      fprintf (dump_file, "\n\tValue: ");
6631 	      dump_value_range (dump_file, &vr_arg);
6632 	      fprintf (dump_file, "\n");
6633 	    }
6634 
6635 	  if (first)
6636 	    copy_value_range (&vr_result, &vr_arg);
6637 	  else
6638 	    vrp_meet (&vr_result, &vr_arg);
6639 	  first = false;
6640 
6641 	  if (vr_result.type == VR_VARYING)
6642 	    break;
6643 	}
6644     }
6645 
6646   if (vr_result.type == VR_VARYING)
6647     goto varying;
6648   else if (vr_result.type == VR_UNDEFINED)
6649     goto update_range;
6650 
6651   old_edges = vr_phi_edge_counts[SSA_NAME_VERSION (lhs)];
6652   vr_phi_edge_counts[SSA_NAME_VERSION (lhs)] = edges;
6653 
6654   /* To prevent infinite iterations in the algorithm, derive ranges
6655      when the new value is slightly bigger or smaller than the
6656      previous one.  We don't do this if we have seen a new executable
6657      edge; this helps us avoid an overflow infinity for conditionals
6658      which are not in a loop.  */
6659   if (edges > 0
6660       && gimple_phi_num_args (phi) > 1
6661       && edges == old_edges)
6662     {
6663       int cmp_min = compare_values (lhs_vr->min, vr_result.min);
6664       int cmp_max = compare_values (lhs_vr->max, vr_result.max);
6665 
6666       /* For non VR_RANGE or for pointers fall back to varying if
6667 	 the range changed.  */
6668       if ((lhs_vr->type != VR_RANGE || vr_result.type != VR_RANGE
6669 	   || POINTER_TYPE_P (TREE_TYPE (lhs)))
6670 	  && (cmp_min != 0 || cmp_max != 0))
6671 	goto varying;
6672 
6673       /* If the new minimum is smaller or larger than the previous
6674 	 one, go all the way to -INF.  In the first case, to avoid
6675 	 iterating millions of times to reach -INF, and in the
6676 	 other case to avoid infinite bouncing between different
6677 	 minimums.  */
6678       if (cmp_min > 0 || cmp_min < 0)
6679 	{
6680 	  if (!needs_overflow_infinity (TREE_TYPE (vr_result.min))
6681 	      || !vrp_var_may_overflow (lhs, phi))
6682 	    vr_result.min = TYPE_MIN_VALUE (TREE_TYPE (vr_result.min));
6683 	  else if (supports_overflow_infinity (TREE_TYPE (vr_result.min)))
6684 	    vr_result.min =
6685 		negative_overflow_infinity (TREE_TYPE (vr_result.min));
6686 	}
6687 
6688       /* Similarly, if the new maximum is smaller or larger than
6689 	 the previous one, go all the way to +INF.  */
6690       if (cmp_max < 0 || cmp_max > 0)
6691 	{
6692 	  if (!needs_overflow_infinity (TREE_TYPE (vr_result.max))
6693 	      || !vrp_var_may_overflow (lhs, phi))
6694 	    vr_result.max = TYPE_MAX_VALUE (TREE_TYPE (vr_result.max));
6695 	  else if (supports_overflow_infinity (TREE_TYPE (vr_result.max)))
6696 	    vr_result.max =
6697 		positive_overflow_infinity (TREE_TYPE (vr_result.max));
6698 	}
6699 
6700       /* If we dropped either bound to +-INF then if this is a loop
6701 	 PHI node SCEV may known more about its value-range.  */
6702       if ((cmp_min > 0 || cmp_min < 0
6703 	   || cmp_max < 0 || cmp_max > 0)
6704 	  && current_loops
6705 	  && (l = loop_containing_stmt (phi))
6706 	  && l->header == gimple_bb (phi))
6707 	adjust_range_with_scev (&vr_result, l, phi, lhs);
6708 
6709       /* If we will end up with a (-INF, +INF) range, set it to
6710 	 VARYING.  Same if the previous max value was invalid for
6711 	 the type and we end up with vr_result.min > vr_result.max.  */
6712       if ((vrp_val_is_max (vr_result.max)
6713 	   && vrp_val_is_min (vr_result.min))
6714 	  || compare_values (vr_result.min,
6715 			     vr_result.max) > 0)
6716 	goto varying;
6717     }
6718 
6719   /* If the new range is different than the previous value, keep
6720      iterating.  */
6721 update_range:
6722   if (update_value_range (lhs, &vr_result))
6723     {
6724       if (dump_file && (dump_flags & TDF_DETAILS))
6725 	{
6726 	  fprintf (dump_file, "Found new range for ");
6727 	  print_generic_expr (dump_file, lhs, 0);
6728 	  fprintf (dump_file, ": ");
6729 	  dump_value_range (dump_file, &vr_result);
6730 	  fprintf (dump_file, "\n\n");
6731 	}
6732 
6733       return SSA_PROP_INTERESTING;
6734     }
6735 
6736   /* Nothing changed, don't add outgoing edges.  */
6737   return SSA_PROP_NOT_INTERESTING;
6738 
6739   /* No match found.  Set the LHS to VARYING.  */
6740 varying:
6741   set_value_range_to_varying (lhs_vr);
6742   return SSA_PROP_VARYING;
6743 }
6744 
6745 /* Simplify boolean operations if the source is known
6746    to be already a boolean.  */
6747 static bool
6748 simplify_truth_ops_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
6749 {
6750   enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
6751   tree lhs, op0, op1;
6752   bool need_conversion;
6753 
6754   /* We handle only !=/== case here.  */
6755   gcc_assert (rhs_code == EQ_EXPR || rhs_code == NE_EXPR);
6756 
6757   op0 = gimple_assign_rhs1 (stmt);
6758   if (!op_with_boolean_value_range_p (op0))
6759     return false;
6760 
6761   op1 = gimple_assign_rhs2 (stmt);
6762   if (!op_with_boolean_value_range_p (op1))
6763     return false;
6764 
6765   /* Reduce number of cases to handle to NE_EXPR.  As there is no
6766      BIT_XNOR_EXPR we cannot replace A == B with a single statement.  */
6767   if (rhs_code == EQ_EXPR)
6768     {
6769       if (TREE_CODE (op1) == INTEGER_CST)
6770 	op1 = int_const_binop (BIT_XOR_EXPR, op1, integer_one_node);
6771       else
6772 	return false;
6773     }
6774 
6775   lhs = gimple_assign_lhs (stmt);
6776   need_conversion
6777     = !useless_type_conversion_p (TREE_TYPE (lhs), TREE_TYPE (op0));
6778 
6779   /* Make sure to not sign-extend a 1-bit 1 when converting the result.  */
6780   if (need_conversion
6781       && !TYPE_UNSIGNED (TREE_TYPE (op0))
6782       && TYPE_PRECISION (TREE_TYPE (op0)) == 1
6783       && TYPE_PRECISION (TREE_TYPE (lhs)) > 1)
6784     return false;
6785 
6786   /* For A != 0 we can substitute A itself.  */
6787   if (integer_zerop (op1))
6788     gimple_assign_set_rhs_with_ops (gsi,
6789 				    need_conversion
6790 				    ? NOP_EXPR : TREE_CODE (op0),
6791 				    op0, NULL_TREE);
6792   /* For A != B we substitute A ^ B.  Either with conversion.  */
6793   else if (need_conversion)
6794     {
6795       gimple newop;
6796       tree tem = create_tmp_reg (TREE_TYPE (op0), NULL);
6797       newop = gimple_build_assign_with_ops (BIT_XOR_EXPR, tem, op0, op1);
6798       tem = make_ssa_name (tem, newop);
6799       gimple_assign_set_lhs (newop, tem);
6800       gsi_insert_before (gsi, newop, GSI_SAME_STMT);
6801       update_stmt (newop);
6802       gimple_assign_set_rhs_with_ops (gsi, NOP_EXPR, tem, NULL_TREE);
6803     }
6804   /* Or without.  */
6805   else
6806     gimple_assign_set_rhs_with_ops (gsi, BIT_XOR_EXPR, op0, op1);
6807   update_stmt (gsi_stmt (*gsi));
6808 
6809   return true;
6810 }
6811 
6812 /* Simplify a division or modulo operator to a right shift or
6813    bitwise and if the first operand is unsigned or is greater
6814    than zero and the second operand is an exact power of two.  */
6815 
6816 static bool
6817 simplify_div_or_mod_using_ranges (gimple stmt)
6818 {
6819   enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
6820   tree val = NULL;
6821   tree op0 = gimple_assign_rhs1 (stmt);
6822   tree op1 = gimple_assign_rhs2 (stmt);
6823   value_range_t *vr = get_value_range (gimple_assign_rhs1 (stmt));
6824 
6825   if (TYPE_UNSIGNED (TREE_TYPE (op0)))
6826     {
6827       val = integer_one_node;
6828     }
6829   else
6830     {
6831       bool sop = false;
6832 
6833       val = compare_range_with_value (GE_EXPR, vr, integer_zero_node, &sop);
6834 
6835       if (val
6836 	  && sop
6837 	  && integer_onep (val)
6838 	  && issue_strict_overflow_warning (WARN_STRICT_OVERFLOW_MISC))
6839 	{
6840 	  location_t location;
6841 
6842 	  if (!gimple_has_location (stmt))
6843 	    location = input_location;
6844 	  else
6845 	    location = gimple_location (stmt);
6846 	  warning_at (location, OPT_Wstrict_overflow,
6847 		      "assuming signed overflow does not occur when "
6848 		      "simplifying %</%> or %<%%%> to %<>>%> or %<&%>");
6849 	}
6850     }
6851 
6852   if (val && integer_onep (val))
6853     {
6854       tree t;
6855 
6856       if (rhs_code == TRUNC_DIV_EXPR)
6857 	{
6858 	  t = build_int_cst (integer_type_node, tree_log2 (op1));
6859 	  gimple_assign_set_rhs_code (stmt, RSHIFT_EXPR);
6860 	  gimple_assign_set_rhs1 (stmt, op0);
6861 	  gimple_assign_set_rhs2 (stmt, t);
6862 	}
6863       else
6864 	{
6865 	  t = build_int_cst (TREE_TYPE (op1), 1);
6866 	  t = int_const_binop (MINUS_EXPR, op1, t);
6867 	  t = fold_convert (TREE_TYPE (op0), t);
6868 
6869 	  gimple_assign_set_rhs_code (stmt, BIT_AND_EXPR);
6870 	  gimple_assign_set_rhs1 (stmt, op0);
6871 	  gimple_assign_set_rhs2 (stmt, t);
6872 	}
6873 
6874       update_stmt (stmt);
6875       return true;
6876     }
6877 
6878   return false;
6879 }
6880 
6881 /* If the operand to an ABS_EXPR is >= 0, then eliminate the
6882    ABS_EXPR.  If the operand is <= 0, then simplify the
6883    ABS_EXPR into a NEGATE_EXPR.  */
6884 
6885 static bool
6886 simplify_abs_using_ranges (gimple stmt)
6887 {
6888   tree val = NULL;
6889   tree op = gimple_assign_rhs1 (stmt);
6890   tree type = TREE_TYPE (op);
6891   value_range_t *vr = get_value_range (op);
6892 
6893   if (TYPE_UNSIGNED (type))
6894     {
6895       val = integer_zero_node;
6896     }
6897   else if (vr)
6898     {
6899       bool sop = false;
6900 
6901       val = compare_range_with_value (LE_EXPR, vr, integer_zero_node, &sop);
6902       if (!val)
6903 	{
6904 	  sop = false;
6905 	  val = compare_range_with_value (GE_EXPR, vr, integer_zero_node,
6906 					  &sop);
6907 
6908 	  if (val)
6909 	    {
6910 	      if (integer_zerop (val))
6911 		val = integer_one_node;
6912 	      else if (integer_onep (val))
6913 		val = integer_zero_node;
6914 	    }
6915 	}
6916 
6917       if (val
6918 	  && (integer_onep (val) || integer_zerop (val)))
6919 	{
6920 	  if (sop && issue_strict_overflow_warning (WARN_STRICT_OVERFLOW_MISC))
6921 	    {
6922 	      location_t location;
6923 
6924 	      if (!gimple_has_location (stmt))
6925 		location = input_location;
6926 	      else
6927 		location = gimple_location (stmt);
6928 	      warning_at (location, OPT_Wstrict_overflow,
6929 			  "assuming signed overflow does not occur when "
6930 			  "simplifying %<abs (X)%> to %<X%> or %<-X%>");
6931 	    }
6932 
6933 	  gimple_assign_set_rhs1 (stmt, op);
6934 	  if (integer_onep (val))
6935 	    gimple_assign_set_rhs_code (stmt, NEGATE_EXPR);
6936 	  else
6937 	    gimple_assign_set_rhs_code (stmt, SSA_NAME);
6938 	  update_stmt (stmt);
6939 	  return true;
6940 	}
6941     }
6942 
6943   return false;
6944 }
6945 
6946 /* Optimize away redundant BIT_AND_EXPR and BIT_IOR_EXPR.
6947    If all the bits that are being cleared by & are already
6948    known to be zero from VR, or all the bits that are being
6949    set by | are already known to be one from VR, the bit
6950    operation is redundant.  */
6951 
6952 static bool
6953 simplify_bit_ops_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
6954 {
6955   tree op0 = gimple_assign_rhs1 (stmt);
6956   tree op1 = gimple_assign_rhs2 (stmt);
6957   tree op = NULL_TREE;
6958   value_range_t vr0 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
6959   value_range_t vr1 = { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL };
6960   double_int may_be_nonzero0, may_be_nonzero1;
6961   double_int must_be_nonzero0, must_be_nonzero1;
6962   double_int mask;
6963 
6964   if (TREE_CODE (op0) == SSA_NAME)
6965     vr0 = *(get_value_range (op0));
6966   else if (is_gimple_min_invariant (op0))
6967     set_value_range_to_value (&vr0, op0, NULL);
6968   else
6969     return false;
6970 
6971   if (TREE_CODE (op1) == SSA_NAME)
6972     vr1 = *(get_value_range (op1));
6973   else if (is_gimple_min_invariant (op1))
6974     set_value_range_to_value (&vr1, op1, NULL);
6975   else
6976     return false;
6977 
6978   if (!zero_nonzero_bits_from_vr (&vr0, &may_be_nonzero0, &must_be_nonzero0))
6979     return false;
6980   if (!zero_nonzero_bits_from_vr (&vr1, &may_be_nonzero1, &must_be_nonzero1))
6981     return false;
6982 
6983   switch (gimple_assign_rhs_code (stmt))
6984     {
6985     case BIT_AND_EXPR:
6986       mask = double_int_and_not (may_be_nonzero0, must_be_nonzero1);
6987       if (double_int_zero_p (mask))
6988 	{
6989 	  op = op0;
6990 	  break;
6991 	}
6992       mask = double_int_and_not (may_be_nonzero1, must_be_nonzero0);
6993       if (double_int_zero_p (mask))
6994 	{
6995 	  op = op1;
6996 	  break;
6997 	}
6998       break;
6999     case BIT_IOR_EXPR:
7000       mask = double_int_and_not (may_be_nonzero0, must_be_nonzero1);
7001       if (double_int_zero_p (mask))
7002 	{
7003 	  op = op1;
7004 	  break;
7005 	}
7006       mask = double_int_and_not (may_be_nonzero1, must_be_nonzero0);
7007       if (double_int_zero_p (mask))
7008 	{
7009 	  op = op0;
7010 	  break;
7011 	}
7012       break;
7013     default:
7014       gcc_unreachable ();
7015     }
7016 
7017   if (op == NULL_TREE)
7018     return false;
7019 
7020   gimple_assign_set_rhs_with_ops (gsi, TREE_CODE (op), op, NULL);
7021   update_stmt (gsi_stmt (*gsi));
7022   return true;
7023 }
7024 
7025 /* We are comparing trees OP0 and OP1 using COND_CODE.  OP0 has
7026    a known value range VR.
7027 
7028    If there is one and only one value which will satisfy the
7029    conditional, then return that value.  Else return NULL.  */
7030 
7031 static tree
7032 test_for_singularity (enum tree_code cond_code, tree op0,
7033 		      tree op1, value_range_t *vr)
7034 {
7035   tree min = NULL;
7036   tree max = NULL;
7037 
7038   /* Extract minimum/maximum values which satisfy the
7039      the conditional as it was written.  */
7040   if (cond_code == LE_EXPR || cond_code == LT_EXPR)
7041     {
7042       /* This should not be negative infinity; there is no overflow
7043 	 here.  */
7044       min = TYPE_MIN_VALUE (TREE_TYPE (op0));
7045 
7046       max = op1;
7047       if (cond_code == LT_EXPR && !is_overflow_infinity (max))
7048 	{
7049 	  tree one = build_int_cst (TREE_TYPE (op0), 1);
7050 	  max = fold_build2 (MINUS_EXPR, TREE_TYPE (op0), max, one);
7051 	  if (EXPR_P (max))
7052 	    TREE_NO_WARNING (max) = 1;
7053 	}
7054     }
7055   else if (cond_code == GE_EXPR || cond_code == GT_EXPR)
7056     {
7057       /* This should not be positive infinity; there is no overflow
7058 	 here.  */
7059       max = TYPE_MAX_VALUE (TREE_TYPE (op0));
7060 
7061       min = op1;
7062       if (cond_code == GT_EXPR && !is_overflow_infinity (min))
7063 	{
7064 	  tree one = build_int_cst (TREE_TYPE (op0), 1);
7065 	  min = fold_build2 (PLUS_EXPR, TREE_TYPE (op0), min, one);
7066 	  if (EXPR_P (min))
7067 	    TREE_NO_WARNING (min) = 1;
7068 	}
7069     }
7070 
7071   /* Now refine the minimum and maximum values using any
7072      value range information we have for op0.  */
7073   if (min && max)
7074     {
7075       if (compare_values (vr->min, min) == 1)
7076 	min = vr->min;
7077       if (compare_values (vr->max, max) == -1)
7078 	max = vr->max;
7079 
7080       /* If the new min/max values have converged to a single value,
7081 	 then there is only one value which can satisfy the condition,
7082 	 return that value.  */
7083       if (operand_equal_p (min, max, 0) && is_gimple_min_invariant (min))
7084 	return min;
7085     }
7086   return NULL;
7087 }
7088 
7089 /* Simplify a conditional using a relational operator to an equality
7090    test if the range information indicates only one value can satisfy
7091    the original conditional.  */
7092 
7093 static bool
7094 simplify_cond_using_ranges (gimple stmt)
7095 {
7096   tree op0 = gimple_cond_lhs (stmt);
7097   tree op1 = gimple_cond_rhs (stmt);
7098   enum tree_code cond_code = gimple_cond_code (stmt);
7099 
7100   if (cond_code != NE_EXPR
7101       && cond_code != EQ_EXPR
7102       && TREE_CODE (op0) == SSA_NAME
7103       && INTEGRAL_TYPE_P (TREE_TYPE (op0))
7104       && is_gimple_min_invariant (op1))
7105     {
7106       value_range_t *vr = get_value_range (op0);
7107 
7108       /* If we have range information for OP0, then we might be
7109 	 able to simplify this conditional. */
7110       if (vr->type == VR_RANGE)
7111 	{
7112 	  tree new_tree = test_for_singularity (cond_code, op0, op1, vr);
7113 
7114 	  if (new_tree)
7115 	    {
7116 	      if (dump_file)
7117 		{
7118 		  fprintf (dump_file, "Simplified relational ");
7119 		  print_gimple_stmt (dump_file, stmt, 0, 0);
7120 		  fprintf (dump_file, " into ");
7121 		}
7122 
7123 	      gimple_cond_set_code (stmt, EQ_EXPR);
7124 	      gimple_cond_set_lhs (stmt, op0);
7125 	      gimple_cond_set_rhs (stmt, new_tree);
7126 
7127 	      update_stmt (stmt);
7128 
7129 	      if (dump_file)
7130 		{
7131 		  print_gimple_stmt (dump_file, stmt, 0, 0);
7132 		  fprintf (dump_file, "\n");
7133 		}
7134 
7135 	      return true;
7136 	    }
7137 
7138 	  /* Try again after inverting the condition.  We only deal
7139 	     with integral types here, so no need to worry about
7140 	     issues with inverting FP comparisons.  */
7141 	  cond_code = invert_tree_comparison (cond_code, false);
7142 	  new_tree = test_for_singularity (cond_code, op0, op1, vr);
7143 
7144 	  if (new_tree)
7145 	    {
7146 	      if (dump_file)
7147 		{
7148 		  fprintf (dump_file, "Simplified relational ");
7149 		  print_gimple_stmt (dump_file, stmt, 0, 0);
7150 		  fprintf (dump_file, " into ");
7151 		}
7152 
7153 	      gimple_cond_set_code (stmt, NE_EXPR);
7154 	      gimple_cond_set_lhs (stmt, op0);
7155 	      gimple_cond_set_rhs (stmt, new_tree);
7156 
7157 	      update_stmt (stmt);
7158 
7159 	      if (dump_file)
7160 		{
7161 		  print_gimple_stmt (dump_file, stmt, 0, 0);
7162 		  fprintf (dump_file, "\n");
7163 		}
7164 
7165 	      return true;
7166 	    }
7167 	}
7168     }
7169 
7170   return false;
7171 }
7172 
7173 /* Simplify a switch statement using the value range of the switch
7174    argument.  */
7175 
7176 static bool
7177 simplify_switch_using_ranges (gimple stmt)
7178 {
7179   tree op = gimple_switch_index (stmt);
7180   value_range_t *vr;
7181   bool take_default;
7182   edge e;
7183   edge_iterator ei;
7184   size_t i = 0, j = 0, n, n2;
7185   tree vec2;
7186   switch_update su;
7187 
7188   if (TREE_CODE (op) == SSA_NAME)
7189     {
7190       vr = get_value_range (op);
7191 
7192       /* We can only handle integer ranges.  */
7193       if (vr->type != VR_RANGE
7194 	  || symbolic_range_p (vr))
7195 	return false;
7196 
7197       /* Find case label for min/max of the value range.  */
7198       take_default = !find_case_label_range (stmt, vr->min, vr->max, &i, &j);
7199     }
7200   else if (TREE_CODE (op) == INTEGER_CST)
7201     {
7202       take_default = !find_case_label_index (stmt, 1, op, &i);
7203       if (take_default)
7204 	{
7205 	  i = 1;
7206 	  j = 0;
7207 	}
7208       else
7209 	{
7210 	  j = i;
7211 	}
7212     }
7213   else
7214     return false;
7215 
7216   n = gimple_switch_num_labels (stmt);
7217 
7218   /* Bail out if this is just all edges taken.  */
7219   if (i == 1
7220       && j == n - 1
7221       && take_default)
7222     return false;
7223 
7224   /* Build a new vector of taken case labels.  */
7225   vec2 = make_tree_vec (j - i + 1 + (int)take_default);
7226   n2 = 0;
7227 
7228   /* Add the default edge, if necessary.  */
7229   if (take_default)
7230     TREE_VEC_ELT (vec2, n2++) = gimple_switch_default_label (stmt);
7231 
7232   for (; i <= j; ++i, ++n2)
7233     TREE_VEC_ELT (vec2, n2) = gimple_switch_label (stmt, i);
7234 
7235   /* Mark needed edges.  */
7236   for (i = 0; i < n2; ++i)
7237     {
7238       e = find_edge (gimple_bb (stmt),
7239 		     label_to_block (CASE_LABEL (TREE_VEC_ELT (vec2, i))));
7240       e->aux = (void *)-1;
7241     }
7242 
7243   /* Queue not needed edges for later removal.  */
7244   FOR_EACH_EDGE (e, ei, gimple_bb (stmt)->succs)
7245     {
7246       if (e->aux == (void *)-1)
7247 	{
7248 	  e->aux = NULL;
7249 	  continue;
7250 	}
7251 
7252       if (dump_file && (dump_flags & TDF_DETAILS))
7253 	{
7254 	  fprintf (dump_file, "removing unreachable case label\n");
7255 	}
7256       VEC_safe_push (edge, heap, to_remove_edges, e);
7257       e->flags &= ~EDGE_EXECUTABLE;
7258     }
7259 
7260   /* And queue an update for the stmt.  */
7261   su.stmt = stmt;
7262   su.vec = vec2;
7263   VEC_safe_push (switch_update, heap, to_update_switch_stmts, &su);
7264   return false;
7265 }
7266 
7267 /* Simplify an integral conversion from an SSA name in STMT.  */
7268 
7269 static bool
7270 simplify_conversion_using_ranges (gimple stmt)
7271 {
7272   tree innerop, middleop, finaltype;
7273   gimple def_stmt;
7274   value_range_t *innervr;
7275   bool inner_unsigned_p, middle_unsigned_p, final_unsigned_p;
7276   unsigned inner_prec, middle_prec, final_prec;
7277   double_int innermin, innermed, innermax, middlemin, middlemed, middlemax;
7278 
7279   finaltype = TREE_TYPE (gimple_assign_lhs (stmt));
7280   if (!INTEGRAL_TYPE_P (finaltype))
7281     return false;
7282   middleop = gimple_assign_rhs1 (stmt);
7283   def_stmt = SSA_NAME_DEF_STMT (middleop);
7284   if (!is_gimple_assign (def_stmt)
7285       || !CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt)))
7286     return false;
7287   innerop = gimple_assign_rhs1 (def_stmt);
7288   if (TREE_CODE (innerop) != SSA_NAME)
7289     return false;
7290 
7291   /* Get the value-range of the inner operand.  */
7292   innervr = get_value_range (innerop);
7293   if (innervr->type != VR_RANGE
7294       || TREE_CODE (innervr->min) != INTEGER_CST
7295       || TREE_CODE (innervr->max) != INTEGER_CST)
7296     return false;
7297 
7298   /* Simulate the conversion chain to check if the result is equal if
7299      the middle conversion is removed.  */
7300   innermin = tree_to_double_int (innervr->min);
7301   innermax = tree_to_double_int (innervr->max);
7302 
7303   inner_prec = TYPE_PRECISION (TREE_TYPE (innerop));
7304   middle_prec = TYPE_PRECISION (TREE_TYPE (middleop));
7305   final_prec = TYPE_PRECISION (finaltype);
7306 
7307   /* If the first conversion is not injective, the second must not
7308      be widening.  */
7309   if (double_int_cmp (double_int_sub (innermax, innermin),
7310 		      double_int_mask (middle_prec), true) > 0
7311       && middle_prec < final_prec)
7312     return false;
7313   /* We also want a medium value so that we can track the effect that
7314      narrowing conversions with sign change have.  */
7315   inner_unsigned_p = TYPE_UNSIGNED (TREE_TYPE (innerop));
7316   if (inner_unsigned_p)
7317     innermed = double_int_rshift (double_int_mask (inner_prec),
7318 				  1, inner_prec, false);
7319   else
7320     innermed = double_int_zero;
7321   if (double_int_cmp (innermin, innermed, inner_unsigned_p) >= 0
7322       || double_int_cmp (innermed, innermax, inner_unsigned_p) >= 0)
7323     innermed = innermin;
7324 
7325   middle_unsigned_p = TYPE_UNSIGNED (TREE_TYPE (middleop));
7326   middlemin = double_int_ext (innermin, middle_prec, middle_unsigned_p);
7327   middlemed = double_int_ext (innermed, middle_prec, middle_unsigned_p);
7328   middlemax = double_int_ext (innermax, middle_prec, middle_unsigned_p);
7329 
7330   /* Require that the final conversion applied to both the original
7331      and the intermediate range produces the same result.  */
7332   final_unsigned_p = TYPE_UNSIGNED (finaltype);
7333   if (!double_int_equal_p (double_int_ext (middlemin,
7334 					   final_prec, final_unsigned_p),
7335 			   double_int_ext (innermin,
7336 					   final_prec, final_unsigned_p))
7337       || !double_int_equal_p (double_int_ext (middlemed,
7338 					      final_prec, final_unsigned_p),
7339 			      double_int_ext (innermed,
7340 					      final_prec, final_unsigned_p))
7341       || !double_int_equal_p (double_int_ext (middlemax,
7342 					      final_prec, final_unsigned_p),
7343 			      double_int_ext (innermax,
7344 					      final_prec, final_unsigned_p)))
7345     return false;
7346 
7347   gimple_assign_set_rhs1 (stmt, innerop);
7348   update_stmt (stmt);
7349   return true;
7350 }
7351 
7352 /* Return whether the value range *VR fits in an integer type specified
7353    by PRECISION and UNSIGNED_P.  */
7354 
7355 static bool
7356 range_fits_type_p (value_range_t *vr, unsigned precision, bool unsigned_p)
7357 {
7358   tree src_type;
7359   unsigned src_precision;
7360   double_int tem;
7361 
7362   /* We can only handle integral and pointer types.  */
7363   src_type = TREE_TYPE (vr->min);
7364   if (!INTEGRAL_TYPE_P (src_type)
7365       && !POINTER_TYPE_P (src_type))
7366     return false;
7367 
7368   /* An extension is always fine, so is an identity transform.  */
7369   src_precision = TYPE_PRECISION (TREE_TYPE (vr->min));
7370   if (src_precision < precision
7371       || (src_precision == precision
7372 	  && TYPE_UNSIGNED (src_type) == unsigned_p))
7373     return true;
7374 
7375   /* Now we can only handle ranges with constant bounds.  */
7376   if (vr->type != VR_RANGE
7377       || TREE_CODE (vr->min) != INTEGER_CST
7378       || TREE_CODE (vr->max) != INTEGER_CST)
7379     return false;
7380 
7381   /* For precision-preserving sign-changes the MSB of the double-int
7382      has to be clear.  */
7383   if (src_precision == precision
7384       && (TREE_INT_CST_HIGH (vr->min) | TREE_INT_CST_HIGH (vr->max)) < 0)
7385     return false;
7386 
7387   /* Then we can perform the conversion on both ends and compare
7388      the result for equality.  */
7389   tem = double_int_ext (tree_to_double_int (vr->min), precision, unsigned_p);
7390   if (!double_int_equal_p (tree_to_double_int (vr->min), tem))
7391     return false;
7392   tem = double_int_ext (tree_to_double_int (vr->max), precision, unsigned_p);
7393   if (!double_int_equal_p (tree_to_double_int (vr->max), tem))
7394     return false;
7395 
7396   return true;
7397 }
7398 
7399 /* Simplify a conversion from integral SSA name to float in STMT.  */
7400 
7401 static bool
7402 simplify_float_conversion_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
7403 {
7404   tree rhs1 = gimple_assign_rhs1 (stmt);
7405   value_range_t *vr = get_value_range (rhs1);
7406   enum machine_mode fltmode = TYPE_MODE (TREE_TYPE (gimple_assign_lhs (stmt)));
7407   enum machine_mode mode;
7408   tree tem;
7409   gimple conv;
7410 
7411   /* We can only handle constant ranges.  */
7412   if (vr->type != VR_RANGE
7413       || TREE_CODE (vr->min) != INTEGER_CST
7414       || TREE_CODE (vr->max) != INTEGER_CST)
7415     return false;
7416 
7417   /* First check if we can use a signed type in place of an unsigned.  */
7418   if (TYPE_UNSIGNED (TREE_TYPE (rhs1))
7419       && (can_float_p (fltmode, TYPE_MODE (TREE_TYPE (rhs1)), 0)
7420 	  != CODE_FOR_nothing)
7421       && range_fits_type_p (vr, GET_MODE_PRECISION
7422 			          (TYPE_MODE (TREE_TYPE (rhs1))), 0))
7423     mode = TYPE_MODE (TREE_TYPE (rhs1));
7424   /* If we can do the conversion in the current input mode do nothing.  */
7425   else if (can_float_p (fltmode, TYPE_MODE (TREE_TYPE (rhs1)),
7426 			TYPE_UNSIGNED (TREE_TYPE (rhs1))))
7427     return false;
7428   /* Otherwise search for a mode we can use, starting from the narrowest
7429      integer mode available.  */
7430   else
7431     {
7432       mode = GET_CLASS_NARROWEST_MODE (MODE_INT);
7433       do
7434 	{
7435 	  /* If we cannot do a signed conversion to float from mode
7436 	     or if the value-range does not fit in the signed type
7437 	     try with a wider mode.  */
7438 	  if (can_float_p (fltmode, mode, 0) != CODE_FOR_nothing
7439 	      && range_fits_type_p (vr, GET_MODE_PRECISION (mode), 0))
7440 	    break;
7441 
7442 	  mode = GET_MODE_WIDER_MODE (mode);
7443 	  /* But do not widen the input.  Instead leave that to the
7444 	     optabs expansion code.  */
7445 	  if (GET_MODE_PRECISION (mode) > TYPE_PRECISION (TREE_TYPE (rhs1)))
7446 	    return false;
7447 	}
7448       while (mode != VOIDmode);
7449       if (mode == VOIDmode)
7450 	return false;
7451     }
7452 
7453   /* It works, insert a truncation or sign-change before the
7454      float conversion.  */
7455   tem = create_tmp_var (build_nonstandard_integer_type
7456 			  (GET_MODE_PRECISION (mode), 0), NULL);
7457   conv = gimple_build_assign_with_ops (NOP_EXPR, tem, rhs1, NULL_TREE);
7458   tem = make_ssa_name (tem, conv);
7459   gimple_assign_set_lhs (conv, tem);
7460   gsi_insert_before (gsi, conv, GSI_SAME_STMT);
7461   gimple_assign_set_rhs1 (stmt, tem);
7462   update_stmt (stmt);
7463 
7464   return true;
7465 }
7466 
7467 /* Simplify STMT using ranges if possible.  */
7468 
7469 static bool
7470 simplify_stmt_using_ranges (gimple_stmt_iterator *gsi)
7471 {
7472   gimple stmt = gsi_stmt (*gsi);
7473   if (is_gimple_assign (stmt))
7474     {
7475       enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
7476       tree rhs1 = gimple_assign_rhs1 (stmt);
7477 
7478       switch (rhs_code)
7479 	{
7480 	case EQ_EXPR:
7481 	case NE_EXPR:
7482           /* Transform EQ_EXPR, NE_EXPR into BIT_XOR_EXPR or identity
7483 	     if the RHS is zero or one, and the LHS are known to be boolean
7484 	     values.  */
7485 	  if (INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
7486 	    return simplify_truth_ops_using_ranges (gsi, stmt);
7487 	  break;
7488 
7489       /* Transform TRUNC_DIV_EXPR and TRUNC_MOD_EXPR into RSHIFT_EXPR
7490 	 and BIT_AND_EXPR respectively if the first operand is greater
7491 	 than zero and the second operand is an exact power of two.  */
7492 	case TRUNC_DIV_EXPR:
7493 	case TRUNC_MOD_EXPR:
7494 	  if (INTEGRAL_TYPE_P (TREE_TYPE (rhs1))
7495 	      && integer_pow2p (gimple_assign_rhs2 (stmt)))
7496 	    return simplify_div_or_mod_using_ranges (stmt);
7497 	  break;
7498 
7499       /* Transform ABS (X) into X or -X as appropriate.  */
7500 	case ABS_EXPR:
7501 	  if (TREE_CODE (rhs1) == SSA_NAME
7502 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
7503 	    return simplify_abs_using_ranges (stmt);
7504 	  break;
7505 
7506 	case BIT_AND_EXPR:
7507 	case BIT_IOR_EXPR:
7508 	  /* Optimize away BIT_AND_EXPR and BIT_IOR_EXPR
7509 	     if all the bits being cleared are already cleared or
7510 	     all the bits being set are already set.  */
7511 	  if (INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
7512 	    return simplify_bit_ops_using_ranges (gsi, stmt);
7513 	  break;
7514 
7515 	CASE_CONVERT:
7516 	  if (TREE_CODE (rhs1) == SSA_NAME
7517 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
7518 	    return simplify_conversion_using_ranges (stmt);
7519 	  break;
7520 
7521 	case FLOAT_EXPR:
7522 	  if (TREE_CODE (rhs1) == SSA_NAME
7523 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
7524 	    return simplify_float_conversion_using_ranges (gsi, stmt);
7525 	  break;
7526 
7527 	default:
7528 	  break;
7529 	}
7530     }
7531   else if (gimple_code (stmt) == GIMPLE_COND)
7532     return simplify_cond_using_ranges (stmt);
7533   else if (gimple_code (stmt) == GIMPLE_SWITCH)
7534     return simplify_switch_using_ranges (stmt);
7535 
7536   return false;
7537 }
7538 
7539 /* If the statement pointed by SI has a predicate whose value can be
7540    computed using the value range information computed by VRP, compute
7541    its value and return true.  Otherwise, return false.  */
7542 
7543 static bool
7544 fold_predicate_in (gimple_stmt_iterator *si)
7545 {
7546   bool assignment_p = false;
7547   tree val;
7548   gimple stmt = gsi_stmt (*si);
7549 
7550   if (is_gimple_assign (stmt)
7551       && TREE_CODE_CLASS (gimple_assign_rhs_code (stmt)) == tcc_comparison)
7552     {
7553       assignment_p = true;
7554       val = vrp_evaluate_conditional (gimple_assign_rhs_code (stmt),
7555 				      gimple_assign_rhs1 (stmt),
7556 				      gimple_assign_rhs2 (stmt),
7557 				      stmt);
7558     }
7559   else if (gimple_code (stmt) == GIMPLE_COND)
7560     val = vrp_evaluate_conditional (gimple_cond_code (stmt),
7561 				    gimple_cond_lhs (stmt),
7562 				    gimple_cond_rhs (stmt),
7563 				    stmt);
7564   else
7565     return false;
7566 
7567   if (val)
7568     {
7569       if (assignment_p)
7570         val = fold_convert (gimple_expr_type (stmt), val);
7571 
7572       if (dump_file)
7573 	{
7574 	  fprintf (dump_file, "Folding predicate ");
7575 	  print_gimple_expr (dump_file, stmt, 0, 0);
7576 	  fprintf (dump_file, " to ");
7577 	  print_generic_expr (dump_file, val, 0);
7578 	  fprintf (dump_file, "\n");
7579 	}
7580 
7581       if (is_gimple_assign (stmt))
7582 	gimple_assign_set_rhs_from_tree (si, val);
7583       else
7584 	{
7585 	  gcc_assert (gimple_code (stmt) == GIMPLE_COND);
7586 	  if (integer_zerop (val))
7587 	    gimple_cond_make_false (stmt);
7588 	  else if (integer_onep (val))
7589 	    gimple_cond_make_true (stmt);
7590 	  else
7591 	    gcc_unreachable ();
7592 	}
7593 
7594       return true;
7595     }
7596 
7597   return false;
7598 }
7599 
7600 /* Callback for substitute_and_fold folding the stmt at *SI.  */
7601 
7602 static bool
7603 vrp_fold_stmt (gimple_stmt_iterator *si)
7604 {
7605   if (fold_predicate_in (si))
7606     return true;
7607 
7608   return simplify_stmt_using_ranges (si);
7609 }
7610 
7611 /* Stack of dest,src equivalency pairs that need to be restored after
7612    each attempt to thread a block's incoming edge to an outgoing edge.
7613 
7614    A NULL entry is used to mark the end of pairs which need to be
7615    restored.  */
7616 static VEC(tree,heap) *stack;
7617 
7618 /* A trivial wrapper so that we can present the generic jump threading
7619    code with a simple API for simplifying statements.  STMT is the
7620    statement we want to simplify, WITHIN_STMT provides the location
7621    for any overflow warnings.  */
7622 
7623 static tree
7624 simplify_stmt_for_jump_threading (gimple stmt, gimple within_stmt)
7625 {
7626   /* We only use VRP information to simplify conditionals.  This is
7627      overly conservative, but it's unclear if doing more would be
7628      worth the compile time cost.  */
7629   if (gimple_code (stmt) != GIMPLE_COND)
7630     return NULL;
7631 
7632   return vrp_evaluate_conditional (gimple_cond_code (stmt),
7633 				   gimple_cond_lhs (stmt),
7634 				   gimple_cond_rhs (stmt), within_stmt);
7635 }
7636 
7637 /* Blocks which have more than one predecessor and more than
7638    one successor present jump threading opportunities, i.e.,
7639    when the block is reached from a specific predecessor, we
7640    may be able to determine which of the outgoing edges will
7641    be traversed.  When this optimization applies, we are able
7642    to avoid conditionals at runtime and we may expose secondary
7643    optimization opportunities.
7644 
7645    This routine is effectively a driver for the generic jump
7646    threading code.  It basically just presents the generic code
7647    with edges that may be suitable for jump threading.
7648 
7649    Unlike DOM, we do not iterate VRP if jump threading was successful.
7650    While iterating may expose new opportunities for VRP, it is expected
7651    those opportunities would be very limited and the compile time cost
7652    to expose those opportunities would be significant.
7653 
7654    As jump threading opportunities are discovered, they are registered
7655    for later realization.  */
7656 
7657 static void
7658 identify_jump_threads (void)
7659 {
7660   basic_block bb;
7661   gimple dummy;
7662   int i;
7663   edge e;
7664 
7665   /* Ugh.  When substituting values earlier in this pass we can
7666      wipe the dominance information.  So rebuild the dominator
7667      information as we need it within the jump threading code.  */
7668   calculate_dominance_info (CDI_DOMINATORS);
7669 
7670   /* We do not allow VRP information to be used for jump threading
7671      across a back edge in the CFG.  Otherwise it becomes too
7672      difficult to avoid eliminating loop exit tests.  Of course
7673      EDGE_DFS_BACK is not accurate at this time so we have to
7674      recompute it.  */
7675   mark_dfs_back_edges ();
7676 
7677   /* Do not thread across edges we are about to remove.  Just marking
7678      them as EDGE_DFS_BACK will do.  */
7679   FOR_EACH_VEC_ELT (edge, to_remove_edges, i, e)
7680     e->flags |= EDGE_DFS_BACK;
7681 
7682   /* Allocate our unwinder stack to unwind any temporary equivalences
7683      that might be recorded.  */
7684   stack = VEC_alloc (tree, heap, 20);
7685 
7686   /* To avoid lots of silly node creation, we create a single
7687      conditional and just modify it in-place when attempting to
7688      thread jumps.  */
7689   dummy = gimple_build_cond (EQ_EXPR,
7690 			     integer_zero_node, integer_zero_node,
7691 			     NULL, NULL);
7692 
7693   /* Walk through all the blocks finding those which present a
7694      potential jump threading opportunity.  We could set this up
7695      as a dominator walker and record data during the walk, but
7696      I doubt it's worth the effort for the classes of jump
7697      threading opportunities we are trying to identify at this
7698      point in compilation.  */
7699   FOR_EACH_BB (bb)
7700     {
7701       gimple last;
7702 
7703       /* If the generic jump threading code does not find this block
7704 	 interesting, then there is nothing to do.  */
7705       if (! potentially_threadable_block (bb))
7706 	continue;
7707 
7708       /* We only care about blocks ending in a COND_EXPR.  While there
7709 	 may be some value in handling SWITCH_EXPR here, I doubt it's
7710 	 terribly important.  */
7711       last = gsi_stmt (gsi_last_bb (bb));
7712 
7713       /* We're basically looking for a switch or any kind of conditional with
7714 	 integral or pointer type arguments.  Note the type of the second
7715 	 argument will be the same as the first argument, so no need to
7716 	 check it explicitly.  */
7717       if (gimple_code (last) == GIMPLE_SWITCH
7718 	  || (gimple_code (last) == GIMPLE_COND
7719       	      && TREE_CODE (gimple_cond_lhs (last)) == SSA_NAME
7720 	      && (INTEGRAL_TYPE_P (TREE_TYPE (gimple_cond_lhs (last)))
7721 		  || POINTER_TYPE_P (TREE_TYPE (gimple_cond_lhs (last))))
7722 	      && (TREE_CODE (gimple_cond_rhs (last)) == SSA_NAME
7723 		  || is_gimple_min_invariant (gimple_cond_rhs (last)))))
7724 	{
7725 	  edge_iterator ei;
7726 
7727 	  /* We've got a block with multiple predecessors and multiple
7728 	     successors which also ends in a suitable conditional or
7729 	     switch statement.  For each predecessor, see if we can thread
7730 	     it to a specific successor.  */
7731 	  FOR_EACH_EDGE (e, ei, bb->preds)
7732 	    {
7733 	      /* Do not thread across back edges or abnormal edges
7734 		 in the CFG.  */
7735 	      if (e->flags & (EDGE_DFS_BACK | EDGE_COMPLEX))
7736 		continue;
7737 
7738 	      thread_across_edge (dummy, e, true, &stack,
7739 				  simplify_stmt_for_jump_threading);
7740 	    }
7741 	}
7742     }
7743 
7744   /* We do not actually update the CFG or SSA graphs at this point as
7745      ASSERT_EXPRs are still in the IL and cfg cleanup code does not yet
7746      handle ASSERT_EXPRs gracefully.  */
7747 }
7748 
7749 /* We identified all the jump threading opportunities earlier, but could
7750    not transform the CFG at that time.  This routine transforms the
7751    CFG and arranges for the dominator tree to be rebuilt if necessary.
7752 
7753    Note the SSA graph update will occur during the normal TODO
7754    processing by the pass manager.  */
7755 static void
7756 finalize_jump_threads (void)
7757 {
7758   thread_through_all_blocks (false);
7759   VEC_free (tree, heap, stack);
7760 }
7761 
7762 
7763 /* Traverse all the blocks folding conditionals with known ranges.  */
7764 
7765 static void
7766 vrp_finalize (void)
7767 {
7768   size_t i;
7769 
7770   values_propagated = true;
7771 
7772   if (dump_file)
7773     {
7774       fprintf (dump_file, "\nValue ranges after VRP:\n\n");
7775       dump_all_value_ranges (dump_file);
7776       fprintf (dump_file, "\n");
7777     }
7778 
7779   substitute_and_fold (op_with_constant_singleton_value_range,
7780 		       vrp_fold_stmt, false);
7781 
7782   if (warn_array_bounds)
7783     check_all_array_refs ();
7784 
7785   /* We must identify jump threading opportunities before we release
7786      the datastructures built by VRP.  */
7787   identify_jump_threads ();
7788 
7789   /* Free allocated memory.  */
7790   for (i = 0; i < num_vr_values; i++)
7791     if (vr_value[i])
7792       {
7793 	BITMAP_FREE (vr_value[i]->equiv);
7794 	free (vr_value[i]);
7795       }
7796 
7797   free (vr_value);
7798   free (vr_phi_edge_counts);
7799 
7800   /* So that we can distinguish between VRP data being available
7801      and not available.  */
7802   vr_value = NULL;
7803   vr_phi_edge_counts = NULL;
7804 }
7805 
7806 
7807 /* Main entry point to VRP (Value Range Propagation).  This pass is
7808    loosely based on J. R. C. Patterson, ``Accurate Static Branch
7809    Prediction by Value Range Propagation,'' in SIGPLAN Conference on
7810    Programming Language Design and Implementation, pp. 67-78, 1995.
7811    Also available at http://citeseer.ist.psu.edu/patterson95accurate.html
7812 
7813    This is essentially an SSA-CCP pass modified to deal with ranges
7814    instead of constants.
7815 
7816    While propagating ranges, we may find that two or more SSA name
7817    have equivalent, though distinct ranges.  For instance,
7818 
7819      1	x_9 = p_3->a;
7820      2	p_4 = ASSERT_EXPR <p_3, p_3 != 0>
7821      3	if (p_4 == q_2)
7822      4	  p_5 = ASSERT_EXPR <p_4, p_4 == q_2>;
7823      5	endif
7824      6	if (q_2)
7825 
7826    In the code above, pointer p_5 has range [q_2, q_2], but from the
7827    code we can also determine that p_5 cannot be NULL and, if q_2 had
7828    a non-varying range, p_5's range should also be compatible with it.
7829 
7830    These equivalences are created by two expressions: ASSERT_EXPR and
7831    copy operations.  Since p_5 is an assertion on p_4, and p_4 was the
7832    result of another assertion, then we can use the fact that p_5 and
7833    p_4 are equivalent when evaluating p_5's range.
7834 
7835    Together with value ranges, we also propagate these equivalences
7836    between names so that we can take advantage of information from
7837    multiple ranges when doing final replacement.  Note that this
7838    equivalency relation is transitive but not symmetric.
7839 
7840    In the example above, p_5 is equivalent to p_4, q_2 and p_3, but we
7841    cannot assert that q_2 is equivalent to p_5 because q_2 may be used
7842    in contexts where that assertion does not hold (e.g., in line 6).
7843 
7844    TODO, the main difference between this pass and Patterson's is that
7845    we do not propagate edge probabilities.  We only compute whether
7846    edges can be taken or not.  That is, instead of having a spectrum
7847    of jump probabilities between 0 and 1, we only deal with 0, 1 and
7848    DON'T KNOW.  In the future, it may be worthwhile to propagate
7849    probabilities to aid branch prediction.  */
7850 
7851 static unsigned int
7852 execute_vrp (void)
7853 {
7854   int i;
7855   edge e;
7856   switch_update *su;
7857 
7858   loop_optimizer_init (LOOPS_NORMAL | LOOPS_HAVE_RECORDED_EXITS);
7859   rewrite_into_loop_closed_ssa (NULL, TODO_update_ssa);
7860   scev_initialize ();
7861 
7862   insert_range_assertions ();
7863 
7864   /* Estimate number of iterations - but do not use undefined behavior
7865      for this.  We can't do this lazily as other functions may compute
7866      this using undefined behavior.  */
7867   free_numbers_of_iterations_estimates ();
7868   estimate_numbers_of_iterations (false);
7869 
7870   to_remove_edges = VEC_alloc (edge, heap, 10);
7871   to_update_switch_stmts = VEC_alloc (switch_update, heap, 5);
7872   threadedge_initialize_values ();
7873 
7874   vrp_initialize ();
7875   ssa_propagate (vrp_visit_stmt, vrp_visit_phi_node);
7876   vrp_finalize ();
7877 
7878   free_numbers_of_iterations_estimates ();
7879 
7880   /* ASSERT_EXPRs must be removed before finalizing jump threads
7881      as finalizing jump threads calls the CFG cleanup code which
7882      does not properly handle ASSERT_EXPRs.  */
7883   remove_range_assertions ();
7884 
7885   /* If we exposed any new variables, go ahead and put them into
7886      SSA form now, before we handle jump threading.  This simplifies
7887      interactions between rewriting of _DECL nodes into SSA form
7888      and rewriting SSA_NAME nodes into SSA form after block
7889      duplication and CFG manipulation.  */
7890   update_ssa (TODO_update_ssa);
7891 
7892   finalize_jump_threads ();
7893 
7894   /* Remove dead edges from SWITCH_EXPR optimization.  This leaves the
7895      CFG in a broken state and requires a cfg_cleanup run.  */
7896   FOR_EACH_VEC_ELT (edge, to_remove_edges, i, e)
7897     remove_edge (e);
7898   /* Update SWITCH_EXPR case label vector.  */
7899   FOR_EACH_VEC_ELT (switch_update, to_update_switch_stmts, i, su)
7900     {
7901       size_t j;
7902       size_t n = TREE_VEC_LENGTH (su->vec);
7903       tree label;
7904       gimple_switch_set_num_labels (su->stmt, n);
7905       for (j = 0; j < n; j++)
7906 	gimple_switch_set_label (su->stmt, j, TREE_VEC_ELT (su->vec, j));
7907       /* As we may have replaced the default label with a regular one
7908 	 make sure to make it a real default label again.  This ensures
7909 	 optimal expansion.  */
7910       label = gimple_switch_default_label (su->stmt);
7911       CASE_LOW (label) = NULL_TREE;
7912       CASE_HIGH (label) = NULL_TREE;
7913     }
7914 
7915   if (VEC_length (edge, to_remove_edges) > 0)
7916     free_dominance_info (CDI_DOMINATORS);
7917 
7918   VEC_free (edge, heap, to_remove_edges);
7919   VEC_free (switch_update, heap, to_update_switch_stmts);
7920   threadedge_finalize_values ();
7921 
7922   scev_finalize ();
7923   loop_optimizer_finalize ();
7924   return 0;
7925 }
7926 
7927 static bool
7928 gate_vrp (void)
7929 {
7930   return flag_tree_vrp != 0;
7931 }
7932 
7933 struct gimple_opt_pass pass_vrp =
7934 {
7935  {
7936   GIMPLE_PASS,
7937   "vrp",				/* name */
7938   gate_vrp,				/* gate */
7939   execute_vrp,				/* execute */
7940   NULL,					/* sub */
7941   NULL,					/* next */
7942   0,					/* static_pass_number */
7943   TV_TREE_VRP,				/* tv_id */
7944   PROP_ssa,				/* properties_required */
7945   0,					/* properties_provided */
7946   0,					/* properties_destroyed */
7947   0,					/* todo_flags_start */
7948   TODO_cleanup_cfg
7949     | TODO_update_ssa
7950     | TODO_verify_ssa
7951     | TODO_verify_flow
7952     | TODO_ggc_collect			/* todo_flags_finish */
7953  }
7954 };
7955