xref: /netbsd-src/external/gpl3/gcc.old/dist/gcc/tree-ssa-loop-niter.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /* Functions to determine/estimate number of iterations of a loop.
2    Copyright (C) 2004-2015 Free Software Foundation, Inc.
3 
4 This file is part of GCC.
5 
6 GCC is free software; you can redistribute it and/or modify it
7 under the terms of the GNU General Public License as published by the
8 Free Software Foundation; either version 3, or (at your option) any
9 later version.
10 
11 GCC is distributed in the hope that it will be useful, but WITHOUT
12 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
14 for more details.
15 
16 You should have received a copy of the GNU General Public License
17 along with GCC; see the file COPYING3.  If not see
18 <http://www.gnu.org/licenses/>.  */
19 
20 #include "config.h"
21 #include "system.h"
22 #include "coretypes.h"
23 #include "tm.h"
24 #include "hash-set.h"
25 #include "machmode.h"
26 #include "vec.h"
27 #include "double-int.h"
28 #include "input.h"
29 #include "alias.h"
30 #include "symtab.h"
31 #include "wide-int.h"
32 #include "inchash.h"
33 #include "tree.h"
34 #include "fold-const.h"
35 #include "calls.h"
36 #include "hashtab.h"
37 #include "hard-reg-set.h"
38 #include "function.h"
39 #include "rtl.h"
40 #include "flags.h"
41 #include "statistics.h"
42 #include "real.h"
43 #include "fixed-value.h"
44 #include "insn-config.h"
45 #include "expmed.h"
46 #include "dojump.h"
47 #include "explow.h"
48 #include "emit-rtl.h"
49 #include "varasm.h"
50 #include "stmt.h"
51 #include "expr.h"
52 #include "tm_p.h"
53 #include "predict.h"
54 #include "dominance.h"
55 #include "cfg.h"
56 #include "basic-block.h"
57 #include "gimple-pretty-print.h"
58 #include "intl.h"
59 #include "tree-ssa-alias.h"
60 #include "internal-fn.h"
61 #include "gimple-expr.h"
62 #include "is-a.h"
63 #include "gimple.h"
64 #include "gimplify.h"
65 #include "gimple-iterator.h"
66 #include "gimple-ssa.h"
67 #include "tree-cfg.h"
68 #include "tree-phinodes.h"
69 #include "ssa-iterators.h"
70 #include "tree-ssa-loop-ivopts.h"
71 #include "tree-ssa-loop-niter.h"
72 #include "tree-ssa-loop.h"
73 #include "dumpfile.h"
74 #include "cfgloop.h"
75 #include "tree-chrec.h"
76 #include "tree-scalar-evolution.h"
77 #include "tree-data-ref.h"
78 #include "params.h"
79 #include "diagnostic-core.h"
80 #include "tree-inline.h"
81 #include "tree-pass.h"
82 #include "stringpool.h"
83 #include "tree-ssanames.h"
84 #include "wide-int-print.h"
85 
86 
87 #define SWAP(X, Y) do { affine_iv *tmp = (X); (X) = (Y); (Y) = tmp; } while (0)
88 
89 /* The maximum number of dominator BBs we search for conditions
90    of loop header copies we use for simplifying a conditional
91    expression.  */
92 #define MAX_DOMINATORS_TO_WALK 8
93 
94 /*
95 
96    Analysis of number of iterations of an affine exit test.
97 
98 */
99 
100 /* Bounds on some value, BELOW <= X <= UP.  */
101 
102 typedef struct
103 {
104   mpz_t below, up;
105 } bounds;
106 
107 
108 /* Splits expression EXPR to a variable part VAR and constant OFFSET.  */
109 
110 static void
111 split_to_var_and_offset (tree expr, tree *var, mpz_t offset)
112 {
113   tree type = TREE_TYPE (expr);
114   tree op0, op1;
115   bool negate = false;
116 
117   *var = expr;
118   mpz_set_ui (offset, 0);
119 
120   switch (TREE_CODE (expr))
121     {
122     case MINUS_EXPR:
123       negate = true;
124       /* Fallthru.  */
125 
126     case PLUS_EXPR:
127     case POINTER_PLUS_EXPR:
128       op0 = TREE_OPERAND (expr, 0);
129       op1 = TREE_OPERAND (expr, 1);
130 
131       if (TREE_CODE (op1) != INTEGER_CST)
132 	break;
133 
134       *var = op0;
135       /* Always sign extend the offset.  */
136       wi::to_mpz (op1, offset, SIGNED);
137       if (negate)
138 	mpz_neg (offset, offset);
139       break;
140 
141     case INTEGER_CST:
142       *var = build_int_cst_type (type, 0);
143       wi::to_mpz (expr, offset, TYPE_SIGN (type));
144       break;
145 
146     default:
147       break;
148     }
149 }
150 
151 /* Stores estimate on the minimum/maximum value of the expression VAR + OFF
152    in TYPE to MIN and MAX.  */
153 
154 static void
155 determine_value_range (struct loop *loop, tree type, tree var, mpz_t off,
156 		       mpz_t min, mpz_t max)
157 {
158   wide_int minv, maxv;
159   enum value_range_type rtype = VR_VARYING;
160 
161   /* If the expression is a constant, we know its value exactly.  */
162   if (integer_zerop (var))
163     {
164       mpz_set (min, off);
165       mpz_set (max, off);
166       return;
167     }
168 
169   get_type_static_bounds (type, min, max);
170 
171   /* See if we have some range info from VRP.  */
172   if (TREE_CODE (var) == SSA_NAME && INTEGRAL_TYPE_P (type))
173     {
174       edge e = loop_preheader_edge (loop);
175       signop sgn = TYPE_SIGN (type);
176       gphi_iterator gsi;
177 
178       /* Either for VAR itself...  */
179       rtype = get_range_info (var, &minv, &maxv);
180       /* Or for PHI results in loop->header where VAR is used as
181 	 PHI argument from the loop preheader edge.  */
182       for (gsi = gsi_start_phis (loop->header); !gsi_end_p (gsi); gsi_next (&gsi))
183 	{
184 	  gphi *phi = gsi.phi ();
185 	  wide_int minc, maxc;
186 	  if (PHI_ARG_DEF_FROM_EDGE (phi, e) == var
187 	      && (get_range_info (gimple_phi_result (phi), &minc, &maxc)
188 		  == VR_RANGE))
189 	    {
190 	      if (rtype != VR_RANGE)
191 		{
192 		  rtype = VR_RANGE;
193 		  minv = minc;
194 		  maxv = maxc;
195 		}
196 	      else
197 		{
198 		  minv = wi::max (minv, minc, sgn);
199 		  maxv = wi::min (maxv, maxc, sgn);
200 		  /* If the PHI result range are inconsistent with
201 		     the VAR range, give up on looking at the PHI
202 		     results.  This can happen if VR_UNDEFINED is
203 		     involved.  */
204 		  if (wi::gt_p (minv, maxv, sgn))
205 		    {
206 		      rtype = get_range_info (var, &minv, &maxv);
207 		      break;
208 		    }
209 		}
210 	    }
211 	}
212       if (rtype == VR_RANGE)
213 	{
214 	  mpz_t minm, maxm;
215 	  gcc_assert (wi::le_p (minv, maxv, sgn));
216 	  mpz_init (minm);
217 	  mpz_init (maxm);
218 	  wi::to_mpz (minv, minm, sgn);
219 	  wi::to_mpz (maxv, maxm, sgn);
220 	  mpz_add (minm, minm, off);
221 	  mpz_add (maxm, maxm, off);
222 	  /* If the computation may not wrap or off is zero, then this
223 	     is always fine.  If off is negative and minv + off isn't
224 	     smaller than type's minimum, or off is positive and
225 	     maxv + off isn't bigger than type's maximum, use the more
226 	     precise range too.  */
227 	  if (nowrap_type_p (type)
228 	      || mpz_sgn (off) == 0
229 	      || (mpz_sgn (off) < 0 && mpz_cmp (minm, min) >= 0)
230 	      || (mpz_sgn (off) > 0 && mpz_cmp (maxm, max) <= 0))
231 	    {
232 	      mpz_set (min, minm);
233 	      mpz_set (max, maxm);
234 	      mpz_clear (minm);
235 	      mpz_clear (maxm);
236 	      return;
237 	    }
238 	  mpz_clear (minm);
239 	  mpz_clear (maxm);
240 	}
241     }
242 
243   /* If the computation may wrap, we know nothing about the value, except for
244      the range of the type.  */
245   if (!nowrap_type_p (type))
246     return;
247 
248   /* Since the addition of OFF does not wrap, if OFF is positive, then we may
249      add it to MIN, otherwise to MAX.  */
250   if (mpz_sgn (off) < 0)
251     mpz_add (max, max, off);
252   else
253     mpz_add (min, min, off);
254 }
255 
256 /* Stores the bounds on the difference of the values of the expressions
257    (var + X) and (var + Y), computed in TYPE, to BNDS.  */
258 
259 static void
260 bound_difference_of_offsetted_base (tree type, mpz_t x, mpz_t y,
261 				    bounds *bnds)
262 {
263   int rel = mpz_cmp (x, y);
264   bool may_wrap = !nowrap_type_p (type);
265   mpz_t m;
266 
267   /* If X == Y, then the expressions are always equal.
268      If X > Y, there are the following possibilities:
269        a) neither of var + X and var + Y overflow or underflow, or both of
270 	  them do.  Then their difference is X - Y.
271        b) var + X overflows, and var + Y does not.  Then the values of the
272 	  expressions are var + X - M and var + Y, where M is the range of
273 	  the type, and their difference is X - Y - M.
274        c) var + Y underflows and var + X does not.  Their difference again
275 	  is M - X + Y.
276        Therefore, if the arithmetics in type does not overflow, then the
277        bounds are (X - Y, X - Y), otherwise they are (X - Y - M, X - Y)
278      Similarly, if X < Y, the bounds are either (X - Y, X - Y) or
279      (X - Y, X - Y + M).  */
280 
281   if (rel == 0)
282     {
283       mpz_set_ui (bnds->below, 0);
284       mpz_set_ui (bnds->up, 0);
285       return;
286     }
287 
288   mpz_init (m);
289   wi::to_mpz (wi::minus_one (TYPE_PRECISION (type)), m, UNSIGNED);
290   mpz_add_ui (m, m, 1);
291   mpz_sub (bnds->up, x, y);
292   mpz_set (bnds->below, bnds->up);
293 
294   if (may_wrap)
295     {
296       if (rel > 0)
297 	mpz_sub (bnds->below, bnds->below, m);
298       else
299 	mpz_add (bnds->up, bnds->up, m);
300     }
301 
302   mpz_clear (m);
303 }
304 
305 /* From condition C0 CMP C1 derives information regarding the
306    difference of values of VARX + OFFX and VARY + OFFY, computed in TYPE,
307    and stores it to BNDS.  */
308 
309 static void
310 refine_bounds_using_guard (tree type, tree varx, mpz_t offx,
311 			   tree vary, mpz_t offy,
312 			   tree c0, enum tree_code cmp, tree c1,
313 			   bounds *bnds)
314 {
315   tree varc0, varc1, tmp, ctype;
316   mpz_t offc0, offc1, loffx, loffy, bnd;
317   bool lbound = false;
318   bool no_wrap = nowrap_type_p (type);
319   bool x_ok, y_ok;
320 
321   switch (cmp)
322     {
323     case LT_EXPR:
324     case LE_EXPR:
325     case GT_EXPR:
326     case GE_EXPR:
327       STRIP_SIGN_NOPS (c0);
328       STRIP_SIGN_NOPS (c1);
329       ctype = TREE_TYPE (c0);
330       if (!useless_type_conversion_p (ctype, type))
331 	return;
332 
333       break;
334 
335     case EQ_EXPR:
336       /* We could derive quite precise information from EQ_EXPR, however, such
337 	 a guard is unlikely to appear, so we do not bother with handling
338 	 it.  */
339       return;
340 
341     case NE_EXPR:
342       /* NE_EXPR comparisons do not contain much of useful information, except for
343 	 special case of comparing with the bounds of the type.  */
344       if (TREE_CODE (c1) != INTEGER_CST
345 	  || !INTEGRAL_TYPE_P (type))
346 	return;
347 
348       /* Ensure that the condition speaks about an expression in the same type
349 	 as X and Y.  */
350       ctype = TREE_TYPE (c0);
351       if (TYPE_PRECISION (ctype) != TYPE_PRECISION (type))
352 	return;
353       c0 = fold_convert (type, c0);
354       c1 = fold_convert (type, c1);
355 
356       if (TYPE_MIN_VALUE (type)
357 	  && operand_equal_p (c1, TYPE_MIN_VALUE (type), 0))
358 	{
359 	  cmp = GT_EXPR;
360 	  break;
361 	}
362       if (TYPE_MAX_VALUE (type)
363 	  && operand_equal_p (c1, TYPE_MAX_VALUE (type), 0))
364 	{
365 	  cmp = LT_EXPR;
366 	  break;
367 	}
368 
369       return;
370     default:
371       return;
372     }
373 
374   mpz_init (offc0);
375   mpz_init (offc1);
376   split_to_var_and_offset (expand_simple_operations (c0), &varc0, offc0);
377   split_to_var_and_offset (expand_simple_operations (c1), &varc1, offc1);
378 
379   /* We are only interested in comparisons of expressions based on VARX and
380      VARY.  TODO -- we might also be able to derive some bounds from
381      expressions containing just one of the variables.  */
382 
383   if (operand_equal_p (varx, varc1, 0))
384     {
385       tmp = varc0; varc0 = varc1; varc1 = tmp;
386       mpz_swap (offc0, offc1);
387       cmp = swap_tree_comparison (cmp);
388     }
389 
390   if (!operand_equal_p (varx, varc0, 0)
391       || !operand_equal_p (vary, varc1, 0))
392     goto end;
393 
394   mpz_init_set (loffx, offx);
395   mpz_init_set (loffy, offy);
396 
397   if (cmp == GT_EXPR || cmp == GE_EXPR)
398     {
399       tmp = varx; varx = vary; vary = tmp;
400       mpz_swap (offc0, offc1);
401       mpz_swap (loffx, loffy);
402       cmp = swap_tree_comparison (cmp);
403       lbound = true;
404     }
405 
406   /* If there is no overflow, the condition implies that
407 
408      (VARX + OFFX) cmp (VARY + OFFY) + (OFFX - OFFY + OFFC1 - OFFC0).
409 
410      The overflows and underflows may complicate things a bit; each
411      overflow decreases the appropriate offset by M, and underflow
412      increases it by M.  The above inequality would not necessarily be
413      true if
414 
415      -- VARX + OFFX underflows and VARX + OFFC0 does not, or
416 	VARX + OFFC0 overflows, but VARX + OFFX does not.
417 	This may only happen if OFFX < OFFC0.
418      -- VARY + OFFY overflows and VARY + OFFC1 does not, or
419 	VARY + OFFC1 underflows and VARY + OFFY does not.
420 	This may only happen if OFFY > OFFC1.  */
421 
422   if (no_wrap)
423     {
424       x_ok = true;
425       y_ok = true;
426     }
427   else
428     {
429       x_ok = (integer_zerop (varx)
430 	      || mpz_cmp (loffx, offc0) >= 0);
431       y_ok = (integer_zerop (vary)
432 	      || mpz_cmp (loffy, offc1) <= 0);
433     }
434 
435   if (x_ok && y_ok)
436     {
437       mpz_init (bnd);
438       mpz_sub (bnd, loffx, loffy);
439       mpz_add (bnd, bnd, offc1);
440       mpz_sub (bnd, bnd, offc0);
441 
442       if (cmp == LT_EXPR)
443 	mpz_sub_ui (bnd, bnd, 1);
444 
445       if (lbound)
446 	{
447 	  mpz_neg (bnd, bnd);
448 	  if (mpz_cmp (bnds->below, bnd) < 0)
449 	    mpz_set (bnds->below, bnd);
450 	}
451       else
452 	{
453 	  if (mpz_cmp (bnd, bnds->up) < 0)
454 	    mpz_set (bnds->up, bnd);
455 	}
456       mpz_clear (bnd);
457     }
458 
459   mpz_clear (loffx);
460   mpz_clear (loffy);
461 end:
462   mpz_clear (offc0);
463   mpz_clear (offc1);
464 }
465 
466 /* Stores the bounds on the value of the expression X - Y in LOOP to BNDS.
467    The subtraction is considered to be performed in arbitrary precision,
468    without overflows.
469 
470    We do not attempt to be too clever regarding the value ranges of X and
471    Y; most of the time, they are just integers or ssa names offsetted by
472    integer.  However, we try to use the information contained in the
473    comparisons before the loop (usually created by loop header copying).  */
474 
475 static void
476 bound_difference (struct loop *loop, tree x, tree y, bounds *bnds)
477 {
478   tree type = TREE_TYPE (x);
479   tree varx, vary;
480   mpz_t offx, offy;
481   mpz_t minx, maxx, miny, maxy;
482   int cnt = 0;
483   edge e;
484   basic_block bb;
485   tree c0, c1;
486   gimple cond;
487   enum tree_code cmp;
488 
489   /* Get rid of unnecessary casts, but preserve the value of
490      the expressions.  */
491   STRIP_SIGN_NOPS (x);
492   STRIP_SIGN_NOPS (y);
493 
494   mpz_init (bnds->below);
495   mpz_init (bnds->up);
496   mpz_init (offx);
497   mpz_init (offy);
498   split_to_var_and_offset (x, &varx, offx);
499   split_to_var_and_offset (y, &vary, offy);
500 
501   if (!integer_zerop (varx)
502       && operand_equal_p (varx, vary, 0))
503     {
504       /* Special case VARX == VARY -- we just need to compare the
505          offsets.  The matters are a bit more complicated in the
506 	 case addition of offsets may wrap.  */
507       bound_difference_of_offsetted_base (type, offx, offy, bnds);
508     }
509   else
510     {
511       /* Otherwise, use the value ranges to determine the initial
512 	 estimates on below and up.  */
513       mpz_init (minx);
514       mpz_init (maxx);
515       mpz_init (miny);
516       mpz_init (maxy);
517       determine_value_range (loop, type, varx, offx, minx, maxx);
518       determine_value_range (loop, type, vary, offy, miny, maxy);
519 
520       mpz_sub (bnds->below, minx, maxy);
521       mpz_sub (bnds->up, maxx, miny);
522       mpz_clear (minx);
523       mpz_clear (maxx);
524       mpz_clear (miny);
525       mpz_clear (maxy);
526     }
527 
528   /* If both X and Y are constants, we cannot get any more precise.  */
529   if (integer_zerop (varx) && integer_zerop (vary))
530     goto end;
531 
532   /* Now walk the dominators of the loop header and use the entry
533      guards to refine the estimates.  */
534   for (bb = loop->header;
535        bb != ENTRY_BLOCK_PTR_FOR_FN (cfun) && cnt < MAX_DOMINATORS_TO_WALK;
536        bb = get_immediate_dominator (CDI_DOMINATORS, bb))
537     {
538       if (!single_pred_p (bb))
539 	continue;
540       e = single_pred_edge (bb);
541 
542       if (!(e->flags & (EDGE_TRUE_VALUE | EDGE_FALSE_VALUE)))
543 	continue;
544 
545       cond = last_stmt (e->src);
546       c0 = gimple_cond_lhs (cond);
547       cmp = gimple_cond_code (cond);
548       c1 = gimple_cond_rhs (cond);
549 
550       if (e->flags & EDGE_FALSE_VALUE)
551 	cmp = invert_tree_comparison (cmp, false);
552 
553       refine_bounds_using_guard (type, varx, offx, vary, offy,
554 				 c0, cmp, c1, bnds);
555       ++cnt;
556     }
557 
558 end:
559   mpz_clear (offx);
560   mpz_clear (offy);
561 }
562 
563 /* Update the bounds in BNDS that restrict the value of X to the bounds
564    that restrict the value of X + DELTA.  X can be obtained as a
565    difference of two values in TYPE.  */
566 
567 static void
568 bounds_add (bounds *bnds, const widest_int &delta, tree type)
569 {
570   mpz_t mdelta, max;
571 
572   mpz_init (mdelta);
573   wi::to_mpz (delta, mdelta, SIGNED);
574 
575   mpz_init (max);
576   wi::to_mpz (wi::minus_one (TYPE_PRECISION (type)), max, UNSIGNED);
577 
578   mpz_add (bnds->up, bnds->up, mdelta);
579   mpz_add (bnds->below, bnds->below, mdelta);
580 
581   if (mpz_cmp (bnds->up, max) > 0)
582     mpz_set (bnds->up, max);
583 
584   mpz_neg (max, max);
585   if (mpz_cmp (bnds->below, max) < 0)
586     mpz_set (bnds->below, max);
587 
588   mpz_clear (mdelta);
589   mpz_clear (max);
590 }
591 
592 /* Update the bounds in BNDS that restrict the value of X to the bounds
593    that restrict the value of -X.  */
594 
595 static void
596 bounds_negate (bounds *bnds)
597 {
598   mpz_t tmp;
599 
600   mpz_init_set (tmp, bnds->up);
601   mpz_neg (bnds->up, bnds->below);
602   mpz_neg (bnds->below, tmp);
603   mpz_clear (tmp);
604 }
605 
606 /* Returns inverse of X modulo 2^s, where MASK = 2^s-1.  */
607 
608 static tree
609 inverse (tree x, tree mask)
610 {
611   tree type = TREE_TYPE (x);
612   tree rslt;
613   unsigned ctr = tree_floor_log2 (mask);
614 
615   if (TYPE_PRECISION (type) <= HOST_BITS_PER_WIDE_INT)
616     {
617       unsigned HOST_WIDE_INT ix;
618       unsigned HOST_WIDE_INT imask;
619       unsigned HOST_WIDE_INT irslt = 1;
620 
621       gcc_assert (cst_and_fits_in_hwi (x));
622       gcc_assert (cst_and_fits_in_hwi (mask));
623 
624       ix = int_cst_value (x);
625       imask = int_cst_value (mask);
626 
627       for (; ctr; ctr--)
628 	{
629 	  irslt *= ix;
630 	  ix *= ix;
631 	}
632       irslt &= imask;
633 
634       rslt = build_int_cst_type (type, irslt);
635     }
636   else
637     {
638       rslt = build_int_cst (type, 1);
639       for (; ctr; ctr--)
640 	{
641 	  rslt = int_const_binop (MULT_EXPR, rslt, x);
642 	  x = int_const_binop (MULT_EXPR, x, x);
643 	}
644       rslt = int_const_binop (BIT_AND_EXPR, rslt, mask);
645     }
646 
647   return rslt;
648 }
649 
650 /* Derives the upper bound BND on the number of executions of loop with exit
651    condition S * i <> C.  If NO_OVERFLOW is true, then the control variable of
652    the loop does not overflow.  EXIT_MUST_BE_TAKEN is true if we are guaranteed
653    that the loop ends through this exit, i.e., the induction variable ever
654    reaches the value of C.
655 
656    The value C is equal to final - base, where final and base are the final and
657    initial value of the actual induction variable in the analysed loop.  BNDS
658    bounds the value of this difference when computed in signed type with
659    unbounded range, while the computation of C is performed in an unsigned
660    type with the range matching the range of the type of the induction variable.
661    In particular, BNDS.up contains an upper bound on C in the following cases:
662    -- if the iv must reach its final value without overflow, i.e., if
663       NO_OVERFLOW && EXIT_MUST_BE_TAKEN is true, or
664    -- if final >= base, which we know to hold when BNDS.below >= 0.  */
665 
666 static void
667 number_of_iterations_ne_max (mpz_t bnd, bool no_overflow, tree c, tree s,
668 			     bounds *bnds, bool exit_must_be_taken)
669 {
670   widest_int max;
671   mpz_t d;
672   tree type = TREE_TYPE (c);
673   bool bnds_u_valid = ((no_overflow && exit_must_be_taken)
674 		       || mpz_sgn (bnds->below) >= 0);
675 
676   if (integer_onep (s)
677       || (TREE_CODE (c) == INTEGER_CST
678 	  && TREE_CODE (s) == INTEGER_CST
679 	  && wi::mod_trunc (c, s, TYPE_SIGN (type)) == 0)
680       || (TYPE_OVERFLOW_UNDEFINED (type)
681 	  && multiple_of_p (type, c, s)))
682     {
683       /* If C is an exact multiple of S, then its value will be reached before
684 	 the induction variable overflows (unless the loop is exited in some
685 	 other way before).  Note that the actual induction variable in the
686 	 loop (which ranges from base to final instead of from 0 to C) may
687 	 overflow, in which case BNDS.up will not be giving a correct upper
688 	 bound on C; thus, BNDS_U_VALID had to be computed in advance.  */
689       no_overflow = true;
690       exit_must_be_taken = true;
691     }
692 
693   /* If the induction variable can overflow, the number of iterations is at
694      most the period of the control variable (or infinite, but in that case
695      the whole # of iterations analysis will fail).  */
696   if (!no_overflow)
697     {
698       max = wi::mask <widest_int> (TYPE_PRECISION (type) - wi::ctz (s), false);
699       wi::to_mpz (max, bnd, UNSIGNED);
700       return;
701     }
702 
703   /* Now we know that the induction variable does not overflow, so the loop
704      iterates at most (range of type / S) times.  */
705   wi::to_mpz (wi::minus_one (TYPE_PRECISION (type)), bnd, UNSIGNED);
706 
707   /* If the induction variable is guaranteed to reach the value of C before
708      overflow, ... */
709   if (exit_must_be_taken)
710     {
711       /* ... then we can strengthen this to C / S, and possibly we can use
712 	 the upper bound on C given by BNDS.  */
713       if (TREE_CODE (c) == INTEGER_CST)
714 	wi::to_mpz (c, bnd, UNSIGNED);
715       else if (bnds_u_valid)
716 	mpz_set (bnd, bnds->up);
717     }
718 
719   mpz_init (d);
720   wi::to_mpz (s, d, UNSIGNED);
721   mpz_fdiv_q (bnd, bnd, d);
722   mpz_clear (d);
723 }
724 
725 /* Determines number of iterations of loop whose ending condition
726    is IV <> FINAL.  TYPE is the type of the iv.  The number of
727    iterations is stored to NITER.  EXIT_MUST_BE_TAKEN is true if
728    we know that the exit must be taken eventually, i.e., that the IV
729    ever reaches the value FINAL (we derived this earlier, and possibly set
730    NITER->assumptions to make sure this is the case).  BNDS contains the
731    bounds on the difference FINAL - IV->base.  */
732 
733 static bool
734 number_of_iterations_ne (tree type, affine_iv *iv, tree final,
735 			 struct tree_niter_desc *niter, bool exit_must_be_taken,
736 			 bounds *bnds)
737 {
738   tree niter_type = unsigned_type_for (type);
739   tree s, c, d, bits, assumption, tmp, bound;
740   mpz_t max;
741 
742   niter->control = *iv;
743   niter->bound = final;
744   niter->cmp = NE_EXPR;
745 
746   /* Rearrange the terms so that we get inequality S * i <> C, with S
747      positive.  Also cast everything to the unsigned type.  If IV does
748      not overflow, BNDS bounds the value of C.  Also, this is the
749      case if the computation |FINAL - IV->base| does not overflow, i.e.,
750      if BNDS->below in the result is nonnegative.  */
751   if (tree_int_cst_sign_bit (iv->step))
752     {
753       s = fold_convert (niter_type,
754 			fold_build1 (NEGATE_EXPR, type, iv->step));
755       c = fold_build2 (MINUS_EXPR, niter_type,
756 		       fold_convert (niter_type, iv->base),
757 		       fold_convert (niter_type, final));
758       bounds_negate (bnds);
759     }
760   else
761     {
762       s = fold_convert (niter_type, iv->step);
763       c = fold_build2 (MINUS_EXPR, niter_type,
764 		       fold_convert (niter_type, final),
765 		       fold_convert (niter_type, iv->base));
766     }
767 
768   mpz_init (max);
769   number_of_iterations_ne_max (max, iv->no_overflow, c, s, bnds,
770 			       exit_must_be_taken);
771   niter->max = widest_int::from (wi::from_mpz (niter_type, max, false),
772 				 TYPE_SIGN (niter_type));
773   mpz_clear (max);
774 
775   /* First the trivial cases -- when the step is 1.  */
776   if (integer_onep (s))
777     {
778       niter->niter = c;
779       return true;
780     }
781 
782   /* Let nsd (step, size of mode) = d.  If d does not divide c, the loop
783      is infinite.  Otherwise, the number of iterations is
784      (inverse(s/d) * (c/d)) mod (size of mode/d).  */
785   bits = num_ending_zeros (s);
786   bound = build_low_bits_mask (niter_type,
787 			       (TYPE_PRECISION (niter_type)
788 				- tree_to_uhwi (bits)));
789 
790   d = fold_binary_to_constant (LSHIFT_EXPR, niter_type,
791 			       build_int_cst (niter_type, 1), bits);
792   s = fold_binary_to_constant (RSHIFT_EXPR, niter_type, s, bits);
793 
794   if (!exit_must_be_taken)
795     {
796       /* If we cannot assume that the exit is taken eventually, record the
797 	 assumptions for divisibility of c.  */
798       assumption = fold_build2 (FLOOR_MOD_EXPR, niter_type, c, d);
799       assumption = fold_build2 (EQ_EXPR, boolean_type_node,
800 				assumption, build_int_cst (niter_type, 0));
801       if (!integer_nonzerop (assumption))
802 	niter->assumptions = fold_build2 (TRUTH_AND_EXPR, boolean_type_node,
803 					  niter->assumptions, assumption);
804     }
805 
806   c = fold_build2 (EXACT_DIV_EXPR, niter_type, c, d);
807   tmp = fold_build2 (MULT_EXPR, niter_type, c, inverse (s, bound));
808   niter->niter = fold_build2 (BIT_AND_EXPR, niter_type, tmp, bound);
809   return true;
810 }
811 
812 /* Checks whether we can determine the final value of the control variable
813    of the loop with ending condition IV0 < IV1 (computed in TYPE).
814    DELTA is the difference IV1->base - IV0->base, STEP is the absolute value
815    of the step.  The assumptions necessary to ensure that the computation
816    of the final value does not overflow are recorded in NITER.  If we
817    find the final value, we adjust DELTA and return TRUE.  Otherwise
818    we return false.  BNDS bounds the value of IV1->base - IV0->base,
819    and will be updated by the same amount as DELTA.  EXIT_MUST_BE_TAKEN is
820    true if we know that the exit must be taken eventually.  */
821 
822 static bool
823 number_of_iterations_lt_to_ne (tree type, affine_iv *iv0, affine_iv *iv1,
824 			       struct tree_niter_desc *niter,
825 			       tree *delta, tree step,
826 			       bool exit_must_be_taken, bounds *bnds)
827 {
828   tree niter_type = TREE_TYPE (step);
829   tree mod = fold_build2 (FLOOR_MOD_EXPR, niter_type, *delta, step);
830   tree tmod;
831   mpz_t mmod;
832   tree assumption = boolean_true_node, bound, noloop;
833   bool ret = false, fv_comp_no_overflow;
834   tree type1 = type;
835   if (POINTER_TYPE_P (type))
836     type1 = sizetype;
837 
838   if (TREE_CODE (mod) != INTEGER_CST)
839     return false;
840   if (integer_nonzerop (mod))
841     mod = fold_build2 (MINUS_EXPR, niter_type, step, mod);
842   tmod = fold_convert (type1, mod);
843 
844   mpz_init (mmod);
845   wi::to_mpz (mod, mmod, UNSIGNED);
846   mpz_neg (mmod, mmod);
847 
848   /* If the induction variable does not overflow and the exit is taken,
849      then the computation of the final value does not overflow.  This is
850      also obviously the case if the new final value is equal to the
851      current one.  Finally, we postulate this for pointer type variables,
852      as the code cannot rely on the object to that the pointer points being
853      placed at the end of the address space (and more pragmatically,
854      TYPE_{MIN,MAX}_VALUE is not defined for pointers).  */
855   if (integer_zerop (mod) || POINTER_TYPE_P (type))
856     fv_comp_no_overflow = true;
857   else if (!exit_must_be_taken)
858     fv_comp_no_overflow = false;
859   else
860     fv_comp_no_overflow =
861 	    (iv0->no_overflow && integer_nonzerop (iv0->step))
862 	    || (iv1->no_overflow && integer_nonzerop (iv1->step));
863 
864   if (integer_nonzerop (iv0->step))
865     {
866       /* The final value of the iv is iv1->base + MOD, assuming that this
867 	 computation does not overflow, and that
868 	 iv0->base <= iv1->base + MOD.  */
869       if (!fv_comp_no_overflow)
870 	{
871 	  bound = fold_build2 (MINUS_EXPR, type1,
872 			       TYPE_MAX_VALUE (type1), tmod);
873 	  assumption = fold_build2 (LE_EXPR, boolean_type_node,
874 				    iv1->base, bound);
875 	  if (integer_zerop (assumption))
876 	    goto end;
877 	}
878       if (mpz_cmp (mmod, bnds->below) < 0)
879 	noloop = boolean_false_node;
880       else if (POINTER_TYPE_P (type))
881 	noloop = fold_build2 (GT_EXPR, boolean_type_node,
882 			      iv0->base,
883 			      fold_build_pointer_plus (iv1->base, tmod));
884       else
885 	noloop = fold_build2 (GT_EXPR, boolean_type_node,
886 			      iv0->base,
887 			      fold_build2 (PLUS_EXPR, type1,
888 					   iv1->base, tmod));
889     }
890   else
891     {
892       /* The final value of the iv is iv0->base - MOD, assuming that this
893 	 computation does not overflow, and that
894 	 iv0->base - MOD <= iv1->base. */
895       if (!fv_comp_no_overflow)
896 	{
897 	  bound = fold_build2 (PLUS_EXPR, type1,
898 			       TYPE_MIN_VALUE (type1), tmod);
899 	  assumption = fold_build2 (GE_EXPR, boolean_type_node,
900 				    iv0->base, bound);
901 	  if (integer_zerop (assumption))
902 	    goto end;
903 	}
904       if (mpz_cmp (mmod, bnds->below) < 0)
905 	noloop = boolean_false_node;
906       else if (POINTER_TYPE_P (type))
907 	noloop = fold_build2 (GT_EXPR, boolean_type_node,
908 			      fold_build_pointer_plus (iv0->base,
909 						       fold_build1 (NEGATE_EXPR,
910 								    type1, tmod)),
911 			      iv1->base);
912       else
913 	noloop = fold_build2 (GT_EXPR, boolean_type_node,
914 			      fold_build2 (MINUS_EXPR, type1,
915 					   iv0->base, tmod),
916 			      iv1->base);
917     }
918 
919   if (!integer_nonzerop (assumption))
920     niter->assumptions = fold_build2 (TRUTH_AND_EXPR, boolean_type_node,
921 				      niter->assumptions,
922 				      assumption);
923   if (!integer_zerop (noloop))
924     niter->may_be_zero = fold_build2 (TRUTH_OR_EXPR, boolean_type_node,
925 				      niter->may_be_zero,
926 				      noloop);
927   bounds_add (bnds, wi::to_widest (mod), type);
928   *delta = fold_build2 (PLUS_EXPR, niter_type, *delta, mod);
929 
930   ret = true;
931 end:
932   mpz_clear (mmod);
933   return ret;
934 }
935 
936 /* Add assertions to NITER that ensure that the control variable of the loop
937    with ending condition IV0 < IV1 does not overflow.  Types of IV0 and IV1
938    are TYPE.  Returns false if we can prove that there is an overflow, true
939    otherwise.  STEP is the absolute value of the step.  */
940 
941 static bool
942 assert_no_overflow_lt (tree type, affine_iv *iv0, affine_iv *iv1,
943 		       struct tree_niter_desc *niter, tree step)
944 {
945   tree bound, d, assumption, diff;
946   tree niter_type = TREE_TYPE (step);
947 
948   if (integer_nonzerop (iv0->step))
949     {
950       /* for (i = iv0->base; i < iv1->base; i += iv0->step) */
951       if (iv0->no_overflow)
952 	return true;
953 
954       /* If iv0->base is a constant, we can determine the last value before
955 	 overflow precisely; otherwise we conservatively assume
956 	 MAX - STEP + 1.  */
957 
958       if (TREE_CODE (iv0->base) == INTEGER_CST)
959 	{
960 	  d = fold_build2 (MINUS_EXPR, niter_type,
961 			   fold_convert (niter_type, TYPE_MAX_VALUE (type)),
962 			   fold_convert (niter_type, iv0->base));
963 	  diff = fold_build2 (FLOOR_MOD_EXPR, niter_type, d, step);
964 	}
965       else
966 	diff = fold_build2 (MINUS_EXPR, niter_type, step,
967 			    build_int_cst (niter_type, 1));
968       bound = fold_build2 (MINUS_EXPR, type,
969 			   TYPE_MAX_VALUE (type), fold_convert (type, diff));
970       assumption = fold_build2 (LE_EXPR, boolean_type_node,
971 				iv1->base, bound);
972     }
973   else
974     {
975       /* for (i = iv1->base; i > iv0->base; i += iv1->step) */
976       if (iv1->no_overflow)
977 	return true;
978 
979       if (TREE_CODE (iv1->base) == INTEGER_CST)
980 	{
981 	  d = fold_build2 (MINUS_EXPR, niter_type,
982 			   fold_convert (niter_type, iv1->base),
983 			   fold_convert (niter_type, TYPE_MIN_VALUE (type)));
984 	  diff = fold_build2 (FLOOR_MOD_EXPR, niter_type, d, step);
985 	}
986       else
987 	diff = fold_build2 (MINUS_EXPR, niter_type, step,
988 			    build_int_cst (niter_type, 1));
989       bound = fold_build2 (PLUS_EXPR, type,
990 			   TYPE_MIN_VALUE (type), fold_convert (type, diff));
991       assumption = fold_build2 (GE_EXPR, boolean_type_node,
992 				iv0->base, bound);
993     }
994 
995   if (integer_zerop (assumption))
996     return false;
997   if (!integer_nonzerop (assumption))
998     niter->assumptions = fold_build2 (TRUTH_AND_EXPR, boolean_type_node,
999 				      niter->assumptions, assumption);
1000 
1001   iv0->no_overflow = true;
1002   iv1->no_overflow = true;
1003   return true;
1004 }
1005 
1006 /* Add an assumption to NITER that a loop whose ending condition
1007    is IV0 < IV1 rolls.  TYPE is the type of the control iv.  BNDS
1008    bounds the value of IV1->base - IV0->base.  */
1009 
1010 static void
1011 assert_loop_rolls_lt (tree type, affine_iv *iv0, affine_iv *iv1,
1012 		      struct tree_niter_desc *niter, bounds *bnds)
1013 {
1014   tree assumption = boolean_true_node, bound, diff;
1015   tree mbz, mbzl, mbzr, type1;
1016   bool rolls_p, no_overflow_p;
1017   widest_int dstep;
1018   mpz_t mstep, max;
1019 
1020   /* We are going to compute the number of iterations as
1021      (iv1->base - iv0->base + step - 1) / step, computed in the unsigned
1022      variant of TYPE.  This formula only works if
1023 
1024      -step + 1 <= (iv1->base - iv0->base) <= MAX - step + 1
1025 
1026      (where MAX is the maximum value of the unsigned variant of TYPE, and
1027      the computations in this formula are performed in full precision,
1028      i.e., without overflows).
1029 
1030      Usually, for loops with exit condition iv0->base + step * i < iv1->base,
1031      we have a condition of the form iv0->base - step < iv1->base before the loop,
1032      and for loops iv0->base < iv1->base - step * i the condition
1033      iv0->base < iv1->base + step, due to loop header copying, which enable us
1034      to prove the lower bound.
1035 
1036      The upper bound is more complicated.  Unless the expressions for initial
1037      and final value themselves contain enough information, we usually cannot
1038      derive it from the context.  */
1039 
1040   /* First check whether the answer does not follow from the bounds we gathered
1041      before.  */
1042   if (integer_nonzerop (iv0->step))
1043     dstep = wi::to_widest (iv0->step);
1044   else
1045     {
1046       dstep = wi::sext (wi::to_widest (iv1->step), TYPE_PRECISION (type));
1047       dstep = -dstep;
1048     }
1049 
1050   mpz_init (mstep);
1051   wi::to_mpz (dstep, mstep, UNSIGNED);
1052   mpz_neg (mstep, mstep);
1053   mpz_add_ui (mstep, mstep, 1);
1054 
1055   rolls_p = mpz_cmp (mstep, bnds->below) <= 0;
1056 
1057   mpz_init (max);
1058   wi::to_mpz (wi::minus_one (TYPE_PRECISION (type)), max, UNSIGNED);
1059   mpz_add (max, max, mstep);
1060   no_overflow_p = (mpz_cmp (bnds->up, max) <= 0
1061 		   /* For pointers, only values lying inside a single object
1062 		      can be compared or manipulated by pointer arithmetics.
1063 		      Gcc in general does not allow or handle objects larger
1064 		      than half of the address space, hence the upper bound
1065 		      is satisfied for pointers.  */
1066 		   || POINTER_TYPE_P (type));
1067   mpz_clear (mstep);
1068   mpz_clear (max);
1069 
1070   if (rolls_p && no_overflow_p)
1071     return;
1072 
1073   type1 = type;
1074   if (POINTER_TYPE_P (type))
1075     type1 = sizetype;
1076 
1077   /* Now the hard part; we must formulate the assumption(s) as expressions, and
1078      we must be careful not to introduce overflow.  */
1079 
1080   if (integer_nonzerop (iv0->step))
1081     {
1082       diff = fold_build2 (MINUS_EXPR, type1,
1083 			  iv0->step, build_int_cst (type1, 1));
1084 
1085       /* We need to know that iv0->base >= MIN + iv0->step - 1.  Since
1086 	 0 address never belongs to any object, we can assume this for
1087 	 pointers.  */
1088       if (!POINTER_TYPE_P (type))
1089 	{
1090 	  bound = fold_build2 (PLUS_EXPR, type1,
1091 			       TYPE_MIN_VALUE (type), diff);
1092 	  assumption = fold_build2 (GE_EXPR, boolean_type_node,
1093 				    iv0->base, bound);
1094 	}
1095 
1096       /* And then we can compute iv0->base - diff, and compare it with
1097 	 iv1->base.  */
1098       mbzl = fold_build2 (MINUS_EXPR, type1,
1099 			  fold_convert (type1, iv0->base), diff);
1100       mbzr = fold_convert (type1, iv1->base);
1101     }
1102   else
1103     {
1104       diff = fold_build2 (PLUS_EXPR, type1,
1105 			  iv1->step, build_int_cst (type1, 1));
1106 
1107       if (!POINTER_TYPE_P (type))
1108 	{
1109 	  bound = fold_build2 (PLUS_EXPR, type1,
1110 			       TYPE_MAX_VALUE (type), diff);
1111 	  assumption = fold_build2 (LE_EXPR, boolean_type_node,
1112 				    iv1->base, bound);
1113 	}
1114 
1115       mbzl = fold_convert (type1, iv0->base);
1116       mbzr = fold_build2 (MINUS_EXPR, type1,
1117 			  fold_convert (type1, iv1->base), diff);
1118     }
1119 
1120   if (!integer_nonzerop (assumption))
1121     niter->assumptions = fold_build2 (TRUTH_AND_EXPR, boolean_type_node,
1122 				      niter->assumptions, assumption);
1123   if (!rolls_p)
1124     {
1125       mbz = fold_build2 (GT_EXPR, boolean_type_node, mbzl, mbzr);
1126       niter->may_be_zero = fold_build2 (TRUTH_OR_EXPR, boolean_type_node,
1127 					niter->may_be_zero, mbz);
1128     }
1129 }
1130 
1131 /* Determines number of iterations of loop whose ending condition
1132    is IV0 < IV1.  TYPE is the type of the iv.  The number of
1133    iterations is stored to NITER.  BNDS bounds the difference
1134    IV1->base - IV0->base.  EXIT_MUST_BE_TAKEN is true if we know
1135    that the exit must be taken eventually.  */
1136 
1137 static bool
1138 number_of_iterations_lt (tree type, affine_iv *iv0, affine_iv *iv1,
1139 			 struct tree_niter_desc *niter,
1140 			 bool exit_must_be_taken, bounds *bnds)
1141 {
1142   tree niter_type = unsigned_type_for (type);
1143   tree delta, step, s;
1144   mpz_t mstep, tmp;
1145 
1146   if (integer_nonzerop (iv0->step))
1147     {
1148       niter->control = *iv0;
1149       niter->cmp = LT_EXPR;
1150       niter->bound = iv1->base;
1151     }
1152   else
1153     {
1154       niter->control = *iv1;
1155       niter->cmp = GT_EXPR;
1156       niter->bound = iv0->base;
1157     }
1158 
1159   delta = fold_build2 (MINUS_EXPR, niter_type,
1160 		       fold_convert (niter_type, iv1->base),
1161 		       fold_convert (niter_type, iv0->base));
1162 
1163   /* First handle the special case that the step is +-1.  */
1164   if ((integer_onep (iv0->step) && integer_zerop (iv1->step))
1165       || (integer_all_onesp (iv1->step) && integer_zerop (iv0->step)))
1166     {
1167       /* for (i = iv0->base; i < iv1->base; i++)
1168 
1169 	 or
1170 
1171 	 for (i = iv1->base; i > iv0->base; i--).
1172 
1173 	 In both cases # of iterations is iv1->base - iv0->base, assuming that
1174 	 iv1->base >= iv0->base.
1175 
1176          First try to derive a lower bound on the value of
1177 	 iv1->base - iv0->base, computed in full precision.  If the difference
1178 	 is nonnegative, we are done, otherwise we must record the
1179 	 condition.  */
1180 
1181       if (mpz_sgn (bnds->below) < 0)
1182 	niter->may_be_zero = fold_build2 (LT_EXPR, boolean_type_node,
1183 					  iv1->base, iv0->base);
1184       niter->niter = delta;
1185       niter->max = widest_int::from (wi::from_mpz (niter_type, bnds->up, false),
1186 				     TYPE_SIGN (niter_type));
1187       return true;
1188     }
1189 
1190   if (integer_nonzerop (iv0->step))
1191     step = fold_convert (niter_type, iv0->step);
1192   else
1193     step = fold_convert (niter_type,
1194 			 fold_build1 (NEGATE_EXPR, type, iv1->step));
1195 
1196   /* If we can determine the final value of the control iv exactly, we can
1197      transform the condition to != comparison.  In particular, this will be
1198      the case if DELTA is constant.  */
1199   if (number_of_iterations_lt_to_ne (type, iv0, iv1, niter, &delta, step,
1200 				     exit_must_be_taken, bnds))
1201     {
1202       affine_iv zps;
1203 
1204       zps.base = build_int_cst (niter_type, 0);
1205       zps.step = step;
1206       /* number_of_iterations_lt_to_ne will add assumptions that ensure that
1207 	 zps does not overflow.  */
1208       zps.no_overflow = true;
1209 
1210       return number_of_iterations_ne (type, &zps, delta, niter, true, bnds);
1211     }
1212 
1213   /* Make sure that the control iv does not overflow.  */
1214   if (!assert_no_overflow_lt (type, iv0, iv1, niter, step))
1215     return false;
1216 
1217   /* We determine the number of iterations as (delta + step - 1) / step.  For
1218      this to work, we must know that iv1->base >= iv0->base - step + 1,
1219      otherwise the loop does not roll.  */
1220   assert_loop_rolls_lt (type, iv0, iv1, niter, bnds);
1221 
1222   s = fold_build2 (MINUS_EXPR, niter_type,
1223 		   step, build_int_cst (niter_type, 1));
1224   delta = fold_build2 (PLUS_EXPR, niter_type, delta, s);
1225   niter->niter = fold_build2 (FLOOR_DIV_EXPR, niter_type, delta, step);
1226 
1227   mpz_init (mstep);
1228   mpz_init (tmp);
1229   wi::to_mpz (step, mstep, UNSIGNED);
1230   mpz_add (tmp, bnds->up, mstep);
1231   mpz_sub_ui (tmp, tmp, 1);
1232   mpz_fdiv_q (tmp, tmp, mstep);
1233   niter->max = widest_int::from (wi::from_mpz (niter_type, tmp, false),
1234 				 TYPE_SIGN (niter_type));
1235   mpz_clear (mstep);
1236   mpz_clear (tmp);
1237 
1238   return true;
1239 }
1240 
1241 /* Determines number of iterations of loop whose ending condition
1242    is IV0 <= IV1.  TYPE is the type of the iv.  The number of
1243    iterations is stored to NITER.  EXIT_MUST_BE_TAKEN is true if
1244    we know that this condition must eventually become false (we derived this
1245    earlier, and possibly set NITER->assumptions to make sure this
1246    is the case).  BNDS bounds the difference IV1->base - IV0->base.  */
1247 
1248 static bool
1249 number_of_iterations_le (tree type, affine_iv *iv0, affine_iv *iv1,
1250 			 struct tree_niter_desc *niter, bool exit_must_be_taken,
1251 			 bounds *bnds)
1252 {
1253   tree assumption;
1254   tree type1 = type;
1255   if (POINTER_TYPE_P (type))
1256     type1 = sizetype;
1257 
1258   /* Say that IV0 is the control variable.  Then IV0 <= IV1 iff
1259      IV0 < IV1 + 1, assuming that IV1 is not equal to the greatest
1260      value of the type.  This we must know anyway, since if it is
1261      equal to this value, the loop rolls forever.  We do not check
1262      this condition for pointer type ivs, as the code cannot rely on
1263      the object to that the pointer points being placed at the end of
1264      the address space (and more pragmatically, TYPE_{MIN,MAX}_VALUE is
1265      not defined for pointers).  */
1266 
1267   if (!exit_must_be_taken && !POINTER_TYPE_P (type))
1268     {
1269       if (integer_nonzerop (iv0->step))
1270 	assumption = fold_build2 (NE_EXPR, boolean_type_node,
1271 				  iv1->base, TYPE_MAX_VALUE (type));
1272       else
1273 	assumption = fold_build2 (NE_EXPR, boolean_type_node,
1274 				  iv0->base, TYPE_MIN_VALUE (type));
1275 
1276       if (integer_zerop (assumption))
1277 	return false;
1278       if (!integer_nonzerop (assumption))
1279 	niter->assumptions = fold_build2 (TRUTH_AND_EXPR, boolean_type_node,
1280 					  niter->assumptions, assumption);
1281     }
1282 
1283   if (integer_nonzerop (iv0->step))
1284     {
1285       if (POINTER_TYPE_P (type))
1286 	iv1->base = fold_build_pointer_plus_hwi (iv1->base, 1);
1287       else
1288 	iv1->base = fold_build2 (PLUS_EXPR, type1, iv1->base,
1289 				 build_int_cst (type1, 1));
1290     }
1291   else if (POINTER_TYPE_P (type))
1292     iv0->base = fold_build_pointer_plus_hwi (iv0->base, -1);
1293   else
1294     iv0->base = fold_build2 (MINUS_EXPR, type1,
1295 			     iv0->base, build_int_cst (type1, 1));
1296 
1297   bounds_add (bnds, 1, type1);
1298 
1299   return number_of_iterations_lt (type, iv0, iv1, niter, exit_must_be_taken,
1300 				  bnds);
1301 }
1302 
1303 /* Dumps description of affine induction variable IV to FILE.  */
1304 
1305 static void
1306 dump_affine_iv (FILE *file, affine_iv *iv)
1307 {
1308   if (!integer_zerop (iv->step))
1309     fprintf (file, "[");
1310 
1311   print_generic_expr (dump_file, iv->base, TDF_SLIM);
1312 
1313   if (!integer_zerop (iv->step))
1314     {
1315       fprintf (file, ", + , ");
1316       print_generic_expr (dump_file, iv->step, TDF_SLIM);
1317       fprintf (file, "]%s", iv->no_overflow ? "(no_overflow)" : "");
1318     }
1319 }
1320 
1321 /* Determine the number of iterations according to condition (for staying
1322    inside loop) which compares two induction variables using comparison
1323    operator CODE.  The induction variable on left side of the comparison
1324    is IV0, the right-hand side is IV1.  Both induction variables must have
1325    type TYPE, which must be an integer or pointer type.  The steps of the
1326    ivs must be constants (or NULL_TREE, which is interpreted as constant zero).
1327 
1328    LOOP is the loop whose number of iterations we are determining.
1329 
1330    ONLY_EXIT is true if we are sure this is the only way the loop could be
1331    exited (including possibly non-returning function calls, exceptions, etc.)
1332    -- in this case we can use the information whether the control induction
1333    variables can overflow or not in a more efficient way.
1334 
1335    if EVERY_ITERATION is true, we know the test is executed on every iteration.
1336 
1337    The results (number of iterations and assumptions as described in
1338    comments at struct tree_niter_desc in tree-ssa-loop.h) are stored to NITER.
1339    Returns false if it fails to determine number of iterations, true if it
1340    was determined (possibly with some assumptions).  */
1341 
1342 static bool
1343 number_of_iterations_cond (struct loop *loop,
1344 			   tree type, affine_iv *iv0, enum tree_code code,
1345 			   affine_iv *iv1, struct tree_niter_desc *niter,
1346 			   bool only_exit, bool every_iteration)
1347 {
1348   bool exit_must_be_taken = false, ret;
1349   bounds bnds;
1350 
1351   /* If the test is not executed every iteration, wrapping may make the test
1352      to pass again.
1353      TODO: the overflow case can be still used as unreliable estimate of upper
1354      bound.  But we have no API to pass it down to number of iterations code
1355      and, at present, it will not use it anyway.  */
1356   if (!every_iteration
1357       && (!iv0->no_overflow || !iv1->no_overflow
1358 	  || code == NE_EXPR || code == EQ_EXPR))
1359     return false;
1360 
1361   /* The meaning of these assumptions is this:
1362      if !assumptions
1363        then the rest of information does not have to be valid
1364      if may_be_zero then the loop does not roll, even if
1365        niter != 0.  */
1366   niter->assumptions = boolean_true_node;
1367   niter->may_be_zero = boolean_false_node;
1368   niter->niter = NULL_TREE;
1369   niter->max = 0;
1370   niter->bound = NULL_TREE;
1371   niter->cmp = ERROR_MARK;
1372 
1373   /* Make < comparison from > ones, and for NE_EXPR comparisons, ensure that
1374      the control variable is on lhs.  */
1375   if (code == GE_EXPR || code == GT_EXPR
1376       || (code == NE_EXPR && integer_zerop (iv0->step)))
1377     {
1378       SWAP (iv0, iv1);
1379       code = swap_tree_comparison (code);
1380     }
1381 
1382   if (POINTER_TYPE_P (type))
1383     {
1384       /* Comparison of pointers is undefined unless both iv0 and iv1 point
1385 	 to the same object.  If they do, the control variable cannot wrap
1386 	 (as wrap around the bounds of memory will never return a pointer
1387 	 that would be guaranteed to point to the same object, even if we
1388 	 avoid undefined behavior by casting to size_t and back).  */
1389       iv0->no_overflow = true;
1390       iv1->no_overflow = true;
1391     }
1392 
1393   /* If the control induction variable does not overflow and the only exit
1394      from the loop is the one that we analyze, we know it must be taken
1395      eventually.  */
1396   if (only_exit)
1397     {
1398       if (!integer_zerop (iv0->step) && iv0->no_overflow)
1399 	exit_must_be_taken = true;
1400       else if (!integer_zerop (iv1->step) && iv1->no_overflow)
1401 	exit_must_be_taken = true;
1402     }
1403 
1404   /* We can handle the case when neither of the sides of the comparison is
1405      invariant, provided that the test is NE_EXPR.  This rarely occurs in
1406      practice, but it is simple enough to manage.  */
1407   if (!integer_zerop (iv0->step) && !integer_zerop (iv1->step))
1408     {
1409       tree step_type = POINTER_TYPE_P (type) ? sizetype : type;
1410       if (code != NE_EXPR)
1411 	return false;
1412 
1413       iv0->step = fold_binary_to_constant (MINUS_EXPR, step_type,
1414 					   iv0->step, iv1->step);
1415       iv0->no_overflow = false;
1416       iv1->step = build_int_cst (step_type, 0);
1417       iv1->no_overflow = true;
1418     }
1419 
1420   /* If the result of the comparison is a constant,  the loop is weird.  More
1421      precise handling would be possible, but the situation is not common enough
1422      to waste time on it.  */
1423   if (integer_zerop (iv0->step) && integer_zerop (iv1->step))
1424     return false;
1425 
1426   /* Ignore loops of while (i-- < 10) type.  */
1427   if (code != NE_EXPR)
1428     {
1429       if (iv0->step && tree_int_cst_sign_bit (iv0->step))
1430 	return false;
1431 
1432       if (!integer_zerop (iv1->step) && !tree_int_cst_sign_bit (iv1->step))
1433 	return false;
1434     }
1435 
1436   /* If the loop exits immediately, there is nothing to do.  */
1437   tree tem = fold_binary (code, boolean_type_node, iv0->base, iv1->base);
1438   if (tem && integer_zerop (tem))
1439     {
1440       niter->niter = build_int_cst (unsigned_type_for (type), 0);
1441       niter->max = 0;
1442       return true;
1443     }
1444 
1445   /* OK, now we know we have a senseful loop.  Handle several cases, depending
1446      on what comparison operator is used.  */
1447   bound_difference (loop, iv1->base, iv0->base, &bnds);
1448 
1449   if (dump_file && (dump_flags & TDF_DETAILS))
1450     {
1451       fprintf (dump_file,
1452 	       "Analyzing # of iterations of loop %d\n", loop->num);
1453 
1454       fprintf (dump_file, "  exit condition ");
1455       dump_affine_iv (dump_file, iv0);
1456       fprintf (dump_file, " %s ",
1457 	       code == NE_EXPR ? "!="
1458 	       : code == LT_EXPR ? "<"
1459 	       : "<=");
1460       dump_affine_iv (dump_file, iv1);
1461       fprintf (dump_file, "\n");
1462 
1463       fprintf (dump_file, "  bounds on difference of bases: ");
1464       mpz_out_str (dump_file, 10, bnds.below);
1465       fprintf (dump_file, " ... ");
1466       mpz_out_str (dump_file, 10, bnds.up);
1467       fprintf (dump_file, "\n");
1468     }
1469 
1470   switch (code)
1471     {
1472     case NE_EXPR:
1473       gcc_assert (integer_zerop (iv1->step));
1474       ret = number_of_iterations_ne (type, iv0, iv1->base, niter,
1475 				     exit_must_be_taken, &bnds);
1476       break;
1477 
1478     case LT_EXPR:
1479       ret = number_of_iterations_lt (type, iv0, iv1, niter, exit_must_be_taken,
1480 				     &bnds);
1481       break;
1482 
1483     case LE_EXPR:
1484       ret = number_of_iterations_le (type, iv0, iv1, niter, exit_must_be_taken,
1485 				     &bnds);
1486       break;
1487 
1488     default:
1489       gcc_unreachable ();
1490     }
1491 
1492   mpz_clear (bnds.up);
1493   mpz_clear (bnds.below);
1494 
1495   if (dump_file && (dump_flags & TDF_DETAILS))
1496     {
1497       if (ret)
1498 	{
1499 	  fprintf (dump_file, "  result:\n");
1500 	  if (!integer_nonzerop (niter->assumptions))
1501 	    {
1502 	      fprintf (dump_file, "    under assumptions ");
1503 	      print_generic_expr (dump_file, niter->assumptions, TDF_SLIM);
1504 	      fprintf (dump_file, "\n");
1505 	    }
1506 
1507 	  if (!integer_zerop (niter->may_be_zero))
1508 	    {
1509 	      fprintf (dump_file, "    zero if ");
1510 	      print_generic_expr (dump_file, niter->may_be_zero, TDF_SLIM);
1511 	      fprintf (dump_file, "\n");
1512 	    }
1513 
1514 	  fprintf (dump_file, "    # of iterations ");
1515 	  print_generic_expr (dump_file, niter->niter, TDF_SLIM);
1516 	  fprintf (dump_file, ", bounded by ");
1517 	  print_decu (niter->max, dump_file);
1518 	  fprintf (dump_file, "\n");
1519 	}
1520       else
1521 	fprintf (dump_file, "  failed\n\n");
1522     }
1523   return ret;
1524 }
1525 
1526 /* Substitute NEW for OLD in EXPR and fold the result.  */
1527 
1528 static tree
1529 simplify_replace_tree (tree expr, tree old, tree new_tree)
1530 {
1531   unsigned i, n;
1532   tree ret = NULL_TREE, e, se;
1533 
1534   if (!expr)
1535     return NULL_TREE;
1536 
1537   /* Do not bother to replace constants.  */
1538   if (CONSTANT_CLASS_P (old))
1539     return expr;
1540 
1541   if (expr == old
1542       || operand_equal_p (expr, old, 0))
1543     return unshare_expr (new_tree);
1544 
1545   if (!EXPR_P (expr))
1546     return expr;
1547 
1548   n = TREE_OPERAND_LENGTH (expr);
1549   for (i = 0; i < n; i++)
1550     {
1551       e = TREE_OPERAND (expr, i);
1552       se = simplify_replace_tree (e, old, new_tree);
1553       if (e == se)
1554 	continue;
1555 
1556       if (!ret)
1557 	ret = copy_node (expr);
1558 
1559       TREE_OPERAND (ret, i) = se;
1560     }
1561 
1562   return (ret ? fold (ret) : expr);
1563 }
1564 
1565 /* Expand definitions of ssa names in EXPR as long as they are simple
1566    enough, and return the new expression.  If STOP is specified, stop
1567    expanding if EXPR equals to it.  */
1568 
1569 tree
1570 expand_simple_operations (tree expr, tree stop)
1571 {
1572   unsigned i, n;
1573   tree ret = NULL_TREE, e, ee, e1;
1574   enum tree_code code;
1575   gimple stmt;
1576 
1577   if (expr == NULL_TREE)
1578     return expr;
1579 
1580   if (is_gimple_min_invariant (expr))
1581     return expr;
1582 
1583   code = TREE_CODE (expr);
1584   if (IS_EXPR_CODE_CLASS (TREE_CODE_CLASS (code)))
1585     {
1586       n = TREE_OPERAND_LENGTH (expr);
1587       for (i = 0; i < n; i++)
1588 	{
1589 	  e = TREE_OPERAND (expr, i);
1590 	  ee = expand_simple_operations (e, stop);
1591 	  if (e == ee)
1592 	    continue;
1593 
1594 	  if (!ret)
1595 	    ret = copy_node (expr);
1596 
1597 	  TREE_OPERAND (ret, i) = ee;
1598 	}
1599 
1600       if (!ret)
1601 	return expr;
1602 
1603       fold_defer_overflow_warnings ();
1604       ret = fold (ret);
1605       fold_undefer_and_ignore_overflow_warnings ();
1606       return ret;
1607     }
1608 
1609   /* Stop if it's not ssa name or the one we don't want to expand.  */
1610   if (TREE_CODE (expr) != SSA_NAME || expr == stop)
1611     return expr;
1612 
1613   stmt = SSA_NAME_DEF_STMT (expr);
1614   if (gimple_code (stmt) == GIMPLE_PHI)
1615     {
1616       basic_block src, dest;
1617 
1618       if (gimple_phi_num_args (stmt) != 1)
1619 	return expr;
1620       e = PHI_ARG_DEF (stmt, 0);
1621 
1622       /* Avoid propagating through loop exit phi nodes, which
1623 	 could break loop-closed SSA form restrictions.  */
1624       dest = gimple_bb (stmt);
1625       src = single_pred (dest);
1626       if (TREE_CODE (e) == SSA_NAME
1627 	  && src->loop_father != dest->loop_father)
1628 	return expr;
1629 
1630       return expand_simple_operations (e, stop);
1631     }
1632   if (gimple_code (stmt) != GIMPLE_ASSIGN)
1633     return expr;
1634 
1635   /* Avoid expanding to expressions that contain SSA names that need
1636      to take part in abnormal coalescing.  */
1637   ssa_op_iter iter;
1638   FOR_EACH_SSA_TREE_OPERAND (e, stmt, iter, SSA_OP_USE)
1639     if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (e))
1640       return expr;
1641 
1642   e = gimple_assign_rhs1 (stmt);
1643   code = gimple_assign_rhs_code (stmt);
1644   if (get_gimple_rhs_class (code) == GIMPLE_SINGLE_RHS)
1645     {
1646       if (is_gimple_min_invariant (e))
1647 	return e;
1648 
1649       if (code == SSA_NAME)
1650 	return expand_simple_operations (e, stop);
1651 
1652       return expr;
1653     }
1654 
1655   switch (code)
1656     {
1657     CASE_CONVERT:
1658       /* Casts are simple.  */
1659       ee = expand_simple_operations (e, stop);
1660       return fold_build1 (code, TREE_TYPE (expr), ee);
1661 
1662     case PLUS_EXPR:
1663     case MINUS_EXPR:
1664       if (ANY_INTEGRAL_TYPE_P (TREE_TYPE (expr))
1665 	  && TYPE_OVERFLOW_TRAPS (TREE_TYPE (expr)))
1666 	return expr;
1667       /* Fallthru.  */
1668     case POINTER_PLUS_EXPR:
1669       /* And increments and decrements by a constant are simple.  */
1670       e1 = gimple_assign_rhs2 (stmt);
1671       if (!is_gimple_min_invariant (e1))
1672 	return expr;
1673 
1674       ee = expand_simple_operations (e, stop);
1675       return fold_build2 (code, TREE_TYPE (expr), ee, e1);
1676 
1677     default:
1678       return expr;
1679     }
1680 }
1681 
1682 /* Tries to simplify EXPR using the condition COND.  Returns the simplified
1683    expression (or EXPR unchanged, if no simplification was possible).  */
1684 
1685 static tree
1686 tree_simplify_using_condition_1 (tree cond, tree expr)
1687 {
1688   bool changed;
1689   tree e, te, e0, e1, e2, notcond;
1690   enum tree_code code = TREE_CODE (expr);
1691 
1692   if (code == INTEGER_CST)
1693     return expr;
1694 
1695   if (code == TRUTH_OR_EXPR
1696       || code == TRUTH_AND_EXPR
1697       || code == COND_EXPR)
1698     {
1699       changed = false;
1700 
1701       e0 = tree_simplify_using_condition_1 (cond, TREE_OPERAND (expr, 0));
1702       if (TREE_OPERAND (expr, 0) != e0)
1703 	changed = true;
1704 
1705       e1 = tree_simplify_using_condition_1 (cond, TREE_OPERAND (expr, 1));
1706       if (TREE_OPERAND (expr, 1) != e1)
1707 	changed = true;
1708 
1709       if (code == COND_EXPR)
1710 	{
1711 	  e2 = tree_simplify_using_condition_1 (cond, TREE_OPERAND (expr, 2));
1712 	  if (TREE_OPERAND (expr, 2) != e2)
1713 	    changed = true;
1714 	}
1715       else
1716 	e2 = NULL_TREE;
1717 
1718       if (changed)
1719 	{
1720 	  if (code == COND_EXPR)
1721 	    expr = fold_build3 (code, boolean_type_node, e0, e1, e2);
1722 	  else
1723 	    expr = fold_build2 (code, boolean_type_node, e0, e1);
1724 	}
1725 
1726       return expr;
1727     }
1728 
1729   /* In case COND is equality, we may be able to simplify EXPR by copy/constant
1730      propagation, and vice versa.  Fold does not handle this, since it is
1731      considered too expensive.  */
1732   if (TREE_CODE (cond) == EQ_EXPR)
1733     {
1734       e0 = TREE_OPERAND (cond, 0);
1735       e1 = TREE_OPERAND (cond, 1);
1736 
1737       /* We know that e0 == e1.  Check whether we cannot simplify expr
1738 	 using this fact.  */
1739       e = simplify_replace_tree (expr, e0, e1);
1740       if (integer_zerop (e) || integer_nonzerop (e))
1741 	return e;
1742 
1743       e = simplify_replace_tree (expr, e1, e0);
1744       if (integer_zerop (e) || integer_nonzerop (e))
1745 	return e;
1746     }
1747   if (TREE_CODE (expr) == EQ_EXPR)
1748     {
1749       e0 = TREE_OPERAND (expr, 0);
1750       e1 = TREE_OPERAND (expr, 1);
1751 
1752       /* If e0 == e1 (EXPR) implies !COND, then EXPR cannot be true.  */
1753       e = simplify_replace_tree (cond, e0, e1);
1754       if (integer_zerop (e))
1755 	return e;
1756       e = simplify_replace_tree (cond, e1, e0);
1757       if (integer_zerop (e))
1758 	return e;
1759     }
1760   if (TREE_CODE (expr) == NE_EXPR)
1761     {
1762       e0 = TREE_OPERAND (expr, 0);
1763       e1 = TREE_OPERAND (expr, 1);
1764 
1765       /* If e0 == e1 (!EXPR) implies !COND, then EXPR must be true.  */
1766       e = simplify_replace_tree (cond, e0, e1);
1767       if (integer_zerop (e))
1768 	return boolean_true_node;
1769       e = simplify_replace_tree (cond, e1, e0);
1770       if (integer_zerop (e))
1771 	return boolean_true_node;
1772     }
1773 
1774   te = expand_simple_operations (expr);
1775 
1776   /* Check whether COND ==> EXPR.  */
1777   notcond = invert_truthvalue (cond);
1778   e = fold_binary (TRUTH_OR_EXPR, boolean_type_node, notcond, te);
1779   if (e && integer_nonzerop (e))
1780     return e;
1781 
1782   /* Check whether COND ==> not EXPR.  */
1783   e = fold_binary (TRUTH_AND_EXPR, boolean_type_node, cond, te);
1784   if (e && integer_zerop (e))
1785     return e;
1786 
1787   return expr;
1788 }
1789 
1790 /* Tries to simplify EXPR using the condition COND.  Returns the simplified
1791    expression (or EXPR unchanged, if no simplification was possible).
1792    Wrapper around tree_simplify_using_condition_1 that ensures that chains
1793    of simple operations in definitions of ssa names in COND are expanded,
1794    so that things like casts or incrementing the value of the bound before
1795    the loop do not cause us to fail.  */
1796 
1797 static tree
1798 tree_simplify_using_condition (tree cond, tree expr)
1799 {
1800   cond = expand_simple_operations (cond);
1801 
1802   return tree_simplify_using_condition_1 (cond, expr);
1803 }
1804 
1805 /* Tries to simplify EXPR using the conditions on entry to LOOP.
1806    Returns the simplified expression (or EXPR unchanged, if no
1807    simplification was possible).*/
1808 
1809 static tree
1810 simplify_using_initial_conditions (struct loop *loop, tree expr)
1811 {
1812   edge e;
1813   basic_block bb;
1814   gimple stmt;
1815   tree cond;
1816   int cnt = 0;
1817 
1818   if (TREE_CODE (expr) == INTEGER_CST)
1819     return expr;
1820 
1821   /* Limit walking the dominators to avoid quadraticness in
1822      the number of BBs times the number of loops in degenerate
1823      cases.  */
1824   for (bb = loop->header;
1825        bb != ENTRY_BLOCK_PTR_FOR_FN (cfun) && cnt < MAX_DOMINATORS_TO_WALK;
1826        bb = get_immediate_dominator (CDI_DOMINATORS, bb))
1827     {
1828       if (!single_pred_p (bb))
1829 	continue;
1830       e = single_pred_edge (bb);
1831 
1832       if (!(e->flags & (EDGE_TRUE_VALUE | EDGE_FALSE_VALUE)))
1833 	continue;
1834 
1835       stmt = last_stmt (e->src);
1836       cond = fold_build2 (gimple_cond_code (stmt),
1837 			  boolean_type_node,
1838 			  gimple_cond_lhs (stmt),
1839 			  gimple_cond_rhs (stmt));
1840       if (e->flags & EDGE_FALSE_VALUE)
1841 	cond = invert_truthvalue (cond);
1842       expr = tree_simplify_using_condition (cond, expr);
1843       ++cnt;
1844     }
1845 
1846   return expr;
1847 }
1848 
1849 /* Tries to simplify EXPR using the evolutions of the loop invariants
1850    in the superloops of LOOP.  Returns the simplified expression
1851    (or EXPR unchanged, if no simplification was possible).  */
1852 
1853 static tree
1854 simplify_using_outer_evolutions (struct loop *loop, tree expr)
1855 {
1856   enum tree_code code = TREE_CODE (expr);
1857   bool changed;
1858   tree e, e0, e1, e2;
1859 
1860   if (is_gimple_min_invariant (expr))
1861     return expr;
1862 
1863   if (code == TRUTH_OR_EXPR
1864       || code == TRUTH_AND_EXPR
1865       || code == COND_EXPR)
1866     {
1867       changed = false;
1868 
1869       e0 = simplify_using_outer_evolutions (loop, TREE_OPERAND (expr, 0));
1870       if (TREE_OPERAND (expr, 0) != e0)
1871 	changed = true;
1872 
1873       e1 = simplify_using_outer_evolutions (loop, TREE_OPERAND (expr, 1));
1874       if (TREE_OPERAND (expr, 1) != e1)
1875 	changed = true;
1876 
1877       if (code == COND_EXPR)
1878 	{
1879 	  e2 = simplify_using_outer_evolutions (loop, TREE_OPERAND (expr, 2));
1880 	  if (TREE_OPERAND (expr, 2) != e2)
1881 	    changed = true;
1882 	}
1883       else
1884 	e2 = NULL_TREE;
1885 
1886       if (changed)
1887 	{
1888 	  if (code == COND_EXPR)
1889 	    expr = fold_build3 (code, boolean_type_node, e0, e1, e2);
1890 	  else
1891 	    expr = fold_build2 (code, boolean_type_node, e0, e1);
1892 	}
1893 
1894       return expr;
1895     }
1896 
1897   e = instantiate_parameters (loop, expr);
1898   if (is_gimple_min_invariant (e))
1899     return e;
1900 
1901   return expr;
1902 }
1903 
1904 /* Returns true if EXIT is the only possible exit from LOOP.  */
1905 
1906 bool
1907 loop_only_exit_p (const struct loop *loop, const_edge exit)
1908 {
1909   basic_block *body;
1910   gimple_stmt_iterator bsi;
1911   unsigned i;
1912   gimple call;
1913 
1914   if (exit != single_exit (loop))
1915     return false;
1916 
1917   body = get_loop_body (loop);
1918   for (i = 0; i < loop->num_nodes; i++)
1919     {
1920       for (bsi = gsi_start_bb (body[i]); !gsi_end_p (bsi); gsi_next (&bsi))
1921 	{
1922 	  call = gsi_stmt (bsi);
1923 	  if (gimple_code (call) != GIMPLE_CALL)
1924 	    continue;
1925 
1926 	  if (gimple_has_side_effects (call))
1927 	    {
1928 	      free (body);
1929 	      return false;
1930 	    }
1931 	}
1932     }
1933 
1934   free (body);
1935   return true;
1936 }
1937 
1938 /* Stores description of number of iterations of LOOP derived from
1939    EXIT (an exit edge of the LOOP) in NITER.  Returns true if some
1940    useful information could be derived (and fields of NITER has
1941    meaning described in comments at struct tree_niter_desc
1942    declaration), false otherwise.  If WARN is true and
1943    -Wunsafe-loop-optimizations was given, warn if the optimizer is going to use
1944    potentially unsafe assumptions.
1945    When EVERY_ITERATION is true, only tests that are known to be executed
1946    every iteration are considered (i.e. only test that alone bounds the loop).
1947  */
1948 
1949 bool
1950 number_of_iterations_exit (struct loop *loop, edge exit,
1951 			   struct tree_niter_desc *niter,
1952 			   bool warn, bool every_iteration)
1953 {
1954   gimple last;
1955   gcond *stmt;
1956   tree type;
1957   tree op0, op1;
1958   enum tree_code code;
1959   affine_iv iv0, iv1;
1960   bool safe;
1961 
1962   safe = dominated_by_p (CDI_DOMINATORS, loop->latch, exit->src);
1963 
1964   if (every_iteration && !safe)
1965     return false;
1966 
1967   niter->assumptions = boolean_false_node;
1968   last = last_stmt (exit->src);
1969   if (!last)
1970     return false;
1971   stmt = dyn_cast <gcond *> (last);
1972   if (!stmt)
1973     return false;
1974 
1975   /* We want the condition for staying inside loop.  */
1976   code = gimple_cond_code (stmt);
1977   if (exit->flags & EDGE_TRUE_VALUE)
1978     code = invert_tree_comparison (code, false);
1979 
1980   switch (code)
1981     {
1982     case GT_EXPR:
1983     case GE_EXPR:
1984     case LT_EXPR:
1985     case LE_EXPR:
1986     case NE_EXPR:
1987       break;
1988 
1989     default:
1990       return false;
1991     }
1992 
1993   op0 = gimple_cond_lhs (stmt);
1994   op1 = gimple_cond_rhs (stmt);
1995   type = TREE_TYPE (op0);
1996 
1997   if (TREE_CODE (type) != INTEGER_TYPE
1998       && !POINTER_TYPE_P (type))
1999     return false;
2000 
2001   if (!simple_iv (loop, loop_containing_stmt (stmt), op0, &iv0, false))
2002     return false;
2003   if (!simple_iv (loop, loop_containing_stmt (stmt), op1, &iv1, false))
2004     return false;
2005 
2006   /* We don't want to see undefined signed overflow warnings while
2007      computing the number of iterations.  */
2008   fold_defer_overflow_warnings ();
2009 
2010   iv0.base = expand_simple_operations (iv0.base);
2011   iv1.base = expand_simple_operations (iv1.base);
2012   if (!number_of_iterations_cond (loop, type, &iv0, code, &iv1, niter,
2013 				  loop_only_exit_p (loop, exit), safe))
2014     {
2015       fold_undefer_and_ignore_overflow_warnings ();
2016       return false;
2017     }
2018 
2019   if (optimize >= 3)
2020     {
2021       niter->assumptions = simplify_using_outer_evolutions (loop,
2022 							    niter->assumptions);
2023       niter->may_be_zero = simplify_using_outer_evolutions (loop,
2024 							    niter->may_be_zero);
2025       niter->niter = simplify_using_outer_evolutions (loop, niter->niter);
2026     }
2027 
2028   niter->assumptions
2029 	  = simplify_using_initial_conditions (loop,
2030 					       niter->assumptions);
2031   niter->may_be_zero
2032 	  = simplify_using_initial_conditions (loop,
2033 					       niter->may_be_zero);
2034 
2035   fold_undefer_and_ignore_overflow_warnings ();
2036 
2037   /* If NITER has simplified into a constant, update MAX.  */
2038   if (TREE_CODE (niter->niter) == INTEGER_CST)
2039     niter->max = wi::to_widest (niter->niter);
2040 
2041   if (integer_onep (niter->assumptions))
2042     return true;
2043 
2044   /* With -funsafe-loop-optimizations we assume that nothing bad can happen.
2045      But if we can prove that there is overflow or some other source of weird
2046      behavior, ignore the loop even with -funsafe-loop-optimizations.  */
2047   if (integer_zerop (niter->assumptions) || !single_exit (loop))
2048     return false;
2049 
2050   if (flag_unsafe_loop_optimizations)
2051     niter->assumptions = boolean_true_node;
2052 
2053   if (warn)
2054     {
2055       const char *wording;
2056       location_t loc = gimple_location (stmt);
2057 
2058       /* We can provide a more specific warning if one of the operator is
2059 	 constant and the other advances by +1 or -1.  */
2060       if (!integer_zerop (iv1.step)
2061 	  ? (integer_zerop (iv0.step)
2062 	     && (integer_onep (iv1.step) || integer_all_onesp (iv1.step)))
2063 	  : (integer_onep (iv0.step) || integer_all_onesp (iv0.step)))
2064         wording =
2065           flag_unsafe_loop_optimizations
2066           ? N_("assuming that the loop is not infinite")
2067           : N_("cannot optimize possibly infinite loops");
2068       else
2069 	wording =
2070 	  flag_unsafe_loop_optimizations
2071 	  ? N_("assuming that the loop counter does not overflow")
2072 	  : N_("cannot optimize loop, the loop counter may overflow");
2073 
2074       warning_at ((LOCATION_LINE (loc) > 0) ? loc : input_location,
2075 		  OPT_Wunsafe_loop_optimizations, "%s", gettext (wording));
2076     }
2077 
2078   return flag_unsafe_loop_optimizations;
2079 }
2080 
2081 /* Try to determine the number of iterations of LOOP.  If we succeed,
2082    expression giving number of iterations is returned and *EXIT is
2083    set to the edge from that the information is obtained.  Otherwise
2084    chrec_dont_know is returned.  */
2085 
2086 tree
2087 find_loop_niter (struct loop *loop, edge *exit)
2088 {
2089   unsigned i;
2090   vec<edge> exits = get_loop_exit_edges (loop);
2091   edge ex;
2092   tree niter = NULL_TREE, aniter;
2093   struct tree_niter_desc desc;
2094 
2095   *exit = NULL;
2096   FOR_EACH_VEC_ELT (exits, i, ex)
2097     {
2098       if (!number_of_iterations_exit (loop, ex, &desc, false))
2099 	continue;
2100 
2101       if (integer_nonzerop (desc.may_be_zero))
2102 	{
2103 	  /* We exit in the first iteration through this exit.
2104 	     We won't find anything better.  */
2105 	  niter = build_int_cst (unsigned_type_node, 0);
2106 	  *exit = ex;
2107 	  break;
2108 	}
2109 
2110       if (!integer_zerop (desc.may_be_zero))
2111 	continue;
2112 
2113       aniter = desc.niter;
2114 
2115       if (!niter)
2116 	{
2117 	  /* Nothing recorded yet.  */
2118 	  niter = aniter;
2119 	  *exit = ex;
2120 	  continue;
2121 	}
2122 
2123       /* Prefer constants, the lower the better.  */
2124       if (TREE_CODE (aniter) != INTEGER_CST)
2125 	continue;
2126 
2127       if (TREE_CODE (niter) != INTEGER_CST)
2128 	{
2129 	  niter = aniter;
2130 	  *exit = ex;
2131 	  continue;
2132 	}
2133 
2134       if (tree_int_cst_lt (aniter, niter))
2135 	{
2136 	  niter = aniter;
2137 	  *exit = ex;
2138 	  continue;
2139 	}
2140     }
2141   exits.release ();
2142 
2143   return niter ? niter : chrec_dont_know;
2144 }
2145 
2146 /* Return true if loop is known to have bounded number of iterations.  */
2147 
2148 bool
2149 finite_loop_p (struct loop *loop)
2150 {
2151   widest_int nit;
2152   int flags;
2153 
2154   if (flag_unsafe_loop_optimizations)
2155     return true;
2156   flags = flags_from_decl_or_type (current_function_decl);
2157   if ((flags & (ECF_CONST|ECF_PURE)) && !(flags & ECF_LOOPING_CONST_OR_PURE))
2158     {
2159       if (dump_file && (dump_flags & TDF_DETAILS))
2160 	fprintf (dump_file, "Found loop %i to be finite: it is within pure or const function.\n",
2161 		 loop->num);
2162       return true;
2163     }
2164 
2165   if (loop->any_upper_bound
2166       || max_loop_iterations (loop, &nit))
2167     {
2168       if (dump_file && (dump_flags & TDF_DETAILS))
2169 	fprintf (dump_file, "Found loop %i to be finite: upper bound found.\n",
2170 		 loop->num);
2171       return true;
2172     }
2173   return false;
2174 }
2175 
2176 /*
2177 
2178    Analysis of a number of iterations of a loop by a brute-force evaluation.
2179 
2180 */
2181 
2182 /* Bound on the number of iterations we try to evaluate.  */
2183 
2184 #define MAX_ITERATIONS_TO_TRACK \
2185   ((unsigned) PARAM_VALUE (PARAM_MAX_ITERATIONS_TO_TRACK))
2186 
2187 /* Returns the loop phi node of LOOP such that ssa name X is derived from its
2188    result by a chain of operations such that all but exactly one of their
2189    operands are constants.  */
2190 
2191 static gphi *
2192 chain_of_csts_start (struct loop *loop, tree x)
2193 {
2194   gimple stmt = SSA_NAME_DEF_STMT (x);
2195   tree use;
2196   basic_block bb = gimple_bb (stmt);
2197   enum tree_code code;
2198 
2199   if (!bb
2200       || !flow_bb_inside_loop_p (loop, bb))
2201     return NULL;
2202 
2203   if (gimple_code (stmt) == GIMPLE_PHI)
2204     {
2205       if (bb == loop->header)
2206 	return as_a <gphi *> (stmt);
2207 
2208       return NULL;
2209     }
2210 
2211   if (gimple_code (stmt) != GIMPLE_ASSIGN
2212       || gimple_assign_rhs_class (stmt) == GIMPLE_TERNARY_RHS)
2213     return NULL;
2214 
2215   code = gimple_assign_rhs_code (stmt);
2216   if (gimple_references_memory_p (stmt)
2217       || TREE_CODE_CLASS (code) == tcc_reference
2218       || (code == ADDR_EXPR
2219 	  && !is_gimple_min_invariant (gimple_assign_rhs1 (stmt))))
2220     return NULL;
2221 
2222   use = SINGLE_SSA_TREE_OPERAND (stmt, SSA_OP_USE);
2223   if (use == NULL_TREE)
2224     return NULL;
2225 
2226   return chain_of_csts_start (loop, use);
2227 }
2228 
2229 /* Determines whether the expression X is derived from a result of a phi node
2230    in header of LOOP such that
2231 
2232    * the derivation of X consists only from operations with constants
2233    * the initial value of the phi node is constant
2234    * the value of the phi node in the next iteration can be derived from the
2235      value in the current iteration by a chain of operations with constants.
2236 
2237    If such phi node exists, it is returned, otherwise NULL is returned.  */
2238 
2239 static gphi *
2240 get_base_for (struct loop *loop, tree x)
2241 {
2242   gphi *phi;
2243   tree init, next;
2244 
2245   if (is_gimple_min_invariant (x))
2246     return NULL;
2247 
2248   phi = chain_of_csts_start (loop, x);
2249   if (!phi)
2250     return NULL;
2251 
2252   init = PHI_ARG_DEF_FROM_EDGE (phi, loop_preheader_edge (loop));
2253   next = PHI_ARG_DEF_FROM_EDGE (phi, loop_latch_edge (loop));
2254 
2255   if (TREE_CODE (next) != SSA_NAME)
2256     return NULL;
2257 
2258   if (!is_gimple_min_invariant (init))
2259     return NULL;
2260 
2261   if (chain_of_csts_start (loop, next) != phi)
2262     return NULL;
2263 
2264   return phi;
2265 }
2266 
2267 /* Given an expression X, then
2268 
2269    * if X is NULL_TREE, we return the constant BASE.
2270    * otherwise X is a SSA name, whose value in the considered loop is derived
2271      by a chain of operations with constant from a result of a phi node in
2272      the header of the loop.  Then we return value of X when the value of the
2273      result of this phi node is given by the constant BASE.  */
2274 
2275 static tree
2276 get_val_for (tree x, tree base)
2277 {
2278   gimple stmt;
2279 
2280   gcc_checking_assert (is_gimple_min_invariant (base));
2281 
2282   if (!x)
2283     return base;
2284 
2285   stmt = SSA_NAME_DEF_STMT (x);
2286   if (gimple_code (stmt) == GIMPLE_PHI)
2287     return base;
2288 
2289   gcc_checking_assert (is_gimple_assign (stmt));
2290 
2291   /* STMT must be either an assignment of a single SSA name or an
2292      expression involving an SSA name and a constant.  Try to fold that
2293      expression using the value for the SSA name.  */
2294   if (gimple_assign_ssa_name_copy_p (stmt))
2295     return get_val_for (gimple_assign_rhs1 (stmt), base);
2296   else if (gimple_assign_rhs_class (stmt) == GIMPLE_UNARY_RHS
2297 	   && TREE_CODE (gimple_assign_rhs1 (stmt)) == SSA_NAME)
2298     {
2299       return fold_build1 (gimple_assign_rhs_code (stmt),
2300 			  gimple_expr_type (stmt),
2301 			  get_val_for (gimple_assign_rhs1 (stmt), base));
2302     }
2303   else if (gimple_assign_rhs_class (stmt) == GIMPLE_BINARY_RHS)
2304     {
2305       tree rhs1 = gimple_assign_rhs1 (stmt);
2306       tree rhs2 = gimple_assign_rhs2 (stmt);
2307       if (TREE_CODE (rhs1) == SSA_NAME)
2308 	rhs1 = get_val_for (rhs1, base);
2309       else if (TREE_CODE (rhs2) == SSA_NAME)
2310 	rhs2 = get_val_for (rhs2, base);
2311       else
2312 	gcc_unreachable ();
2313       return fold_build2 (gimple_assign_rhs_code (stmt),
2314 			  gimple_expr_type (stmt), rhs1, rhs2);
2315     }
2316   else
2317     gcc_unreachable ();
2318 }
2319 
2320 
2321 /* Tries to count the number of iterations of LOOP till it exits by EXIT
2322    by brute force -- i.e. by determining the value of the operands of the
2323    condition at EXIT in first few iterations of the loop (assuming that
2324    these values are constant) and determining the first one in that the
2325    condition is not satisfied.  Returns the constant giving the number
2326    of the iterations of LOOP if successful, chrec_dont_know otherwise.  */
2327 
2328 tree
2329 loop_niter_by_eval (struct loop *loop, edge exit)
2330 {
2331   tree acnd;
2332   tree op[2], val[2], next[2], aval[2];
2333   gphi *phi;
2334   gimple cond;
2335   unsigned i, j;
2336   enum tree_code cmp;
2337 
2338   cond = last_stmt (exit->src);
2339   if (!cond || gimple_code (cond) != GIMPLE_COND)
2340     return chrec_dont_know;
2341 
2342   cmp = gimple_cond_code (cond);
2343   if (exit->flags & EDGE_TRUE_VALUE)
2344     cmp = invert_tree_comparison (cmp, false);
2345 
2346   switch (cmp)
2347     {
2348     case EQ_EXPR:
2349     case NE_EXPR:
2350     case GT_EXPR:
2351     case GE_EXPR:
2352     case LT_EXPR:
2353     case LE_EXPR:
2354       op[0] = gimple_cond_lhs (cond);
2355       op[1] = gimple_cond_rhs (cond);
2356       break;
2357 
2358     default:
2359       return chrec_dont_know;
2360     }
2361 
2362   for (j = 0; j < 2; j++)
2363     {
2364       if (is_gimple_min_invariant (op[j]))
2365 	{
2366 	  val[j] = op[j];
2367 	  next[j] = NULL_TREE;
2368 	  op[j] = NULL_TREE;
2369 	}
2370       else
2371 	{
2372 	  phi = get_base_for (loop, op[j]);
2373 	  if (!phi)
2374 	    return chrec_dont_know;
2375 	  val[j] = PHI_ARG_DEF_FROM_EDGE (phi, loop_preheader_edge (loop));
2376 	  next[j] = PHI_ARG_DEF_FROM_EDGE (phi, loop_latch_edge (loop));
2377 	}
2378     }
2379 
2380   /* Don't issue signed overflow warnings.  */
2381   fold_defer_overflow_warnings ();
2382 
2383   for (i = 0; i < MAX_ITERATIONS_TO_TRACK; i++)
2384     {
2385       for (j = 0; j < 2; j++)
2386 	aval[j] = get_val_for (op[j], val[j]);
2387 
2388       acnd = fold_binary (cmp, boolean_type_node, aval[0], aval[1]);
2389       if (acnd && integer_zerop (acnd))
2390 	{
2391 	  fold_undefer_and_ignore_overflow_warnings ();
2392 	  if (dump_file && (dump_flags & TDF_DETAILS))
2393 	    fprintf (dump_file,
2394 		     "Proved that loop %d iterates %d times using brute force.\n",
2395 		     loop->num, i);
2396 	  return build_int_cst (unsigned_type_node, i);
2397 	}
2398 
2399       for (j = 0; j < 2; j++)
2400 	{
2401 	  val[j] = get_val_for (next[j], val[j]);
2402 	  if (!is_gimple_min_invariant (val[j]))
2403 	    {
2404 	      fold_undefer_and_ignore_overflow_warnings ();
2405 	      return chrec_dont_know;
2406 	    }
2407 	}
2408     }
2409 
2410   fold_undefer_and_ignore_overflow_warnings ();
2411 
2412   return chrec_dont_know;
2413 }
2414 
2415 /* Finds the exit of the LOOP by that the loop exits after a constant
2416    number of iterations and stores the exit edge to *EXIT.  The constant
2417    giving the number of iterations of LOOP is returned.  The number of
2418    iterations is determined using loop_niter_by_eval (i.e. by brute force
2419    evaluation).  If we are unable to find the exit for that loop_niter_by_eval
2420    determines the number of iterations, chrec_dont_know is returned.  */
2421 
2422 tree
2423 find_loop_niter_by_eval (struct loop *loop, edge *exit)
2424 {
2425   unsigned i;
2426   vec<edge> exits = get_loop_exit_edges (loop);
2427   edge ex;
2428   tree niter = NULL_TREE, aniter;
2429 
2430   *exit = NULL;
2431 
2432   /* Loops with multiple exits are expensive to handle and less important.  */
2433   if (!flag_expensive_optimizations
2434       && exits.length () > 1)
2435     {
2436       exits.release ();
2437       return chrec_dont_know;
2438     }
2439 
2440   FOR_EACH_VEC_ELT (exits, i, ex)
2441     {
2442       if (!just_once_each_iteration_p (loop, ex->src))
2443 	continue;
2444 
2445       aniter = loop_niter_by_eval (loop, ex);
2446       if (chrec_contains_undetermined (aniter))
2447 	continue;
2448 
2449       if (niter
2450 	  && !tree_int_cst_lt (aniter, niter))
2451 	continue;
2452 
2453       niter = aniter;
2454       *exit = ex;
2455     }
2456   exits.release ();
2457 
2458   return niter ? niter : chrec_dont_know;
2459 }
2460 
2461 /*
2462 
2463    Analysis of upper bounds on number of iterations of a loop.
2464 
2465 */
2466 
2467 static widest_int derive_constant_upper_bound_ops (tree, tree,
2468 						   enum tree_code, tree);
2469 
2470 /* Returns a constant upper bound on the value of the right-hand side of
2471    an assignment statement STMT.  */
2472 
2473 static widest_int
2474 derive_constant_upper_bound_assign (gimple stmt)
2475 {
2476   enum tree_code code = gimple_assign_rhs_code (stmt);
2477   tree op0 = gimple_assign_rhs1 (stmt);
2478   tree op1 = gimple_assign_rhs2 (stmt);
2479 
2480   return derive_constant_upper_bound_ops (TREE_TYPE (gimple_assign_lhs (stmt)),
2481 					  op0, code, op1);
2482 }
2483 
2484 /* Returns a constant upper bound on the value of expression VAL.  VAL
2485    is considered to be unsigned.  If its type is signed, its value must
2486    be nonnegative.  */
2487 
2488 static widest_int
2489 derive_constant_upper_bound (tree val)
2490 {
2491   enum tree_code code;
2492   tree op0, op1, op2;
2493 
2494   extract_ops_from_tree (val, &code, &op0, &op1, &op2);
2495   return derive_constant_upper_bound_ops (TREE_TYPE (val), op0, code, op1);
2496 }
2497 
2498 /* Returns a constant upper bound on the value of expression OP0 CODE OP1,
2499    whose type is TYPE.  The expression is considered to be unsigned.  If
2500    its type is signed, its value must be nonnegative.  */
2501 
2502 static widest_int
2503 derive_constant_upper_bound_ops (tree type, tree op0,
2504 				 enum tree_code code, tree op1)
2505 {
2506   tree subtype, maxt;
2507   widest_int bnd, max, cst;
2508   gimple stmt;
2509 
2510   if (INTEGRAL_TYPE_P (type))
2511     maxt = TYPE_MAX_VALUE (type);
2512   else
2513     maxt = upper_bound_in_type (type, type);
2514 
2515   max = wi::to_widest (maxt);
2516 
2517   switch (code)
2518     {
2519     case INTEGER_CST:
2520       return wi::to_widest (op0);
2521 
2522     CASE_CONVERT:
2523       subtype = TREE_TYPE (op0);
2524       if (!TYPE_UNSIGNED (subtype)
2525 	  /* If TYPE is also signed, the fact that VAL is nonnegative implies
2526 	     that OP0 is nonnegative.  */
2527 	  && TYPE_UNSIGNED (type)
2528 	  && !tree_expr_nonnegative_p (op0))
2529 	{
2530 	  /* If we cannot prove that the casted expression is nonnegative,
2531 	     we cannot establish more useful upper bound than the precision
2532 	     of the type gives us.  */
2533 	  return max;
2534 	}
2535 
2536       /* We now know that op0 is an nonnegative value.  Try deriving an upper
2537 	 bound for it.  */
2538       bnd = derive_constant_upper_bound (op0);
2539 
2540       /* If the bound does not fit in TYPE, max. value of TYPE could be
2541 	 attained.  */
2542       if (wi::ltu_p (max, bnd))
2543 	return max;
2544 
2545       return bnd;
2546 
2547     case PLUS_EXPR:
2548     case POINTER_PLUS_EXPR:
2549     case MINUS_EXPR:
2550       if (TREE_CODE (op1) != INTEGER_CST
2551 	  || !tree_expr_nonnegative_p (op0))
2552 	return max;
2553 
2554       /* Canonicalize to OP0 - CST.  Consider CST to be signed, in order to
2555 	 choose the most logical way how to treat this constant regardless
2556 	 of the signedness of the type.  */
2557       cst = wi::sext (wi::to_widest (op1), TYPE_PRECISION (type));
2558       if (code != MINUS_EXPR)
2559 	cst = -cst;
2560 
2561       bnd = derive_constant_upper_bound (op0);
2562 
2563       if (wi::neg_p (cst))
2564 	{
2565 	  cst = -cst;
2566 	  /* Avoid CST == 0x80000...  */
2567 	  if (wi::neg_p (cst))
2568 	    return max;;
2569 
2570 	  /* OP0 + CST.  We need to check that
2571 	     BND <= MAX (type) - CST.  */
2572 
2573 	  widest_int mmax = max - cst;
2574 	  if (wi::leu_p (bnd, mmax))
2575 	    return max;
2576 
2577 	  return bnd + cst;
2578 	}
2579       else
2580 	{
2581 	  /* OP0 - CST, where CST >= 0.
2582 
2583 	     If TYPE is signed, we have already verified that OP0 >= 0, and we
2584 	     know that the result is nonnegative.  This implies that
2585 	     VAL <= BND - CST.
2586 
2587 	     If TYPE is unsigned, we must additionally know that OP0 >= CST,
2588 	     otherwise the operation underflows.
2589 	   */
2590 
2591 	  /* This should only happen if the type is unsigned; however, for
2592 	     buggy programs that use overflowing signed arithmetics even with
2593 	     -fno-wrapv, this condition may also be true for signed values.  */
2594 	  if (wi::ltu_p (bnd, cst))
2595 	    return max;
2596 
2597 	  if (TYPE_UNSIGNED (type))
2598 	    {
2599 	      tree tem = fold_binary (GE_EXPR, boolean_type_node, op0,
2600 				      wide_int_to_tree (type, cst));
2601 	      if (!tem || integer_nonzerop (tem))
2602 		return max;
2603 	    }
2604 
2605 	  bnd -= cst;
2606 	}
2607 
2608       return bnd;
2609 
2610     case FLOOR_DIV_EXPR:
2611     case EXACT_DIV_EXPR:
2612       if (TREE_CODE (op1) != INTEGER_CST
2613 	  || tree_int_cst_sign_bit (op1))
2614 	return max;
2615 
2616       bnd = derive_constant_upper_bound (op0);
2617       return wi::udiv_floor (bnd, wi::to_widest (op1));
2618 
2619     case BIT_AND_EXPR:
2620       if (TREE_CODE (op1) != INTEGER_CST
2621 	  || tree_int_cst_sign_bit (op1))
2622 	return max;
2623       return wi::to_widest (op1);
2624 
2625     case SSA_NAME:
2626       stmt = SSA_NAME_DEF_STMT (op0);
2627       if (gimple_code (stmt) != GIMPLE_ASSIGN
2628 	  || gimple_assign_lhs (stmt) != op0)
2629 	return max;
2630       return derive_constant_upper_bound_assign (stmt);
2631 
2632     default:
2633       return max;
2634     }
2635 }
2636 
2637 /* Emit a -Waggressive-loop-optimizations warning if needed.  */
2638 
2639 static void
2640 do_warn_aggressive_loop_optimizations (struct loop *loop,
2641 				       widest_int i_bound, gimple stmt)
2642 {
2643   /* Don't warn if the loop doesn't have known constant bound.  */
2644   if (!loop->nb_iterations
2645       || TREE_CODE (loop->nb_iterations) != INTEGER_CST
2646       || !warn_aggressive_loop_optimizations
2647       /* To avoid warning multiple times for the same loop,
2648 	 only start warning when we preserve loops.  */
2649       || (cfun->curr_properties & PROP_loops) == 0
2650       /* Only warn once per loop.  */
2651       || loop->warned_aggressive_loop_optimizations
2652       /* Only warn if undefined behavior gives us lower estimate than the
2653 	 known constant bound.  */
2654       || wi::cmpu (i_bound, wi::to_widest (loop->nb_iterations)) >= 0
2655       /* And undefined behavior happens unconditionally.  */
2656       || !dominated_by_p (CDI_DOMINATORS, loop->latch, gimple_bb (stmt)))
2657     return;
2658 
2659   edge e = single_exit (loop);
2660   if (e == NULL)
2661     return;
2662 
2663   gimple estmt = last_stmt (e->src);
2664   if (warning_at (gimple_location (stmt), OPT_Waggressive_loop_optimizations,
2665 		  "iteration %E invokes undefined behavior",
2666 		  wide_int_to_tree (TREE_TYPE (loop->nb_iterations),
2667 				    i_bound)))
2668     inform (gimple_location (estmt), "containing loop");
2669   loop->warned_aggressive_loop_optimizations = true;
2670 }
2671 
2672 /* Records that AT_STMT is executed at most BOUND + 1 times in LOOP.  IS_EXIT
2673    is true if the loop is exited immediately after STMT, and this exit
2674    is taken at last when the STMT is executed BOUND + 1 times.
2675    REALISTIC is true if BOUND is expected to be close to the real number
2676    of iterations.  UPPER is true if we are sure the loop iterates at most
2677    BOUND times.  I_BOUND is a widest_int upper estimate on BOUND.  */
2678 
2679 static void
2680 record_estimate (struct loop *loop, tree bound, const widest_int &i_bound,
2681 		 gimple at_stmt, bool is_exit, bool realistic, bool upper)
2682 {
2683   widest_int delta;
2684 
2685   if (dump_file && (dump_flags & TDF_DETAILS))
2686     {
2687       fprintf (dump_file, "Statement %s", is_exit ? "(exit)" : "");
2688       print_gimple_stmt (dump_file, at_stmt, 0, TDF_SLIM);
2689       fprintf (dump_file, " is %sexecuted at most ",
2690 	       upper ? "" : "probably ");
2691       print_generic_expr (dump_file, bound, TDF_SLIM);
2692       fprintf (dump_file, " (bounded by ");
2693       print_decu (i_bound, dump_file);
2694       fprintf (dump_file, ") + 1 times in loop %d.\n", loop->num);
2695     }
2696 
2697   /* If the I_BOUND is just an estimate of BOUND, it rarely is close to the
2698      real number of iterations.  */
2699   if (TREE_CODE (bound) != INTEGER_CST)
2700     realistic = false;
2701   else
2702     gcc_checking_assert (i_bound == wi::to_widest (bound));
2703   if (!upper && !realistic)
2704     return;
2705 
2706   /* If we have a guaranteed upper bound, record it in the appropriate
2707      list, unless this is an !is_exit bound (i.e. undefined behavior in
2708      at_stmt) in a loop with known constant number of iterations.  */
2709   if (upper
2710       && (is_exit
2711 	  || loop->nb_iterations == NULL_TREE
2712 	  || TREE_CODE (loop->nb_iterations) != INTEGER_CST))
2713     {
2714       struct nb_iter_bound *elt = ggc_alloc<nb_iter_bound> ();
2715 
2716       elt->bound = i_bound;
2717       elt->stmt = at_stmt;
2718       elt->is_exit = is_exit;
2719       elt->next = loop->bounds;
2720       loop->bounds = elt;
2721     }
2722 
2723   /* If statement is executed on every path to the loop latch, we can directly
2724      infer the upper bound on the # of iterations of the loop.  */
2725   if (!dominated_by_p (CDI_DOMINATORS, loop->latch, gimple_bb (at_stmt)))
2726     return;
2727 
2728   /* Update the number of iteration estimates according to the bound.
2729      If at_stmt is an exit then the loop latch is executed at most BOUND times,
2730      otherwise it can be executed BOUND + 1 times.  We will lower the estimate
2731      later if such statement must be executed on last iteration  */
2732   if (is_exit)
2733     delta = 0;
2734   else
2735     delta = 1;
2736   widest_int new_i_bound = i_bound + delta;
2737 
2738   /* If an overflow occurred, ignore the result.  */
2739   if (wi::ltu_p (new_i_bound, delta))
2740     return;
2741 
2742   if (upper && !is_exit)
2743     do_warn_aggressive_loop_optimizations (loop, new_i_bound, at_stmt);
2744   record_niter_bound (loop, new_i_bound, realistic, upper);
2745 }
2746 
2747 /* Record the estimate on number of iterations of LOOP based on the fact that
2748    the induction variable BASE + STEP * i evaluated in STMT does not wrap and
2749    its values belong to the range <LOW, HIGH>.  REALISTIC is true if the
2750    estimated number of iterations is expected to be close to the real one.
2751    UPPER is true if we are sure the induction variable does not wrap.  */
2752 
2753 static void
2754 record_nonwrapping_iv (struct loop *loop, tree base, tree step, gimple stmt,
2755 		       tree low, tree high, bool realistic, bool upper)
2756 {
2757   tree niter_bound, extreme, delta;
2758   tree type = TREE_TYPE (base), unsigned_type;
2759   tree orig_base = base;
2760 
2761   if (TREE_CODE (step) != INTEGER_CST || integer_zerop (step))
2762     return;
2763 
2764   if (dump_file && (dump_flags & TDF_DETAILS))
2765     {
2766       fprintf (dump_file, "Induction variable (");
2767       print_generic_expr (dump_file, TREE_TYPE (base), TDF_SLIM);
2768       fprintf (dump_file, ") ");
2769       print_generic_expr (dump_file, base, TDF_SLIM);
2770       fprintf (dump_file, " + ");
2771       print_generic_expr (dump_file, step, TDF_SLIM);
2772       fprintf (dump_file, " * iteration does not wrap in statement ");
2773       print_gimple_stmt (dump_file, stmt, 0, TDF_SLIM);
2774       fprintf (dump_file, " in loop %d.\n", loop->num);
2775     }
2776 
2777   unsigned_type = unsigned_type_for (type);
2778   base = fold_convert (unsigned_type, base);
2779   step = fold_convert (unsigned_type, step);
2780 
2781   if (tree_int_cst_sign_bit (step))
2782     {
2783       wide_int min, max;
2784       extreme = fold_convert (unsigned_type, low);
2785       if (TREE_CODE (orig_base) == SSA_NAME
2786 	  && TREE_CODE (high) == INTEGER_CST
2787 	  && INTEGRAL_TYPE_P (TREE_TYPE (orig_base))
2788 	  && get_range_info (orig_base, &min, &max) == VR_RANGE
2789 	  && wi::gts_p (high, max))
2790 	base = wide_int_to_tree (unsigned_type, max);
2791       else if (TREE_CODE (base) != INTEGER_CST
2792 	       && dominated_by_p (CDI_DOMINATORS,
2793 				  loop->latch, gimple_bb (stmt)))
2794 	base = fold_convert (unsigned_type, high);
2795       delta = fold_build2 (MINUS_EXPR, unsigned_type, base, extreme);
2796       step = fold_build1 (NEGATE_EXPR, unsigned_type, step);
2797     }
2798   else
2799     {
2800       wide_int min, max;
2801       extreme = fold_convert (unsigned_type, high);
2802       if (TREE_CODE (orig_base) == SSA_NAME
2803 	  && TREE_CODE (low) == INTEGER_CST
2804 	  && INTEGRAL_TYPE_P (TREE_TYPE (orig_base))
2805 	  && get_range_info (orig_base, &min, &max) == VR_RANGE
2806 	  && wi::gts_p (min, low))
2807 	base = wide_int_to_tree (unsigned_type, min);
2808       else if (TREE_CODE (base) != INTEGER_CST
2809 	       && dominated_by_p (CDI_DOMINATORS,
2810 				  loop->latch, gimple_bb (stmt)))
2811 	base = fold_convert (unsigned_type, low);
2812       delta = fold_build2 (MINUS_EXPR, unsigned_type, extreme, base);
2813     }
2814 
2815   /* STMT is executed at most NITER_BOUND + 1 times, since otherwise the value
2816      would get out of the range.  */
2817   niter_bound = fold_build2 (FLOOR_DIV_EXPR, unsigned_type, delta, step);
2818   widest_int max = derive_constant_upper_bound (niter_bound);
2819   record_estimate (loop, niter_bound, max, stmt, false, realistic, upper);
2820 }
2821 
2822 /* Determine information about number of iterations a LOOP from the index
2823    IDX of a data reference accessed in STMT.  RELIABLE is true if STMT is
2824    guaranteed to be executed in every iteration of LOOP.  Callback for
2825    for_each_index.  */
2826 
2827 struct ilb_data
2828 {
2829   struct loop *loop;
2830   gimple stmt;
2831 };
2832 
2833 static bool
2834 idx_infer_loop_bounds (tree base, tree *idx, void *dta)
2835 {
2836   struct ilb_data *data = (struct ilb_data *) dta;
2837   tree ev, init, step;
2838   tree low, high, type, next;
2839   bool sign, upper = true, at_end = false;
2840   struct loop *loop = data->loop;
2841   bool reliable = true;
2842 
2843   if (TREE_CODE (base) != ARRAY_REF)
2844     return true;
2845 
2846   /* For arrays at the end of the structure, we are not guaranteed that they
2847      do not really extend over their declared size.  However, for arrays of
2848      size greater than one, this is unlikely to be intended.  */
2849   if (array_at_struct_end_p (base))
2850     {
2851       at_end = true;
2852       upper = false;
2853     }
2854 
2855   struct loop *dloop = loop_containing_stmt (data->stmt);
2856   if (!dloop)
2857     return true;
2858 
2859   ev = analyze_scalar_evolution (dloop, *idx);
2860   ev = instantiate_parameters (loop, ev);
2861   init = initial_condition (ev);
2862   step = evolution_part_in_loop_num (ev, loop->num);
2863 
2864   if (!init
2865       || !step
2866       || TREE_CODE (step) != INTEGER_CST
2867       || integer_zerop (step)
2868       || tree_contains_chrecs (init, NULL)
2869       || chrec_contains_symbols_defined_in_loop (init, loop->num))
2870     return true;
2871 
2872   low = array_ref_low_bound (base);
2873   high = array_ref_up_bound (base);
2874 
2875   /* The case of nonconstant bounds could be handled, but it would be
2876      complicated.  */
2877   if (TREE_CODE (low) != INTEGER_CST
2878       || !high
2879       || TREE_CODE (high) != INTEGER_CST)
2880     return true;
2881   sign = tree_int_cst_sign_bit (step);
2882   type = TREE_TYPE (step);
2883 
2884   /* The array of length 1 at the end of a structure most likely extends
2885      beyond its bounds.  */
2886   if (at_end
2887       && operand_equal_p (low, high, 0))
2888     return true;
2889 
2890   /* In case the relevant bound of the array does not fit in type, or
2891      it does, but bound + step (in type) still belongs into the range of the
2892      array, the index may wrap and still stay within the range of the array
2893      (consider e.g. if the array is indexed by the full range of
2894      unsigned char).
2895 
2896      To make things simpler, we require both bounds to fit into type, although
2897      there are cases where this would not be strictly necessary.  */
2898   if (!int_fits_type_p (high, type)
2899       || !int_fits_type_p (low, type))
2900     return true;
2901   low = fold_convert (type, low);
2902   high = fold_convert (type, high);
2903 
2904   if (sign)
2905     next = fold_binary (PLUS_EXPR, type, low, step);
2906   else
2907     next = fold_binary (PLUS_EXPR, type, high, step);
2908 
2909   if (tree_int_cst_compare (low, next) <= 0
2910       && tree_int_cst_compare (next, high) <= 0)
2911     return true;
2912 
2913   /* If access is not executed on every iteration, we must ensure that overlow may
2914      not make the access valid later.  */
2915   if (!dominated_by_p (CDI_DOMINATORS, loop->latch, gimple_bb (data->stmt))
2916       && scev_probably_wraps_p (initial_condition_in_loop_num (ev, loop->num),
2917 				step, data->stmt, loop, true))
2918     reliable = false;
2919 
2920   record_nonwrapping_iv (loop, init, step, data->stmt, low, high, reliable, upper);
2921   return true;
2922 }
2923 
2924 /* Determine information about number of iterations a LOOP from the bounds
2925    of arrays in the data reference REF accessed in STMT.  RELIABLE is true if
2926    STMT is guaranteed to be executed in every iteration of LOOP.*/
2927 
2928 static void
2929 infer_loop_bounds_from_ref (struct loop *loop, gimple stmt, tree ref)
2930 {
2931   struct ilb_data data;
2932 
2933   data.loop = loop;
2934   data.stmt = stmt;
2935   for_each_index (&ref, idx_infer_loop_bounds, &data);
2936 }
2937 
2938 /* Determine information about number of iterations of a LOOP from the way
2939    arrays are used in STMT.  RELIABLE is true if STMT is guaranteed to be
2940    executed in every iteration of LOOP.  */
2941 
2942 static void
2943 infer_loop_bounds_from_array (struct loop *loop, gimple stmt)
2944 {
2945   if (is_gimple_assign (stmt))
2946     {
2947       tree op0 = gimple_assign_lhs (stmt);
2948       tree op1 = gimple_assign_rhs1 (stmt);
2949 
2950       /* For each memory access, analyze its access function
2951 	 and record a bound on the loop iteration domain.  */
2952       if (REFERENCE_CLASS_P (op0))
2953 	infer_loop_bounds_from_ref (loop, stmt, op0);
2954 
2955       if (REFERENCE_CLASS_P (op1))
2956 	infer_loop_bounds_from_ref (loop, stmt, op1);
2957     }
2958   else if (is_gimple_call (stmt))
2959     {
2960       tree arg, lhs;
2961       unsigned i, n = gimple_call_num_args (stmt);
2962 
2963       lhs = gimple_call_lhs (stmt);
2964       if (lhs && REFERENCE_CLASS_P (lhs))
2965 	infer_loop_bounds_from_ref (loop, stmt, lhs);
2966 
2967       for (i = 0; i < n; i++)
2968 	{
2969 	  arg = gimple_call_arg (stmt, i);
2970 	  if (REFERENCE_CLASS_P (arg))
2971 	    infer_loop_bounds_from_ref (loop, stmt, arg);
2972 	}
2973     }
2974 }
2975 
2976 /* Determine information about number of iterations of a LOOP from the fact
2977    that pointer arithmetics in STMT does not overflow.  */
2978 
2979 static void
2980 infer_loop_bounds_from_pointer_arith (struct loop *loop, gimple stmt)
2981 {
2982   tree def, base, step, scev, type, low, high;
2983   tree var, ptr;
2984 
2985   if (!is_gimple_assign (stmt)
2986       || gimple_assign_rhs_code (stmt) != POINTER_PLUS_EXPR)
2987     return;
2988 
2989   def = gimple_assign_lhs (stmt);
2990   if (TREE_CODE (def) != SSA_NAME)
2991     return;
2992 
2993   type = TREE_TYPE (def);
2994   if (!nowrap_type_p (type))
2995     return;
2996 
2997   ptr = gimple_assign_rhs1 (stmt);
2998   if (!expr_invariant_in_loop_p (loop, ptr))
2999     return;
3000 
3001   var = gimple_assign_rhs2 (stmt);
3002   if (TYPE_PRECISION (type) != TYPE_PRECISION (TREE_TYPE (var)))
3003     return;
3004 
3005   scev = instantiate_parameters (loop, analyze_scalar_evolution (loop, def));
3006   if (chrec_contains_undetermined (scev))
3007     return;
3008 
3009   base = initial_condition_in_loop_num (scev, loop->num);
3010   step = evolution_part_in_loop_num (scev, loop->num);
3011 
3012   if (!base || !step
3013       || TREE_CODE (step) != INTEGER_CST
3014       || tree_contains_chrecs (base, NULL)
3015       || chrec_contains_symbols_defined_in_loop (base, loop->num))
3016     return;
3017 
3018   low = lower_bound_in_type (type, type);
3019   high = upper_bound_in_type (type, type);
3020 
3021   /* In C, pointer arithmetic p + 1 cannot use a NULL pointer, and p - 1 cannot
3022      produce a NULL pointer.  The contrary would mean NULL points to an object,
3023      while NULL is supposed to compare unequal with the address of all objects.
3024      Furthermore, p + 1 cannot produce a NULL pointer and p - 1 cannot use a
3025      NULL pointer since that would mean wrapping, which we assume here not to
3026      happen.  So, we can exclude NULL from the valid range of pointer
3027      arithmetic.  */
3028   if (flag_delete_null_pointer_checks && int_cst_value (low) == 0)
3029     low = build_int_cstu (TREE_TYPE (low), TYPE_ALIGN_UNIT (TREE_TYPE (type)));
3030 
3031   record_nonwrapping_iv (loop, base, step, stmt, low, high, false, true);
3032 }
3033 
3034 /* Determine information about number of iterations of a LOOP from the fact
3035    that signed arithmetics in STMT does not overflow.  */
3036 
3037 static void
3038 infer_loop_bounds_from_signedness (struct loop *loop, gimple stmt)
3039 {
3040   tree def, base, step, scev, type, low, high;
3041 
3042   if (gimple_code (stmt) != GIMPLE_ASSIGN)
3043     return;
3044 
3045   def = gimple_assign_lhs (stmt);
3046 
3047   if (TREE_CODE (def) != SSA_NAME)
3048     return;
3049 
3050   type = TREE_TYPE (def);
3051   if (!INTEGRAL_TYPE_P (type)
3052       || !TYPE_OVERFLOW_UNDEFINED (type))
3053     return;
3054 
3055   scev = instantiate_parameters (loop, analyze_scalar_evolution (loop, def));
3056   if (chrec_contains_undetermined (scev))
3057     return;
3058 
3059   base = initial_condition_in_loop_num (scev, loop->num);
3060   step = evolution_part_in_loop_num (scev, loop->num);
3061 
3062   if (!base || !step
3063       || TREE_CODE (step) != INTEGER_CST
3064       || tree_contains_chrecs (base, NULL)
3065       || chrec_contains_symbols_defined_in_loop (base, loop->num))
3066     return;
3067 
3068   low = lower_bound_in_type (type, type);
3069   high = upper_bound_in_type (type, type);
3070 
3071   record_nonwrapping_iv (loop, base, step, stmt, low, high, false, true);
3072 }
3073 
3074 /* The following analyzers are extracting informations on the bounds
3075    of LOOP from the following undefined behaviors:
3076 
3077    - data references should not access elements over the statically
3078      allocated size,
3079 
3080    - signed variables should not overflow when flag_wrapv is not set.
3081 */
3082 
3083 static void
3084 infer_loop_bounds_from_undefined (struct loop *loop)
3085 {
3086   unsigned i;
3087   basic_block *bbs;
3088   gimple_stmt_iterator bsi;
3089   basic_block bb;
3090   bool reliable;
3091 
3092   bbs = get_loop_body (loop);
3093 
3094   for (i = 0; i < loop->num_nodes; i++)
3095     {
3096       bb = bbs[i];
3097 
3098       /* If BB is not executed in each iteration of the loop, we cannot
3099 	 use the operations in it to infer reliable upper bound on the
3100 	 # of iterations of the loop.  However, we can use it as a guess.
3101 	 Reliable guesses come only from array bounds.  */
3102       reliable = dominated_by_p (CDI_DOMINATORS, loop->latch, bb);
3103 
3104       for (bsi = gsi_start_bb (bb); !gsi_end_p (bsi); gsi_next (&bsi))
3105 	{
3106 	  gimple stmt = gsi_stmt (bsi);
3107 
3108 	  infer_loop_bounds_from_array (loop, stmt);
3109 
3110 	  if (reliable)
3111             {
3112               infer_loop_bounds_from_signedness (loop, stmt);
3113               infer_loop_bounds_from_pointer_arith (loop, stmt);
3114             }
3115   	}
3116 
3117     }
3118 
3119   free (bbs);
3120 }
3121 
3122 /* Compare wide ints, callback for qsort.  */
3123 
3124 static int
3125 wide_int_cmp (const void *p1, const void *p2)
3126 {
3127   const widest_int *d1 = (const widest_int *) p1;
3128   const widest_int *d2 = (const widest_int *) p2;
3129   return wi::cmpu (*d1, *d2);
3130 }
3131 
3132 /* Return index of BOUND in BOUNDS array sorted in increasing order.
3133    Lookup by binary search.  */
3134 
3135 static int
3136 bound_index (vec<widest_int> bounds, const widest_int &bound)
3137 {
3138   unsigned int end = bounds.length ();
3139   unsigned int begin = 0;
3140 
3141   /* Find a matching index by means of a binary search.  */
3142   while (begin != end)
3143     {
3144       unsigned int middle = (begin + end) / 2;
3145       widest_int index = bounds[middle];
3146 
3147       if (index == bound)
3148 	return middle;
3149       else if (wi::ltu_p (index, bound))
3150 	begin = middle + 1;
3151       else
3152 	end = middle;
3153     }
3154   gcc_unreachable ();
3155 }
3156 
3157 /* We recorded loop bounds only for statements dominating loop latch (and thus
3158    executed each loop iteration).  If there are any bounds on statements not
3159    dominating the loop latch we can improve the estimate by walking the loop
3160    body and seeing if every path from loop header to loop latch contains
3161    some bounded statement.  */
3162 
3163 static void
3164 discover_iteration_bound_by_body_walk (struct loop *loop)
3165 {
3166   struct nb_iter_bound *elt;
3167   vec<widest_int> bounds = vNULL;
3168   vec<vec<basic_block> > queues = vNULL;
3169   vec<basic_block> queue = vNULL;
3170   ptrdiff_t queue_index;
3171   ptrdiff_t latch_index = 0;
3172 
3173   /* Discover what bounds may interest us.  */
3174   for (elt = loop->bounds; elt; elt = elt->next)
3175     {
3176       widest_int bound = elt->bound;
3177 
3178       /* Exit terminates loop at given iteration, while non-exits produce undefined
3179 	 effect on the next iteration.  */
3180       if (!elt->is_exit)
3181 	{
3182 	  bound += 1;
3183 	  /* If an overflow occurred, ignore the result.  */
3184 	  if (bound == 0)
3185 	    continue;
3186 	}
3187 
3188       if (!loop->any_upper_bound
3189 	  || wi::ltu_p (bound, loop->nb_iterations_upper_bound))
3190         bounds.safe_push (bound);
3191     }
3192 
3193   /* Exit early if there is nothing to do.  */
3194   if (!bounds.exists ())
3195     return;
3196 
3197   if (dump_file && (dump_flags & TDF_DETAILS))
3198     fprintf (dump_file, " Trying to walk loop body to reduce the bound.\n");
3199 
3200   /* Sort the bounds in decreasing order.  */
3201   bounds.qsort (wide_int_cmp);
3202 
3203   /* For every basic block record the lowest bound that is guaranteed to
3204      terminate the loop.  */
3205 
3206   hash_map<basic_block, ptrdiff_t> bb_bounds;
3207   for (elt = loop->bounds; elt; elt = elt->next)
3208     {
3209       widest_int bound = elt->bound;
3210       if (!elt->is_exit)
3211 	{
3212 	  bound += 1;
3213 	  /* If an overflow occurred, ignore the result.  */
3214 	  if (bound == 0)
3215 	    continue;
3216 	}
3217 
3218       if (!loop->any_upper_bound
3219 	  || wi::ltu_p (bound, loop->nb_iterations_upper_bound))
3220 	{
3221 	  ptrdiff_t index = bound_index (bounds, bound);
3222 	  ptrdiff_t *entry = bb_bounds.get (gimple_bb (elt->stmt));
3223 	  if (!entry)
3224 	    bb_bounds.put (gimple_bb (elt->stmt), index);
3225 	  else if ((ptrdiff_t)*entry > index)
3226 	    *entry = index;
3227 	}
3228     }
3229 
3230   hash_map<basic_block, ptrdiff_t> block_priority;
3231 
3232   /* Perform shortest path discovery loop->header ... loop->latch.
3233 
3234      The "distance" is given by the smallest loop bound of basic block
3235      present in the path and we look for path with largest smallest bound
3236      on it.
3237 
3238      To avoid the need for fibonacci heap on double ints we simply compress
3239      double ints into indexes to BOUNDS array and then represent the queue
3240      as arrays of queues for every index.
3241      Index of BOUNDS.length() means that the execution of given BB has
3242      no bounds determined.
3243 
3244      VISITED is a pointer map translating basic block into smallest index
3245      it was inserted into the priority queue with.  */
3246   latch_index = -1;
3247 
3248   /* Start walk in loop header with index set to infinite bound.  */
3249   queue_index = bounds.length ();
3250   queues.safe_grow_cleared (queue_index + 1);
3251   queue.safe_push (loop->header);
3252   queues[queue_index] = queue;
3253   block_priority.put (loop->header, queue_index);
3254 
3255   for (; queue_index >= 0; queue_index--)
3256     {
3257       if (latch_index < queue_index)
3258 	{
3259 	  while (queues[queue_index].length ())
3260 	    {
3261 	      basic_block bb;
3262 	      ptrdiff_t bound_index = queue_index;
3263               edge e;
3264               edge_iterator ei;
3265 
3266 	      queue = queues[queue_index];
3267 	      bb = queue.pop ();
3268 
3269 	      /* OK, we later inserted the BB with lower priority, skip it.  */
3270 	      if (*block_priority.get (bb) > queue_index)
3271 		continue;
3272 
3273 	      /* See if we can improve the bound.  */
3274 	      ptrdiff_t *entry = bb_bounds.get (bb);
3275 	      if (entry && *entry < bound_index)
3276 		bound_index = *entry;
3277 
3278 	      /* Insert succesors into the queue, watch for latch edge
3279 		 and record greatest index we saw.  */
3280 	      FOR_EACH_EDGE (e, ei, bb->succs)
3281 		{
3282 		  bool insert = false;
3283 
3284 		  if (loop_exit_edge_p (loop, e))
3285 		    continue;
3286 
3287 		  if (e == loop_latch_edge (loop)
3288 		      && latch_index < bound_index)
3289 		    latch_index = bound_index;
3290 		  else if (!(entry = block_priority.get (e->dest)))
3291 		    {
3292 		      insert = true;
3293 		      block_priority.put (e->dest, bound_index);
3294 		    }
3295 		  else if (*entry < bound_index)
3296 		    {
3297 		      insert = true;
3298 		      *entry = bound_index;
3299 		    }
3300 
3301 		  if (insert)
3302 		    queues[bound_index].safe_push (e->dest);
3303 		}
3304 	    }
3305 	}
3306       queues[queue_index].release ();
3307     }
3308 
3309   gcc_assert (latch_index >= 0);
3310   if ((unsigned)latch_index < bounds.length ())
3311     {
3312       if (dump_file && (dump_flags & TDF_DETAILS))
3313 	{
3314 	  fprintf (dump_file, "Found better loop bound ");
3315 	  print_decu (bounds[latch_index], dump_file);
3316 	  fprintf (dump_file, "\n");
3317 	}
3318       record_niter_bound (loop, bounds[latch_index], false, true);
3319     }
3320 
3321   queues.release ();
3322   bounds.release ();
3323 }
3324 
3325 /* See if every path cross the loop goes through a statement that is known
3326    to not execute at the last iteration. In that case we can decrese iteration
3327    count by 1.  */
3328 
3329 static void
3330 maybe_lower_iteration_bound (struct loop *loop)
3331 {
3332   hash_set<gimple> *not_executed_last_iteration = NULL;
3333   struct nb_iter_bound *elt;
3334   bool found_exit = false;
3335   vec<basic_block> queue = vNULL;
3336   bitmap visited;
3337 
3338   /* Collect all statements with interesting (i.e. lower than
3339      nb_iterations_upper_bound) bound on them.
3340 
3341      TODO: Due to the way record_estimate choose estimates to store, the bounds
3342      will be always nb_iterations_upper_bound-1.  We can change this to record
3343      also statements not dominating the loop latch and update the walk bellow
3344      to the shortest path algorthm.  */
3345   for (elt = loop->bounds; elt; elt = elt->next)
3346     {
3347       if (!elt->is_exit
3348 	  && wi::ltu_p (elt->bound, loop->nb_iterations_upper_bound))
3349 	{
3350 	  if (!not_executed_last_iteration)
3351 	    not_executed_last_iteration = new hash_set<gimple>;
3352 	  not_executed_last_iteration->add (elt->stmt);
3353 	}
3354     }
3355   if (!not_executed_last_iteration)
3356     return;
3357 
3358   /* Start DFS walk in the loop header and see if we can reach the
3359      loop latch or any of the exits (including statements with side
3360      effects that may terminate the loop otherwise) without visiting
3361      any of the statements known to have undefined effect on the last
3362      iteration.  */
3363   queue.safe_push (loop->header);
3364   visited = BITMAP_ALLOC (NULL);
3365   bitmap_set_bit (visited, loop->header->index);
3366   found_exit = false;
3367 
3368   do
3369     {
3370       basic_block bb = queue.pop ();
3371       gimple_stmt_iterator gsi;
3372       bool stmt_found = false;
3373 
3374       /* Loop for possible exits and statements bounding the execution.  */
3375       for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
3376 	{
3377 	  gimple stmt = gsi_stmt (gsi);
3378 	  if (not_executed_last_iteration->contains (stmt))
3379 	    {
3380 	      stmt_found = true;
3381 	      break;
3382 	    }
3383 	  if (gimple_has_side_effects (stmt))
3384 	    {
3385 	      found_exit = true;
3386 	      break;
3387 	    }
3388 	}
3389       if (found_exit)
3390 	break;
3391 
3392       /* If no bounding statement is found, continue the walk.  */
3393       if (!stmt_found)
3394 	{
3395           edge e;
3396           edge_iterator ei;
3397 
3398           FOR_EACH_EDGE (e, ei, bb->succs)
3399 	    {
3400 	      if (loop_exit_edge_p (loop, e)
3401 		  || e == loop_latch_edge (loop))
3402 		{
3403 		  found_exit = true;
3404 		  break;
3405 		}
3406 	      if (bitmap_set_bit (visited, e->dest->index))
3407 		queue.safe_push (e->dest);
3408 	    }
3409 	}
3410     }
3411   while (queue.length () && !found_exit);
3412 
3413   /* If every path through the loop reach bounding statement before exit,
3414      then we know the last iteration of the loop will have undefined effect
3415      and we can decrease number of iterations.  */
3416 
3417   if (!found_exit)
3418     {
3419       if (dump_file && (dump_flags & TDF_DETAILS))
3420 	fprintf (dump_file, "Reducing loop iteration estimate by 1; "
3421 		 "undefined statement must be executed at the last iteration.\n");
3422       record_niter_bound (loop, loop->nb_iterations_upper_bound - 1,
3423 			  false, true);
3424     }
3425 
3426   BITMAP_FREE (visited);
3427   queue.release ();
3428   delete not_executed_last_iteration;
3429 }
3430 
3431 /* Records estimates on numbers of iterations of LOOP.  If USE_UNDEFINED_P
3432    is true also use estimates derived from undefined behavior.  */
3433 
3434 static void
3435 estimate_numbers_of_iterations_loop (struct loop *loop)
3436 {
3437   vec<edge> exits;
3438   tree niter, type;
3439   unsigned i;
3440   struct tree_niter_desc niter_desc;
3441   edge ex;
3442   widest_int bound;
3443   edge likely_exit;
3444 
3445   /* Give up if we already have tried to compute an estimation.  */
3446   if (loop->estimate_state != EST_NOT_COMPUTED)
3447     return;
3448 
3449   loop->estimate_state = EST_AVAILABLE;
3450   /* Force estimate compuation but leave any existing upper bound in place.  */
3451   loop->any_estimate = false;
3452 
3453   /* Ensure that loop->nb_iterations is computed if possible.  If it turns out
3454      to be constant, we avoid undefined behavior implied bounds and instead
3455      diagnose those loops with -Waggressive-loop-optimizations.  */
3456   number_of_latch_executions (loop);
3457 
3458   exits = get_loop_exit_edges (loop);
3459   likely_exit = single_likely_exit (loop);
3460   FOR_EACH_VEC_ELT (exits, i, ex)
3461     {
3462       if (!number_of_iterations_exit (loop, ex, &niter_desc, false, false))
3463 	continue;
3464 
3465       niter = niter_desc.niter;
3466       type = TREE_TYPE (niter);
3467       if (TREE_CODE (niter_desc.may_be_zero) != INTEGER_CST)
3468 	niter = build3 (COND_EXPR, type, niter_desc.may_be_zero,
3469 			build_int_cst (type, 0),
3470 			niter);
3471       record_estimate (loop, niter, niter_desc.max,
3472 		       last_stmt (ex->src),
3473 		       true, ex == likely_exit, true);
3474     }
3475   exits.release ();
3476 
3477   if (flag_aggressive_loop_optimizations)
3478     infer_loop_bounds_from_undefined (loop);
3479 
3480   discover_iteration_bound_by_body_walk (loop);
3481 
3482   maybe_lower_iteration_bound (loop);
3483 
3484   /* If we have a measured profile, use it to estimate the number of
3485      iterations.  */
3486   if (loop->header->count != 0)
3487     {
3488       gcov_type nit = expected_loop_iterations_unbounded (loop) + 1;
3489       bound = gcov_type_to_wide_int (nit);
3490       record_niter_bound (loop, bound, true, false);
3491     }
3492 
3493   /* If we know the exact number of iterations of this loop, try to
3494      not break code with undefined behavior by not recording smaller
3495      maximum number of iterations.  */
3496   if (loop->nb_iterations
3497       && TREE_CODE (loop->nb_iterations) == INTEGER_CST)
3498     {
3499       loop->any_upper_bound = true;
3500       loop->nb_iterations_upper_bound = wi::to_widest (loop->nb_iterations);
3501     }
3502 }
3503 
3504 /* Sets NIT to the estimated number of executions of the latch of the
3505    LOOP.  If CONSERVATIVE is true, we must be sure that NIT is at least as
3506    large as the number of iterations.  If we have no reliable estimate,
3507    the function returns false, otherwise returns true.  */
3508 
3509 bool
3510 estimated_loop_iterations (struct loop *loop, widest_int *nit)
3511 {
3512   /* When SCEV information is available, try to update loop iterations
3513      estimate.  Otherwise just return whatever we recorded earlier.  */
3514   if (scev_initialized_p ())
3515     estimate_numbers_of_iterations_loop (loop);
3516 
3517   return (get_estimated_loop_iterations (loop, nit));
3518 }
3519 
3520 /* Similar to estimated_loop_iterations, but returns the estimate only
3521    if it fits to HOST_WIDE_INT.  If this is not the case, or the estimate
3522    on the number of iterations of LOOP could not be derived, returns -1.  */
3523 
3524 HOST_WIDE_INT
3525 estimated_loop_iterations_int (struct loop *loop)
3526 {
3527   widest_int nit;
3528   HOST_WIDE_INT hwi_nit;
3529 
3530   if (!estimated_loop_iterations (loop, &nit))
3531     return -1;
3532 
3533   if (!wi::fits_shwi_p (nit))
3534     return -1;
3535   hwi_nit = nit.to_shwi ();
3536 
3537   return hwi_nit < 0 ? -1 : hwi_nit;
3538 }
3539 
3540 
3541 /* Sets NIT to an upper bound for the maximum number of executions of the
3542    latch of the LOOP.  If we have no reliable estimate, the function returns
3543    false, otherwise returns true.  */
3544 
3545 bool
3546 max_loop_iterations (struct loop *loop, widest_int *nit)
3547 {
3548   /* When SCEV information is available, try to update loop iterations
3549      estimate.  Otherwise just return whatever we recorded earlier.  */
3550   if (scev_initialized_p ())
3551     estimate_numbers_of_iterations_loop (loop);
3552 
3553   return get_max_loop_iterations (loop, nit);
3554 }
3555 
3556 /* Similar to max_loop_iterations, but returns the estimate only
3557    if it fits to HOST_WIDE_INT.  If this is not the case, or the estimate
3558    on the number of iterations of LOOP could not be derived, returns -1.  */
3559 
3560 HOST_WIDE_INT
3561 max_loop_iterations_int (struct loop *loop)
3562 {
3563   widest_int nit;
3564   HOST_WIDE_INT hwi_nit;
3565 
3566   if (!max_loop_iterations (loop, &nit))
3567     return -1;
3568 
3569   if (!wi::fits_shwi_p (nit))
3570     return -1;
3571   hwi_nit = nit.to_shwi ();
3572 
3573   return hwi_nit < 0 ? -1 : hwi_nit;
3574 }
3575 
3576 /* Returns an estimate for the number of executions of statements
3577    in the LOOP.  For statements before the loop exit, this exceeds
3578    the number of execution of the latch by one.  */
3579 
3580 HOST_WIDE_INT
3581 estimated_stmt_executions_int (struct loop *loop)
3582 {
3583   HOST_WIDE_INT nit = estimated_loop_iterations_int (loop);
3584   HOST_WIDE_INT snit;
3585 
3586   if (nit == -1)
3587     return -1;
3588 
3589   snit = (HOST_WIDE_INT) ((unsigned HOST_WIDE_INT) nit + 1);
3590 
3591   /* If the computation overflows, return -1.  */
3592   return snit < 0 ? -1 : snit;
3593 }
3594 
3595 /* Sets NIT to the estimated maximum number of executions of the latch of the
3596    LOOP, plus one.  If we have no reliable estimate, the function returns
3597    false, otherwise returns true.  */
3598 
3599 bool
3600 max_stmt_executions (struct loop *loop, widest_int *nit)
3601 {
3602   widest_int nit_minus_one;
3603 
3604   if (!max_loop_iterations (loop, nit))
3605     return false;
3606 
3607   nit_minus_one = *nit;
3608 
3609   *nit += 1;
3610 
3611   return wi::gtu_p (*nit, nit_minus_one);
3612 }
3613 
3614 /* Sets NIT to the estimated number of executions of the latch of the
3615    LOOP, plus one.  If we have no reliable estimate, the function returns
3616    false, otherwise returns true.  */
3617 
3618 bool
3619 estimated_stmt_executions (struct loop *loop, widest_int *nit)
3620 {
3621   widest_int nit_minus_one;
3622 
3623   if (!estimated_loop_iterations (loop, nit))
3624     return false;
3625 
3626   nit_minus_one = *nit;
3627 
3628   *nit += 1;
3629 
3630   return wi::gtu_p (*nit, nit_minus_one);
3631 }
3632 
3633 /* Records estimates on numbers of iterations of loops.  */
3634 
3635 void
3636 estimate_numbers_of_iterations (void)
3637 {
3638   struct loop *loop;
3639 
3640   /* We don't want to issue signed overflow warnings while getting
3641      loop iteration estimates.  */
3642   fold_defer_overflow_warnings ();
3643 
3644   FOR_EACH_LOOP (loop, 0)
3645     {
3646       estimate_numbers_of_iterations_loop (loop);
3647     }
3648 
3649   fold_undefer_and_ignore_overflow_warnings ();
3650 }
3651 
3652 /* Returns true if statement S1 dominates statement S2.  */
3653 
3654 bool
3655 stmt_dominates_stmt_p (gimple s1, gimple s2)
3656 {
3657   basic_block bb1 = gimple_bb (s1), bb2 = gimple_bb (s2);
3658 
3659   if (!bb1
3660       || s1 == s2)
3661     return true;
3662 
3663   if (bb1 == bb2)
3664     {
3665       gimple_stmt_iterator bsi;
3666 
3667       if (gimple_code (s2) == GIMPLE_PHI)
3668 	return false;
3669 
3670       if (gimple_code (s1) == GIMPLE_PHI)
3671 	return true;
3672 
3673       for (bsi = gsi_start_bb (bb1); gsi_stmt (bsi) != s2; gsi_next (&bsi))
3674 	if (gsi_stmt (bsi) == s1)
3675 	  return true;
3676 
3677       return false;
3678     }
3679 
3680   return dominated_by_p (CDI_DOMINATORS, bb2, bb1);
3681 }
3682 
3683 /* Returns true when we can prove that the number of executions of
3684    STMT in the loop is at most NITER, according to the bound on
3685    the number of executions of the statement NITER_BOUND->stmt recorded in
3686    NITER_BOUND and fact that NITER_BOUND->stmt dominate STMT.
3687 
3688    ??? This code can become quite a CPU hog - we can have many bounds,
3689    and large basic block forcing stmt_dominates_stmt_p to be queried
3690    many times on a large basic blocks, so the whole thing is O(n^2)
3691    for scev_probably_wraps_p invocation (that can be done n times).
3692 
3693    It would make more sense (and give better answers) to remember BB
3694    bounds computed by discover_iteration_bound_by_body_walk.  */
3695 
3696 static bool
3697 n_of_executions_at_most (gimple stmt,
3698 			 struct nb_iter_bound *niter_bound,
3699 			 tree niter)
3700 {
3701   widest_int bound = niter_bound->bound;
3702   tree nit_type = TREE_TYPE (niter), e;
3703   enum tree_code cmp;
3704 
3705   gcc_assert (TYPE_UNSIGNED (nit_type));
3706 
3707   /* If the bound does not even fit into NIT_TYPE, it cannot tell us that
3708      the number of iterations is small.  */
3709   if (!wi::fits_to_tree_p (bound, nit_type))
3710     return false;
3711 
3712   /* We know that NITER_BOUND->stmt is executed at most NITER_BOUND->bound + 1
3713      times.  This means that:
3714 
3715      -- if NITER_BOUND->is_exit is true, then everything after
3716 	it at most NITER_BOUND->bound times.
3717 
3718      -- If NITER_BOUND->is_exit is false, then if we can prove that when STMT
3719 	is executed, then NITER_BOUND->stmt is executed as well in the same
3720 	iteration then STMT is executed at most NITER_BOUND->bound + 1 times.
3721 
3722 	If we can determine that NITER_BOUND->stmt is always executed
3723 	after STMT, then STMT is executed at most NITER_BOUND->bound + 2 times.
3724 	We conclude that if both statements belong to the same
3725 	basic block and STMT is before NITER_BOUND->stmt and there are no
3726 	statements with side effects in between.  */
3727 
3728   if (niter_bound->is_exit)
3729     {
3730       if (stmt == niter_bound->stmt
3731 	  || !stmt_dominates_stmt_p (niter_bound->stmt, stmt))
3732 	return false;
3733       cmp = GE_EXPR;
3734     }
3735   else
3736     {
3737       if (!stmt_dominates_stmt_p (niter_bound->stmt, stmt))
3738 	{
3739           gimple_stmt_iterator bsi;
3740 	  if (gimple_bb (stmt) != gimple_bb (niter_bound->stmt)
3741 	      || gimple_code (stmt) == GIMPLE_PHI
3742 	      || gimple_code (niter_bound->stmt) == GIMPLE_PHI)
3743 	    return false;
3744 
3745 	  /* By stmt_dominates_stmt_p we already know that STMT appears
3746 	     before NITER_BOUND->STMT.  Still need to test that the loop
3747 	     can not be terinated by a side effect in between.  */
3748 	  for (bsi = gsi_for_stmt (stmt); gsi_stmt (bsi) != niter_bound->stmt;
3749 	       gsi_next (&bsi))
3750 	    if (gimple_has_side_effects (gsi_stmt (bsi)))
3751 	       return false;
3752 	  bound += 1;
3753 	  if (bound == 0
3754 	      || !wi::fits_to_tree_p (bound, nit_type))
3755 	    return false;
3756 	}
3757       cmp = GT_EXPR;
3758     }
3759 
3760   e = fold_binary (cmp, boolean_type_node,
3761 		   niter, wide_int_to_tree (nit_type, bound));
3762   return e && integer_nonzerop (e);
3763 }
3764 
3765 /* Returns true if the arithmetics in TYPE can be assumed not to wrap.  */
3766 
3767 bool
3768 nowrap_type_p (tree type)
3769 {
3770   if (INTEGRAL_TYPE_P (type)
3771       && TYPE_OVERFLOW_UNDEFINED (type))
3772     return true;
3773 
3774   if (POINTER_TYPE_P (type))
3775     return true;
3776 
3777   return false;
3778 }
3779 
3780 /* Return false only when the induction variable BASE + STEP * I is
3781    known to not overflow: i.e. when the number of iterations is small
3782    enough with respect to the step and initial condition in order to
3783    keep the evolution confined in TYPEs bounds.  Return true when the
3784    iv is known to overflow or when the property is not computable.
3785 
3786    USE_OVERFLOW_SEMANTICS is true if this function should assume that
3787    the rules for overflow of the given language apply (e.g., that signed
3788    arithmetics in C does not overflow).  */
3789 
3790 bool
3791 scev_probably_wraps_p (tree base, tree step,
3792 		       gimple at_stmt, struct loop *loop,
3793 		       bool use_overflow_semantics)
3794 {
3795   tree delta, step_abs;
3796   tree unsigned_type, valid_niter;
3797   tree type = TREE_TYPE (step);
3798   tree e;
3799   widest_int niter;
3800   struct nb_iter_bound *bound;
3801 
3802   /* FIXME: We really need something like
3803      http://gcc.gnu.org/ml/gcc-patches/2005-06/msg02025.html.
3804 
3805      We used to test for the following situation that frequently appears
3806      during address arithmetics:
3807 
3808        D.1621_13 = (long unsigned intD.4) D.1620_12;
3809        D.1622_14 = D.1621_13 * 8;
3810        D.1623_15 = (doubleD.29 *) D.1622_14;
3811 
3812      And derived that the sequence corresponding to D_14
3813      can be proved to not wrap because it is used for computing a
3814      memory access; however, this is not really the case -- for example,
3815      if D_12 = (unsigned char) [254,+,1], then D_14 has values
3816      2032, 2040, 0, 8, ..., but the code is still legal.  */
3817 
3818   if (chrec_contains_undetermined (base)
3819       || chrec_contains_undetermined (step))
3820     return true;
3821 
3822   if (integer_zerop (step))
3823     return false;
3824 
3825   /* If we can use the fact that signed and pointer arithmetics does not
3826      wrap, we are done.  */
3827   if (use_overflow_semantics && nowrap_type_p (TREE_TYPE (base)))
3828     return false;
3829 
3830   /* To be able to use estimates on number of iterations of the loop,
3831      we must have an upper bound on the absolute value of the step.  */
3832   if (TREE_CODE (step) != INTEGER_CST)
3833     return true;
3834 
3835   /* Don't issue signed overflow warnings.  */
3836   fold_defer_overflow_warnings ();
3837 
3838   /* Otherwise, compute the number of iterations before we reach the
3839      bound of the type, and verify that the loop is exited before this
3840      occurs.  */
3841   unsigned_type = unsigned_type_for (type);
3842   base = fold_convert (unsigned_type, base);
3843 
3844   if (tree_int_cst_sign_bit (step))
3845     {
3846       tree extreme = fold_convert (unsigned_type,
3847 				   lower_bound_in_type (type, type));
3848       delta = fold_build2 (MINUS_EXPR, unsigned_type, base, extreme);
3849       step_abs = fold_build1 (NEGATE_EXPR, unsigned_type,
3850 			      fold_convert (unsigned_type, step));
3851     }
3852   else
3853     {
3854       tree extreme = fold_convert (unsigned_type,
3855 				   upper_bound_in_type (type, type));
3856       delta = fold_build2 (MINUS_EXPR, unsigned_type, extreme, base);
3857       step_abs = fold_convert (unsigned_type, step);
3858     }
3859 
3860   valid_niter = fold_build2 (FLOOR_DIV_EXPR, unsigned_type, delta, step_abs);
3861 
3862   estimate_numbers_of_iterations_loop (loop);
3863 
3864   if (max_loop_iterations (loop, &niter)
3865       && wi::fits_to_tree_p (niter, TREE_TYPE (valid_niter))
3866       && (e = fold_binary (GT_EXPR, boolean_type_node, valid_niter,
3867 			   wide_int_to_tree (TREE_TYPE (valid_niter),
3868 					     niter))) != NULL
3869       && integer_nonzerop (e))
3870     {
3871       fold_undefer_and_ignore_overflow_warnings ();
3872       return false;
3873     }
3874   if (at_stmt)
3875     for (bound = loop->bounds; bound; bound = bound->next)
3876       {
3877 	if (n_of_executions_at_most (at_stmt, bound, valid_niter))
3878 	  {
3879 	    fold_undefer_and_ignore_overflow_warnings ();
3880 	    return false;
3881 	  }
3882       }
3883 
3884   fold_undefer_and_ignore_overflow_warnings ();
3885 
3886   /* At this point we still don't have a proof that the iv does not
3887      overflow: give up.  */
3888   return true;
3889 }
3890 
3891 /* Frees the information on upper bounds on numbers of iterations of LOOP.  */
3892 
3893 void
3894 free_numbers_of_iterations_estimates_loop (struct loop *loop)
3895 {
3896   struct nb_iter_bound *bound, *next;
3897 
3898   loop->nb_iterations = NULL;
3899   loop->estimate_state = EST_NOT_COMPUTED;
3900   for (bound = loop->bounds; bound; bound = next)
3901     {
3902       next = bound->next;
3903       ggc_free (bound);
3904     }
3905 
3906   loop->bounds = NULL;
3907 }
3908 
3909 /* Frees the information on upper bounds on numbers of iterations of loops.  */
3910 
3911 void
3912 free_numbers_of_iterations_estimates (void)
3913 {
3914   struct loop *loop;
3915 
3916   FOR_EACH_LOOP (loop, 0)
3917     {
3918       free_numbers_of_iterations_estimates_loop (loop);
3919     }
3920 }
3921 
3922 /* Substitute value VAL for ssa name NAME inside expressions held
3923    at LOOP.  */
3924 
3925 void
3926 substitute_in_loop_info (struct loop *loop, tree name, tree val)
3927 {
3928   loop->nb_iterations = simplify_replace_tree (loop->nb_iterations, name, val);
3929 }
3930