xref: /netbsd-src/external/gpl3/gcc.old/dist/gcc/tree-vrp.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /* Support routines for Value Range Propagation (VRP).
2    Copyright (C) 2005-2015 Free Software Foundation, Inc.
3    Contributed by Diego Novillo <dnovillo@redhat.com>.
4 
5 This file is part of GCC.
6 
7 GCC is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3, or (at your option)
10 any later version.
11 
12 GCC is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 GNU General Public License for more details.
16 
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3.  If not see
19 <http://www.gnu.org/licenses/>.  */
20 
21 #include "config.h"
22 #include "system.h"
23 #include "coretypes.h"
24 #include "tm.h"
25 #include "flags.h"
26 #include "hash-set.h"
27 #include "machmode.h"
28 #include "vec.h"
29 #include "double-int.h"
30 #include "input.h"
31 #include "alias.h"
32 #include "symtab.h"
33 #include "wide-int.h"
34 #include "inchash.h"
35 #include "tree.h"
36 #include "fold-const.h"
37 #include "stor-layout.h"
38 #include "calls.h"
39 #include "predict.h"
40 #include "hard-reg-set.h"
41 #include "function.h"
42 #include "dominance.h"
43 #include "cfg.h"
44 #include "cfganal.h"
45 #include "basic-block.h"
46 #include "tree-ssa-alias.h"
47 #include "internal-fn.h"
48 #include "gimple-fold.h"
49 #include "tree-eh.h"
50 #include "gimple-expr.h"
51 #include "is-a.h"
52 #include "gimple.h"
53 #include "gimple-iterator.h"
54 #include "gimple-walk.h"
55 #include "gimple-ssa.h"
56 #include "tree-cfg.h"
57 #include "tree-phinodes.h"
58 #include "ssa-iterators.h"
59 #include "stringpool.h"
60 #include "tree-ssanames.h"
61 #include "tree-ssa-loop-manip.h"
62 #include "tree-ssa-loop-niter.h"
63 #include "tree-ssa-loop.h"
64 #include "tree-into-ssa.h"
65 #include "tree-ssa.h"
66 #include "tree-pass.h"
67 #include "tree-dump.h"
68 #include "gimple-pretty-print.h"
69 #include "diagnostic-core.h"
70 #include "intl.h"
71 #include "cfgloop.h"
72 #include "tree-scalar-evolution.h"
73 #include "tree-ssa-propagate.h"
74 #include "tree-chrec.h"
75 #include "tree-ssa-threadupdate.h"
76 #include "hashtab.h"
77 #include "rtl.h"
78 #include "statistics.h"
79 #include "real.h"
80 #include "fixed-value.h"
81 #include "insn-config.h"
82 #include "expmed.h"
83 #include "dojump.h"
84 #include "explow.h"
85 #include "emit-rtl.h"
86 #include "varasm.h"
87 #include "stmt.h"
88 #include "expr.h"
89 #include "insn-codes.h"
90 #include "optabs.h"
91 #include "tree-ssa-threadedge.h"
92 
93 
94 
95 /* Range of values that can be associated with an SSA_NAME after VRP
96    has executed.  */
97 struct value_range_d
98 {
99   /* Lattice value represented by this range.  */
100   enum value_range_type type;
101 
102   /* Minimum and maximum values represented by this range.  These
103      values should be interpreted as follows:
104 
105 	- If TYPE is VR_UNDEFINED or VR_VARYING then MIN and MAX must
106 	  be NULL.
107 
108 	- If TYPE == VR_RANGE then MIN holds the minimum value and
109 	  MAX holds the maximum value of the range [MIN, MAX].
110 
111 	- If TYPE == ANTI_RANGE the variable is known to NOT
112 	  take any values in the range [MIN, MAX].  */
113   tree min;
114   tree max;
115 
116   /* Set of SSA names whose value ranges are equivalent to this one.
117      This set is only valid when TYPE is VR_RANGE or VR_ANTI_RANGE.  */
118   bitmap equiv;
119 };
120 
121 typedef struct value_range_d value_range_t;
122 
123 #define VR_INITIALIZER { VR_UNDEFINED, NULL_TREE, NULL_TREE, NULL }
124 
125 /* Set of SSA names found live during the RPO traversal of the function
126    for still active basic-blocks.  */
127 static sbitmap *live;
128 
129 /* Return true if the SSA name NAME is live on the edge E.  */
130 
131 static bool
132 live_on_edge (edge e, tree name)
133 {
134   return (live[e->dest->index]
135 	  && bitmap_bit_p (live[e->dest->index], SSA_NAME_VERSION (name)));
136 }
137 
138 /* Local functions.  */
139 static int compare_values (tree val1, tree val2);
140 static int compare_values_warnv (tree val1, tree val2, bool *);
141 static void vrp_meet (value_range_t *, value_range_t *);
142 static void vrp_intersect_ranges (value_range_t *, value_range_t *);
143 static tree vrp_evaluate_conditional_warnv_with_ops (enum tree_code,
144 						     tree, tree, bool, bool *,
145 						     bool *);
146 
147 /* Location information for ASSERT_EXPRs.  Each instance of this
148    structure describes an ASSERT_EXPR for an SSA name.  Since a single
149    SSA name may have more than one assertion associated with it, these
150    locations are kept in a linked list attached to the corresponding
151    SSA name.  */
152 struct assert_locus_d
153 {
154   /* Basic block where the assertion would be inserted.  */
155   basic_block bb;
156 
157   /* Some assertions need to be inserted on an edge (e.g., assertions
158      generated by COND_EXPRs).  In those cases, BB will be NULL.  */
159   edge e;
160 
161   /* Pointer to the statement that generated this assertion.  */
162   gimple_stmt_iterator si;
163 
164   /* Predicate code for the ASSERT_EXPR.  Must be COMPARISON_CLASS_P.  */
165   enum tree_code comp_code;
166 
167   /* Value being compared against.  */
168   tree val;
169 
170   /* Expression to compare.  */
171   tree expr;
172 
173   /* Next node in the linked list.  */
174   struct assert_locus_d *next;
175 };
176 
177 typedef struct assert_locus_d *assert_locus_t;
178 
179 /* If bit I is present, it means that SSA name N_i has a list of
180    assertions that should be inserted in the IL.  */
181 static bitmap need_assert_for;
182 
183 /* Array of locations lists where to insert assertions.  ASSERTS_FOR[I]
184    holds a list of ASSERT_LOCUS_T nodes that describe where
185    ASSERT_EXPRs for SSA name N_I should be inserted.  */
186 static assert_locus_t *asserts_for;
187 
188 /* Value range array.  After propagation, VR_VALUE[I] holds the range
189    of values that SSA name N_I may take.  */
190 static unsigned num_vr_values;
191 static value_range_t **vr_value;
192 static bool values_propagated;
193 
194 /* For a PHI node which sets SSA name N_I, VR_COUNTS[I] holds the
195    number of executable edges we saw the last time we visited the
196    node.  */
197 static int *vr_phi_edge_counts;
198 
199 typedef struct {
200   gswitch *stmt;
201   tree vec;
202 } switch_update;
203 
204 static vec<edge> to_remove_edges;
205 static vec<switch_update> to_update_switch_stmts;
206 
207 
208 /* Return the maximum value for TYPE.  */
209 
210 static inline tree
211 vrp_val_max (const_tree type)
212 {
213   if (!INTEGRAL_TYPE_P (type))
214     return NULL_TREE;
215 
216   return TYPE_MAX_VALUE (type);
217 }
218 
219 /* Return the minimum value for TYPE.  */
220 
221 static inline tree
222 vrp_val_min (const_tree type)
223 {
224   if (!INTEGRAL_TYPE_P (type))
225     return NULL_TREE;
226 
227   return TYPE_MIN_VALUE (type);
228 }
229 
230 /* Return whether VAL is equal to the maximum value of its type.  This
231    will be true for a positive overflow infinity.  We can't do a
232    simple equality comparison with TYPE_MAX_VALUE because C typedefs
233    and Ada subtypes can produce types whose TYPE_MAX_VALUE is not ==
234    to the integer constant with the same value in the type.  */
235 
236 static inline bool
237 vrp_val_is_max (const_tree val)
238 {
239   tree type_max = vrp_val_max (TREE_TYPE (val));
240   return (val == type_max
241 	  || (type_max != NULL_TREE
242 	      && operand_equal_p (val, type_max, 0)));
243 }
244 
245 /* Return whether VAL is equal to the minimum value of its type.  This
246    will be true for a negative overflow infinity.  */
247 
248 static inline bool
249 vrp_val_is_min (const_tree val)
250 {
251   tree type_min = vrp_val_min (TREE_TYPE (val));
252   return (val == type_min
253 	  || (type_min != NULL_TREE
254 	      && operand_equal_p (val, type_min, 0)));
255 }
256 
257 
258 /* Return whether TYPE should use an overflow infinity distinct from
259    TYPE_{MIN,MAX}_VALUE.  We use an overflow infinity value to
260    represent a signed overflow during VRP computations.  An infinity
261    is distinct from a half-range, which will go from some number to
262    TYPE_{MIN,MAX}_VALUE.  */
263 
264 static inline bool
265 needs_overflow_infinity (const_tree type)
266 {
267   return INTEGRAL_TYPE_P (type) && !TYPE_OVERFLOW_WRAPS (type);
268 }
269 
270 /* Return whether TYPE can support our overflow infinity
271    representation: we use the TREE_OVERFLOW flag, which only exists
272    for constants.  If TYPE doesn't support this, we don't optimize
273    cases which would require signed overflow--we drop them to
274    VARYING.  */
275 
276 static inline bool
277 supports_overflow_infinity (const_tree type)
278 {
279   tree min = vrp_val_min (type), max = vrp_val_max (type);
280 #ifdef ENABLE_CHECKING
281   gcc_assert (needs_overflow_infinity (type));
282 #endif
283   return (min != NULL_TREE
284 	  && CONSTANT_CLASS_P (min)
285 	  && max != NULL_TREE
286 	  && CONSTANT_CLASS_P (max));
287 }
288 
289 /* VAL is the maximum or minimum value of a type.  Return a
290    corresponding overflow infinity.  */
291 
292 static inline tree
293 make_overflow_infinity (tree val)
294 {
295   gcc_checking_assert (val != NULL_TREE && CONSTANT_CLASS_P (val));
296   val = copy_node (val);
297   TREE_OVERFLOW (val) = 1;
298   return val;
299 }
300 
301 /* Return a negative overflow infinity for TYPE.  */
302 
303 static inline tree
304 negative_overflow_infinity (tree type)
305 {
306   gcc_checking_assert (supports_overflow_infinity (type));
307   return make_overflow_infinity (vrp_val_min (type));
308 }
309 
310 /* Return a positive overflow infinity for TYPE.  */
311 
312 static inline tree
313 positive_overflow_infinity (tree type)
314 {
315   gcc_checking_assert (supports_overflow_infinity (type));
316   return make_overflow_infinity (vrp_val_max (type));
317 }
318 
319 /* Return whether VAL is a negative overflow infinity.  */
320 
321 static inline bool
322 is_negative_overflow_infinity (const_tree val)
323 {
324   return (TREE_OVERFLOW_P (val)
325 	  && needs_overflow_infinity (TREE_TYPE (val))
326 	  && vrp_val_is_min (val));
327 }
328 
329 /* Return whether VAL is a positive overflow infinity.  */
330 
331 static inline bool
332 is_positive_overflow_infinity (const_tree val)
333 {
334   return (TREE_OVERFLOW_P (val)
335 	  && needs_overflow_infinity (TREE_TYPE (val))
336 	  && vrp_val_is_max (val));
337 }
338 
339 /* Return whether VAL is a positive or negative overflow infinity.  */
340 
341 static inline bool
342 is_overflow_infinity (const_tree val)
343 {
344   return (TREE_OVERFLOW_P (val)
345 	  && needs_overflow_infinity (TREE_TYPE (val))
346 	  && (vrp_val_is_min (val) || vrp_val_is_max (val)));
347 }
348 
349 /* Return whether STMT has a constant rhs that is_overflow_infinity. */
350 
351 static inline bool
352 stmt_overflow_infinity (gimple stmt)
353 {
354   if (is_gimple_assign (stmt)
355       && get_gimple_rhs_class (gimple_assign_rhs_code (stmt)) ==
356       GIMPLE_SINGLE_RHS)
357     return is_overflow_infinity (gimple_assign_rhs1 (stmt));
358   return false;
359 }
360 
361 /* If VAL is now an overflow infinity, return VAL.  Otherwise, return
362    the same value with TREE_OVERFLOW clear.  This can be used to avoid
363    confusing a regular value with an overflow value.  */
364 
365 static inline tree
366 avoid_overflow_infinity (tree val)
367 {
368   if (!is_overflow_infinity (val))
369     return val;
370 
371   if (vrp_val_is_max (val))
372     return vrp_val_max (TREE_TYPE (val));
373   else
374     {
375       gcc_checking_assert (vrp_val_is_min (val));
376       return vrp_val_min (TREE_TYPE (val));
377     }
378 }
379 
380 
381 /* Return true if ARG is marked with the nonnull attribute in the
382    current function signature.  */
383 
384 static bool
385 nonnull_arg_p (const_tree arg)
386 {
387   tree t, attrs, fntype;
388   unsigned HOST_WIDE_INT arg_num;
389 
390   gcc_assert (TREE_CODE (arg) == PARM_DECL && POINTER_TYPE_P (TREE_TYPE (arg)));
391 
392   /* The static chain decl is always non null.  */
393   if (arg == cfun->static_chain_decl)
394     return true;
395 
396   fntype = TREE_TYPE (current_function_decl);
397   for (attrs = TYPE_ATTRIBUTES (fntype); attrs; attrs = TREE_CHAIN (attrs))
398     {
399       attrs = lookup_attribute ("nonnull", attrs);
400 
401       /* If "nonnull" wasn't specified, we know nothing about the argument.  */
402       if (attrs == NULL_TREE)
403 	return false;
404 
405       /* If "nonnull" applies to all the arguments, then ARG is non-null.  */
406       if (TREE_VALUE (attrs) == NULL_TREE)
407 	return true;
408 
409       /* Get the position number for ARG in the function signature.  */
410       for (arg_num = 1, t = DECL_ARGUMENTS (current_function_decl);
411 	   t;
412 	   t = DECL_CHAIN (t), arg_num++)
413 	{
414 	  if (t == arg)
415 	    break;
416 	}
417 
418       gcc_assert (t == arg);
419 
420       /* Now see if ARG_NUM is mentioned in the nonnull list.  */
421       for (t = TREE_VALUE (attrs); t; t = TREE_CHAIN (t))
422 	{
423 	  if (compare_tree_int (TREE_VALUE (t), arg_num) == 0)
424 	    return true;
425 	}
426     }
427 
428   return false;
429 }
430 
431 
432 /* Set value range VR to VR_UNDEFINED.  */
433 
434 static inline void
435 set_value_range_to_undefined (value_range_t *vr)
436 {
437   vr->type = VR_UNDEFINED;
438   vr->min = vr->max = NULL_TREE;
439   if (vr->equiv)
440     bitmap_clear (vr->equiv);
441 }
442 
443 
444 /* Set value range VR to VR_VARYING.  */
445 
446 static inline void
447 set_value_range_to_varying (value_range_t *vr)
448 {
449   vr->type = VR_VARYING;
450   vr->min = vr->max = NULL_TREE;
451   if (vr->equiv)
452     bitmap_clear (vr->equiv);
453 }
454 
455 
456 /* Set value range VR to {T, MIN, MAX, EQUIV}.  */
457 
458 static void
459 set_value_range (value_range_t *vr, enum value_range_type t, tree min,
460 		 tree max, bitmap equiv)
461 {
462 #if defined ENABLE_CHECKING
463   /* Check the validity of the range.  */
464   if (t == VR_RANGE || t == VR_ANTI_RANGE)
465     {
466       int cmp;
467 
468       gcc_assert (min && max);
469 
470       gcc_assert ((!TREE_OVERFLOW_P (min) || is_overflow_infinity (min))
471 		  && (!TREE_OVERFLOW_P (max) || is_overflow_infinity (max)));
472 
473       if (INTEGRAL_TYPE_P (TREE_TYPE (min)) && t == VR_ANTI_RANGE)
474 	gcc_assert (!vrp_val_is_min (min) || !vrp_val_is_max (max));
475 
476       cmp = compare_values (min, max);
477       gcc_assert (cmp == 0 || cmp == -1 || cmp == -2);
478 
479       if (needs_overflow_infinity (TREE_TYPE (min)))
480 	gcc_assert (!is_overflow_infinity (min)
481 		    || !is_overflow_infinity (max));
482     }
483 
484   if (t == VR_UNDEFINED || t == VR_VARYING)
485     gcc_assert (min == NULL_TREE && max == NULL_TREE);
486 
487   if (t == VR_UNDEFINED || t == VR_VARYING)
488     gcc_assert (equiv == NULL || bitmap_empty_p (equiv));
489 #endif
490 
491   vr->type = t;
492   vr->min = min;
493   vr->max = max;
494 
495   /* Since updating the equivalence set involves deep copying the
496      bitmaps, only do it if absolutely necessary.  */
497   if (vr->equiv == NULL
498       && equiv != NULL)
499     vr->equiv = BITMAP_ALLOC (NULL);
500 
501   if (equiv != vr->equiv)
502     {
503       if (equiv && !bitmap_empty_p (equiv))
504 	bitmap_copy (vr->equiv, equiv);
505       else
506 	bitmap_clear (vr->equiv);
507     }
508 }
509 
510 
511 /* Set value range VR to the canonical form of {T, MIN, MAX, EQUIV}.
512    This means adjusting T, MIN and MAX representing the case of a
513    wrapping range with MAX < MIN covering [MIN, type_max] U [type_min, MAX]
514    as anti-rage ~[MAX+1, MIN-1].  Likewise for wrapping anti-ranges.
515    In corner cases where MAX+1 or MIN-1 wraps this will fall back
516    to varying.
517    This routine exists to ease canonicalization in the case where we
518    extract ranges from var + CST op limit.  */
519 
520 static void
521 set_and_canonicalize_value_range (value_range_t *vr, enum value_range_type t,
522 				  tree min, tree max, bitmap equiv)
523 {
524   /* Use the canonical setters for VR_UNDEFINED and VR_VARYING.  */
525   if (t == VR_UNDEFINED)
526     {
527       set_value_range_to_undefined (vr);
528       return;
529     }
530   else if (t == VR_VARYING)
531     {
532       set_value_range_to_varying (vr);
533       return;
534     }
535 
536   /* Nothing to canonicalize for symbolic ranges.  */
537   if (TREE_CODE (min) != INTEGER_CST
538       || TREE_CODE (max) != INTEGER_CST)
539     {
540       set_value_range (vr, t, min, max, equiv);
541       return;
542     }
543 
544   /* Wrong order for min and max, to swap them and the VR type we need
545      to adjust them.  */
546   if (tree_int_cst_lt (max, min))
547     {
548       tree one, tmp;
549 
550       /* For one bit precision if max < min, then the swapped
551 	 range covers all values, so for VR_RANGE it is varying and
552 	 for VR_ANTI_RANGE empty range, so drop to varying as well.  */
553       if (TYPE_PRECISION (TREE_TYPE (min)) == 1)
554 	{
555 	  set_value_range_to_varying (vr);
556 	  return;
557 	}
558 
559       one = build_int_cst (TREE_TYPE (min), 1);
560       tmp = int_const_binop (PLUS_EXPR, max, one);
561       max = int_const_binop (MINUS_EXPR, min, one);
562       min = tmp;
563 
564       /* There's one corner case, if we had [C+1, C] before we now have
565 	 that again.  But this represents an empty value range, so drop
566 	 to varying in this case.  */
567       if (tree_int_cst_lt (max, min))
568 	{
569 	  set_value_range_to_varying (vr);
570 	  return;
571 	}
572 
573       t = t == VR_RANGE ? VR_ANTI_RANGE : VR_RANGE;
574     }
575 
576   /* Anti-ranges that can be represented as ranges should be so.  */
577   if (t == VR_ANTI_RANGE)
578     {
579       bool is_min = vrp_val_is_min (min);
580       bool is_max = vrp_val_is_max (max);
581 
582       if (is_min && is_max)
583 	{
584 	  /* We cannot deal with empty ranges, drop to varying.
585 	     ???  This could be VR_UNDEFINED instead.  */
586 	  set_value_range_to_varying (vr);
587 	  return;
588 	}
589       else if (TYPE_PRECISION (TREE_TYPE (min)) == 1
590 	       && (is_min || is_max))
591 	{
592 	  /* Non-empty boolean ranges can always be represented
593 	     as a singleton range.  */
594 	  if (is_min)
595 	    min = max = vrp_val_max (TREE_TYPE (min));
596 	  else
597 	    min = max = vrp_val_min (TREE_TYPE (min));
598 	  t = VR_RANGE;
599 	}
600       else if (is_min
601 	       /* As a special exception preserve non-null ranges.  */
602 	       && !(TYPE_UNSIGNED (TREE_TYPE (min))
603 		    && integer_zerop (max)))
604         {
605 	  tree one = build_int_cst (TREE_TYPE (max), 1);
606 	  min = int_const_binop (PLUS_EXPR, max, one);
607 	  max = vrp_val_max (TREE_TYPE (max));
608 	  t = VR_RANGE;
609         }
610       else if (is_max)
611         {
612 	  tree one = build_int_cst (TREE_TYPE (min), 1);
613 	  max = int_const_binop (MINUS_EXPR, min, one);
614 	  min = vrp_val_min (TREE_TYPE (min));
615 	  t = VR_RANGE;
616         }
617     }
618 
619   /* Drop [-INF(OVF), +INF(OVF)] to varying.  */
620   if (needs_overflow_infinity (TREE_TYPE (min))
621       && is_overflow_infinity (min)
622       && is_overflow_infinity (max))
623     {
624       set_value_range_to_varying (vr);
625       return;
626     }
627 
628   set_value_range (vr, t, min, max, equiv);
629 }
630 
631 /* Copy value range FROM into value range TO.  */
632 
633 static inline void
634 copy_value_range (value_range_t *to, value_range_t *from)
635 {
636   set_value_range (to, from->type, from->min, from->max, from->equiv);
637 }
638 
639 /* Set value range VR to a single value.  This function is only called
640    with values we get from statements, and exists to clear the
641    TREE_OVERFLOW flag so that we don't think we have an overflow
642    infinity when we shouldn't.  */
643 
644 static inline void
645 set_value_range_to_value (value_range_t *vr, tree val, bitmap equiv)
646 {
647   gcc_assert (is_gimple_min_invariant (val));
648   if (TREE_OVERFLOW_P (val))
649     val = drop_tree_overflow (val);
650   set_value_range (vr, VR_RANGE, val, val, equiv);
651 }
652 
653 /* Set value range VR to a non-negative range of type TYPE.
654    OVERFLOW_INFINITY indicates whether to use an overflow infinity
655    rather than TYPE_MAX_VALUE; this should be true if we determine
656    that the range is nonnegative based on the assumption that signed
657    overflow does not occur.  */
658 
659 static inline void
660 set_value_range_to_nonnegative (value_range_t *vr, tree type,
661 				bool overflow_infinity)
662 {
663   tree zero;
664 
665   if (overflow_infinity && !supports_overflow_infinity (type))
666     {
667       set_value_range_to_varying (vr);
668       return;
669     }
670 
671   zero = build_int_cst (type, 0);
672   set_value_range (vr, VR_RANGE, zero,
673 		   (overflow_infinity
674 		    ? positive_overflow_infinity (type)
675 		    : TYPE_MAX_VALUE (type)),
676 		   vr->equiv);
677 }
678 
679 /* Set value range VR to a non-NULL range of type TYPE.  */
680 
681 static inline void
682 set_value_range_to_nonnull (value_range_t *vr, tree type)
683 {
684   tree zero = build_int_cst (type, 0);
685   set_value_range (vr, VR_ANTI_RANGE, zero, zero, vr->equiv);
686 }
687 
688 
689 /* Set value range VR to a NULL range of type TYPE.  */
690 
691 static inline void
692 set_value_range_to_null (value_range_t *vr, tree type)
693 {
694   set_value_range_to_value (vr, build_int_cst (type, 0), vr->equiv);
695 }
696 
697 
698 /* Set value range VR to a range of a truthvalue of type TYPE.  */
699 
700 static inline void
701 set_value_range_to_truthvalue (value_range_t *vr, tree type)
702 {
703   if (TYPE_PRECISION (type) == 1)
704     set_value_range_to_varying (vr);
705   else
706     set_value_range (vr, VR_RANGE,
707 		     build_int_cst (type, 0), build_int_cst (type, 1),
708 		     vr->equiv);
709 }
710 
711 
712 /* If abs (min) < abs (max), set VR to [-max, max], if
713    abs (min) >= abs (max), set VR to [-min, min].  */
714 
715 static void
716 abs_extent_range (value_range_t *vr, tree min, tree max)
717 {
718   int cmp;
719 
720   gcc_assert (TREE_CODE (min) == INTEGER_CST);
721   gcc_assert (TREE_CODE (max) == INTEGER_CST);
722   gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (min)));
723   gcc_assert (!TYPE_UNSIGNED (TREE_TYPE (min)));
724   min = fold_unary (ABS_EXPR, TREE_TYPE (min), min);
725   max = fold_unary (ABS_EXPR, TREE_TYPE (max), max);
726   if (TREE_OVERFLOW (min) || TREE_OVERFLOW (max))
727     {
728       set_value_range_to_varying (vr);
729       return;
730     }
731   cmp = compare_values (min, max);
732   if (cmp == -1)
733     min = fold_unary (NEGATE_EXPR, TREE_TYPE (min), max);
734   else if (cmp == 0 || cmp == 1)
735     {
736       max = min;
737       min = fold_unary (NEGATE_EXPR, TREE_TYPE (min), min);
738     }
739   else
740     {
741       set_value_range_to_varying (vr);
742       return;
743     }
744   set_and_canonicalize_value_range (vr, VR_RANGE, min, max, NULL);
745 }
746 
747 
748 /* Return value range information for VAR.
749 
750    If we have no values ranges recorded (ie, VRP is not running), then
751    return NULL.  Otherwise create an empty range if none existed for VAR.  */
752 
753 static value_range_t *
754 get_value_range (const_tree var)
755 {
756   static const struct value_range_d vr_const_varying
757     = { VR_VARYING, NULL_TREE, NULL_TREE, NULL };
758   value_range_t *vr;
759   tree sym;
760   unsigned ver = SSA_NAME_VERSION (var);
761 
762   /* If we have no recorded ranges, then return NULL.  */
763   if (! vr_value)
764     return NULL;
765 
766   /* If we query the range for a new SSA name return an unmodifiable VARYING.
767      We should get here at most from the substitute-and-fold stage which
768      will never try to change values.  */
769   if (ver >= num_vr_values)
770     return CONST_CAST (value_range_t *, &vr_const_varying);
771 
772   vr = vr_value[ver];
773   if (vr)
774     return vr;
775 
776   /* After propagation finished do not allocate new value-ranges.  */
777   if (values_propagated)
778     return CONST_CAST (value_range_t *, &vr_const_varying);
779 
780   /* Create a default value range.  */
781   vr_value[ver] = vr = XCNEW (value_range_t);
782 
783   /* Defer allocating the equivalence set.  */
784   vr->equiv = NULL;
785 
786   /* If VAR is a default definition of a parameter, the variable can
787      take any value in VAR's type.  */
788   if (SSA_NAME_IS_DEFAULT_DEF (var))
789     {
790       sym = SSA_NAME_VAR (var);
791       if (TREE_CODE (sym) == PARM_DECL)
792 	{
793 	  /* Try to use the "nonnull" attribute to create ~[0, 0]
794 	     anti-ranges for pointers.  Note that this is only valid with
795 	     default definitions of PARM_DECLs.  */
796 	  if (POINTER_TYPE_P (TREE_TYPE (sym))
797 	      && nonnull_arg_p (sym))
798 	    set_value_range_to_nonnull (vr, TREE_TYPE (sym));
799 	  else
800 	    set_value_range_to_varying (vr);
801 	}
802       else if (TREE_CODE (sym) == RESULT_DECL
803 	       && DECL_BY_REFERENCE (sym))
804 	set_value_range_to_nonnull (vr, TREE_TYPE (sym));
805     }
806 
807   return vr;
808 }
809 
810 /* Set value-ranges of all SSA names defined by STMT to varying.  */
811 
812 static void
813 set_defs_to_varying (gimple stmt)
814 {
815   ssa_op_iter i;
816   tree def;
817   FOR_EACH_SSA_TREE_OPERAND (def, stmt, i, SSA_OP_DEF)
818     {
819       value_range_t *vr = get_value_range (def);
820       /* Avoid writing to vr_const_varying get_value_range may return.  */
821       if (vr->type != VR_VARYING)
822 	set_value_range_to_varying (vr);
823     }
824 }
825 
826 
827 /* Return true, if VAL1 and VAL2 are equal values for VRP purposes.  */
828 
829 static inline bool
830 vrp_operand_equal_p (const_tree val1, const_tree val2)
831 {
832   if (val1 == val2)
833     return true;
834   if (!val1 || !val2 || !operand_equal_p (val1, val2, 0))
835     return false;
836   return is_overflow_infinity (val1) == is_overflow_infinity (val2);
837 }
838 
839 /* Return true, if the bitmaps B1 and B2 are equal.  */
840 
841 static inline bool
842 vrp_bitmap_equal_p (const_bitmap b1, const_bitmap b2)
843 {
844   return (b1 == b2
845 	  || ((!b1 || bitmap_empty_p (b1))
846 	      && (!b2 || bitmap_empty_p (b2)))
847 	  || (b1 && b2
848 	      && bitmap_equal_p (b1, b2)));
849 }
850 
851 /* Update the value range and equivalence set for variable VAR to
852    NEW_VR.  Return true if NEW_VR is different from VAR's previous
853    value.
854 
855    NOTE: This function assumes that NEW_VR is a temporary value range
856    object created for the sole purpose of updating VAR's range.  The
857    storage used by the equivalence set from NEW_VR will be freed by
858    this function.  Do not call update_value_range when NEW_VR
859    is the range object associated with another SSA name.  */
860 
861 static inline bool
862 update_value_range (const_tree var, value_range_t *new_vr)
863 {
864   value_range_t *old_vr;
865   bool is_new;
866 
867   /* If there is a value-range on the SSA name from earlier analysis
868      factor that in.  */
869   if (INTEGRAL_TYPE_P (TREE_TYPE (var)))
870     {
871       wide_int min, max;
872       value_range_type rtype = get_range_info (var, &min, &max);
873       if (rtype == VR_RANGE || rtype == VR_ANTI_RANGE)
874 	{
875 	  value_range_d nr;
876 	  nr.type = rtype;
877 	  nr.min = wide_int_to_tree (TREE_TYPE (var), min);
878 	  nr.max = wide_int_to_tree (TREE_TYPE (var), max);
879 	  nr.equiv = NULL;
880 	  vrp_intersect_ranges (new_vr, &nr);
881 	}
882     }
883 
884   /* Update the value range, if necessary.  */
885   old_vr = get_value_range (var);
886   is_new = old_vr->type != new_vr->type
887 	   || !vrp_operand_equal_p (old_vr->min, new_vr->min)
888 	   || !vrp_operand_equal_p (old_vr->max, new_vr->max)
889 	   || !vrp_bitmap_equal_p (old_vr->equiv, new_vr->equiv);
890 
891   if (is_new)
892     {
893       /* Do not allow transitions up the lattice.  The following
894 	 is slightly more awkward than just new_vr->type < old_vr->type
895 	 because VR_RANGE and VR_ANTI_RANGE need to be considered
896 	 the same.  We may not have is_new when transitioning to
897 	 UNDEFINED.  If old_vr->type is VARYING, we shouldn't be
898 	 called.  */
899       if (new_vr->type == VR_UNDEFINED)
900 	{
901 	  BITMAP_FREE (new_vr->equiv);
902 	  set_value_range_to_varying (old_vr);
903 	  set_value_range_to_varying (new_vr);
904 	  return true;
905 	}
906       else
907 	set_value_range (old_vr, new_vr->type, new_vr->min, new_vr->max,
908 			 new_vr->equiv);
909     }
910 
911   BITMAP_FREE (new_vr->equiv);
912 
913   return is_new;
914 }
915 
916 
917 /* Add VAR and VAR's equivalence set to EQUIV.  This is the central
918    point where equivalence processing can be turned on/off.  */
919 
920 static void
921 add_equivalence (bitmap *equiv, const_tree var)
922 {
923   unsigned ver = SSA_NAME_VERSION (var);
924   value_range_t *vr = vr_value[ver];
925 
926   if (*equiv == NULL)
927     *equiv = BITMAP_ALLOC (NULL);
928   bitmap_set_bit (*equiv, ver);
929   if (vr && vr->equiv)
930     bitmap_ior_into (*equiv, vr->equiv);
931 }
932 
933 
934 /* Return true if VR is ~[0, 0].  */
935 
936 static inline bool
937 range_is_nonnull (value_range_t *vr)
938 {
939   return vr->type == VR_ANTI_RANGE
940 	 && integer_zerop (vr->min)
941 	 && integer_zerop (vr->max);
942 }
943 
944 
945 /* Return true if VR is [0, 0].  */
946 
947 static inline bool
948 range_is_null (value_range_t *vr)
949 {
950   return vr->type == VR_RANGE
951 	 && integer_zerop (vr->min)
952 	 && integer_zerop (vr->max);
953 }
954 
955 /* Return true if max and min of VR are INTEGER_CST.  It's not necessary
956    a singleton.  */
957 
958 static inline bool
959 range_int_cst_p (value_range_t *vr)
960 {
961   return (vr->type == VR_RANGE
962 	  && TREE_CODE (vr->max) == INTEGER_CST
963 	  && TREE_CODE (vr->min) == INTEGER_CST);
964 }
965 
966 /* Return true if VR is a INTEGER_CST singleton.  */
967 
968 static inline bool
969 range_int_cst_singleton_p (value_range_t *vr)
970 {
971   return (range_int_cst_p (vr)
972 	  && !is_overflow_infinity (vr->min)
973 	  && !is_overflow_infinity (vr->max)
974 	  && tree_int_cst_equal (vr->min, vr->max));
975 }
976 
977 /* Return true if value range VR involves at least one symbol.  */
978 
979 static inline bool
980 symbolic_range_p (value_range_t *vr)
981 {
982   return (!is_gimple_min_invariant (vr->min)
983           || !is_gimple_min_invariant (vr->max));
984 }
985 
986 /* Return the single symbol (an SSA_NAME) contained in T if any, or NULL_TREE
987    otherwise.  We only handle additive operations and set NEG to true if the
988    symbol is negated and INV to the invariant part, if any.  */
989 
990 static tree
991 get_single_symbol (tree t, bool *neg, tree *inv)
992 {
993   bool neg_;
994   tree inv_;
995 
996   if (TREE_CODE (t) == PLUS_EXPR
997       || TREE_CODE (t) == POINTER_PLUS_EXPR
998       || TREE_CODE (t) == MINUS_EXPR)
999     {
1000       if (is_gimple_min_invariant (TREE_OPERAND (t, 0)))
1001 	{
1002 	  neg_ = (TREE_CODE (t) == MINUS_EXPR);
1003 	  inv_ = TREE_OPERAND (t, 0);
1004 	  t = TREE_OPERAND (t, 1);
1005 	}
1006       else if (is_gimple_min_invariant (TREE_OPERAND (t, 1)))
1007 	{
1008 	  neg_ = false;
1009 	  inv_ = TREE_OPERAND (t, 1);
1010 	  t = TREE_OPERAND (t, 0);
1011 	}
1012       else
1013         return NULL_TREE;
1014     }
1015   else
1016     {
1017       neg_ = false;
1018       inv_ = NULL_TREE;
1019     }
1020 
1021   if (TREE_CODE (t) == NEGATE_EXPR)
1022     {
1023       t = TREE_OPERAND (t, 0);
1024       neg_ = !neg_;
1025     }
1026 
1027   if (TREE_CODE (t) != SSA_NAME)
1028     return NULL_TREE;
1029 
1030   *neg = neg_;
1031   *inv = inv_;
1032   return t;
1033 }
1034 
1035 /* The reverse operation: build a symbolic expression with TYPE
1036    from symbol SYM, negated according to NEG, and invariant INV.  */
1037 
1038 static tree
1039 build_symbolic_expr (tree type, tree sym, bool neg, tree inv)
1040 {
1041   const bool pointer_p = POINTER_TYPE_P (type);
1042   tree t = sym;
1043 
1044   if (neg)
1045     t = build1 (NEGATE_EXPR, type, t);
1046 
1047   if (integer_zerop (inv))
1048     return t;
1049 
1050   return build2 (pointer_p ? POINTER_PLUS_EXPR : PLUS_EXPR, type, t, inv);
1051 }
1052 
1053 /* Return true if value range VR involves exactly one symbol SYM.  */
1054 
1055 static bool
1056 symbolic_range_based_on_p (value_range_t *vr, const_tree sym)
1057 {
1058   bool neg, min_has_symbol, max_has_symbol;
1059   tree inv;
1060 
1061   if (is_gimple_min_invariant (vr->min))
1062     min_has_symbol = false;
1063   else if (get_single_symbol (vr->min, &neg, &inv) == sym)
1064     min_has_symbol = true;
1065   else
1066     return false;
1067 
1068   if (is_gimple_min_invariant (vr->max))
1069     max_has_symbol = false;
1070   else if (get_single_symbol (vr->max, &neg, &inv) == sym)
1071     max_has_symbol = true;
1072   else
1073     return false;
1074 
1075   return (min_has_symbol || max_has_symbol);
1076 }
1077 
1078 /* Return true if value range VR uses an overflow infinity.  */
1079 
1080 static inline bool
1081 overflow_infinity_range_p (value_range_t *vr)
1082 {
1083   return (vr->type == VR_RANGE
1084 	  && (is_overflow_infinity (vr->min)
1085 	      || is_overflow_infinity (vr->max)));
1086 }
1087 
1088 /* Return false if we can not make a valid comparison based on VR;
1089    this will be the case if it uses an overflow infinity and overflow
1090    is not undefined (i.e., -fno-strict-overflow is in effect).
1091    Otherwise return true, and set *STRICT_OVERFLOW_P to true if VR
1092    uses an overflow infinity.  */
1093 
1094 static bool
1095 usable_range_p (value_range_t *vr, bool *strict_overflow_p)
1096 {
1097   gcc_assert (vr->type == VR_RANGE);
1098   if (is_overflow_infinity (vr->min))
1099     {
1100       *strict_overflow_p = true;
1101       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (vr->min)))
1102 	return false;
1103     }
1104   if (is_overflow_infinity (vr->max))
1105     {
1106       *strict_overflow_p = true;
1107       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (vr->max)))
1108 	return false;
1109     }
1110   return true;
1111 }
1112 
1113 
1114 /* Return true if the result of assignment STMT is know to be non-negative.
1115    If the return value is based on the assumption that signed overflow is
1116    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
1117    *STRICT_OVERFLOW_P.*/
1118 
1119 static bool
1120 gimple_assign_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
1121 {
1122   enum tree_code code = gimple_assign_rhs_code (stmt);
1123   switch (get_gimple_rhs_class (code))
1124     {
1125     case GIMPLE_UNARY_RHS:
1126       return tree_unary_nonnegative_warnv_p (gimple_assign_rhs_code (stmt),
1127 					     gimple_expr_type (stmt),
1128 					     gimple_assign_rhs1 (stmt),
1129 					     strict_overflow_p);
1130     case GIMPLE_BINARY_RHS:
1131       return tree_binary_nonnegative_warnv_p (gimple_assign_rhs_code (stmt),
1132 					      gimple_expr_type (stmt),
1133 					      gimple_assign_rhs1 (stmt),
1134 					      gimple_assign_rhs2 (stmt),
1135 					      strict_overflow_p);
1136     case GIMPLE_TERNARY_RHS:
1137       return false;
1138     case GIMPLE_SINGLE_RHS:
1139       return tree_single_nonnegative_warnv_p (gimple_assign_rhs1 (stmt),
1140 					      strict_overflow_p);
1141     case GIMPLE_INVALID_RHS:
1142       gcc_unreachable ();
1143     default:
1144       gcc_unreachable ();
1145     }
1146 }
1147 
1148 /* Return true if return value of call STMT is know to be non-negative.
1149    If the return value is based on the assumption that signed overflow is
1150    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
1151    *STRICT_OVERFLOW_P.*/
1152 
1153 static bool
1154 gimple_call_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
1155 {
1156   tree arg0 = gimple_call_num_args (stmt) > 0 ?
1157     gimple_call_arg (stmt, 0) : NULL_TREE;
1158   tree arg1 = gimple_call_num_args (stmt) > 1 ?
1159     gimple_call_arg (stmt, 1) : NULL_TREE;
1160 
1161   return tree_call_nonnegative_warnv_p (gimple_expr_type (stmt),
1162 					gimple_call_fndecl (stmt),
1163 					arg0,
1164 					arg1,
1165 					strict_overflow_p);
1166 }
1167 
1168 /* Return true if STMT is know to to compute a non-negative value.
1169    If the return value is based on the assumption that signed overflow is
1170    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
1171    *STRICT_OVERFLOW_P.*/
1172 
1173 static bool
1174 gimple_stmt_nonnegative_warnv_p (gimple stmt, bool *strict_overflow_p)
1175 {
1176   switch (gimple_code (stmt))
1177     {
1178     case GIMPLE_ASSIGN:
1179       return gimple_assign_nonnegative_warnv_p (stmt, strict_overflow_p);
1180     case GIMPLE_CALL:
1181       return gimple_call_nonnegative_warnv_p (stmt, strict_overflow_p);
1182     default:
1183       gcc_unreachable ();
1184     }
1185 }
1186 
1187 /* Return true if the result of assignment STMT is know to be non-zero.
1188    If the return value is based on the assumption that signed overflow is
1189    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
1190    *STRICT_OVERFLOW_P.*/
1191 
1192 static bool
1193 gimple_assign_nonzero_warnv_p (gimple stmt, bool *strict_overflow_p)
1194 {
1195   enum tree_code code = gimple_assign_rhs_code (stmt);
1196   switch (get_gimple_rhs_class (code))
1197     {
1198     case GIMPLE_UNARY_RHS:
1199       return tree_unary_nonzero_warnv_p (gimple_assign_rhs_code (stmt),
1200 					 gimple_expr_type (stmt),
1201 					 gimple_assign_rhs1 (stmt),
1202 					 strict_overflow_p);
1203     case GIMPLE_BINARY_RHS:
1204       return tree_binary_nonzero_warnv_p (gimple_assign_rhs_code (stmt),
1205 					  gimple_expr_type (stmt),
1206 					  gimple_assign_rhs1 (stmt),
1207 					  gimple_assign_rhs2 (stmt),
1208 					  strict_overflow_p);
1209     case GIMPLE_TERNARY_RHS:
1210       return false;
1211     case GIMPLE_SINGLE_RHS:
1212       return tree_single_nonzero_warnv_p (gimple_assign_rhs1 (stmt),
1213 					  strict_overflow_p);
1214     case GIMPLE_INVALID_RHS:
1215       gcc_unreachable ();
1216     default:
1217       gcc_unreachable ();
1218     }
1219 }
1220 
1221 /* Return true if STMT is known to compute a non-zero value.
1222    If the return value is based on the assumption that signed overflow is
1223    undefined, set *STRICT_OVERFLOW_P to true; otherwise, don't change
1224    *STRICT_OVERFLOW_P.*/
1225 
1226 static bool
1227 gimple_stmt_nonzero_warnv_p (gimple stmt, bool *strict_overflow_p)
1228 {
1229   switch (gimple_code (stmt))
1230     {
1231     case GIMPLE_ASSIGN:
1232       return gimple_assign_nonzero_warnv_p (stmt, strict_overflow_p);
1233     case GIMPLE_CALL:
1234       {
1235 	tree fndecl = gimple_call_fndecl (stmt);
1236 	if (!fndecl) return false;
1237 	if (flag_delete_null_pointer_checks && !flag_check_new
1238 	    && DECL_IS_OPERATOR_NEW (fndecl)
1239 	    && !TREE_NOTHROW (fndecl))
1240 	  return true;
1241 	if (flag_delete_null_pointer_checks &&
1242 	    lookup_attribute ("returns_nonnull",
1243 			      TYPE_ATTRIBUTES (gimple_call_fntype (stmt))))
1244 	  return true;
1245 	return gimple_alloca_call_p (stmt);
1246       }
1247     default:
1248       gcc_unreachable ();
1249     }
1250 }
1251 
1252 /* Like tree_expr_nonzero_warnv_p, but this function uses value ranges
1253    obtained so far.  */
1254 
1255 static bool
1256 vrp_stmt_computes_nonzero (gimple stmt, bool *strict_overflow_p)
1257 {
1258   if (gimple_stmt_nonzero_warnv_p (stmt, strict_overflow_p))
1259     return true;
1260 
1261   /* If we have an expression of the form &X->a, then the expression
1262      is nonnull if X is nonnull.  */
1263   if (is_gimple_assign (stmt)
1264       && gimple_assign_rhs_code (stmt) == ADDR_EXPR)
1265     {
1266       tree expr = gimple_assign_rhs1 (stmt);
1267       tree base = get_base_address (TREE_OPERAND (expr, 0));
1268 
1269       if (base != NULL_TREE
1270 	  && TREE_CODE (base) == MEM_REF
1271 	  && TREE_CODE (TREE_OPERAND (base, 0)) == SSA_NAME)
1272 	{
1273 	  value_range_t *vr = get_value_range (TREE_OPERAND (base, 0));
1274 	  if (range_is_nonnull (vr))
1275 	    return true;
1276 	}
1277     }
1278 
1279   return false;
1280 }
1281 
1282 /* Returns true if EXPR is a valid value (as expected by compare_values) --
1283    a gimple invariant, or SSA_NAME +- CST.  */
1284 
1285 static bool
1286 valid_value_p (tree expr)
1287 {
1288   if (TREE_CODE (expr) == SSA_NAME)
1289     return true;
1290 
1291   if (TREE_CODE (expr) == PLUS_EXPR
1292       || TREE_CODE (expr) == MINUS_EXPR)
1293     return (TREE_CODE (TREE_OPERAND (expr, 0)) == SSA_NAME
1294 	    && TREE_CODE (TREE_OPERAND (expr, 1)) == INTEGER_CST);
1295 
1296   return is_gimple_min_invariant (expr);
1297 }
1298 
1299 /* Return
1300    1 if VAL < VAL2
1301    0 if !(VAL < VAL2)
1302    -2 if those are incomparable.  */
1303 static inline int
1304 operand_less_p (tree val, tree val2)
1305 {
1306   /* LT is folded faster than GE and others.  Inline the common case.  */
1307   if (TREE_CODE (val) == INTEGER_CST && TREE_CODE (val2) == INTEGER_CST)
1308     return tree_int_cst_lt (val, val2);
1309   else
1310     {
1311       tree tcmp;
1312 
1313       fold_defer_overflow_warnings ();
1314 
1315       tcmp = fold_binary_to_constant (LT_EXPR, boolean_type_node, val, val2);
1316 
1317       fold_undefer_and_ignore_overflow_warnings ();
1318 
1319       if (!tcmp
1320 	  || TREE_CODE (tcmp) != INTEGER_CST)
1321 	return -2;
1322 
1323       if (!integer_zerop (tcmp))
1324 	return 1;
1325     }
1326 
1327   /* val >= val2, not considering overflow infinity.  */
1328   if (is_negative_overflow_infinity (val))
1329     return is_negative_overflow_infinity (val2) ? 0 : 1;
1330   else if (is_positive_overflow_infinity (val2))
1331     return is_positive_overflow_infinity (val) ? 0 : 1;
1332 
1333   return 0;
1334 }
1335 
1336 /* Compare two values VAL1 and VAL2.  Return
1337 
1338    	-2 if VAL1 and VAL2 cannot be compared at compile-time,
1339    	-1 if VAL1 < VAL2,
1340    	 0 if VAL1 == VAL2,
1341 	+1 if VAL1 > VAL2, and
1342 	+2 if VAL1 != VAL2
1343 
1344    This is similar to tree_int_cst_compare but supports pointer values
1345    and values that cannot be compared at compile time.
1346 
1347    If STRICT_OVERFLOW_P is not NULL, then set *STRICT_OVERFLOW_P to
1348    true if the return value is only valid if we assume that signed
1349    overflow is undefined.  */
1350 
1351 static int
1352 compare_values_warnv (tree val1, tree val2, bool *strict_overflow_p)
1353 {
1354   if (val1 == val2)
1355     return 0;
1356 
1357   /* Below we rely on the fact that VAL1 and VAL2 are both pointers or
1358      both integers.  */
1359   gcc_assert (POINTER_TYPE_P (TREE_TYPE (val1))
1360 	      == POINTER_TYPE_P (TREE_TYPE (val2)));
1361 
1362   /* Convert the two values into the same type.  This is needed because
1363      sizetype causes sign extension even for unsigned types.  */
1364   val2 = fold_convert (TREE_TYPE (val1), val2);
1365   STRIP_USELESS_TYPE_CONVERSION (val2);
1366 
1367   if ((TREE_CODE (val1) == SSA_NAME
1368        || (TREE_CODE (val1) == NEGATE_EXPR
1369 	   && TREE_CODE (TREE_OPERAND (val1, 0)) == SSA_NAME)
1370        || TREE_CODE (val1) == PLUS_EXPR
1371        || TREE_CODE (val1) == MINUS_EXPR)
1372       && (TREE_CODE (val2) == SSA_NAME
1373 	  || (TREE_CODE (val2) == NEGATE_EXPR
1374 	      && TREE_CODE (TREE_OPERAND (val2, 0)) == SSA_NAME)
1375 	  || TREE_CODE (val2) == PLUS_EXPR
1376 	  || TREE_CODE (val2) == MINUS_EXPR))
1377     {
1378       tree n1, c1, n2, c2;
1379       enum tree_code code1, code2;
1380 
1381       /* If VAL1 and VAL2 are of the form '[-]NAME [+-] CST' or 'NAME',
1382 	 return -1 or +1 accordingly.  If VAL1 and VAL2 don't use the
1383 	 same name, return -2.  */
1384       if (TREE_CODE (val1) == SSA_NAME || TREE_CODE (val1) == NEGATE_EXPR)
1385 	{
1386 	  code1 = SSA_NAME;
1387 	  n1 = val1;
1388 	  c1 = NULL_TREE;
1389 	}
1390       else
1391 	{
1392 	  code1 = TREE_CODE (val1);
1393 	  n1 = TREE_OPERAND (val1, 0);
1394 	  c1 = TREE_OPERAND (val1, 1);
1395 	  if (tree_int_cst_sgn (c1) == -1)
1396 	    {
1397 	      if (is_negative_overflow_infinity (c1))
1398 		return -2;
1399 	      c1 = fold_unary_to_constant (NEGATE_EXPR, TREE_TYPE (c1), c1);
1400 	      if (!c1)
1401 		return -2;
1402 	      code1 = code1 == MINUS_EXPR ? PLUS_EXPR : MINUS_EXPR;
1403 	    }
1404 	}
1405 
1406       if (TREE_CODE (val2) == SSA_NAME || TREE_CODE (val2) == NEGATE_EXPR)
1407 	{
1408 	  code2 = SSA_NAME;
1409 	  n2 = val2;
1410 	  c2 = NULL_TREE;
1411 	}
1412       else
1413 	{
1414 	  code2 = TREE_CODE (val2);
1415 	  n2 = TREE_OPERAND (val2, 0);
1416 	  c2 = TREE_OPERAND (val2, 1);
1417 	  if (tree_int_cst_sgn (c2) == -1)
1418 	    {
1419 	      if (is_negative_overflow_infinity (c2))
1420 		return -2;
1421 	      c2 = fold_unary_to_constant (NEGATE_EXPR, TREE_TYPE (c2), c2);
1422 	      if (!c2)
1423 		return -2;
1424 	      code2 = code2 == MINUS_EXPR ? PLUS_EXPR : MINUS_EXPR;
1425 	    }
1426 	}
1427 
1428       /* Both values must use the same name.  */
1429       if (TREE_CODE (n1) == NEGATE_EXPR && TREE_CODE (n2) == NEGATE_EXPR)
1430 	{
1431 	  n1 = TREE_OPERAND (n1, 0);
1432 	  n2 = TREE_OPERAND (n2, 0);
1433 	}
1434       if (n1 != n2)
1435 	return -2;
1436 
1437       if (code1 == SSA_NAME && code2 == SSA_NAME)
1438 	/* NAME == NAME  */
1439 	return 0;
1440 
1441       /* If overflow is defined we cannot simplify more.  */
1442       if (!TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (val1)))
1443 	return -2;
1444 
1445       if (strict_overflow_p != NULL
1446 	  && (code1 == SSA_NAME || !TREE_NO_WARNING (val1))
1447 	  && (code2 == SSA_NAME || !TREE_NO_WARNING (val2)))
1448 	*strict_overflow_p = true;
1449 
1450       if (code1 == SSA_NAME)
1451 	{
1452 	  if (code2 == PLUS_EXPR)
1453 	    /* NAME < NAME + CST  */
1454 	    return -1;
1455 	  else if (code2 == MINUS_EXPR)
1456 	    /* NAME > NAME - CST  */
1457 	    return 1;
1458 	}
1459       else if (code1 == PLUS_EXPR)
1460 	{
1461 	  if (code2 == SSA_NAME)
1462 	    /* NAME + CST > NAME  */
1463 	    return 1;
1464 	  else if (code2 == PLUS_EXPR)
1465 	    /* NAME + CST1 > NAME + CST2, if CST1 > CST2  */
1466 	    return compare_values_warnv (c1, c2, strict_overflow_p);
1467 	  else if (code2 == MINUS_EXPR)
1468 	    /* NAME + CST1 > NAME - CST2  */
1469 	    return 1;
1470 	}
1471       else if (code1 == MINUS_EXPR)
1472 	{
1473 	  if (code2 == SSA_NAME)
1474 	    /* NAME - CST < NAME  */
1475 	    return -1;
1476 	  else if (code2 == PLUS_EXPR)
1477 	    /* NAME - CST1 < NAME + CST2  */
1478 	    return -1;
1479 	  else if (code2 == MINUS_EXPR)
1480 	    /* NAME - CST1 > NAME - CST2, if CST1 < CST2.  Notice that
1481 	       C1 and C2 are swapped in the call to compare_values.  */
1482 	    return compare_values_warnv (c2, c1, strict_overflow_p);
1483 	}
1484 
1485       gcc_unreachable ();
1486     }
1487 
1488   /* We cannot compare non-constants.  */
1489   if (!is_gimple_min_invariant (val1) || !is_gimple_min_invariant (val2))
1490     return -2;
1491 
1492   if (!POINTER_TYPE_P (TREE_TYPE (val1)))
1493     {
1494       /* We cannot compare overflowed values, except for overflow
1495 	 infinities.  */
1496       if (TREE_OVERFLOW (val1) || TREE_OVERFLOW (val2))
1497 	{
1498 	  if (strict_overflow_p != NULL)
1499 	    *strict_overflow_p = true;
1500 	  if (is_negative_overflow_infinity (val1))
1501 	    return is_negative_overflow_infinity (val2) ? 0 : -1;
1502 	  else if (is_negative_overflow_infinity (val2))
1503 	    return 1;
1504 	  else if (is_positive_overflow_infinity (val1))
1505 	    return is_positive_overflow_infinity (val2) ? 0 : 1;
1506 	  else if (is_positive_overflow_infinity (val2))
1507 	    return -1;
1508 	  return -2;
1509 	}
1510 
1511       return tree_int_cst_compare (val1, val2);
1512     }
1513   else
1514     {
1515       tree t;
1516 
1517       /* First see if VAL1 and VAL2 are not the same.  */
1518       if (val1 == val2 || operand_equal_p (val1, val2, 0))
1519 	return 0;
1520 
1521       /* If VAL1 is a lower address than VAL2, return -1.  */
1522       if (operand_less_p (val1, val2) == 1)
1523 	return -1;
1524 
1525       /* If VAL1 is a higher address than VAL2, return +1.  */
1526       if (operand_less_p (val2, val1) == 1)
1527 	return 1;
1528 
1529       /* If VAL1 is different than VAL2, return +2.
1530 	 For integer constants we either have already returned -1 or 1
1531 	 or they are equivalent.  We still might succeed in proving
1532 	 something about non-trivial operands.  */
1533       if (TREE_CODE (val1) != INTEGER_CST
1534 	  || TREE_CODE (val2) != INTEGER_CST)
1535 	{
1536           t = fold_binary_to_constant (NE_EXPR, boolean_type_node, val1, val2);
1537 	  if (t && integer_onep (t))
1538 	    return 2;
1539 	}
1540 
1541       return -2;
1542     }
1543 }
1544 
1545 /* Compare values like compare_values_warnv, but treat comparisons of
1546    nonconstants which rely on undefined overflow as incomparable.  */
1547 
1548 static int
1549 compare_values (tree val1, tree val2)
1550 {
1551   bool sop;
1552   int ret;
1553 
1554   sop = false;
1555   ret = compare_values_warnv (val1, val2, &sop);
1556   if (sop
1557       && (!is_gimple_min_invariant (val1) || !is_gimple_min_invariant (val2)))
1558     ret = -2;
1559   return ret;
1560 }
1561 
1562 
1563 /* Return 1 if VAL is inside value range MIN <= VAL <= MAX,
1564           0 if VAL is not inside [MIN, MAX],
1565 	 -2 if we cannot tell either way.
1566 
1567    Benchmark compile/20001226-1.c compilation time after changing this
1568    function.  */
1569 
1570 static inline int
1571 value_inside_range (tree val, tree min, tree max)
1572 {
1573   int cmp1, cmp2;
1574 
1575   cmp1 = operand_less_p (val, min);
1576   if (cmp1 == -2)
1577     return -2;
1578   if (cmp1 == 1)
1579     return 0;
1580 
1581   cmp2 = operand_less_p (max, val);
1582   if (cmp2 == -2)
1583     return -2;
1584 
1585   return !cmp2;
1586 }
1587 
1588 
1589 /* Return true if value ranges VR0 and VR1 have a non-empty
1590    intersection.
1591 
1592    Benchmark compile/20001226-1.c compilation time after changing this
1593    function.
1594    */
1595 
1596 static inline bool
1597 value_ranges_intersect_p (value_range_t *vr0, value_range_t *vr1)
1598 {
1599   /* The value ranges do not intersect if the maximum of the first range is
1600      less than the minimum of the second range or vice versa.
1601      When those relations are unknown, we can't do any better.  */
1602   if (operand_less_p (vr0->max, vr1->min) != 0)
1603     return false;
1604   if (operand_less_p (vr1->max, vr0->min) != 0)
1605     return false;
1606   return true;
1607 }
1608 
1609 
1610 /* Return 1 if [MIN, MAX] includes the value zero, 0 if it does not
1611    include the value zero, -2 if we cannot tell.  */
1612 
1613 static inline int
1614 range_includes_zero_p (tree min, tree max)
1615 {
1616   tree zero = build_int_cst (TREE_TYPE (min), 0);
1617   return value_inside_range (zero, min, max);
1618 }
1619 
1620 /* Return true if *VR is know to only contain nonnegative values.  */
1621 
1622 static inline bool
1623 value_range_nonnegative_p (value_range_t *vr)
1624 {
1625   /* Testing for VR_ANTI_RANGE is not useful here as any anti-range
1626      which would return a useful value should be encoded as a
1627      VR_RANGE.  */
1628   if (vr->type == VR_RANGE)
1629     {
1630       int result = compare_values (vr->min, integer_zero_node);
1631       return (result == 0 || result == 1);
1632     }
1633 
1634   return false;
1635 }
1636 
1637 /* If *VR has a value rante that is a single constant value return that,
1638    otherwise return NULL_TREE.  */
1639 
1640 static tree
1641 value_range_constant_singleton (value_range_t *vr)
1642 {
1643   if (vr->type == VR_RANGE
1644       && operand_equal_p (vr->min, vr->max, 0)
1645       && is_gimple_min_invariant (vr->min))
1646     return vr->min;
1647 
1648   return NULL_TREE;
1649 }
1650 
1651 /* If OP has a value range with a single constant value return that,
1652    otherwise return NULL_TREE.  This returns OP itself if OP is a
1653    constant.  */
1654 
1655 static tree
1656 op_with_constant_singleton_value_range (tree op)
1657 {
1658   if (is_gimple_min_invariant (op))
1659     return op;
1660 
1661   if (TREE_CODE (op) != SSA_NAME)
1662     return NULL_TREE;
1663 
1664   return value_range_constant_singleton (get_value_range (op));
1665 }
1666 
1667 /* Return true if op is in a boolean [0, 1] value-range.  */
1668 
1669 static bool
1670 op_with_boolean_value_range_p (tree op)
1671 {
1672   value_range_t *vr;
1673 
1674   if (TYPE_PRECISION (TREE_TYPE (op)) == 1)
1675     return true;
1676 
1677   if (integer_zerop (op)
1678       || integer_onep (op))
1679     return true;
1680 
1681   if (TREE_CODE (op) != SSA_NAME)
1682     return false;
1683 
1684   vr = get_value_range (op);
1685   return (vr->type == VR_RANGE
1686 	  && integer_zerop (vr->min)
1687 	  && integer_onep (vr->max));
1688 }
1689 
1690 /* Extract value range information from an ASSERT_EXPR EXPR and store
1691    it in *VR_P.  */
1692 
1693 static void
1694 extract_range_from_assert (value_range_t *vr_p, tree expr)
1695 {
1696   tree var, cond, limit, min, max, type;
1697   value_range_t *limit_vr;
1698   enum tree_code cond_code;
1699 
1700   var = ASSERT_EXPR_VAR (expr);
1701   cond = ASSERT_EXPR_COND (expr);
1702 
1703   gcc_assert (COMPARISON_CLASS_P (cond));
1704 
1705   /* Find VAR in the ASSERT_EXPR conditional.  */
1706   if (var == TREE_OPERAND (cond, 0)
1707       || TREE_CODE (TREE_OPERAND (cond, 0)) == PLUS_EXPR
1708       || TREE_CODE (TREE_OPERAND (cond, 0)) == NOP_EXPR)
1709     {
1710       /* If the predicate is of the form VAR COMP LIMIT, then we just
1711 	 take LIMIT from the RHS and use the same comparison code.  */
1712       cond_code = TREE_CODE (cond);
1713       limit = TREE_OPERAND (cond, 1);
1714       cond = TREE_OPERAND (cond, 0);
1715     }
1716   else
1717     {
1718       /* If the predicate is of the form LIMIT COMP VAR, then we need
1719 	 to flip around the comparison code to create the proper range
1720 	 for VAR.  */
1721       cond_code = swap_tree_comparison (TREE_CODE (cond));
1722       limit = TREE_OPERAND (cond, 0);
1723       cond = TREE_OPERAND (cond, 1);
1724     }
1725 
1726   limit = avoid_overflow_infinity (limit);
1727 
1728   type = TREE_TYPE (var);
1729   gcc_assert (limit != var);
1730 
1731   /* For pointer arithmetic, we only keep track of pointer equality
1732      and inequality.  */
1733   if (POINTER_TYPE_P (type) && cond_code != NE_EXPR && cond_code != EQ_EXPR)
1734     {
1735       set_value_range_to_varying (vr_p);
1736       return;
1737     }
1738 
1739   /* If LIMIT is another SSA name and LIMIT has a range of its own,
1740      try to use LIMIT's range to avoid creating symbolic ranges
1741      unnecessarily. */
1742   limit_vr = (TREE_CODE (limit) == SSA_NAME) ? get_value_range (limit) : NULL;
1743 
1744   /* LIMIT's range is only interesting if it has any useful information.  */
1745   if (limit_vr
1746       && (limit_vr->type == VR_UNDEFINED
1747 	  || limit_vr->type == VR_VARYING
1748 	  || symbolic_range_p (limit_vr)))
1749     limit_vr = NULL;
1750 
1751   /* Initially, the new range has the same set of equivalences of
1752      VAR's range.  This will be revised before returning the final
1753      value.  Since assertions may be chained via mutually exclusive
1754      predicates, we will need to trim the set of equivalences before
1755      we are done.  */
1756   gcc_assert (vr_p->equiv == NULL);
1757   add_equivalence (&vr_p->equiv, var);
1758 
1759   /* Extract a new range based on the asserted comparison for VAR and
1760      LIMIT's value range.  Notice that if LIMIT has an anti-range, we
1761      will only use it for equality comparisons (EQ_EXPR).  For any
1762      other kind of assertion, we cannot derive a range from LIMIT's
1763      anti-range that can be used to describe the new range.  For
1764      instance, ASSERT_EXPR <x_2, x_2 <= b_4>.  If b_4 is ~[2, 10],
1765      then b_4 takes on the ranges [-INF, 1] and [11, +INF].  There is
1766      no single range for x_2 that could describe LE_EXPR, so we might
1767      as well build the range [b_4, +INF] for it.
1768      One special case we handle is extracting a range from a
1769      range test encoded as (unsigned)var + CST <= limit.  */
1770   if (TREE_CODE (cond) == NOP_EXPR
1771       || TREE_CODE (cond) == PLUS_EXPR)
1772     {
1773       if (TREE_CODE (cond) == PLUS_EXPR)
1774         {
1775           min = fold_build1 (NEGATE_EXPR, TREE_TYPE (TREE_OPERAND (cond, 1)),
1776 			     TREE_OPERAND (cond, 1));
1777           max = int_const_binop (PLUS_EXPR, limit, min);
1778 	  cond = TREE_OPERAND (cond, 0);
1779 	}
1780       else
1781 	{
1782 	  min = build_int_cst (TREE_TYPE (var), 0);
1783 	  max = limit;
1784 	}
1785 
1786       /* Make sure to not set TREE_OVERFLOW on the final type
1787 	 conversion.  We are willingly interpreting large positive
1788 	 unsigned values as negative signed values here.  */
1789       min = force_fit_type (TREE_TYPE (var), wi::to_widest (min), 0, false);
1790       max = force_fit_type (TREE_TYPE (var), wi::to_widest (max), 0, false);
1791 
1792       /* We can transform a max, min range to an anti-range or
1793          vice-versa.  Use set_and_canonicalize_value_range which does
1794 	 this for us.  */
1795       if (cond_code == LE_EXPR)
1796         set_and_canonicalize_value_range (vr_p, VR_RANGE,
1797 					  min, max, vr_p->equiv);
1798       else if (cond_code == GT_EXPR)
1799         set_and_canonicalize_value_range (vr_p, VR_ANTI_RANGE,
1800 					  min, max, vr_p->equiv);
1801       else
1802 	gcc_unreachable ();
1803     }
1804   else if (cond_code == EQ_EXPR)
1805     {
1806       enum value_range_type range_type;
1807 
1808       if (limit_vr)
1809 	{
1810 	  range_type = limit_vr->type;
1811 	  min = limit_vr->min;
1812 	  max = limit_vr->max;
1813 	}
1814       else
1815 	{
1816 	  range_type = VR_RANGE;
1817 	  min = limit;
1818 	  max = limit;
1819 	}
1820 
1821       set_value_range (vr_p, range_type, min, max, vr_p->equiv);
1822 
1823       /* When asserting the equality VAR == LIMIT and LIMIT is another
1824 	 SSA name, the new range will also inherit the equivalence set
1825 	 from LIMIT.  */
1826       if (TREE_CODE (limit) == SSA_NAME)
1827 	add_equivalence (&vr_p->equiv, limit);
1828     }
1829   else if (cond_code == NE_EXPR)
1830     {
1831       /* As described above, when LIMIT's range is an anti-range and
1832 	 this assertion is an inequality (NE_EXPR), then we cannot
1833 	 derive anything from the anti-range.  For instance, if
1834 	 LIMIT's range was ~[0, 0], the assertion 'VAR != LIMIT' does
1835 	 not imply that VAR's range is [0, 0].  So, in the case of
1836 	 anti-ranges, we just assert the inequality using LIMIT and
1837 	 not its anti-range.
1838 
1839 	 If LIMIT_VR is a range, we can only use it to build a new
1840 	 anti-range if LIMIT_VR is a single-valued range.  For
1841 	 instance, if LIMIT_VR is [0, 1], the predicate
1842 	 VAR != [0, 1] does not mean that VAR's range is ~[0, 1].
1843 	 Rather, it means that for value 0 VAR should be ~[0, 0]
1844 	 and for value 1, VAR should be ~[1, 1].  We cannot
1845 	 represent these ranges.
1846 
1847 	 The only situation in which we can build a valid
1848 	 anti-range is when LIMIT_VR is a single-valued range
1849 	 (i.e., LIMIT_VR->MIN == LIMIT_VR->MAX).  In that case,
1850 	 build the anti-range ~[LIMIT_VR->MIN, LIMIT_VR->MAX].  */
1851       if (limit_vr
1852 	  && limit_vr->type == VR_RANGE
1853 	  && compare_values (limit_vr->min, limit_vr->max) == 0)
1854 	{
1855 	  min = limit_vr->min;
1856 	  max = limit_vr->max;
1857 	}
1858       else
1859 	{
1860 	  /* In any other case, we cannot use LIMIT's range to build a
1861 	     valid anti-range.  */
1862 	  min = max = limit;
1863 	}
1864 
1865       /* If MIN and MAX cover the whole range for their type, then
1866 	 just use the original LIMIT.  */
1867       if (INTEGRAL_TYPE_P (type)
1868 	  && vrp_val_is_min (min)
1869 	  && vrp_val_is_max (max))
1870 	min = max = limit;
1871 
1872       set_and_canonicalize_value_range (vr_p, VR_ANTI_RANGE,
1873 					min, max, vr_p->equiv);
1874     }
1875   else if (cond_code == LE_EXPR || cond_code == LT_EXPR)
1876     {
1877       min = TYPE_MIN_VALUE (type);
1878 
1879       if (limit_vr == NULL || limit_vr->type == VR_ANTI_RANGE)
1880 	max = limit;
1881       else
1882 	{
1883 	  /* If LIMIT_VR is of the form [N1, N2], we need to build the
1884 	     range [MIN, N2] for LE_EXPR and [MIN, N2 - 1] for
1885 	     LT_EXPR.  */
1886 	  max = limit_vr->max;
1887 	}
1888 
1889       /* If the maximum value forces us to be out of bounds, simply punt.
1890 	 It would be pointless to try and do anything more since this
1891 	 all should be optimized away above us.  */
1892       if ((cond_code == LT_EXPR
1893 	   && compare_values (max, min) == 0)
1894 	  || is_overflow_infinity (max))
1895 	set_value_range_to_varying (vr_p);
1896       else
1897 	{
1898 	  /* For LT_EXPR, we create the range [MIN, MAX - 1].  */
1899 	  if (cond_code == LT_EXPR)
1900 	    {
1901 	      if (TYPE_PRECISION (TREE_TYPE (max)) == 1
1902 		  && !TYPE_UNSIGNED (TREE_TYPE (max)))
1903 		max = fold_build2 (PLUS_EXPR, TREE_TYPE (max), max,
1904 				   build_int_cst (TREE_TYPE (max), -1));
1905 	      else
1906 		max = fold_build2 (MINUS_EXPR, TREE_TYPE (max), max,
1907 				   build_int_cst (TREE_TYPE (max), 1));
1908 	      if (EXPR_P (max))
1909 		TREE_NO_WARNING (max) = 1;
1910 	    }
1911 
1912 	  set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1913 	}
1914     }
1915   else if (cond_code == GE_EXPR || cond_code == GT_EXPR)
1916     {
1917       max = TYPE_MAX_VALUE (type);
1918 
1919       if (limit_vr == NULL || limit_vr->type == VR_ANTI_RANGE)
1920 	min = limit;
1921       else
1922 	{
1923 	  /* If LIMIT_VR is of the form [N1, N2], we need to build the
1924 	     range [N1, MAX] for GE_EXPR and [N1 + 1, MAX] for
1925 	     GT_EXPR.  */
1926 	  min = limit_vr->min;
1927 	}
1928 
1929       /* If the minimum value forces us to be out of bounds, simply punt.
1930 	 It would be pointless to try and do anything more since this
1931 	 all should be optimized away above us.  */
1932       if ((cond_code == GT_EXPR
1933 	   && compare_values (min, max) == 0)
1934 	  || is_overflow_infinity (min))
1935 	set_value_range_to_varying (vr_p);
1936       else
1937 	{
1938 	  /* For GT_EXPR, we create the range [MIN + 1, MAX].  */
1939 	  if (cond_code == GT_EXPR)
1940 	    {
1941 	      if (TYPE_PRECISION (TREE_TYPE (min)) == 1
1942 		  && !TYPE_UNSIGNED (TREE_TYPE (min)))
1943 		min = fold_build2 (MINUS_EXPR, TREE_TYPE (min), min,
1944 				   build_int_cst (TREE_TYPE (min), -1));
1945 	      else
1946 		min = fold_build2 (PLUS_EXPR, TREE_TYPE (min), min,
1947 				   build_int_cst (TREE_TYPE (min), 1));
1948 	      if (EXPR_P (min))
1949 		TREE_NO_WARNING (min) = 1;
1950 	    }
1951 
1952 	  set_value_range (vr_p, VR_RANGE, min, max, vr_p->equiv);
1953 	}
1954     }
1955   else
1956     gcc_unreachable ();
1957 
1958   /* Finally intersect the new range with what we already know about var.  */
1959   vrp_intersect_ranges (vr_p, get_value_range (var));
1960 }
1961 
1962 
1963 /* Extract range information from SSA name VAR and store it in VR.  If
1964    VAR has an interesting range, use it.  Otherwise, create the
1965    range [VAR, VAR] and return it.  This is useful in situations where
1966    we may have conditionals testing values of VARYING names.  For
1967    instance,
1968 
1969    	x_3 = y_5;
1970 	if (x_3 > y_5)
1971 	  ...
1972 
1973     Even if y_5 is deemed VARYING, we can determine that x_3 > y_5 is
1974     always false.  */
1975 
1976 static void
1977 extract_range_from_ssa_name (value_range_t *vr, tree var)
1978 {
1979   value_range_t *var_vr = get_value_range (var);
1980 
1981   if (var_vr->type != VR_VARYING)
1982     copy_value_range (vr, var_vr);
1983   else
1984     set_value_range (vr, VR_RANGE, var, var, NULL);
1985 
1986   add_equivalence (&vr->equiv, var);
1987 }
1988 
1989 
1990 /* Wrapper around int_const_binop.  If the operation overflows and we
1991    are not using wrapping arithmetic, then adjust the result to be
1992    -INF or +INF depending on CODE, VAL1 and VAL2.  This can return
1993    NULL_TREE if we need to use an overflow infinity representation but
1994    the type does not support it.  */
1995 
1996 static tree
1997 vrp_int_const_binop (enum tree_code code, tree val1, tree val2)
1998 {
1999   tree res;
2000 
2001   res = int_const_binop (code, val1, val2);
2002 
2003   /* If we are using unsigned arithmetic, operate symbolically
2004      on -INF and +INF as int_const_binop only handles signed overflow.  */
2005   if (TYPE_UNSIGNED (TREE_TYPE (val1)))
2006     {
2007       int checkz = compare_values (res, val1);
2008       bool overflow = false;
2009 
2010       /* Ensure that res = val1 [+*] val2 >= val1
2011          or that res = val1 - val2 <= val1.  */
2012       if ((code == PLUS_EXPR
2013 	   && !(checkz == 1 || checkz == 0))
2014           || (code == MINUS_EXPR
2015 	      && !(checkz == 0 || checkz == -1)))
2016 	{
2017 	  overflow = true;
2018 	}
2019       /* Checking for multiplication overflow is done by dividing the
2020 	 output of the multiplication by the first input of the
2021 	 multiplication.  If the result of that division operation is
2022 	 not equal to the second input of the multiplication, then the
2023 	 multiplication overflowed.  */
2024       else if (code == MULT_EXPR && !integer_zerop (val1))
2025 	{
2026 	  tree tmp = int_const_binop (TRUNC_DIV_EXPR,
2027 				      res,
2028 				      val1);
2029 	  int check = compare_values (tmp, val2);
2030 
2031 	  if (check != 0)
2032 	    overflow = true;
2033 	}
2034 
2035       if (overflow)
2036 	{
2037 	  res = copy_node (res);
2038 	  TREE_OVERFLOW (res) = 1;
2039 	}
2040 
2041     }
2042   else if (TYPE_OVERFLOW_WRAPS (TREE_TYPE (val1)))
2043     /* If the singed operation wraps then int_const_binop has done
2044        everything we want.  */
2045     ;
2046   /* Signed division of -1/0 overflows and by the time it gets here
2047      returns NULL_TREE.  */
2048   else if (!res)
2049     return NULL_TREE;
2050   else if ((TREE_OVERFLOW (res)
2051 	    && !TREE_OVERFLOW (val1)
2052 	    && !TREE_OVERFLOW (val2))
2053 	   || is_overflow_infinity (val1)
2054 	   || is_overflow_infinity (val2))
2055     {
2056       /* If the operation overflowed but neither VAL1 nor VAL2 are
2057 	 overflown, return -INF or +INF depending on the operation
2058 	 and the combination of signs of the operands.  */
2059       int sgn1 = tree_int_cst_sgn (val1);
2060       int sgn2 = tree_int_cst_sgn (val2);
2061 
2062       if (needs_overflow_infinity (TREE_TYPE (res))
2063 	  && !supports_overflow_infinity (TREE_TYPE (res)))
2064 	return NULL_TREE;
2065 
2066       /* We have to punt on adding infinities of different signs,
2067 	 since we can't tell what the sign of the result should be.
2068 	 Likewise for subtracting infinities of the same sign.  */
2069       if (((code == PLUS_EXPR && sgn1 != sgn2)
2070 	   || (code == MINUS_EXPR && sgn1 == sgn2))
2071 	  && is_overflow_infinity (val1)
2072 	  && is_overflow_infinity (val2))
2073 	return NULL_TREE;
2074 
2075       /* Don't try to handle division or shifting of infinities.  */
2076       if ((code == TRUNC_DIV_EXPR
2077 	   || code == FLOOR_DIV_EXPR
2078 	   || code == CEIL_DIV_EXPR
2079 	   || code == EXACT_DIV_EXPR
2080 	   || code == ROUND_DIV_EXPR
2081 	   || code == RSHIFT_EXPR)
2082 	  && (is_overflow_infinity (val1)
2083 	      || is_overflow_infinity (val2)))
2084 	return NULL_TREE;
2085 
2086       /* Notice that we only need to handle the restricted set of
2087 	 operations handled by extract_range_from_binary_expr.
2088 	 Among them, only multiplication, addition and subtraction
2089 	 can yield overflow without overflown operands because we
2090 	 are working with integral types only... except in the
2091 	 case VAL1 = -INF and VAL2 = -1 which overflows to +INF
2092 	 for division too.  */
2093 
2094       /* For multiplication, the sign of the overflow is given
2095 	 by the comparison of the signs of the operands.  */
2096       if ((code == MULT_EXPR && sgn1 == sgn2)
2097           /* For addition, the operands must be of the same sign
2098 	     to yield an overflow.  Its sign is therefore that
2099 	     of one of the operands, for example the first.  For
2100 	     infinite operands X + -INF is negative, not positive.  */
2101 	  || (code == PLUS_EXPR
2102 	      && (sgn1 >= 0
2103 		  ? !is_negative_overflow_infinity (val2)
2104 		  : is_positive_overflow_infinity (val2)))
2105 	  /* For subtraction, non-infinite operands must be of
2106 	     different signs to yield an overflow.  Its sign is
2107 	     therefore that of the first operand or the opposite of
2108 	     that of the second operand.  A first operand of 0 counts
2109 	     as positive here, for the corner case 0 - (-INF), which
2110 	     overflows, but must yield +INF.  For infinite operands 0
2111 	     - INF is negative, not positive.  */
2112 	  || (code == MINUS_EXPR
2113 	      && (sgn1 >= 0
2114 		  ? !is_positive_overflow_infinity (val2)
2115 		  : is_negative_overflow_infinity (val2)))
2116 	  /* We only get in here with positive shift count, so the
2117 	     overflow direction is the same as the sign of val1.
2118 	     Actually rshift does not overflow at all, but we only
2119 	     handle the case of shifting overflowed -INF and +INF.  */
2120 	  || (code == RSHIFT_EXPR
2121 	      && sgn1 >= 0)
2122 	  /* For division, the only case is -INF / -1 = +INF.  */
2123 	  || code == TRUNC_DIV_EXPR
2124 	  || code == FLOOR_DIV_EXPR
2125 	  || code == CEIL_DIV_EXPR
2126 	  || code == EXACT_DIV_EXPR
2127 	  || code == ROUND_DIV_EXPR)
2128 	return (needs_overflow_infinity (TREE_TYPE (res))
2129 		? positive_overflow_infinity (TREE_TYPE (res))
2130 		: TYPE_MAX_VALUE (TREE_TYPE (res)));
2131       else
2132 	return (needs_overflow_infinity (TREE_TYPE (res))
2133 		? negative_overflow_infinity (TREE_TYPE (res))
2134 		: TYPE_MIN_VALUE (TREE_TYPE (res)));
2135     }
2136 
2137   return res;
2138 }
2139 
2140 
2141 /* For range VR compute two wide_int bitmasks.  In *MAY_BE_NONZERO
2142    bitmask if some bit is unset, it means for all numbers in the range
2143    the bit is 0, otherwise it might be 0 or 1.  In *MUST_BE_NONZERO
2144    bitmask if some bit is set, it means for all numbers in the range
2145    the bit is 1, otherwise it might be 0 or 1.  */
2146 
2147 static bool
2148 zero_nonzero_bits_from_vr (const tree expr_type,
2149 			   value_range_t *vr,
2150 			   wide_int *may_be_nonzero,
2151 			   wide_int *must_be_nonzero)
2152 {
2153   *may_be_nonzero = wi::minus_one (TYPE_PRECISION (expr_type));
2154   *must_be_nonzero = wi::zero (TYPE_PRECISION (expr_type));
2155   if (!range_int_cst_p (vr)
2156       || is_overflow_infinity (vr->min)
2157       || is_overflow_infinity (vr->max))
2158     return false;
2159 
2160   if (range_int_cst_singleton_p (vr))
2161     {
2162       *may_be_nonzero = vr->min;
2163       *must_be_nonzero = *may_be_nonzero;
2164     }
2165   else if (tree_int_cst_sgn (vr->min) >= 0
2166 	   || tree_int_cst_sgn (vr->max) < 0)
2167     {
2168       wide_int xor_mask = wi::bit_xor (vr->min, vr->max);
2169       *may_be_nonzero = wi::bit_or (vr->min, vr->max);
2170       *must_be_nonzero = wi::bit_and (vr->min, vr->max);
2171       if (xor_mask != 0)
2172 	{
2173 	  wide_int mask = wi::mask (wi::floor_log2 (xor_mask), false,
2174 				    may_be_nonzero->get_precision ());
2175 	  *may_be_nonzero = *may_be_nonzero | mask;
2176 	  *must_be_nonzero = must_be_nonzero->and_not (mask);
2177 	}
2178     }
2179 
2180   return true;
2181 }
2182 
2183 /* Create two value-ranges in *VR0 and *VR1 from the anti-range *AR
2184    so that *VR0 U *VR1 == *AR.  Returns true if that is possible,
2185    false otherwise.  If *AR can be represented with a single range
2186    *VR1 will be VR_UNDEFINED.  */
2187 
2188 static bool
2189 ranges_from_anti_range (value_range_t *ar,
2190 			value_range_t *vr0, value_range_t *vr1)
2191 {
2192   tree type = TREE_TYPE (ar->min);
2193 
2194   vr0->type = VR_UNDEFINED;
2195   vr1->type = VR_UNDEFINED;
2196 
2197   if (ar->type != VR_ANTI_RANGE
2198       || TREE_CODE (ar->min) != INTEGER_CST
2199       || TREE_CODE (ar->max) != INTEGER_CST
2200       || !vrp_val_min (type)
2201       || !vrp_val_max (type))
2202     return false;
2203 
2204   if (!vrp_val_is_min (ar->min))
2205     {
2206       vr0->type = VR_RANGE;
2207       vr0->min = vrp_val_min (type);
2208       vr0->max = wide_int_to_tree (type, wi::sub (ar->min, 1));
2209     }
2210   if (!vrp_val_is_max (ar->max))
2211     {
2212       vr1->type = VR_RANGE;
2213       vr1->min = wide_int_to_tree (type, wi::add (ar->max, 1));
2214       vr1->max = vrp_val_max (type);
2215     }
2216   if (vr0->type == VR_UNDEFINED)
2217     {
2218       *vr0 = *vr1;
2219       vr1->type = VR_UNDEFINED;
2220     }
2221 
2222   return vr0->type != VR_UNDEFINED;
2223 }
2224 
2225 /* Helper to extract a value-range *VR for a multiplicative operation
2226    *VR0 CODE *VR1.  */
2227 
2228 static void
2229 extract_range_from_multiplicative_op_1 (value_range_t *vr,
2230 					enum tree_code code,
2231 					value_range_t *vr0, value_range_t *vr1)
2232 {
2233   enum value_range_type type;
2234   tree val[4];
2235   size_t i;
2236   tree min, max;
2237   bool sop;
2238   int cmp;
2239 
2240   /* Multiplications, divisions and shifts are a bit tricky to handle,
2241      depending on the mix of signs we have in the two ranges, we
2242      need to operate on different values to get the minimum and
2243      maximum values for the new range.  One approach is to figure
2244      out all the variations of range combinations and do the
2245      operations.
2246 
2247      However, this involves several calls to compare_values and it
2248      is pretty convoluted.  It's simpler to do the 4 operations
2249      (MIN0 OP MIN1, MIN0 OP MAX1, MAX0 OP MIN1 and MAX0 OP MAX0 OP
2250      MAX1) and then figure the smallest and largest values to form
2251      the new range.  */
2252   gcc_assert (code == MULT_EXPR
2253 	      || code == TRUNC_DIV_EXPR
2254 	      || code == FLOOR_DIV_EXPR
2255 	      || code == CEIL_DIV_EXPR
2256 	      || code == EXACT_DIV_EXPR
2257 	      || code == ROUND_DIV_EXPR
2258 	      || code == RSHIFT_EXPR
2259 	      || code == LSHIFT_EXPR);
2260   gcc_assert ((vr0->type == VR_RANGE
2261 	       || (code == MULT_EXPR && vr0->type == VR_ANTI_RANGE))
2262 	      && vr0->type == vr1->type);
2263 
2264   type = vr0->type;
2265 
2266   /* Compute the 4 cross operations.  */
2267   sop = false;
2268   val[0] = vrp_int_const_binop (code, vr0->min, vr1->min);
2269   if (val[0] == NULL_TREE)
2270     sop = true;
2271 
2272   if (vr1->max == vr1->min)
2273     val[1] = NULL_TREE;
2274   else
2275     {
2276       val[1] = vrp_int_const_binop (code, vr0->min, vr1->max);
2277       if (val[1] == NULL_TREE)
2278 	sop = true;
2279     }
2280 
2281   if (vr0->max == vr0->min)
2282     val[2] = NULL_TREE;
2283   else
2284     {
2285       val[2] = vrp_int_const_binop (code, vr0->max, vr1->min);
2286       if (val[2] == NULL_TREE)
2287 	sop = true;
2288     }
2289 
2290   if (vr0->min == vr0->max || vr1->min == vr1->max)
2291     val[3] = NULL_TREE;
2292   else
2293     {
2294       val[3] = vrp_int_const_binop (code, vr0->max, vr1->max);
2295       if (val[3] == NULL_TREE)
2296 	sop = true;
2297     }
2298 
2299   if (sop)
2300     {
2301       set_value_range_to_varying (vr);
2302       return;
2303     }
2304 
2305   /* Set MIN to the minimum of VAL[i] and MAX to the maximum
2306      of VAL[i].  */
2307   min = val[0];
2308   max = val[0];
2309   for (i = 1; i < 4; i++)
2310     {
2311       if (!is_gimple_min_invariant (min)
2312 	  || (TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2313 	  || !is_gimple_min_invariant (max)
2314 	  || (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2315 	break;
2316 
2317       if (val[i])
2318 	{
2319 	  if (!is_gimple_min_invariant (val[i])
2320 	      || (TREE_OVERFLOW (val[i])
2321 		  && !is_overflow_infinity (val[i])))
2322 	    {
2323 	      /* If we found an overflowed value, set MIN and MAX
2324 		 to it so that we set the resulting range to
2325 		 VARYING.  */
2326 	      min = max = val[i];
2327 	      break;
2328 	    }
2329 
2330 	  if (compare_values (val[i], min) == -1)
2331 	    min = val[i];
2332 
2333 	  if (compare_values (val[i], max) == 1)
2334 	    max = val[i];
2335 	}
2336     }
2337 
2338   /* If either MIN or MAX overflowed, then set the resulting range to
2339      VARYING.  But we do accept an overflow infinity
2340      representation.  */
2341   if (min == NULL_TREE
2342       || !is_gimple_min_invariant (min)
2343       || (TREE_OVERFLOW (min) && !is_overflow_infinity (min))
2344       || max == NULL_TREE
2345       || !is_gimple_min_invariant (max)
2346       || (TREE_OVERFLOW (max) && !is_overflow_infinity (max)))
2347     {
2348       set_value_range_to_varying (vr);
2349       return;
2350     }
2351 
2352   /* We punt if:
2353      1) [-INF, +INF]
2354      2) [-INF, +-INF(OVF)]
2355      3) [+-INF(OVF), +INF]
2356      4) [+-INF(OVF), +-INF(OVF)]
2357      We learn nothing when we have INF and INF(OVF) on both sides.
2358      Note that we do accept [-INF, -INF] and [+INF, +INF] without
2359      overflow.  */
2360   if ((vrp_val_is_min (min) || is_overflow_infinity (min))
2361       && (vrp_val_is_max (max) || is_overflow_infinity (max)))
2362     {
2363       set_value_range_to_varying (vr);
2364       return;
2365     }
2366 
2367   cmp = compare_values (min, max);
2368   if (cmp == -2 || cmp == 1)
2369     {
2370       /* If the new range has its limits swapped around (MIN > MAX),
2371 	 then the operation caused one of them to wrap around, mark
2372 	 the new range VARYING.  */
2373       set_value_range_to_varying (vr);
2374     }
2375   else
2376     set_value_range (vr, type, min, max, NULL);
2377 }
2378 
2379 /* Extract range information from a binary operation CODE based on
2380    the ranges of each of its operands *VR0 and *VR1 with resulting
2381    type EXPR_TYPE.  The resulting range is stored in *VR.  */
2382 
2383 static void
2384 extract_range_from_binary_expr_1 (value_range_t *vr,
2385 				  enum tree_code code, tree expr_type,
2386 				  value_range_t *vr0_, value_range_t *vr1_)
2387 {
2388   value_range_t vr0 = *vr0_, vr1 = *vr1_;
2389   value_range_t vrtem0 = VR_INITIALIZER, vrtem1 = VR_INITIALIZER;
2390   enum value_range_type type;
2391   tree min = NULL_TREE, max = NULL_TREE;
2392   int cmp;
2393 
2394   if (!INTEGRAL_TYPE_P (expr_type)
2395       && !POINTER_TYPE_P (expr_type))
2396     {
2397       set_value_range_to_varying (vr);
2398       return;
2399     }
2400 
2401   /* Not all binary expressions can be applied to ranges in a
2402      meaningful way.  Handle only arithmetic operations.  */
2403   if (code != PLUS_EXPR
2404       && code != MINUS_EXPR
2405       && code != POINTER_PLUS_EXPR
2406       && code != MULT_EXPR
2407       && code != TRUNC_DIV_EXPR
2408       && code != FLOOR_DIV_EXPR
2409       && code != CEIL_DIV_EXPR
2410       && code != EXACT_DIV_EXPR
2411       && code != ROUND_DIV_EXPR
2412       && code != TRUNC_MOD_EXPR
2413       && code != RSHIFT_EXPR
2414       && code != LSHIFT_EXPR
2415       && code != MIN_EXPR
2416       && code != MAX_EXPR
2417       && code != BIT_AND_EXPR
2418       && code != BIT_IOR_EXPR
2419       && code != BIT_XOR_EXPR)
2420     {
2421       set_value_range_to_varying (vr);
2422       return;
2423     }
2424 
2425   /* If both ranges are UNDEFINED, so is the result.  */
2426   if (vr0.type == VR_UNDEFINED && vr1.type == VR_UNDEFINED)
2427     {
2428       set_value_range_to_undefined (vr);
2429       return;
2430     }
2431   /* If one of the ranges is UNDEFINED drop it to VARYING for the following
2432      code.  At some point we may want to special-case operations that
2433      have UNDEFINED result for all or some value-ranges of the not UNDEFINED
2434      operand.  */
2435   else if (vr0.type == VR_UNDEFINED)
2436     set_value_range_to_varying (&vr0);
2437   else if (vr1.type == VR_UNDEFINED)
2438     set_value_range_to_varying (&vr1);
2439 
2440   /* Now canonicalize anti-ranges to ranges when they are not symbolic
2441      and express ~[] op X as ([]' op X) U ([]'' op X).  */
2442   if (vr0.type == VR_ANTI_RANGE
2443       && ranges_from_anti_range (&vr0, &vrtem0, &vrtem1))
2444     {
2445       extract_range_from_binary_expr_1 (vr, code, expr_type, &vrtem0, vr1_);
2446       if (vrtem1.type != VR_UNDEFINED)
2447 	{
2448 	  value_range_t vrres = VR_INITIALIZER;
2449 	  extract_range_from_binary_expr_1 (&vrres, code, expr_type,
2450 					    &vrtem1, vr1_);
2451 	  vrp_meet (vr, &vrres);
2452 	}
2453       return;
2454     }
2455   /* Likewise for X op ~[].  */
2456   if (vr1.type == VR_ANTI_RANGE
2457       && ranges_from_anti_range (&vr1, &vrtem0, &vrtem1))
2458     {
2459       extract_range_from_binary_expr_1 (vr, code, expr_type, vr0_, &vrtem0);
2460       if (vrtem1.type != VR_UNDEFINED)
2461 	{
2462 	  value_range_t vrres = VR_INITIALIZER;
2463 	  extract_range_from_binary_expr_1 (&vrres, code, expr_type,
2464 					    vr0_, &vrtem1);
2465 	  vrp_meet (vr, &vrres);
2466 	}
2467       return;
2468     }
2469 
2470   /* The type of the resulting value range defaults to VR0.TYPE.  */
2471   type = vr0.type;
2472 
2473   /* Refuse to operate on VARYING ranges, ranges of different kinds
2474      and symbolic ranges.  As an exception, we allow BIT_{AND,IOR}
2475      because we may be able to derive a useful range even if one of
2476      the operands is VR_VARYING or symbolic range.  Similarly for
2477      divisions, MIN/MAX and PLUS/MINUS.
2478 
2479      TODO, we may be able to derive anti-ranges in some cases.  */
2480   if (code != BIT_AND_EXPR
2481       && code != BIT_IOR_EXPR
2482       && code != TRUNC_DIV_EXPR
2483       && code != FLOOR_DIV_EXPR
2484       && code != CEIL_DIV_EXPR
2485       && code != EXACT_DIV_EXPR
2486       && code != ROUND_DIV_EXPR
2487       && code != TRUNC_MOD_EXPR
2488       && code != MIN_EXPR
2489       && code != MAX_EXPR
2490       && code != PLUS_EXPR
2491       && code != MINUS_EXPR
2492       && code != RSHIFT_EXPR
2493       && (vr0.type == VR_VARYING
2494 	  || vr1.type == VR_VARYING
2495 	  || vr0.type != vr1.type
2496 	  || symbolic_range_p (&vr0)
2497 	  || symbolic_range_p (&vr1)))
2498     {
2499       set_value_range_to_varying (vr);
2500       return;
2501     }
2502 
2503   /* Now evaluate the expression to determine the new range.  */
2504   if (POINTER_TYPE_P (expr_type))
2505     {
2506       if (code == MIN_EXPR || code == MAX_EXPR)
2507 	{
2508 	  /* For MIN/MAX expressions with pointers, we only care about
2509 	     nullness, if both are non null, then the result is nonnull.
2510 	     If both are null, then the result is null. Otherwise they
2511 	     are varying.  */
2512 	  if (range_is_nonnull (&vr0) && range_is_nonnull (&vr1))
2513 	    set_value_range_to_nonnull (vr, expr_type);
2514 	  else if (range_is_null (&vr0) && range_is_null (&vr1))
2515 	    set_value_range_to_null (vr, expr_type);
2516 	  else
2517 	    set_value_range_to_varying (vr);
2518 	}
2519       else if (code == POINTER_PLUS_EXPR)
2520 	{
2521 	  /* For pointer types, we are really only interested in asserting
2522 	     whether the expression evaluates to non-NULL.  */
2523 	  if (range_is_nonnull (&vr0) || range_is_nonnull (&vr1))
2524 	    set_value_range_to_nonnull (vr, expr_type);
2525 	  else if (range_is_null (&vr0) && range_is_null (&vr1))
2526 	    set_value_range_to_null (vr, expr_type);
2527 	  else
2528 	    set_value_range_to_varying (vr);
2529 	}
2530       else if (code == BIT_AND_EXPR)
2531 	{
2532 	  /* For pointer types, we are really only interested in asserting
2533 	     whether the expression evaluates to non-NULL.  */
2534 	  if (range_is_nonnull (&vr0) && range_is_nonnull (&vr1))
2535 	    set_value_range_to_nonnull (vr, expr_type);
2536 	  else if (range_is_null (&vr0) || range_is_null (&vr1))
2537 	    set_value_range_to_null (vr, expr_type);
2538 	  else
2539 	    set_value_range_to_varying (vr);
2540 	}
2541       else
2542 	set_value_range_to_varying (vr);
2543 
2544       return;
2545     }
2546 
2547   /* For integer ranges, apply the operation to each end of the
2548      range and see what we end up with.  */
2549   if (code == PLUS_EXPR || code == MINUS_EXPR)
2550     {
2551       const bool minus_p = (code == MINUS_EXPR);
2552       tree min_op0 = vr0.min;
2553       tree min_op1 = minus_p ? vr1.max : vr1.min;
2554       tree max_op0 = vr0.max;
2555       tree max_op1 = minus_p ? vr1.min : vr1.max;
2556       tree sym_min_op0 = NULL_TREE;
2557       tree sym_min_op1 = NULL_TREE;
2558       tree sym_max_op0 = NULL_TREE;
2559       tree sym_max_op1 = NULL_TREE;
2560       bool neg_min_op0, neg_min_op1, neg_max_op0, neg_max_op1;
2561 
2562       /* If we have a PLUS or MINUS with two VR_RANGEs, either constant or
2563 	 single-symbolic ranges, try to compute the precise resulting range,
2564 	 but only if we know that this resulting range will also be constant
2565 	 or single-symbolic.  */
2566       if (vr0.type == VR_RANGE && vr1.type == VR_RANGE
2567 	  && (TREE_CODE (min_op0) == INTEGER_CST
2568 	      || (sym_min_op0
2569 		  = get_single_symbol (min_op0, &neg_min_op0, &min_op0)))
2570 	  && (TREE_CODE (min_op1) == INTEGER_CST
2571 	      || (sym_min_op1
2572 		  = get_single_symbol (min_op1, &neg_min_op1, &min_op1)))
2573 	  && (!(sym_min_op0 && sym_min_op1)
2574 	      || (sym_min_op0 == sym_min_op1
2575 		  && neg_min_op0 == (minus_p ? neg_min_op1 : !neg_min_op1)))
2576 	  && (TREE_CODE (max_op0) == INTEGER_CST
2577 	      || (sym_max_op0
2578 		  = get_single_symbol (max_op0, &neg_max_op0, &max_op0)))
2579 	  && (TREE_CODE (max_op1) == INTEGER_CST
2580 	      || (sym_max_op1
2581 		  = get_single_symbol (max_op1, &neg_max_op1, &max_op1)))
2582 	  && (!(sym_max_op0 && sym_max_op1)
2583 	      || (sym_max_op0 == sym_max_op1
2584 		  && neg_max_op0 == (minus_p ? neg_max_op1 : !neg_max_op1))))
2585 	{
2586 	  const signop sgn = TYPE_SIGN (expr_type);
2587 	  const unsigned int prec = TYPE_PRECISION (expr_type);
2588 	  wide_int type_min, type_max, wmin, wmax;
2589 	  int min_ovf = 0;
2590 	  int max_ovf = 0;
2591 
2592 	  /* Get the lower and upper bounds of the type.  */
2593 	  if (TYPE_OVERFLOW_WRAPS (expr_type))
2594 	    {
2595 	      type_min = wi::min_value (prec, sgn);
2596 	      type_max = wi::max_value (prec, sgn);
2597 	    }
2598 	  else
2599 	    {
2600 	      type_min = vrp_val_min (expr_type);
2601 	      type_max = vrp_val_max (expr_type);
2602 	    }
2603 
2604 	  /* Combine the lower bounds, if any.  */
2605 	  if (min_op0 && min_op1)
2606 	    {
2607 	      if (minus_p)
2608 		{
2609 		  wmin = wi::sub (min_op0, min_op1);
2610 
2611 		  /* Check for overflow.  */
2612 		  if (wi::cmp (0, min_op1, sgn)
2613 		      != wi::cmp (wmin, min_op0, sgn))
2614 		    min_ovf = wi::cmp (min_op0, min_op1, sgn);
2615 		}
2616 	      else
2617 		{
2618 		  wmin = wi::add (min_op0, min_op1);
2619 
2620 		  /* Check for overflow.  */
2621 		  if (wi::cmp (min_op1, 0, sgn)
2622 		      != wi::cmp (wmin, min_op0, sgn))
2623 		    min_ovf = wi::cmp (min_op0, wmin, sgn);
2624 		}
2625 	    }
2626 	  else if (min_op0)
2627 	    wmin = min_op0;
2628 	  else if (min_op1)
2629 	    wmin = minus_p ? wi::neg (min_op1) : min_op1;
2630 	  else
2631 	    wmin = wi::shwi (0, prec);
2632 
2633 	  /* Combine the upper bounds, if any.  */
2634 	  if (max_op0 && max_op1)
2635 	    {
2636 	      if (minus_p)
2637 		{
2638 		  wmax = wi::sub (max_op0, max_op1);
2639 
2640 		  /* Check for overflow.  */
2641 		  if (wi::cmp (0, max_op1, sgn)
2642 		      != wi::cmp (wmax, max_op0, sgn))
2643 		    max_ovf = wi::cmp (max_op0, max_op1, sgn);
2644 		}
2645 	      else
2646 		{
2647 		  wmax = wi::add (max_op0, max_op1);
2648 
2649 		  if (wi::cmp (max_op1, 0, sgn)
2650 		      != wi::cmp (wmax, max_op0, sgn))
2651 		    max_ovf = wi::cmp (max_op0, wmax, sgn);
2652 		}
2653 	    }
2654 	  else if (max_op0)
2655 	    wmax = max_op0;
2656 	  else if (max_op1)
2657 	    wmax = minus_p ? wi::neg (max_op1) : max_op1;
2658 	  else
2659 	    wmax = wi::shwi (0, prec);
2660 
2661 	  /* Check for type overflow.  */
2662 	  if (min_ovf == 0)
2663 	    {
2664 	      if (wi::cmp (wmin, type_min, sgn) == -1)
2665 		min_ovf = -1;
2666 	      else if (wi::cmp (wmin, type_max, sgn) == 1)
2667 		min_ovf = 1;
2668 	    }
2669 	  if (max_ovf == 0)
2670 	    {
2671 	      if (wi::cmp (wmax, type_min, sgn) == -1)
2672 		max_ovf = -1;
2673 	      else if (wi::cmp (wmax, type_max, sgn) == 1)
2674 		max_ovf = 1;
2675 	    }
2676 
2677 	  /* If we have overflow for the constant part and the resulting
2678 	     range will be symbolic, drop to VR_VARYING.  */
2679 	  if ((min_ovf && sym_min_op0 != sym_min_op1)
2680 	      || (max_ovf && sym_max_op0 != sym_max_op1))
2681 	    {
2682 	      set_value_range_to_varying (vr);
2683 	      return;
2684 	    }
2685 
2686 	  if (TYPE_OVERFLOW_WRAPS (expr_type))
2687 	    {
2688 	      /* If overflow wraps, truncate the values and adjust the
2689 		 range kind and bounds appropriately.  */
2690 	      wide_int tmin = wide_int::from (wmin, prec, sgn);
2691 	      wide_int tmax = wide_int::from (wmax, prec, sgn);
2692 	      if (min_ovf == max_ovf)
2693 		{
2694 		  /* No overflow or both overflow or underflow.  The
2695 		     range kind stays VR_RANGE.  */
2696 		  min = wide_int_to_tree (expr_type, tmin);
2697 		  max = wide_int_to_tree (expr_type, tmax);
2698 		}
2699 	      else if (min_ovf == -1 && max_ovf == 1)
2700 		{
2701 		  /* Underflow and overflow, drop to VR_VARYING.  */
2702 		  set_value_range_to_varying (vr);
2703 		  return;
2704 		}
2705 	      else
2706 		{
2707 		  /* Min underflow or max overflow.  The range kind
2708 		     changes to VR_ANTI_RANGE.  */
2709 		  bool covers = false;
2710 		  wide_int tem = tmin;
2711 		  gcc_assert ((min_ovf == -1 && max_ovf == 0)
2712 			      || (max_ovf == 1 && min_ovf == 0));
2713 		  type = VR_ANTI_RANGE;
2714 		  tmin = tmax + 1;
2715 		  if (wi::cmp (tmin, tmax, sgn) < 0)
2716 		    covers = true;
2717 		  tmax = tem - 1;
2718 		  if (wi::cmp (tmax, tem, sgn) > 0)
2719 		    covers = true;
2720 		  /* If the anti-range would cover nothing, drop to varying.
2721 		     Likewise if the anti-range bounds are outside of the
2722 		     types values.  */
2723 		  if (covers || wi::cmp (tmin, tmax, sgn) > 0)
2724 		    {
2725 		      set_value_range_to_varying (vr);
2726 		      return;
2727 		    }
2728 		  min = wide_int_to_tree (expr_type, tmin);
2729 		  max = wide_int_to_tree (expr_type, tmax);
2730 		}
2731 	    }
2732 	  else
2733 	    {
2734 	      /* If overflow does not wrap, saturate to the types min/max
2735 	         value.  */
2736 	      if (min_ovf == -1)
2737 		{
2738 		  if (needs_overflow_infinity (expr_type)
2739 		      && supports_overflow_infinity (expr_type))
2740 		    min = negative_overflow_infinity (expr_type);
2741 		  else
2742 		    min = wide_int_to_tree (expr_type, type_min);
2743 		}
2744 	      else if (min_ovf == 1)
2745 		{
2746 		  if (needs_overflow_infinity (expr_type)
2747 		      && supports_overflow_infinity (expr_type))
2748 		    min = positive_overflow_infinity (expr_type);
2749 		  else
2750 		    min = wide_int_to_tree (expr_type, type_max);
2751 		}
2752 	      else
2753 		min = wide_int_to_tree (expr_type, wmin);
2754 
2755 	      if (max_ovf == -1)
2756 		{
2757 		  if (needs_overflow_infinity (expr_type)
2758 		      && supports_overflow_infinity (expr_type))
2759 		    max = negative_overflow_infinity (expr_type);
2760 		  else
2761 		    max = wide_int_to_tree (expr_type, type_min);
2762 		}
2763 	      else if (max_ovf == 1)
2764 		{
2765 		  if (needs_overflow_infinity (expr_type)
2766 		      && supports_overflow_infinity (expr_type))
2767 		    max = positive_overflow_infinity (expr_type);
2768 		  else
2769 		    max = wide_int_to_tree (expr_type, type_max);
2770 		}
2771 	      else
2772 		max = wide_int_to_tree (expr_type, wmax);
2773 	    }
2774 
2775 	  if (needs_overflow_infinity (expr_type)
2776 	      && supports_overflow_infinity (expr_type))
2777 	    {
2778 	      if ((min_op0 && is_negative_overflow_infinity (min_op0))
2779 		  || (min_op1
2780 		      && (minus_p
2781 			  ? is_positive_overflow_infinity (min_op1)
2782 			  : is_negative_overflow_infinity (min_op1))))
2783 		min = negative_overflow_infinity (expr_type);
2784 	      if ((max_op0 && is_positive_overflow_infinity (max_op0))
2785 		  || (max_op1
2786 		      && (minus_p
2787 			  ? is_negative_overflow_infinity (max_op1)
2788 			  : is_positive_overflow_infinity (max_op1))))
2789 		max = positive_overflow_infinity (expr_type);
2790 	    }
2791 
2792 	  /* If the result lower bound is constant, we're done;
2793 	     otherwise, build the symbolic lower bound.  */
2794 	  if (sym_min_op0 == sym_min_op1)
2795 	    ;
2796 	  else if (sym_min_op0)
2797 	    min = build_symbolic_expr (expr_type, sym_min_op0,
2798 				       neg_min_op0, min);
2799 	  else if (sym_min_op1)
2800 	    {
2801 	      /* We may not negate if that might introduce
2802 		 undefined overflow.  */
2803 	      if (! minus_p
2804 		  || neg_min_op1
2805 		  || TYPE_OVERFLOW_WRAPS (expr_type))
2806 		min = build_symbolic_expr (expr_type, sym_min_op1,
2807 					   neg_min_op1 ^ minus_p, min);
2808 	      else
2809 		min = NULL_TREE;
2810 	    }
2811 
2812 	  /* Likewise for the upper bound.  */
2813 	  if (sym_max_op0 == sym_max_op1)
2814 	    ;
2815 	  else if (sym_max_op0)
2816 	    max = build_symbolic_expr (expr_type, sym_max_op0,
2817 				       neg_max_op0, max);
2818 	  else if (sym_max_op1)
2819 	    {
2820 	      /* We may not negate if that might introduce
2821 		 undefined overflow.  */
2822 	      if (! minus_p
2823 		  || neg_max_op1
2824 		  || TYPE_OVERFLOW_WRAPS (expr_type))
2825 		max = build_symbolic_expr (expr_type, sym_max_op1,
2826 					   neg_max_op1 ^ minus_p, max);
2827 	      else
2828 		max = NULL_TREE;
2829 	    }
2830 	}
2831       else
2832 	{
2833 	  /* For other cases, for example if we have a PLUS_EXPR with two
2834 	     VR_ANTI_RANGEs, drop to VR_VARYING.  It would take more effort
2835 	     to compute a precise range for such a case.
2836 	     ???  General even mixed range kind operations can be expressed
2837 	     by for example transforming ~[3, 5] + [1, 2] to range-only
2838 	     operations and a union primitive:
2839 	       [-INF, 2] + [1, 2]  U  [5, +INF] + [1, 2]
2840 	           [-INF+1, 4]     U    [6, +INF(OVF)]
2841 	     though usually the union is not exactly representable with
2842 	     a single range or anti-range as the above is
2843 		 [-INF+1, +INF(OVF)] intersected with ~[5, 5]
2844 	     but one could use a scheme similar to equivalences for this. */
2845 	  set_value_range_to_varying (vr);
2846 	  return;
2847 	}
2848     }
2849   else if (code == MIN_EXPR
2850 	   || code == MAX_EXPR)
2851     {
2852       if (vr0.type == VR_RANGE
2853 	  && !symbolic_range_p (&vr0))
2854 	{
2855 	  type = VR_RANGE;
2856 	  if (vr1.type == VR_RANGE
2857 	      && !symbolic_range_p (&vr1))
2858 	    {
2859 	      /* For operations that make the resulting range directly
2860 		 proportional to the original ranges, apply the operation to
2861 		 the same end of each range.  */
2862 	      min = vrp_int_const_binop (code, vr0.min, vr1.min);
2863 	      max = vrp_int_const_binop (code, vr0.max, vr1.max);
2864 	    }
2865 	  else if (code == MIN_EXPR)
2866 	    {
2867 	      min = vrp_val_min (expr_type);
2868 	      max = vr0.max;
2869 	    }
2870 	  else if (code == MAX_EXPR)
2871 	    {
2872 	      min = vr0.min;
2873 	      max = vrp_val_max (expr_type);
2874 	    }
2875 	}
2876       else if (vr1.type == VR_RANGE
2877 	       && !symbolic_range_p (&vr1))
2878 	{
2879 	  type = VR_RANGE;
2880 	  if (code == MIN_EXPR)
2881 	    {
2882 	      min = vrp_val_min (expr_type);
2883 	      max = vr1.max;
2884 	    }
2885 	  else if (code == MAX_EXPR)
2886 	    {
2887 	      min = vr1.min;
2888 	      max = vrp_val_max (expr_type);
2889 	    }
2890 	}
2891       else
2892 	{
2893 	  set_value_range_to_varying (vr);
2894 	  return;
2895 	}
2896     }
2897   else if (code == MULT_EXPR)
2898     {
2899       /* Fancy code so that with unsigned, [-3,-1]*[-3,-1] does not
2900 	 drop to varying.  This test requires 2*prec bits if both
2901 	 operands are signed and 2*prec + 2 bits if either is not.  */
2902 
2903       signop sign = TYPE_SIGN (expr_type);
2904       unsigned int prec = TYPE_PRECISION (expr_type);
2905 
2906       if (range_int_cst_p (&vr0)
2907 	  && range_int_cst_p (&vr1)
2908 	  && TYPE_OVERFLOW_WRAPS (expr_type))
2909 	{
2910 	  typedef FIXED_WIDE_INT (WIDE_INT_MAX_PRECISION * 2) vrp_int;
2911 	  typedef generic_wide_int
2912              <wi::extended_tree <WIDE_INT_MAX_PRECISION * 2> > vrp_int_cst;
2913 	  vrp_int sizem1 = wi::mask <vrp_int> (prec, false);
2914 	  vrp_int size = sizem1 + 1;
2915 
2916 	  /* Extend the values using the sign of the result to PREC2.
2917 	     From here on out, everthing is just signed math no matter
2918 	     what the input types were.  */
2919           vrp_int min0 = vrp_int_cst (vr0.min);
2920           vrp_int max0 = vrp_int_cst (vr0.max);
2921           vrp_int min1 = vrp_int_cst (vr1.min);
2922           vrp_int max1 = vrp_int_cst (vr1.max);
2923 	  /* Canonicalize the intervals.  */
2924 	  if (sign == UNSIGNED)
2925 	    {
2926 	      if (wi::ltu_p (size, min0 + max0))
2927 		{
2928 		  min0 -= size;
2929 		  max0 -= size;
2930 		}
2931 
2932 	      if (wi::ltu_p (size, min1 + max1))
2933 		{
2934 		  min1 -= size;
2935 		  max1 -= size;
2936 		}
2937 	    }
2938 
2939 	  vrp_int prod0 = min0 * min1;
2940 	  vrp_int prod1 = min0 * max1;
2941 	  vrp_int prod2 = max0 * min1;
2942 	  vrp_int prod3 = max0 * max1;
2943 
2944 	  /* Sort the 4 products so that min is in prod0 and max is in
2945 	     prod3.  */
2946 	  /* min0min1 > max0max1 */
2947 	  if (wi::gts_p (prod0, prod3))
2948 	    {
2949 	      vrp_int tmp = prod3;
2950 	      prod3 = prod0;
2951 	      prod0 = tmp;
2952 	    }
2953 
2954 	  /* min0max1 > max0min1 */
2955 	  if (wi::gts_p (prod1, prod2))
2956 	    {
2957 	      vrp_int tmp = prod2;
2958 	      prod2 = prod1;
2959 	      prod1 = tmp;
2960 	    }
2961 
2962 	  if (wi::gts_p (prod0, prod1))
2963 	    {
2964 	      vrp_int tmp = prod1;
2965 	      prod1 = prod0;
2966 	      prod0 = tmp;
2967 	    }
2968 
2969 	  if (wi::gts_p (prod2, prod3))
2970 	    {
2971 	      vrp_int tmp = prod3;
2972 	      prod3 = prod2;
2973 	      prod2 = tmp;
2974 	    }
2975 
2976 	  /* diff = max - min.  */
2977 	  prod2 = prod3 - prod0;
2978 	  if (wi::geu_p (prod2, sizem1))
2979 	    {
2980 	      /* the range covers all values.  */
2981 	      set_value_range_to_varying (vr);
2982 	      return;
2983 	    }
2984 
2985 	  /* The following should handle the wrapping and selecting
2986 	     VR_ANTI_RANGE for us.  */
2987 	  min = wide_int_to_tree (expr_type, prod0);
2988 	  max = wide_int_to_tree (expr_type, prod3);
2989 	  set_and_canonicalize_value_range (vr, VR_RANGE, min, max, NULL);
2990 	  return;
2991 	}
2992 
2993       /* If we have an unsigned MULT_EXPR with two VR_ANTI_RANGEs,
2994 	 drop to VR_VARYING.  It would take more effort to compute a
2995 	 precise range for such a case.  For example, if we have
2996 	 op0 == 65536 and op1 == 65536 with their ranges both being
2997 	 ~[0,0] on a 32-bit machine, we would have op0 * op1 == 0, so
2998 	 we cannot claim that the product is in ~[0,0].  Note that we
2999 	 are guaranteed to have vr0.type == vr1.type at this
3000 	 point.  */
3001       if (vr0.type == VR_ANTI_RANGE
3002 	  && !TYPE_OVERFLOW_UNDEFINED (expr_type))
3003 	{
3004 	  set_value_range_to_varying (vr);
3005 	  return;
3006 	}
3007 
3008       extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
3009       return;
3010     }
3011   else if (code == RSHIFT_EXPR
3012 	   || code == LSHIFT_EXPR)
3013     {
3014       /* If we have a RSHIFT_EXPR with any shift values outside [0..prec-1],
3015 	 then drop to VR_VARYING.  Outside of this range we get undefined
3016 	 behavior from the shift operation.  We cannot even trust
3017 	 SHIFT_COUNT_TRUNCATED at this stage, because that applies to rtl
3018 	 shifts, and the operation at the tree level may be widened.  */
3019       if (range_int_cst_p (&vr1)
3020 	  && compare_tree_int (vr1.min, 0) >= 0
3021 	  && compare_tree_int (vr1.max, TYPE_PRECISION (expr_type)) == -1)
3022 	{
3023 	  if (code == RSHIFT_EXPR)
3024 	    {
3025 	      /* Even if vr0 is VARYING or otherwise not usable, we can derive
3026 		 useful ranges just from the shift count.  E.g.
3027 		 x >> 63 for signed 64-bit x is always [-1, 0].  */
3028 	      if (vr0.type != VR_RANGE || symbolic_range_p (&vr0))
3029 		{
3030 		  vr0.type = type = VR_RANGE;
3031 		  vr0.min = vrp_val_min (expr_type);
3032 		  vr0.max = vrp_val_max (expr_type);
3033 		}
3034 	      extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
3035 	      return;
3036 	    }
3037 	  /* We can map lshifts by constants to MULT_EXPR handling.  */
3038 	  else if (code == LSHIFT_EXPR
3039 		   && range_int_cst_singleton_p (&vr1))
3040 	    {
3041 	      bool saved_flag_wrapv;
3042 	      value_range_t vr1p = VR_INITIALIZER;
3043 	      vr1p.type = VR_RANGE;
3044 	      vr1p.min = (wide_int_to_tree
3045 			  (expr_type,
3046 			   wi::set_bit_in_zero (tree_to_shwi (vr1.min),
3047 						TYPE_PRECISION (expr_type))));
3048 	      vr1p.max = vr1p.min;
3049 	      /* We have to use a wrapping multiply though as signed overflow
3050 		 on lshifts is implementation defined in C89.  */
3051 	      saved_flag_wrapv = flag_wrapv;
3052 	      flag_wrapv = 1;
3053 	      extract_range_from_binary_expr_1 (vr, MULT_EXPR, expr_type,
3054 						&vr0, &vr1p);
3055 	      flag_wrapv = saved_flag_wrapv;
3056 	      return;
3057 	    }
3058 	  else if (code == LSHIFT_EXPR
3059 		   && range_int_cst_p (&vr0))
3060 	    {
3061 	      int prec = TYPE_PRECISION (expr_type);
3062 	      int overflow_pos = prec;
3063 	      int bound_shift;
3064 	      wide_int low_bound, high_bound;
3065 	      bool uns = TYPE_UNSIGNED (expr_type);
3066 	      bool in_bounds = false;
3067 
3068 	      if (!uns)
3069 		overflow_pos -= 1;
3070 
3071 	      bound_shift = overflow_pos - tree_to_shwi (vr1.max);
3072 	      /* If bound_shift == HOST_BITS_PER_WIDE_INT, the llshift can
3073 		 overflow.  However, for that to happen, vr1.max needs to be
3074 		 zero, which means vr1 is a singleton range of zero, which
3075 		 means it should be handled by the previous LSHIFT_EXPR
3076 		 if-clause.  */
3077 	      wide_int bound = wi::set_bit_in_zero (bound_shift, prec);
3078 	      wide_int complement = ~(bound - 1);
3079 
3080 	      if (uns)
3081 		{
3082 		  low_bound = bound;
3083 		  high_bound = complement;
3084 		  if (wi::ltu_p (vr0.max, low_bound))
3085 		    {
3086 		      /* [5, 6] << [1, 2] == [10, 24].  */
3087 		      /* We're shifting out only zeroes, the value increases
3088 			 monotonically.  */
3089 		      in_bounds = true;
3090 		    }
3091 		  else if (wi::ltu_p (high_bound, vr0.min))
3092 		    {
3093 		      /* [0xffffff00, 0xffffffff] << [1, 2]
3094 		         == [0xfffffc00, 0xfffffffe].  */
3095 		      /* We're shifting out only ones, the value decreases
3096 			 monotonically.  */
3097 		      in_bounds = true;
3098 		    }
3099 		}
3100 	      else
3101 		{
3102 		  /* [-1, 1] << [1, 2] == [-4, 4].  */
3103 		  low_bound = complement;
3104 		  high_bound = bound;
3105 		  if (wi::lts_p (vr0.max, high_bound)
3106 		      && wi::lts_p (low_bound, vr0.min))
3107 		    {
3108 		      /* For non-negative numbers, we're shifting out only
3109 			 zeroes, the value increases monotonically.
3110 			 For negative numbers, we're shifting out only ones, the
3111 			 value decreases monotomically.  */
3112 		      in_bounds = true;
3113 		    }
3114 		}
3115 
3116 	      if (in_bounds)
3117 		{
3118 		  extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
3119 		  return;
3120 		}
3121 	    }
3122 	}
3123       set_value_range_to_varying (vr);
3124       return;
3125     }
3126   else if (code == TRUNC_DIV_EXPR
3127 	   || code == FLOOR_DIV_EXPR
3128 	   || code == CEIL_DIV_EXPR
3129 	   || code == EXACT_DIV_EXPR
3130 	   || code == ROUND_DIV_EXPR)
3131     {
3132       if (vr0.type != VR_RANGE || symbolic_range_p (&vr0))
3133 	{
3134 	  /* For division, if op1 has VR_RANGE but op0 does not, something
3135 	     can be deduced just from that range.  Say [min, max] / [4, max]
3136 	     gives [min / 4, max / 4] range.  */
3137 	  if (vr1.type == VR_RANGE
3138 	      && !symbolic_range_p (&vr1)
3139 	      && range_includes_zero_p (vr1.min, vr1.max) == 0)
3140 	    {
3141 	      vr0.type = type = VR_RANGE;
3142 	      vr0.min = vrp_val_min (expr_type);
3143 	      vr0.max = vrp_val_max (expr_type);
3144 	    }
3145 	  else
3146 	    {
3147 	      set_value_range_to_varying (vr);
3148 	      return;
3149 	    }
3150 	}
3151 
3152       /* For divisions, if flag_non_call_exceptions is true, we must
3153 	 not eliminate a division by zero.  */
3154       if (cfun->can_throw_non_call_exceptions
3155 	  && (vr1.type != VR_RANGE
3156 	      || range_includes_zero_p (vr1.min, vr1.max) != 0))
3157 	{
3158 	  set_value_range_to_varying (vr);
3159 	  return;
3160 	}
3161 
3162       /* For divisions, if op0 is VR_RANGE, we can deduce a range
3163 	 even if op1 is VR_VARYING, VR_ANTI_RANGE, symbolic or can
3164 	 include 0.  */
3165       if (vr0.type == VR_RANGE
3166 	  && (vr1.type != VR_RANGE
3167 	      || range_includes_zero_p (vr1.min, vr1.max) != 0))
3168 	{
3169 	  tree zero = build_int_cst (TREE_TYPE (vr0.min), 0);
3170 	  int cmp;
3171 
3172 	  min = NULL_TREE;
3173 	  max = NULL_TREE;
3174 	  if (TYPE_UNSIGNED (expr_type)
3175 	      || value_range_nonnegative_p (&vr1))
3176 	    {
3177 	      /* For unsigned division or when divisor is known
3178 		 to be non-negative, the range has to cover
3179 		 all numbers from 0 to max for positive max
3180 		 and all numbers from min to 0 for negative min.  */
3181 	      cmp = compare_values (vr0.max, zero);
3182 	      if (cmp == -1)
3183 		max = zero;
3184 	      else if (cmp == 0 || cmp == 1)
3185 		max = vr0.max;
3186 	      else
3187 		type = VR_VARYING;
3188 	      cmp = compare_values (vr0.min, zero);
3189 	      if (cmp == 1)
3190 		min = zero;
3191 	      else if (cmp == 0 || cmp == -1)
3192 		min = vr0.min;
3193 	      else
3194 		type = VR_VARYING;
3195 	    }
3196 	  else
3197 	    {
3198 	      /* Otherwise the range is -max .. max or min .. -min
3199 		 depending on which bound is bigger in absolute value,
3200 		 as the division can change the sign.  */
3201 	      abs_extent_range (vr, vr0.min, vr0.max);
3202 	      return;
3203 	    }
3204 	  if (type == VR_VARYING)
3205 	    {
3206 	      set_value_range_to_varying (vr);
3207 	      return;
3208 	    }
3209 	}
3210       else
3211 	{
3212 	  extract_range_from_multiplicative_op_1 (vr, code, &vr0, &vr1);
3213 	  return;
3214 	}
3215     }
3216   else if (code == TRUNC_MOD_EXPR)
3217     {
3218       if (vr1.type != VR_RANGE
3219 	  || range_includes_zero_p (vr1.min, vr1.max) != 0
3220 	  || vrp_val_is_min (vr1.min))
3221 	{
3222 	  set_value_range_to_varying (vr);
3223 	  return;
3224 	}
3225       type = VR_RANGE;
3226       /* Compute MAX <|vr1.min|, |vr1.max|> - 1.  */
3227       max = fold_unary_to_constant (ABS_EXPR, expr_type, vr1.min);
3228       if (tree_int_cst_lt (max, vr1.max))
3229 	max = vr1.max;
3230       max = int_const_binop (MINUS_EXPR, max, build_int_cst (TREE_TYPE (max), 1));
3231       /* If the dividend is non-negative the modulus will be
3232 	 non-negative as well.  */
3233       if (TYPE_UNSIGNED (expr_type)
3234 	  || value_range_nonnegative_p (&vr0))
3235 	min = build_int_cst (TREE_TYPE (max), 0);
3236       else
3237 	min = fold_unary_to_constant (NEGATE_EXPR, expr_type, max);
3238     }
3239   else if (code == BIT_AND_EXPR || code == BIT_IOR_EXPR || code == BIT_XOR_EXPR)
3240     {
3241       bool int_cst_range0, int_cst_range1;
3242       wide_int may_be_nonzero0, may_be_nonzero1;
3243       wide_int must_be_nonzero0, must_be_nonzero1;
3244 
3245       int_cst_range0 = zero_nonzero_bits_from_vr (expr_type, &vr0,
3246 						  &may_be_nonzero0,
3247 						  &must_be_nonzero0);
3248       int_cst_range1 = zero_nonzero_bits_from_vr (expr_type, &vr1,
3249 						  &may_be_nonzero1,
3250 						  &must_be_nonzero1);
3251 
3252       type = VR_RANGE;
3253       if (code == BIT_AND_EXPR)
3254 	{
3255 	  min = wide_int_to_tree (expr_type,
3256 				  must_be_nonzero0 & must_be_nonzero1);
3257 	  wide_int wmax = may_be_nonzero0 & may_be_nonzero1;
3258 	  /* If both input ranges contain only negative values we can
3259 	     truncate the result range maximum to the minimum of the
3260 	     input range maxima.  */
3261 	  if (int_cst_range0 && int_cst_range1
3262 	      && tree_int_cst_sgn (vr0.max) < 0
3263 	      && tree_int_cst_sgn (vr1.max) < 0)
3264 	    {
3265 	      wmax = wi::min (wmax, vr0.max, TYPE_SIGN (expr_type));
3266 	      wmax = wi::min (wmax, vr1.max, TYPE_SIGN (expr_type));
3267 	    }
3268 	  /* If either input range contains only non-negative values
3269 	     we can truncate the result range maximum to the respective
3270 	     maximum of the input range.  */
3271 	  if (int_cst_range0 && tree_int_cst_sgn (vr0.min) >= 0)
3272 	    wmax = wi::min (wmax, vr0.max, TYPE_SIGN (expr_type));
3273 	  if (int_cst_range1 && tree_int_cst_sgn (vr1.min) >= 0)
3274 	    wmax = wi::min (wmax, vr1.max, TYPE_SIGN (expr_type));
3275 	  max = wide_int_to_tree (expr_type, wmax);
3276 	}
3277       else if (code == BIT_IOR_EXPR)
3278 	{
3279 	  max = wide_int_to_tree (expr_type,
3280 				  may_be_nonzero0 | may_be_nonzero1);
3281 	  wide_int wmin = must_be_nonzero0 | must_be_nonzero1;
3282 	  /* If the input ranges contain only positive values we can
3283 	     truncate the minimum of the result range to the maximum
3284 	     of the input range minima.  */
3285 	  if (int_cst_range0 && int_cst_range1
3286 	      && tree_int_cst_sgn (vr0.min) >= 0
3287 	      && tree_int_cst_sgn (vr1.min) >= 0)
3288 	    {
3289 	      wmin = wi::max (wmin, vr0.min, TYPE_SIGN (expr_type));
3290 	      wmin = wi::max (wmin, vr1.min, TYPE_SIGN (expr_type));
3291 	    }
3292 	  /* If either input range contains only negative values
3293 	     we can truncate the minimum of the result range to the
3294 	     respective minimum range.  */
3295 	  if (int_cst_range0 && tree_int_cst_sgn (vr0.max) < 0)
3296 	    wmin = wi::max (wmin, vr0.min, TYPE_SIGN (expr_type));
3297 	  if (int_cst_range1 && tree_int_cst_sgn (vr1.max) < 0)
3298 	    wmin = wi::max (wmin, vr1.min, TYPE_SIGN (expr_type));
3299 	  min = wide_int_to_tree (expr_type, wmin);
3300 	}
3301       else if (code == BIT_XOR_EXPR)
3302 	{
3303 	  wide_int result_zero_bits = ((must_be_nonzero0 & must_be_nonzero1)
3304 				       | ~(may_be_nonzero0 | may_be_nonzero1));
3305 	  wide_int result_one_bits
3306 	    = (must_be_nonzero0.and_not (may_be_nonzero1)
3307 	       | must_be_nonzero1.and_not (may_be_nonzero0));
3308 	  max = wide_int_to_tree (expr_type, ~result_zero_bits);
3309 	  min = wide_int_to_tree (expr_type, result_one_bits);
3310 	  /* If the range has all positive or all negative values the
3311 	     result is better than VARYING.  */
3312 	  if (tree_int_cst_sgn (min) < 0
3313 	      || tree_int_cst_sgn (max) >= 0)
3314 	    ;
3315 	  else
3316 	    max = min = NULL_TREE;
3317 	}
3318     }
3319   else
3320     gcc_unreachable ();
3321 
3322   /* If either MIN or MAX overflowed, then set the resulting range to
3323      VARYING.  But we do accept an overflow infinity representation.  */
3324   if (min == NULL_TREE
3325       || (TREE_OVERFLOW_P (min) && !is_overflow_infinity (min))
3326       || max == NULL_TREE
3327       || (TREE_OVERFLOW_P (max) && !is_overflow_infinity (max)))
3328     {
3329       set_value_range_to_varying (vr);
3330       return;
3331     }
3332 
3333   /* We punt if:
3334      1) [-INF, +INF]
3335      2) [-INF, +-INF(OVF)]
3336      3) [+-INF(OVF), +INF]
3337      4) [+-INF(OVF), +-INF(OVF)]
3338      We learn nothing when we have INF and INF(OVF) on both sides.
3339      Note that we do accept [-INF, -INF] and [+INF, +INF] without
3340      overflow.  */
3341   if ((vrp_val_is_min (min) || is_overflow_infinity (min))
3342       && (vrp_val_is_max (max) || is_overflow_infinity (max)))
3343     {
3344       set_value_range_to_varying (vr);
3345       return;
3346     }
3347 
3348   cmp = compare_values (min, max);
3349   if (cmp == -2 || cmp == 1)
3350     {
3351       /* If the new range has its limits swapped around (MIN > MAX),
3352 	 then the operation caused one of them to wrap around, mark
3353 	 the new range VARYING.  */
3354       set_value_range_to_varying (vr);
3355     }
3356   else
3357     set_value_range (vr, type, min, max, NULL);
3358 }
3359 
3360 /* Extract range information from a binary expression OP0 CODE OP1 based on
3361    the ranges of each of its operands with resulting type EXPR_TYPE.
3362    The resulting range is stored in *VR.  */
3363 
3364 static void
3365 extract_range_from_binary_expr (value_range_t *vr,
3366 				enum tree_code code,
3367 				tree expr_type, tree op0, tree op1)
3368 {
3369   value_range_t vr0 = VR_INITIALIZER;
3370   value_range_t vr1 = VR_INITIALIZER;
3371 
3372   /* Get value ranges for each operand.  For constant operands, create
3373      a new value range with the operand to simplify processing.  */
3374   if (TREE_CODE (op0) == SSA_NAME)
3375     vr0 = *(get_value_range (op0));
3376   else if (is_gimple_min_invariant (op0))
3377     set_value_range_to_value (&vr0, op0, NULL);
3378   else
3379     set_value_range_to_varying (&vr0);
3380 
3381   if (TREE_CODE (op1) == SSA_NAME)
3382     vr1 = *(get_value_range (op1));
3383   else if (is_gimple_min_invariant (op1))
3384     set_value_range_to_value (&vr1, op1, NULL);
3385   else
3386     set_value_range_to_varying (&vr1);
3387 
3388   extract_range_from_binary_expr_1 (vr, code, expr_type, &vr0, &vr1);
3389 
3390   /* Try harder for PLUS and MINUS if the range of one operand is symbolic
3391      and based on the other operand, for example if it was deduced from a
3392      symbolic comparison.  When a bound of the range of the first operand
3393      is invariant, we set the corresponding bound of the new range to INF
3394      in order to avoid recursing on the range of the second operand.  */
3395   if (vr->type == VR_VARYING
3396       && (code == PLUS_EXPR || code == MINUS_EXPR)
3397       && TREE_CODE (op1) == SSA_NAME
3398       && vr0.type == VR_RANGE
3399       && symbolic_range_based_on_p (&vr0, op1))
3400     {
3401       const bool minus_p = (code == MINUS_EXPR);
3402       value_range_t n_vr1 = VR_INITIALIZER;
3403 
3404       /* Try with VR0 and [-INF, OP1].  */
3405       if (is_gimple_min_invariant (minus_p ? vr0.max : vr0.min))
3406 	set_value_range (&n_vr1, VR_RANGE, vrp_val_min (expr_type), op1, NULL);
3407 
3408       /* Try with VR0 and [OP1, +INF].  */
3409       else if (is_gimple_min_invariant (minus_p ? vr0.min : vr0.max))
3410 	set_value_range (&n_vr1, VR_RANGE, op1, vrp_val_max (expr_type), NULL);
3411 
3412       /* Try with VR0 and [OP1, OP1].  */
3413       else
3414 	set_value_range (&n_vr1, VR_RANGE, op1, op1, NULL);
3415 
3416       extract_range_from_binary_expr_1 (vr, code, expr_type, &vr0, &n_vr1);
3417     }
3418 
3419   if (vr->type == VR_VARYING
3420       && (code == PLUS_EXPR || code == MINUS_EXPR)
3421       && TREE_CODE (op0) == SSA_NAME
3422       && vr1.type == VR_RANGE
3423       && symbolic_range_based_on_p (&vr1, op0))
3424     {
3425       const bool minus_p = (code == MINUS_EXPR);
3426       value_range_t n_vr0 = VR_INITIALIZER;
3427 
3428       /* Try with [-INF, OP0] and VR1.  */
3429       if (is_gimple_min_invariant (minus_p ? vr1.max : vr1.min))
3430 	set_value_range (&n_vr0, VR_RANGE, vrp_val_min (expr_type), op0, NULL);
3431 
3432       /* Try with [OP0, +INF] and VR1.  */
3433       else if (is_gimple_min_invariant (minus_p ? vr1.min : vr1.max))
3434 	set_value_range (&n_vr0, VR_RANGE, op0, vrp_val_max (expr_type), NULL);
3435 
3436       /* Try with [OP0, OP0] and VR1.  */
3437       else
3438 	set_value_range (&n_vr0, VR_RANGE, op0, op0, NULL);
3439 
3440       extract_range_from_binary_expr_1 (vr, code, expr_type, &n_vr0, &vr1);
3441     }
3442 }
3443 
3444 /* Extract range information from a unary operation CODE based on
3445    the range of its operand *VR0 with type OP0_TYPE with resulting type TYPE.
3446    The The resulting range is stored in *VR.  */
3447 
3448 static void
3449 extract_range_from_unary_expr_1 (value_range_t *vr,
3450 				 enum tree_code code, tree type,
3451 				 value_range_t *vr0_, tree op0_type)
3452 {
3453   value_range_t vr0 = *vr0_, vrtem0 = VR_INITIALIZER, vrtem1 = VR_INITIALIZER;
3454 
3455   /* VRP only operates on integral and pointer types.  */
3456   if (!(INTEGRAL_TYPE_P (op0_type)
3457 	|| POINTER_TYPE_P (op0_type))
3458       || !(INTEGRAL_TYPE_P (type)
3459 	   || POINTER_TYPE_P (type)))
3460     {
3461       set_value_range_to_varying (vr);
3462       return;
3463     }
3464 
3465   /* If VR0 is UNDEFINED, so is the result.  */
3466   if (vr0.type == VR_UNDEFINED)
3467     {
3468       set_value_range_to_undefined (vr);
3469       return;
3470     }
3471 
3472   /* Handle operations that we express in terms of others.  */
3473   if (code == PAREN_EXPR || code == OBJ_TYPE_REF)
3474     {
3475       /* PAREN_EXPR and OBJ_TYPE_REF are simple copies.  */
3476       copy_value_range (vr, &vr0);
3477       return;
3478     }
3479   else if (code == NEGATE_EXPR)
3480     {
3481       /* -X is simply 0 - X, so re-use existing code that also handles
3482          anti-ranges fine.  */
3483       value_range_t zero = VR_INITIALIZER;
3484       set_value_range_to_value (&zero, build_int_cst (type, 0), NULL);
3485       extract_range_from_binary_expr_1 (vr, MINUS_EXPR, type, &zero, &vr0);
3486       return;
3487     }
3488   else if (code == BIT_NOT_EXPR)
3489     {
3490       /* ~X is simply -1 - X, so re-use existing code that also handles
3491          anti-ranges fine.  */
3492       value_range_t minusone = VR_INITIALIZER;
3493       set_value_range_to_value (&minusone, build_int_cst (type, -1), NULL);
3494       extract_range_from_binary_expr_1 (vr, MINUS_EXPR,
3495 					type, &minusone, &vr0);
3496       return;
3497     }
3498 
3499   /* Now canonicalize anti-ranges to ranges when they are not symbolic
3500      and express op ~[]  as (op []') U (op []'').  */
3501   if (vr0.type == VR_ANTI_RANGE
3502       && ranges_from_anti_range (&vr0, &vrtem0, &vrtem1))
3503     {
3504       extract_range_from_unary_expr_1 (vr, code, type, &vrtem0, op0_type);
3505       if (vrtem1.type != VR_UNDEFINED)
3506 	{
3507 	  value_range_t vrres = VR_INITIALIZER;
3508 	  extract_range_from_unary_expr_1 (&vrres, code, type,
3509 					   &vrtem1, op0_type);
3510 	  vrp_meet (vr, &vrres);
3511 	}
3512       return;
3513     }
3514 
3515   if (CONVERT_EXPR_CODE_P (code))
3516     {
3517       tree inner_type = op0_type;
3518       tree outer_type = type;
3519 
3520       /* If the expression evaluates to a pointer, we are only interested in
3521 	 determining if it evaluates to NULL [0, 0] or non-NULL (~[0, 0]).  */
3522       if (POINTER_TYPE_P (type))
3523 	{
3524 	  if (range_is_nonnull (&vr0))
3525 	    set_value_range_to_nonnull (vr, type);
3526 	  else if (range_is_null (&vr0))
3527 	    set_value_range_to_null (vr, type);
3528 	  else
3529 	    set_value_range_to_varying (vr);
3530 	  return;
3531 	}
3532 
3533       /* If VR0 is varying and we increase the type precision, assume
3534 	 a full range for the following transformation.  */
3535       if (vr0.type == VR_VARYING
3536 	  && INTEGRAL_TYPE_P (inner_type)
3537 	  && TYPE_PRECISION (inner_type) < TYPE_PRECISION (outer_type))
3538 	{
3539 	  vr0.type = VR_RANGE;
3540 	  vr0.min = TYPE_MIN_VALUE (inner_type);
3541 	  vr0.max = TYPE_MAX_VALUE (inner_type);
3542 	}
3543 
3544       /* If VR0 is a constant range or anti-range and the conversion is
3545 	 not truncating we can convert the min and max values and
3546 	 canonicalize the resulting range.  Otherwise we can do the
3547 	 conversion if the size of the range is less than what the
3548 	 precision of the target type can represent and the range is
3549 	 not an anti-range.  */
3550       if ((vr0.type == VR_RANGE
3551 	   || vr0.type == VR_ANTI_RANGE)
3552 	  && TREE_CODE (vr0.min) == INTEGER_CST
3553 	  && TREE_CODE (vr0.max) == INTEGER_CST
3554 	  && (!is_overflow_infinity (vr0.min)
3555 	      || (vr0.type == VR_RANGE
3556 		  && TYPE_PRECISION (outer_type) > TYPE_PRECISION (inner_type)
3557 		  && needs_overflow_infinity (outer_type)
3558 		  && supports_overflow_infinity (outer_type)))
3559 	  && (!is_overflow_infinity (vr0.max)
3560 	      || (vr0.type == VR_RANGE
3561 		  && TYPE_PRECISION (outer_type) > TYPE_PRECISION (inner_type)
3562 		  && needs_overflow_infinity (outer_type)
3563 		  && supports_overflow_infinity (outer_type)))
3564 	  && (TYPE_PRECISION (outer_type) >= TYPE_PRECISION (inner_type)
3565 	      || (vr0.type == VR_RANGE
3566 		  && integer_zerop (int_const_binop (RSHIFT_EXPR,
3567 		       int_const_binop (MINUS_EXPR, vr0.max, vr0.min),
3568 		         size_int (TYPE_PRECISION (outer_type)))))))
3569 	{
3570 	  tree new_min, new_max;
3571 	  if (is_overflow_infinity (vr0.min))
3572 	    new_min = negative_overflow_infinity (outer_type);
3573 	  else
3574 	    new_min = force_fit_type (outer_type, wi::to_widest (vr0.min),
3575 				      0, false);
3576 	  if (is_overflow_infinity (vr0.max))
3577 	    new_max = positive_overflow_infinity (outer_type);
3578 	  else
3579 	    new_max = force_fit_type (outer_type, wi::to_widest (vr0.max),
3580 				      0, false);
3581 	  set_and_canonicalize_value_range (vr, vr0.type,
3582 					    new_min, new_max, NULL);
3583 	  return;
3584 	}
3585 
3586       set_value_range_to_varying (vr);
3587       return;
3588     }
3589   else if (code == ABS_EXPR)
3590     {
3591       tree min, max;
3592       int cmp;
3593 
3594       /* Pass through vr0 in the easy cases.  */
3595       if (TYPE_UNSIGNED (type)
3596 	  || value_range_nonnegative_p (&vr0))
3597 	{
3598 	  copy_value_range (vr, &vr0);
3599 	  return;
3600 	}
3601 
3602       /* For the remaining varying or symbolic ranges we can't do anything
3603 	 useful.  */
3604       if (vr0.type == VR_VARYING
3605 	  || symbolic_range_p (&vr0))
3606 	{
3607 	  set_value_range_to_varying (vr);
3608 	  return;
3609 	}
3610 
3611       /* -TYPE_MIN_VALUE = TYPE_MIN_VALUE with flag_wrapv so we can't get a
3612          useful range.  */
3613       if (!TYPE_OVERFLOW_UNDEFINED (type)
3614 	  && ((vr0.type == VR_RANGE
3615 	       && vrp_val_is_min (vr0.min))
3616 	      || (vr0.type == VR_ANTI_RANGE
3617 		  && !vrp_val_is_min (vr0.min))))
3618 	{
3619 	  set_value_range_to_varying (vr);
3620 	  return;
3621 	}
3622 
3623       /* ABS_EXPR may flip the range around, if the original range
3624 	 included negative values.  */
3625       if (is_overflow_infinity (vr0.min))
3626 	min = positive_overflow_infinity (type);
3627       else if (!vrp_val_is_min (vr0.min))
3628 	min = fold_unary_to_constant (code, type, vr0.min);
3629       else if (!needs_overflow_infinity (type))
3630 	min = TYPE_MAX_VALUE (type);
3631       else if (supports_overflow_infinity (type))
3632 	min = positive_overflow_infinity (type);
3633       else
3634 	{
3635 	  set_value_range_to_varying (vr);
3636 	  return;
3637 	}
3638 
3639       if (is_overflow_infinity (vr0.max))
3640 	max = positive_overflow_infinity (type);
3641       else if (!vrp_val_is_min (vr0.max))
3642 	max = fold_unary_to_constant (code, type, vr0.max);
3643       else if (!needs_overflow_infinity (type))
3644 	max = TYPE_MAX_VALUE (type);
3645       else if (supports_overflow_infinity (type)
3646 	       /* We shouldn't generate [+INF, +INF] as set_value_range
3647 		  doesn't like this and ICEs.  */
3648 	       && !is_positive_overflow_infinity (min))
3649 	max = positive_overflow_infinity (type);
3650       else
3651 	{
3652 	  set_value_range_to_varying (vr);
3653 	  return;
3654 	}
3655 
3656       cmp = compare_values (min, max);
3657 
3658       /* If a VR_ANTI_RANGEs contains zero, then we have
3659 	 ~[-INF, min(MIN, MAX)].  */
3660       if (vr0.type == VR_ANTI_RANGE)
3661 	{
3662 	  if (range_includes_zero_p (vr0.min, vr0.max) == 1)
3663 	    {
3664 	      /* Take the lower of the two values.  */
3665 	      if (cmp != 1)
3666 		max = min;
3667 
3668 	      /* Create ~[-INF, min (abs(MIN), abs(MAX))]
3669 	         or ~[-INF + 1, min (abs(MIN), abs(MAX))] when
3670 		 flag_wrapv is set and the original anti-range doesn't include
3671 	         TYPE_MIN_VALUE, remember -TYPE_MIN_VALUE = TYPE_MIN_VALUE.  */
3672 	      if (TYPE_OVERFLOW_WRAPS (type))
3673 		{
3674 		  tree type_min_value = TYPE_MIN_VALUE (type);
3675 
3676 		  min = (vr0.min != type_min_value
3677 			 ? int_const_binop (PLUS_EXPR, type_min_value,
3678 					    build_int_cst (TREE_TYPE (type_min_value), 1))
3679 			 : type_min_value);
3680 		}
3681 	      else
3682 		{
3683 		  if (overflow_infinity_range_p (&vr0))
3684 		    min = negative_overflow_infinity (type);
3685 		  else
3686 		    min = TYPE_MIN_VALUE (type);
3687 		}
3688 	    }
3689 	  else
3690 	    {
3691 	      /* All else has failed, so create the range [0, INF], even for
3692 	         flag_wrapv since TYPE_MIN_VALUE is in the original
3693 	         anti-range.  */
3694 	      vr0.type = VR_RANGE;
3695 	      min = build_int_cst (type, 0);
3696 	      if (needs_overflow_infinity (type))
3697 		{
3698 		  if (supports_overflow_infinity (type))
3699 		    max = positive_overflow_infinity (type);
3700 		  else
3701 		    {
3702 		      set_value_range_to_varying (vr);
3703 		      return;
3704 		    }
3705 		}
3706 	      else
3707 		max = TYPE_MAX_VALUE (type);
3708 	    }
3709 	}
3710 
3711       /* If the range contains zero then we know that the minimum value in the
3712          range will be zero.  */
3713       else if (range_includes_zero_p (vr0.min, vr0.max) == 1)
3714 	{
3715 	  if (cmp == 1)
3716 	    max = min;
3717 	  min = build_int_cst (type, 0);
3718 	}
3719       else
3720 	{
3721           /* If the range was reversed, swap MIN and MAX.  */
3722 	  if (cmp == 1)
3723 	    {
3724 	      tree t = min;
3725 	      min = max;
3726 	      max = t;
3727 	    }
3728 	}
3729 
3730       cmp = compare_values (min, max);
3731       if (cmp == -2 || cmp == 1)
3732 	{
3733 	  /* If the new range has its limits swapped around (MIN > MAX),
3734 	     then the operation caused one of them to wrap around, mark
3735 	     the new range VARYING.  */
3736 	  set_value_range_to_varying (vr);
3737 	}
3738       else
3739 	set_value_range (vr, vr0.type, min, max, NULL);
3740       return;
3741     }
3742 
3743   /* For unhandled operations fall back to varying.  */
3744   set_value_range_to_varying (vr);
3745   return;
3746 }
3747 
3748 
3749 /* Extract range information from a unary expression CODE OP0 based on
3750    the range of its operand with resulting type TYPE.
3751    The resulting range is stored in *VR.  */
3752 
3753 static void
3754 extract_range_from_unary_expr (value_range_t *vr, enum tree_code code,
3755 			       tree type, tree op0)
3756 {
3757   value_range_t vr0 = VR_INITIALIZER;
3758 
3759   /* Get value ranges for the operand.  For constant operands, create
3760      a new value range with the operand to simplify processing.  */
3761   if (TREE_CODE (op0) == SSA_NAME)
3762     vr0 = *(get_value_range (op0));
3763   else if (is_gimple_min_invariant (op0))
3764     set_value_range_to_value (&vr0, op0, NULL);
3765   else
3766     set_value_range_to_varying (&vr0);
3767 
3768   extract_range_from_unary_expr_1 (vr, code, type, &vr0, TREE_TYPE (op0));
3769 }
3770 
3771 
3772 /* Extract range information from a conditional expression STMT based on
3773    the ranges of each of its operands and the expression code.  */
3774 
3775 static void
3776 extract_range_from_cond_expr (value_range_t *vr, gassign *stmt)
3777 {
3778   tree op0, op1;
3779   value_range_t vr0 = VR_INITIALIZER;
3780   value_range_t vr1 = VR_INITIALIZER;
3781 
3782   /* Get value ranges for each operand.  For constant operands, create
3783      a new value range with the operand to simplify processing.  */
3784   op0 = gimple_assign_rhs2 (stmt);
3785   if (TREE_CODE (op0) == SSA_NAME)
3786     vr0 = *(get_value_range (op0));
3787   else if (is_gimple_min_invariant (op0))
3788     set_value_range_to_value (&vr0, op0, NULL);
3789   else
3790     set_value_range_to_varying (&vr0);
3791 
3792   op1 = gimple_assign_rhs3 (stmt);
3793   if (TREE_CODE (op1) == SSA_NAME)
3794     vr1 = *(get_value_range (op1));
3795   else if (is_gimple_min_invariant (op1))
3796     set_value_range_to_value (&vr1, op1, NULL);
3797   else
3798     set_value_range_to_varying (&vr1);
3799 
3800   /* The resulting value range is the union of the operand ranges */
3801   copy_value_range (vr, &vr0);
3802   vrp_meet (vr, &vr1);
3803 }
3804 
3805 
3806 /* Extract range information from a comparison expression EXPR based
3807    on the range of its operand and the expression code.  */
3808 
3809 static void
3810 extract_range_from_comparison (value_range_t *vr, enum tree_code code,
3811 			       tree type, tree op0, tree op1)
3812 {
3813   bool sop = false;
3814   tree val;
3815 
3816   val = vrp_evaluate_conditional_warnv_with_ops (code, op0, op1, false, &sop,
3817   						 NULL);
3818 
3819   /* A disadvantage of using a special infinity as an overflow
3820      representation is that we lose the ability to record overflow
3821      when we don't have an infinity.  So we have to ignore a result
3822      which relies on overflow.  */
3823 
3824   if (val && !is_overflow_infinity (val) && !sop)
3825     {
3826       /* Since this expression was found on the RHS of an assignment,
3827 	 its type may be different from _Bool.  Convert VAL to EXPR's
3828 	 type.  */
3829       val = fold_convert (type, val);
3830       if (is_gimple_min_invariant (val))
3831 	set_value_range_to_value (vr, val, vr->equiv);
3832       else
3833 	set_value_range (vr, VR_RANGE, val, val, vr->equiv);
3834     }
3835   else
3836     /* The result of a comparison is always true or false.  */
3837     set_value_range_to_truthvalue (vr, type);
3838 }
3839 
3840 /* Helper function for simplify_internal_call_using_ranges and
3841    extract_range_basic.  Return true if OP0 SUBCODE OP1 for
3842    SUBCODE {PLUS,MINUS,MULT}_EXPR is known to never overflow or
3843    always overflow.  Set *OVF to true if it is known to always
3844    overflow.  */
3845 
3846 static bool
3847 check_for_binary_op_overflow (enum tree_code subcode, tree type,
3848 			      tree op0, tree op1, bool *ovf)
3849 {
3850   value_range_t vr0 = VR_INITIALIZER;
3851   value_range_t vr1 = VR_INITIALIZER;
3852   if (TREE_CODE (op0) == SSA_NAME)
3853     vr0 = *get_value_range (op0);
3854   else if (TREE_CODE (op0) == INTEGER_CST)
3855     set_value_range_to_value (&vr0, op0, NULL);
3856   else
3857     set_value_range_to_varying (&vr0);
3858 
3859   if (TREE_CODE (op1) == SSA_NAME)
3860     vr1 = *get_value_range (op1);
3861   else if (TREE_CODE (op1) == INTEGER_CST)
3862     set_value_range_to_value (&vr1, op1, NULL);
3863   else
3864     set_value_range_to_varying (&vr1);
3865 
3866   if (!range_int_cst_p (&vr0)
3867       || TREE_OVERFLOW (vr0.min)
3868       || TREE_OVERFLOW (vr0.max))
3869     {
3870       vr0.min = vrp_val_min (TREE_TYPE (op0));
3871       vr0.max = vrp_val_max (TREE_TYPE (op0));
3872     }
3873   if (!range_int_cst_p (&vr1)
3874       || TREE_OVERFLOW (vr1.min)
3875       || TREE_OVERFLOW (vr1.max))
3876     {
3877       vr1.min = vrp_val_min (TREE_TYPE (op1));
3878       vr1.max = vrp_val_max (TREE_TYPE (op1));
3879     }
3880   *ovf = arith_overflowed_p (subcode, type, vr0.min,
3881 			     subcode == MINUS_EXPR ? vr1.max : vr1.min);
3882   if (arith_overflowed_p (subcode, type, vr0.max,
3883 			  subcode == MINUS_EXPR ? vr1.min : vr1.max) != *ovf)
3884     return false;
3885   if (subcode == MULT_EXPR)
3886     {
3887       if (arith_overflowed_p (subcode, type, vr0.min, vr1.max) != *ovf
3888 	  || arith_overflowed_p (subcode, type, vr0.max, vr1.min) != *ovf)
3889 	return false;
3890     }
3891   if (*ovf)
3892     {
3893       /* So far we found that there is an overflow on the boundaries.
3894 	 That doesn't prove that there is an overflow even for all values
3895 	 in between the boundaries.  For that compute widest_int range
3896 	 of the result and see if it doesn't overlap the range of
3897 	 type.  */
3898       widest_int wmin, wmax;
3899       widest_int w[4];
3900       int i;
3901       w[0] = wi::to_widest (vr0.min);
3902       w[1] = wi::to_widest (vr0.max);
3903       w[2] = wi::to_widest (vr1.min);
3904       w[3] = wi::to_widest (vr1.max);
3905       for (i = 0; i < 4; i++)
3906 	{
3907 	  widest_int wt;
3908 	  switch (subcode)
3909 	    {
3910 	    case PLUS_EXPR:
3911 	      wt = wi::add (w[i & 1], w[2 + (i & 2) / 2]);
3912 	      break;
3913 	    case MINUS_EXPR:
3914 	      wt = wi::sub (w[i & 1], w[2 + (i & 2) / 2]);
3915 	      break;
3916 	    case MULT_EXPR:
3917 	      wt = wi::mul (w[i & 1], w[2 + (i & 2) / 2]);
3918 	      break;
3919 	    default:
3920 	      gcc_unreachable ();
3921 	    }
3922 	  if (i == 0)
3923 	    {
3924 	      wmin = wt;
3925 	      wmax = wt;
3926 	    }
3927 	  else
3928 	    {
3929 	      wmin = wi::smin (wmin, wt);
3930 	      wmax = wi::smax (wmax, wt);
3931 	    }
3932 	}
3933       /* The result of op0 CODE op1 is known to be in range
3934 	 [wmin, wmax].  */
3935       widest_int wtmin = wi::to_widest (vrp_val_min (type));
3936       widest_int wtmax = wi::to_widest (vrp_val_max (type));
3937       /* If all values in [wmin, wmax] are smaller than
3938 	 [wtmin, wtmax] or all are larger than [wtmin, wtmax],
3939 	 the arithmetic operation will always overflow.  */
3940       if (wi::lts_p (wmax, wtmin) || wi::gts_p (wmin, wtmax))
3941 	return true;
3942       return false;
3943     }
3944   return true;
3945 }
3946 
3947 /* Try to derive a nonnegative or nonzero range out of STMT relying
3948    primarily on generic routines in fold in conjunction with range data.
3949    Store the result in *VR */
3950 
3951 static void
3952 extract_range_basic (value_range_t *vr, gimple stmt)
3953 {
3954   bool sop = false;
3955   tree type = gimple_expr_type (stmt);
3956 
3957   if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
3958     {
3959       tree fndecl = gimple_call_fndecl (stmt), arg;
3960       int mini, maxi, zerov = 0, prec;
3961 
3962       switch (DECL_FUNCTION_CODE (fndecl))
3963 	{
3964 	case BUILT_IN_CONSTANT_P:
3965 	  /* If the call is __builtin_constant_p and the argument is a
3966 	     function parameter resolve it to false.  This avoids bogus
3967 	     array bound warnings.
3968 	     ???  We could do this as early as inlining is finished.  */
3969 	  arg = gimple_call_arg (stmt, 0);
3970 	  if (TREE_CODE (arg) == SSA_NAME
3971 	      && SSA_NAME_IS_DEFAULT_DEF (arg)
3972 	      && TREE_CODE (SSA_NAME_VAR (arg)) == PARM_DECL)
3973 	    {
3974 	      set_value_range_to_null (vr, type);
3975 	      return;
3976 	    }
3977 	  break;
3978 	  /* Both __builtin_ffs* and __builtin_popcount return
3979 	     [0, prec].  */
3980 	CASE_INT_FN (BUILT_IN_FFS):
3981 	CASE_INT_FN (BUILT_IN_POPCOUNT):
3982 	  arg = gimple_call_arg (stmt, 0);
3983 	  prec = TYPE_PRECISION (TREE_TYPE (arg));
3984 	  mini = 0;
3985 	  maxi = prec;
3986 	  if (TREE_CODE (arg) == SSA_NAME)
3987 	    {
3988 	      value_range_t *vr0 = get_value_range (arg);
3989 	      /* If arg is non-zero, then ffs or popcount
3990 		 are non-zero.  */
3991 	      if (((vr0->type == VR_RANGE
3992 		    && range_includes_zero_p (vr0->min, vr0->max) == 0)
3993 		   || (vr0->type == VR_ANTI_RANGE
3994 		       && range_includes_zero_p (vr0->min, vr0->max) == 1))
3995 		  && !is_overflow_infinity (vr0->min)
3996 		  && !is_overflow_infinity (vr0->max))
3997 		mini = 1;
3998 	      /* If some high bits are known to be zero,
3999 		 we can decrease the maximum.  */
4000 	      if (vr0->type == VR_RANGE
4001 		  && TREE_CODE (vr0->max) == INTEGER_CST
4002 		  && !operand_less_p (vr0->min,
4003 				      build_zero_cst (TREE_TYPE (vr0->min)))
4004 		  && !is_overflow_infinity (vr0->max))
4005 		maxi = tree_floor_log2 (vr0->max) + 1;
4006 	    }
4007 	  goto bitop_builtin;
4008 	  /* __builtin_parity* returns [0, 1].  */
4009 	CASE_INT_FN (BUILT_IN_PARITY):
4010 	  mini = 0;
4011 	  maxi = 1;
4012 	  goto bitop_builtin;
4013 	  /* __builtin_c[lt]z* return [0, prec-1], except for
4014 	     when the argument is 0, but that is undefined behavior.
4015 	     On many targets where the CLZ RTL or optab value is defined
4016 	     for 0 the value is prec, so include that in the range
4017 	     by default.  */
4018 	CASE_INT_FN (BUILT_IN_CLZ):
4019 	  arg = gimple_call_arg (stmt, 0);
4020 	  prec = TYPE_PRECISION (TREE_TYPE (arg));
4021 	  mini = 0;
4022 	  maxi = prec;
4023 	  if (optab_handler (clz_optab, TYPE_MODE (TREE_TYPE (arg)))
4024 	      != CODE_FOR_nothing
4025 	      && CLZ_DEFINED_VALUE_AT_ZERO (TYPE_MODE (TREE_TYPE (arg)),
4026 					    zerov)
4027 	      /* Handle only the single common value.  */
4028 	      && zerov != prec)
4029 	    /* Magic value to give up, unless vr0 proves
4030 	       arg is non-zero.  */
4031 	    mini = -2;
4032 	  if (TREE_CODE (arg) == SSA_NAME)
4033 	    {
4034 	      value_range_t *vr0 = get_value_range (arg);
4035 	      /* From clz of VR_RANGE minimum we can compute
4036 		 result maximum.  */
4037 	      if (vr0->type == VR_RANGE
4038 		  && TREE_CODE (vr0->min) == INTEGER_CST
4039 		  && !is_overflow_infinity (vr0->min))
4040 		{
4041 		  maxi = prec - 1 - tree_floor_log2 (vr0->min);
4042 		  if (maxi != prec)
4043 		    mini = 0;
4044 		}
4045 	      else if (vr0->type == VR_ANTI_RANGE
4046 		       && integer_zerop (vr0->min)
4047 		       && !is_overflow_infinity (vr0->min))
4048 		{
4049 		  maxi = prec - 1;
4050 		  mini = 0;
4051 		}
4052 	      if (mini == -2)
4053 		break;
4054 	      /* From clz of VR_RANGE maximum we can compute
4055 		 result minimum.  */
4056 	      if (vr0->type == VR_RANGE
4057 		  && TREE_CODE (vr0->max) == INTEGER_CST
4058 		  && !is_overflow_infinity (vr0->max))
4059 		{
4060 		  mini = prec - 1 - tree_floor_log2 (vr0->max);
4061 		  if (mini == prec)
4062 		    break;
4063 		}
4064 	    }
4065 	  if (mini == -2)
4066 	    break;
4067 	  goto bitop_builtin;
4068 	  /* __builtin_ctz* return [0, prec-1], except for
4069 	     when the argument is 0, but that is undefined behavior.
4070 	     If there is a ctz optab for this mode and
4071 	     CTZ_DEFINED_VALUE_AT_ZERO, include that in the range,
4072 	     otherwise just assume 0 won't be seen.  */
4073 	CASE_INT_FN (BUILT_IN_CTZ):
4074 	  arg = gimple_call_arg (stmt, 0);
4075 	  prec = TYPE_PRECISION (TREE_TYPE (arg));
4076 	  mini = 0;
4077 	  maxi = prec - 1;
4078 	  if (optab_handler (ctz_optab, TYPE_MODE (TREE_TYPE (arg)))
4079 	      != CODE_FOR_nothing
4080 	      && CTZ_DEFINED_VALUE_AT_ZERO (TYPE_MODE (TREE_TYPE (arg)),
4081 					    zerov))
4082 	    {
4083 	      /* Handle only the two common values.  */
4084 	      if (zerov == -1)
4085 		mini = -1;
4086 	      else if (zerov == prec)
4087 		maxi = prec;
4088 	      else
4089 		/* Magic value to give up, unless vr0 proves
4090 		   arg is non-zero.  */
4091 		mini = -2;
4092 	    }
4093 	  if (TREE_CODE (arg) == SSA_NAME)
4094 	    {
4095 	      value_range_t *vr0 = get_value_range (arg);
4096 	      /* If arg is non-zero, then use [0, prec - 1].  */
4097 	      if (((vr0->type == VR_RANGE
4098 		    && integer_nonzerop (vr0->min))
4099 		   || (vr0->type == VR_ANTI_RANGE
4100 		       && integer_zerop (vr0->min)))
4101 		  && !is_overflow_infinity (vr0->min))
4102 		{
4103 		  mini = 0;
4104 		  maxi = prec - 1;
4105 		}
4106 	      /* If some high bits are known to be zero,
4107 		 we can decrease the result maximum.  */
4108 	      if (vr0->type == VR_RANGE
4109 		  && TREE_CODE (vr0->max) == INTEGER_CST
4110 		  && !is_overflow_infinity (vr0->max))
4111 		{
4112 		  maxi = tree_floor_log2 (vr0->max);
4113 		  /* For vr0 [0, 0] give up.  */
4114 		  if (maxi == -1)
4115 		    break;
4116 		}
4117 	    }
4118 	  if (mini == -2)
4119 	    break;
4120 	  goto bitop_builtin;
4121 	  /* __builtin_clrsb* returns [0, prec-1].  */
4122 	CASE_INT_FN (BUILT_IN_CLRSB):
4123 	  arg = gimple_call_arg (stmt, 0);
4124 	  prec = TYPE_PRECISION (TREE_TYPE (arg));
4125 	  mini = 0;
4126 	  maxi = prec - 1;
4127 	  goto bitop_builtin;
4128 	bitop_builtin:
4129 	  set_value_range (vr, VR_RANGE, build_int_cst (type, mini),
4130 			   build_int_cst (type, maxi), NULL);
4131 	  return;
4132 	default:
4133 	  break;
4134 	}
4135     }
4136   else if (is_gimple_call (stmt) && gimple_call_internal_p (stmt))
4137     {
4138       enum tree_code subcode = ERROR_MARK;
4139       switch (gimple_call_internal_fn (stmt))
4140 	{
4141 	case IFN_UBSAN_CHECK_ADD:
4142 	  subcode = PLUS_EXPR;
4143 	  break;
4144 	case IFN_UBSAN_CHECK_SUB:
4145 	  subcode = MINUS_EXPR;
4146 	  break;
4147 	case IFN_UBSAN_CHECK_MUL:
4148 	  subcode = MULT_EXPR;
4149 	  break;
4150 	default:
4151 	  break;
4152 	}
4153       if (subcode != ERROR_MARK)
4154 	{
4155 	  bool saved_flag_wrapv = flag_wrapv;
4156 	  /* Pretend the arithmetics is wrapping.  If there is
4157 	     any overflow, we'll complain, but will actually do
4158 	     wrapping operation.  */
4159 	  flag_wrapv = 1;
4160 	  extract_range_from_binary_expr (vr, subcode, type,
4161 					  gimple_call_arg (stmt, 0),
4162 					  gimple_call_arg (stmt, 1));
4163 	  flag_wrapv = saved_flag_wrapv;
4164 
4165 	  /* If for both arguments vrp_valueize returned non-NULL,
4166 	     this should have been already folded and if not, it
4167 	     wasn't folded because of overflow.  Avoid removing the
4168 	     UBSAN_CHECK_* calls in that case.  */
4169 	  if (vr->type == VR_RANGE
4170 	      && (vr->min == vr->max
4171 		  || operand_equal_p (vr->min, vr->max, 0)))
4172 	    set_value_range_to_varying (vr);
4173 	  return;
4174 	}
4175     }
4176   /* Handle extraction of the two results (result of arithmetics and
4177      a flag whether arithmetics overflowed) from {ADD,SUB,MUL}_OVERFLOW
4178      internal function.  */
4179   else if (is_gimple_assign (stmt)
4180 	   && (gimple_assign_rhs_code (stmt) == REALPART_EXPR
4181 	       || gimple_assign_rhs_code (stmt) == IMAGPART_EXPR)
4182 	   && INTEGRAL_TYPE_P (type))
4183     {
4184       enum tree_code code = gimple_assign_rhs_code (stmt);
4185       tree op = gimple_assign_rhs1 (stmt);
4186       if (TREE_CODE (op) == code && TREE_CODE (TREE_OPERAND (op, 0)) == SSA_NAME)
4187 	{
4188 	  gimple g = SSA_NAME_DEF_STMT (TREE_OPERAND (op, 0));
4189 	  if (is_gimple_call (g) && gimple_call_internal_p (g))
4190 	    {
4191 	      enum tree_code subcode = ERROR_MARK;
4192 	      switch (gimple_call_internal_fn (g))
4193 		{
4194 		case IFN_ADD_OVERFLOW:
4195 		  subcode = PLUS_EXPR;
4196 		  break;
4197 		case IFN_SUB_OVERFLOW:
4198 		  subcode = MINUS_EXPR;
4199 		  break;
4200 		case IFN_MUL_OVERFLOW:
4201 		  subcode = MULT_EXPR;
4202 		  break;
4203 		default:
4204 		  break;
4205 		}
4206 	      if (subcode != ERROR_MARK)
4207 		{
4208 		  tree op0 = gimple_call_arg (g, 0);
4209 		  tree op1 = gimple_call_arg (g, 1);
4210 		  if (code == IMAGPART_EXPR)
4211 		    {
4212 		      bool ovf = false;
4213 		      if (check_for_binary_op_overflow (subcode, type,
4214 							op0, op1, &ovf))
4215 			set_value_range_to_value (vr,
4216 						  build_int_cst (type, ovf),
4217 						  NULL);
4218 		      else
4219 			set_value_range (vr, VR_RANGE, build_int_cst (type, 0),
4220 					 build_int_cst (type, 1), NULL);
4221 		    }
4222 		  else if (types_compatible_p (type, TREE_TYPE (op0))
4223 			   && types_compatible_p (type, TREE_TYPE (op1)))
4224 		    {
4225 		      bool saved_flag_wrapv = flag_wrapv;
4226 		      /* Pretend the arithmetics is wrapping.  If there is
4227 			 any overflow, IMAGPART_EXPR will be set.  */
4228 		      flag_wrapv = 1;
4229 		      extract_range_from_binary_expr (vr, subcode, type,
4230 						      op0, op1);
4231 		      flag_wrapv = saved_flag_wrapv;
4232 		    }
4233 		  else
4234 		    {
4235 		      value_range_t vr0 = VR_INITIALIZER;
4236 		      value_range_t vr1 = VR_INITIALIZER;
4237 		      bool saved_flag_wrapv = flag_wrapv;
4238 		      /* Pretend the arithmetics is wrapping.  If there is
4239 			 any overflow, IMAGPART_EXPR will be set.  */
4240 		      flag_wrapv = 1;
4241 		      extract_range_from_unary_expr (&vr0, NOP_EXPR,
4242 						     type, op0);
4243 		      extract_range_from_unary_expr (&vr1, NOP_EXPR,
4244 						     type, op1);
4245 		      extract_range_from_binary_expr_1 (vr, subcode, type,
4246 							&vr0, &vr1);
4247 		      flag_wrapv = saved_flag_wrapv;
4248 		    }
4249 		  return;
4250 		}
4251 	    }
4252 	}
4253     }
4254   if (INTEGRAL_TYPE_P (type)
4255       && gimple_stmt_nonnegative_warnv_p (stmt, &sop))
4256     set_value_range_to_nonnegative (vr, type,
4257 				    sop || stmt_overflow_infinity (stmt));
4258   else if (vrp_stmt_computes_nonzero (stmt, &sop)
4259 	   && !sop)
4260     set_value_range_to_nonnull (vr, type);
4261   else
4262     set_value_range_to_varying (vr);
4263 }
4264 
4265 
4266 /* Try to compute a useful range out of assignment STMT and store it
4267    in *VR.  */
4268 
4269 static void
4270 extract_range_from_assignment (value_range_t *vr, gassign *stmt)
4271 {
4272   enum tree_code code = gimple_assign_rhs_code (stmt);
4273 
4274   if (code == ASSERT_EXPR)
4275     extract_range_from_assert (vr, gimple_assign_rhs1 (stmt));
4276   else if (code == SSA_NAME)
4277     extract_range_from_ssa_name (vr, gimple_assign_rhs1 (stmt));
4278   else if (TREE_CODE_CLASS (code) == tcc_binary)
4279     extract_range_from_binary_expr (vr, gimple_assign_rhs_code (stmt),
4280 				    gimple_expr_type (stmt),
4281 				    gimple_assign_rhs1 (stmt),
4282 				    gimple_assign_rhs2 (stmt));
4283   else if (TREE_CODE_CLASS (code) == tcc_unary)
4284     extract_range_from_unary_expr (vr, gimple_assign_rhs_code (stmt),
4285 				   gimple_expr_type (stmt),
4286 				   gimple_assign_rhs1 (stmt));
4287   else if (code == COND_EXPR)
4288     extract_range_from_cond_expr (vr, stmt);
4289   else if (TREE_CODE_CLASS (code) == tcc_comparison)
4290     extract_range_from_comparison (vr, gimple_assign_rhs_code (stmt),
4291 				   gimple_expr_type (stmt),
4292 				   gimple_assign_rhs1 (stmt),
4293 				   gimple_assign_rhs2 (stmt));
4294   else if (get_gimple_rhs_class (code) == GIMPLE_SINGLE_RHS
4295 	   && is_gimple_min_invariant (gimple_assign_rhs1 (stmt)))
4296     set_value_range_to_value (vr, gimple_assign_rhs1 (stmt), NULL);
4297   else
4298     set_value_range_to_varying (vr);
4299 
4300   if (vr->type == VR_VARYING)
4301     extract_range_basic (vr, stmt);
4302 }
4303 
4304 /* Given a range VR, a LOOP and a variable VAR, determine whether it
4305    would be profitable to adjust VR using scalar evolution information
4306    for VAR.  If so, update VR with the new limits.  */
4307 
4308 static void
4309 adjust_range_with_scev (value_range_t *vr, struct loop *loop,
4310 			gimple stmt, tree var)
4311 {
4312   tree init, step, chrec, tmin, tmax, min, max, type, tem;
4313   enum ev_direction dir;
4314 
4315   /* TODO.  Don't adjust anti-ranges.  An anti-range may provide
4316      better opportunities than a regular range, but I'm not sure.  */
4317   if (vr->type == VR_ANTI_RANGE)
4318     return;
4319 
4320   chrec = instantiate_parameters (loop, analyze_scalar_evolution (loop, var));
4321 
4322   /* Like in PR19590, scev can return a constant function.  */
4323   if (is_gimple_min_invariant (chrec))
4324     {
4325       set_value_range_to_value (vr, chrec, vr->equiv);
4326       return;
4327     }
4328 
4329   if (TREE_CODE (chrec) != POLYNOMIAL_CHREC)
4330     return;
4331 
4332   init = initial_condition_in_loop_num (chrec, loop->num);
4333   tem = op_with_constant_singleton_value_range (init);
4334   if (tem)
4335     init = tem;
4336   step = evolution_part_in_loop_num (chrec, loop->num);
4337   tem = op_with_constant_singleton_value_range (step);
4338   if (tem)
4339     step = tem;
4340 
4341   /* If STEP is symbolic, we can't know whether INIT will be the
4342      minimum or maximum value in the range.  Also, unless INIT is
4343      a simple expression, compare_values and possibly other functions
4344      in tree-vrp won't be able to handle it.  */
4345   if (step == NULL_TREE
4346       || !is_gimple_min_invariant (step)
4347       || !valid_value_p (init))
4348     return;
4349 
4350   dir = scev_direction (chrec);
4351   if (/* Do not adjust ranges if we do not know whether the iv increases
4352 	 or decreases,  ... */
4353       dir == EV_DIR_UNKNOWN
4354       /* ... or if it may wrap.  */
4355       || scev_probably_wraps_p (init, step, stmt, get_chrec_loop (chrec),
4356 				true))
4357     return;
4358 
4359   /* We use TYPE_MIN_VALUE and TYPE_MAX_VALUE here instead of
4360      negative_overflow_infinity and positive_overflow_infinity,
4361      because we have concluded that the loop probably does not
4362      wrap.  */
4363 
4364   type = TREE_TYPE (var);
4365   if (POINTER_TYPE_P (type) || !TYPE_MIN_VALUE (type))
4366     tmin = lower_bound_in_type (type, type);
4367   else
4368     tmin = TYPE_MIN_VALUE (type);
4369   if (POINTER_TYPE_P (type) || !TYPE_MAX_VALUE (type))
4370     tmax = upper_bound_in_type (type, type);
4371   else
4372     tmax = TYPE_MAX_VALUE (type);
4373 
4374   /* Try to use estimated number of iterations for the loop to constrain the
4375      final value in the evolution.  */
4376   if (TREE_CODE (step) == INTEGER_CST
4377       && is_gimple_val (init)
4378       && (TREE_CODE (init) != SSA_NAME
4379 	  || get_value_range (init)->type == VR_RANGE))
4380     {
4381       widest_int nit;
4382 
4383       /* We are only entering here for loop header PHI nodes, so using
4384 	 the number of latch executions is the correct thing to use.  */
4385       if (max_loop_iterations (loop, &nit))
4386 	{
4387 	  value_range_t maxvr = VR_INITIALIZER;
4388 	  signop sgn = TYPE_SIGN (TREE_TYPE (step));
4389 	  bool overflow;
4390 
4391 	  widest_int wtmp = wi::mul (wi::to_widest (step), nit, sgn,
4392 				     &overflow);
4393 	  /* If the multiplication overflowed we can't do a meaningful
4394 	     adjustment.  Likewise if the result doesn't fit in the type
4395 	     of the induction variable.  For a signed type we have to
4396 	     check whether the result has the expected signedness which
4397 	     is that of the step as number of iterations is unsigned.  */
4398 	  if (!overflow
4399 	      && wi::fits_to_tree_p (wtmp, TREE_TYPE (init))
4400 	      && (sgn == UNSIGNED
4401 		  || wi::gts_p (wtmp, 0) == wi::gts_p (step, 0)))
4402 	    {
4403 	      tem = wide_int_to_tree (TREE_TYPE (init), wtmp);
4404 	      extract_range_from_binary_expr (&maxvr, PLUS_EXPR,
4405 					      TREE_TYPE (init), init, tem);
4406 	      /* Likewise if the addition did.  */
4407 	      if (maxvr.type == VR_RANGE)
4408 		{
4409 		  tmin = maxvr.min;
4410 		  tmax = maxvr.max;
4411 		}
4412 	    }
4413 	}
4414     }
4415 
4416   if (vr->type == VR_VARYING || vr->type == VR_UNDEFINED)
4417     {
4418       min = tmin;
4419       max = tmax;
4420 
4421       /* For VARYING or UNDEFINED ranges, just about anything we get
4422 	 from scalar evolutions should be better.  */
4423 
4424       if (dir == EV_DIR_DECREASES)
4425 	max = init;
4426       else
4427 	min = init;
4428     }
4429   else if (vr->type == VR_RANGE)
4430     {
4431       min = vr->min;
4432       max = vr->max;
4433 
4434       if (dir == EV_DIR_DECREASES)
4435 	{
4436 	  /* INIT is the maximum value.  If INIT is lower than VR->MAX
4437 	     but no smaller than VR->MIN, set VR->MAX to INIT.  */
4438 	  if (compare_values (init, max) == -1)
4439 	    max = init;
4440 
4441 	  /* According to the loop information, the variable does not
4442 	     overflow.  If we think it does, probably because of an
4443 	     overflow due to arithmetic on a different INF value,
4444 	     reset now.  */
4445 	  if (is_negative_overflow_infinity (min)
4446 	      || compare_values (min, tmin) == -1)
4447 	    min = tmin;
4448 
4449 	}
4450       else
4451 	{
4452 	  /* If INIT is bigger than VR->MIN, set VR->MIN to INIT.  */
4453 	  if (compare_values (init, min) == 1)
4454 	    min = init;
4455 
4456 	  if (is_positive_overflow_infinity (max)
4457 	      || compare_values (tmax, max) == -1)
4458 	    max = tmax;
4459 	}
4460     }
4461   else
4462     return;
4463 
4464   /* If we just created an invalid range with the minimum
4465      greater than the maximum, we fail conservatively.
4466      This should happen only in unreachable
4467      parts of code, or for invalid programs.  */
4468   if (compare_values (min, max) == 1
4469       || (is_negative_overflow_infinity (min)
4470 	  && is_positive_overflow_infinity (max)))
4471     return;
4472 
4473   set_value_range (vr, VR_RANGE, min, max, vr->equiv);
4474 }
4475 
4476 
4477 /* Given two numeric value ranges VR0, VR1 and a comparison code COMP:
4478 
4479    - Return BOOLEAN_TRUE_NODE if VR0 COMP VR1 always returns true for
4480      all the values in the ranges.
4481 
4482    - Return BOOLEAN_FALSE_NODE if the comparison always returns false.
4483 
4484    - Return NULL_TREE if it is not always possible to determine the
4485      value of the comparison.
4486 
4487    Also set *STRICT_OVERFLOW_P to indicate whether a range with an
4488    overflow infinity was used in the test.  */
4489 
4490 
4491 static tree
4492 compare_ranges (enum tree_code comp, value_range_t *vr0, value_range_t *vr1,
4493 		bool *strict_overflow_p)
4494 {
4495   /* VARYING or UNDEFINED ranges cannot be compared.  */
4496   if (vr0->type == VR_VARYING
4497       || vr0->type == VR_UNDEFINED
4498       || vr1->type == VR_VARYING
4499       || vr1->type == VR_UNDEFINED)
4500     return NULL_TREE;
4501 
4502   /* Anti-ranges need to be handled separately.  */
4503   if (vr0->type == VR_ANTI_RANGE || vr1->type == VR_ANTI_RANGE)
4504     {
4505       /* If both are anti-ranges, then we cannot compute any
4506 	 comparison.  */
4507       if (vr0->type == VR_ANTI_RANGE && vr1->type == VR_ANTI_RANGE)
4508 	return NULL_TREE;
4509 
4510       /* These comparisons are never statically computable.  */
4511       if (comp == GT_EXPR
4512 	  || comp == GE_EXPR
4513 	  || comp == LT_EXPR
4514 	  || comp == LE_EXPR)
4515 	return NULL_TREE;
4516 
4517       /* Equality can be computed only between a range and an
4518 	 anti-range.  ~[VAL1, VAL2] == [VAL1, VAL2] is always false.  */
4519       if (vr0->type == VR_RANGE)
4520 	{
4521 	  /* To simplify processing, make VR0 the anti-range.  */
4522 	  value_range_t *tmp = vr0;
4523 	  vr0 = vr1;
4524 	  vr1 = tmp;
4525 	}
4526 
4527       gcc_assert (comp == NE_EXPR || comp == EQ_EXPR);
4528 
4529       if (compare_values_warnv (vr0->min, vr1->min, strict_overflow_p) == 0
4530 	  && compare_values_warnv (vr0->max, vr1->max, strict_overflow_p) == 0)
4531 	return (comp == NE_EXPR) ? boolean_true_node : boolean_false_node;
4532 
4533       return NULL_TREE;
4534     }
4535 
4536   if (!usable_range_p (vr0, strict_overflow_p)
4537       || !usable_range_p (vr1, strict_overflow_p))
4538     return NULL_TREE;
4539 
4540   /* Simplify processing.  If COMP is GT_EXPR or GE_EXPR, switch the
4541      operands around and change the comparison code.  */
4542   if (comp == GT_EXPR || comp == GE_EXPR)
4543     {
4544       value_range_t *tmp;
4545       comp = (comp == GT_EXPR) ? LT_EXPR : LE_EXPR;
4546       tmp = vr0;
4547       vr0 = vr1;
4548       vr1 = tmp;
4549     }
4550 
4551   if (comp == EQ_EXPR)
4552     {
4553       /* Equality may only be computed if both ranges represent
4554 	 exactly one value.  */
4555       if (compare_values_warnv (vr0->min, vr0->max, strict_overflow_p) == 0
4556 	  && compare_values_warnv (vr1->min, vr1->max, strict_overflow_p) == 0)
4557 	{
4558 	  int cmp_min = compare_values_warnv (vr0->min, vr1->min,
4559 					      strict_overflow_p);
4560 	  int cmp_max = compare_values_warnv (vr0->max, vr1->max,
4561 					      strict_overflow_p);
4562 	  if (cmp_min == 0 && cmp_max == 0)
4563 	    return boolean_true_node;
4564 	  else if (cmp_min != -2 && cmp_max != -2)
4565 	    return boolean_false_node;
4566 	}
4567       /* If [V0_MIN, V1_MAX] < [V1_MIN, V1_MAX] then V0 != V1.  */
4568       else if (compare_values_warnv (vr0->min, vr1->max,
4569 				     strict_overflow_p) == 1
4570 	       || compare_values_warnv (vr1->min, vr0->max,
4571 					strict_overflow_p) == 1)
4572 	return boolean_false_node;
4573 
4574       return NULL_TREE;
4575     }
4576   else if (comp == NE_EXPR)
4577     {
4578       int cmp1, cmp2;
4579 
4580       /* If VR0 is completely to the left or completely to the right
4581 	 of VR1, they are always different.  Notice that we need to
4582 	 make sure that both comparisons yield similar results to
4583 	 avoid comparing values that cannot be compared at
4584 	 compile-time.  */
4585       cmp1 = compare_values_warnv (vr0->max, vr1->min, strict_overflow_p);
4586       cmp2 = compare_values_warnv (vr0->min, vr1->max, strict_overflow_p);
4587       if ((cmp1 == -1 && cmp2 == -1) || (cmp1 == 1 && cmp2 == 1))
4588 	return boolean_true_node;
4589 
4590       /* If VR0 and VR1 represent a single value and are identical,
4591 	 return false.  */
4592       else if (compare_values_warnv (vr0->min, vr0->max,
4593 				     strict_overflow_p) == 0
4594 	       && compare_values_warnv (vr1->min, vr1->max,
4595 					strict_overflow_p) == 0
4596 	       && compare_values_warnv (vr0->min, vr1->min,
4597 					strict_overflow_p) == 0
4598 	       && compare_values_warnv (vr0->max, vr1->max,
4599 					strict_overflow_p) == 0)
4600 	return boolean_false_node;
4601 
4602       /* Otherwise, they may or may not be different.  */
4603       else
4604 	return NULL_TREE;
4605     }
4606   else if (comp == LT_EXPR || comp == LE_EXPR)
4607     {
4608       int tst;
4609 
4610       /* If VR0 is to the left of VR1, return true.  */
4611       tst = compare_values_warnv (vr0->max, vr1->min, strict_overflow_p);
4612       if ((comp == LT_EXPR && tst == -1)
4613 	  || (comp == LE_EXPR && (tst == -1 || tst == 0)))
4614 	{
4615 	  if (overflow_infinity_range_p (vr0)
4616 	      || overflow_infinity_range_p (vr1))
4617 	    *strict_overflow_p = true;
4618 	  return boolean_true_node;
4619 	}
4620 
4621       /* If VR0 is to the right of VR1, return false.  */
4622       tst = compare_values_warnv (vr0->min, vr1->max, strict_overflow_p);
4623       if ((comp == LT_EXPR && (tst == 0 || tst == 1))
4624 	  || (comp == LE_EXPR && tst == 1))
4625 	{
4626 	  if (overflow_infinity_range_p (vr0)
4627 	      || overflow_infinity_range_p (vr1))
4628 	    *strict_overflow_p = true;
4629 	  return boolean_false_node;
4630 	}
4631 
4632       /* Otherwise, we don't know.  */
4633       return NULL_TREE;
4634     }
4635 
4636   gcc_unreachable ();
4637 }
4638 
4639 
4640 /* Given a value range VR, a value VAL and a comparison code COMP, return
4641    BOOLEAN_TRUE_NODE if VR COMP VAL always returns true for all the
4642    values in VR.  Return BOOLEAN_FALSE_NODE if the comparison
4643    always returns false.  Return NULL_TREE if it is not always
4644    possible to determine the value of the comparison.  Also set
4645    *STRICT_OVERFLOW_P to indicate whether a range with an overflow
4646    infinity was used in the test.  */
4647 
4648 static tree
4649 compare_range_with_value (enum tree_code comp, value_range_t *vr, tree val,
4650 			  bool *strict_overflow_p)
4651 {
4652   if (vr->type == VR_VARYING || vr->type == VR_UNDEFINED)
4653     return NULL_TREE;
4654 
4655   /* Anti-ranges need to be handled separately.  */
4656   if (vr->type == VR_ANTI_RANGE)
4657     {
4658       /* For anti-ranges, the only predicates that we can compute at
4659 	 compile time are equality and inequality.  */
4660       if (comp == GT_EXPR
4661 	  || comp == GE_EXPR
4662 	  || comp == LT_EXPR
4663 	  || comp == LE_EXPR)
4664 	return NULL_TREE;
4665 
4666       /* ~[VAL_1, VAL_2] OP VAL is known if VAL_1 <= VAL <= VAL_2.  */
4667       if (value_inside_range (val, vr->min, vr->max) == 1)
4668 	return (comp == NE_EXPR) ? boolean_true_node : boolean_false_node;
4669 
4670       return NULL_TREE;
4671     }
4672 
4673   if (!usable_range_p (vr, strict_overflow_p))
4674     return NULL_TREE;
4675 
4676   if (comp == EQ_EXPR)
4677     {
4678       /* EQ_EXPR may only be computed if VR represents exactly
4679 	 one value.  */
4680       if (compare_values_warnv (vr->min, vr->max, strict_overflow_p) == 0)
4681 	{
4682 	  int cmp = compare_values_warnv (vr->min, val, strict_overflow_p);
4683 	  if (cmp == 0)
4684 	    return boolean_true_node;
4685 	  else if (cmp == -1 || cmp == 1 || cmp == 2)
4686 	    return boolean_false_node;
4687 	}
4688       else if (compare_values_warnv (val, vr->min, strict_overflow_p) == -1
4689 	       || compare_values_warnv (vr->max, val, strict_overflow_p) == -1)
4690 	return boolean_false_node;
4691 
4692       return NULL_TREE;
4693     }
4694   else if (comp == NE_EXPR)
4695     {
4696       /* If VAL is not inside VR, then they are always different.  */
4697       if (compare_values_warnv (vr->max, val, strict_overflow_p) == -1
4698 	  || compare_values_warnv (vr->min, val, strict_overflow_p) == 1)
4699 	return boolean_true_node;
4700 
4701       /* If VR represents exactly one value equal to VAL, then return
4702 	 false.  */
4703       if (compare_values_warnv (vr->min, vr->max, strict_overflow_p) == 0
4704 	  && compare_values_warnv (vr->min, val, strict_overflow_p) == 0)
4705 	return boolean_false_node;
4706 
4707       /* Otherwise, they may or may not be different.  */
4708       return NULL_TREE;
4709     }
4710   else if (comp == LT_EXPR || comp == LE_EXPR)
4711     {
4712       int tst;
4713 
4714       /* If VR is to the left of VAL, return true.  */
4715       tst = compare_values_warnv (vr->max, val, strict_overflow_p);
4716       if ((comp == LT_EXPR && tst == -1)
4717 	  || (comp == LE_EXPR && (tst == -1 || tst == 0)))
4718 	{
4719 	  if (overflow_infinity_range_p (vr))
4720 	    *strict_overflow_p = true;
4721 	  return boolean_true_node;
4722 	}
4723 
4724       /* If VR is to the right of VAL, return false.  */
4725       tst = compare_values_warnv (vr->min, val, strict_overflow_p);
4726       if ((comp == LT_EXPR && (tst == 0 || tst == 1))
4727 	  || (comp == LE_EXPR && tst == 1))
4728 	{
4729 	  if (overflow_infinity_range_p (vr))
4730 	    *strict_overflow_p = true;
4731 	  return boolean_false_node;
4732 	}
4733 
4734       /* Otherwise, we don't know.  */
4735       return NULL_TREE;
4736     }
4737   else if (comp == GT_EXPR || comp == GE_EXPR)
4738     {
4739       int tst;
4740 
4741       /* If VR is to the right of VAL, return true.  */
4742       tst = compare_values_warnv (vr->min, val, strict_overflow_p);
4743       if ((comp == GT_EXPR && tst == 1)
4744 	  || (comp == GE_EXPR && (tst == 0 || tst == 1)))
4745 	{
4746 	  if (overflow_infinity_range_p (vr))
4747 	    *strict_overflow_p = true;
4748 	  return boolean_true_node;
4749 	}
4750 
4751       /* If VR is to the left of VAL, return false.  */
4752       tst = compare_values_warnv (vr->max, val, strict_overflow_p);
4753       if ((comp == GT_EXPR && (tst == -1 || tst == 0))
4754 	  || (comp == GE_EXPR && tst == -1))
4755 	{
4756 	  if (overflow_infinity_range_p (vr))
4757 	    *strict_overflow_p = true;
4758 	  return boolean_false_node;
4759 	}
4760 
4761       /* Otherwise, we don't know.  */
4762       return NULL_TREE;
4763     }
4764 
4765   gcc_unreachable ();
4766 }
4767 
4768 
4769 /* Debugging dumps.  */
4770 
4771 void dump_value_range (FILE *, value_range_t *);
4772 void debug_value_range (value_range_t *);
4773 void dump_all_value_ranges (FILE *);
4774 void debug_all_value_ranges (void);
4775 void dump_vr_equiv (FILE *, bitmap);
4776 void debug_vr_equiv (bitmap);
4777 
4778 
4779 /* Dump value range VR to FILE.  */
4780 
4781 void
4782 dump_value_range (FILE *file, value_range_t *vr)
4783 {
4784   if (vr == NULL)
4785     fprintf (file, "[]");
4786   else if (vr->type == VR_UNDEFINED)
4787     fprintf (file, "UNDEFINED");
4788   else if (vr->type == VR_RANGE || vr->type == VR_ANTI_RANGE)
4789     {
4790       tree type = TREE_TYPE (vr->min);
4791 
4792       fprintf (file, "%s[", (vr->type == VR_ANTI_RANGE) ? "~" : "");
4793 
4794       if (is_negative_overflow_infinity (vr->min))
4795 	fprintf (file, "-INF(OVF)");
4796       else if (INTEGRAL_TYPE_P (type)
4797 	       && !TYPE_UNSIGNED (type)
4798 	       && vrp_val_is_min (vr->min))
4799 	fprintf (file, "-INF");
4800       else
4801 	print_generic_expr (file, vr->min, 0);
4802 
4803       fprintf (file, ", ");
4804 
4805       if (is_positive_overflow_infinity (vr->max))
4806 	fprintf (file, "+INF(OVF)");
4807       else if (INTEGRAL_TYPE_P (type)
4808 	       && vrp_val_is_max (vr->max))
4809 	fprintf (file, "+INF");
4810       else
4811 	print_generic_expr (file, vr->max, 0);
4812 
4813       fprintf (file, "]");
4814 
4815       if (vr->equiv)
4816 	{
4817 	  bitmap_iterator bi;
4818 	  unsigned i, c = 0;
4819 
4820 	  fprintf (file, "  EQUIVALENCES: { ");
4821 
4822 	  EXECUTE_IF_SET_IN_BITMAP (vr->equiv, 0, i, bi)
4823 	    {
4824 	      print_generic_expr (file, ssa_name (i), 0);
4825 	      fprintf (file, " ");
4826 	      c++;
4827 	    }
4828 
4829 	  fprintf (file, "} (%u elements)", c);
4830 	}
4831     }
4832   else if (vr->type == VR_VARYING)
4833     fprintf (file, "VARYING");
4834   else
4835     fprintf (file, "INVALID RANGE");
4836 }
4837 
4838 
4839 /* Dump value range VR to stderr.  */
4840 
4841 DEBUG_FUNCTION void
4842 debug_value_range (value_range_t *vr)
4843 {
4844   dump_value_range (stderr, vr);
4845   fprintf (stderr, "\n");
4846 }
4847 
4848 
4849 /* Dump value ranges of all SSA_NAMEs to FILE.  */
4850 
4851 void
4852 dump_all_value_ranges (FILE *file)
4853 {
4854   size_t i;
4855 
4856   for (i = 0; i < num_vr_values; i++)
4857     {
4858       if (vr_value[i])
4859 	{
4860 	  print_generic_expr (file, ssa_name (i), 0);
4861 	  fprintf (file, ": ");
4862 	  dump_value_range (file, vr_value[i]);
4863 	  fprintf (file, "\n");
4864 	}
4865     }
4866 
4867   fprintf (file, "\n");
4868 }
4869 
4870 
4871 /* Dump all value ranges to stderr.  */
4872 
4873 DEBUG_FUNCTION void
4874 debug_all_value_ranges (void)
4875 {
4876   dump_all_value_ranges (stderr);
4877 }
4878 
4879 
4880 /* Given a COND_EXPR COND of the form 'V OP W', and an SSA name V,
4881    create a new SSA name N and return the assertion assignment
4882    'N = ASSERT_EXPR <V, V OP W>'.  */
4883 
4884 static gimple
4885 build_assert_expr_for (tree cond, tree v)
4886 {
4887   tree a;
4888   gassign *assertion;
4889 
4890   gcc_assert (TREE_CODE (v) == SSA_NAME
4891 	      && COMPARISON_CLASS_P (cond));
4892 
4893   a = build2 (ASSERT_EXPR, TREE_TYPE (v), v, cond);
4894   assertion = gimple_build_assign (NULL_TREE, a);
4895 
4896   /* The new ASSERT_EXPR, creates a new SSA name that replaces the
4897      operand of the ASSERT_EXPR.  Create it so the new name and the old one
4898      are registered in the replacement table so that we can fix the SSA web
4899      after adding all the ASSERT_EXPRs.  */
4900   create_new_def_for (v, assertion, NULL);
4901 
4902   return assertion;
4903 }
4904 
4905 
4906 /* Return false if EXPR is a predicate expression involving floating
4907    point values.  */
4908 
4909 static inline bool
4910 fp_predicate (gimple stmt)
4911 {
4912   GIMPLE_CHECK (stmt, GIMPLE_COND);
4913 
4914   return FLOAT_TYPE_P (TREE_TYPE (gimple_cond_lhs (stmt)));
4915 }
4916 
4917 /* If the range of values taken by OP can be inferred after STMT executes,
4918    return the comparison code (COMP_CODE_P) and value (VAL_P) that
4919    describes the inferred range.  Return true if a range could be
4920    inferred.  */
4921 
4922 static bool
4923 infer_value_range (gimple stmt, tree op, enum tree_code *comp_code_p, tree *val_p)
4924 {
4925   *val_p = NULL_TREE;
4926   *comp_code_p = ERROR_MARK;
4927 
4928   /* Do not attempt to infer anything in names that flow through
4929      abnormal edges.  */
4930   if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (op))
4931     return false;
4932 
4933   /* Similarly, don't infer anything from statements that may throw
4934      exceptions. ??? Relax this requirement?  */
4935   if (stmt_could_throw_p (stmt))
4936     return false;
4937 
4938   /* If STMT is the last statement of a basic block with no normal
4939      successors, there is no point inferring anything about any of its
4940      operands.  We would not be able to find a proper insertion point
4941      for the assertion, anyway.  */
4942   if (stmt_ends_bb_p (stmt))
4943     {
4944       edge_iterator ei;
4945       edge e;
4946 
4947       FOR_EACH_EDGE (e, ei, gimple_bb (stmt)->succs)
4948 	if (!(e->flags & EDGE_ABNORMAL))
4949 	  break;
4950       if (e == NULL)
4951 	return false;
4952     }
4953 
4954   if (infer_nonnull_range (stmt, op, true, true))
4955     {
4956       *val_p = build_int_cst (TREE_TYPE (op), 0);
4957       *comp_code_p = NE_EXPR;
4958       return true;
4959     }
4960 
4961   return false;
4962 }
4963 
4964 
4965 void dump_asserts_for (FILE *, tree);
4966 void debug_asserts_for (tree);
4967 void dump_all_asserts (FILE *);
4968 void debug_all_asserts (void);
4969 
4970 /* Dump all the registered assertions for NAME to FILE.  */
4971 
4972 void
4973 dump_asserts_for (FILE *file, tree name)
4974 {
4975   assert_locus_t loc;
4976 
4977   fprintf (file, "Assertions to be inserted for ");
4978   print_generic_expr (file, name, 0);
4979   fprintf (file, "\n");
4980 
4981   loc = asserts_for[SSA_NAME_VERSION (name)];
4982   while (loc)
4983     {
4984       fprintf (file, "\t");
4985       print_gimple_stmt (file, gsi_stmt (loc->si), 0, 0);
4986       fprintf (file, "\n\tBB #%d", loc->bb->index);
4987       if (loc->e)
4988 	{
4989 	  fprintf (file, "\n\tEDGE %d->%d", loc->e->src->index,
4990 	           loc->e->dest->index);
4991 	  dump_edge_info (file, loc->e, dump_flags, 0);
4992 	}
4993       fprintf (file, "\n\tPREDICATE: ");
4994       print_generic_expr (file, name, 0);
4995       fprintf (file, " %s ", get_tree_code_name (loc->comp_code));
4996       print_generic_expr (file, loc->val, 0);
4997       fprintf (file, "\n\n");
4998       loc = loc->next;
4999     }
5000 
5001   fprintf (file, "\n");
5002 }
5003 
5004 
5005 /* Dump all the registered assertions for NAME to stderr.  */
5006 
5007 DEBUG_FUNCTION void
5008 debug_asserts_for (tree name)
5009 {
5010   dump_asserts_for (stderr, name);
5011 }
5012 
5013 
5014 /* Dump all the registered assertions for all the names to FILE.  */
5015 
5016 void
5017 dump_all_asserts (FILE *file)
5018 {
5019   unsigned i;
5020   bitmap_iterator bi;
5021 
5022   fprintf (file, "\nASSERT_EXPRs to be inserted\n\n");
5023   EXECUTE_IF_SET_IN_BITMAP (need_assert_for, 0, i, bi)
5024     dump_asserts_for (file, ssa_name (i));
5025   fprintf (file, "\n");
5026 }
5027 
5028 
5029 /* Dump all the registered assertions for all the names to stderr.  */
5030 
5031 DEBUG_FUNCTION void
5032 debug_all_asserts (void)
5033 {
5034   dump_all_asserts (stderr);
5035 }
5036 
5037 
5038 /* If NAME doesn't have an ASSERT_EXPR registered for asserting
5039    'EXPR COMP_CODE VAL' at a location that dominates block BB or
5040    E->DEST, then register this location as a possible insertion point
5041    for ASSERT_EXPR <NAME, EXPR COMP_CODE VAL>.
5042 
5043    BB, E and SI provide the exact insertion point for the new
5044    ASSERT_EXPR.  If BB is NULL, then the ASSERT_EXPR is to be inserted
5045    on edge E.  Otherwise, if E is NULL, the ASSERT_EXPR is inserted on
5046    BB.  If SI points to a COND_EXPR or a SWITCH_EXPR statement, then E
5047    must not be NULL.  */
5048 
5049 static void
5050 register_new_assert_for (tree name, tree expr,
5051 			 enum tree_code comp_code,
5052 			 tree val,
5053 			 basic_block bb,
5054 			 edge e,
5055 			 gimple_stmt_iterator si)
5056 {
5057   assert_locus_t n, loc, last_loc;
5058   basic_block dest_bb;
5059 
5060   gcc_checking_assert (bb == NULL || e == NULL);
5061 
5062   if (e == NULL)
5063     gcc_checking_assert (gimple_code (gsi_stmt (si)) != GIMPLE_COND
5064 			 && gimple_code (gsi_stmt (si)) != GIMPLE_SWITCH);
5065 
5066   /* Never build an assert comparing against an integer constant with
5067      TREE_OVERFLOW set.  This confuses our undefined overflow warning
5068      machinery.  */
5069   if (TREE_OVERFLOW_P (val))
5070     val = drop_tree_overflow (val);
5071 
5072   /* The new assertion A will be inserted at BB or E.  We need to
5073      determine if the new location is dominated by a previously
5074      registered location for A.  If we are doing an edge insertion,
5075      assume that A will be inserted at E->DEST.  Note that this is not
5076      necessarily true.
5077 
5078      If E is a critical edge, it will be split.  But even if E is
5079      split, the new block will dominate the same set of blocks that
5080      E->DEST dominates.
5081 
5082      The reverse, however, is not true, blocks dominated by E->DEST
5083      will not be dominated by the new block created to split E.  So,
5084      if the insertion location is on a critical edge, we will not use
5085      the new location to move another assertion previously registered
5086      at a block dominated by E->DEST.  */
5087   dest_bb = (bb) ? bb : e->dest;
5088 
5089   /* If NAME already has an ASSERT_EXPR registered for COMP_CODE and
5090      VAL at a block dominating DEST_BB, then we don't need to insert a new
5091      one.  Similarly, if the same assertion already exists at a block
5092      dominated by DEST_BB and the new location is not on a critical
5093      edge, then update the existing location for the assertion (i.e.,
5094      move the assertion up in the dominance tree).
5095 
5096      Note, this is implemented as a simple linked list because there
5097      should not be more than a handful of assertions registered per
5098      name.  If this becomes a performance problem, a table hashed by
5099      COMP_CODE and VAL could be implemented.  */
5100   loc = asserts_for[SSA_NAME_VERSION (name)];
5101   last_loc = loc;
5102   while (loc)
5103     {
5104       if (loc->comp_code == comp_code
5105 	  && (loc->val == val
5106 	      || operand_equal_p (loc->val, val, 0))
5107 	  && (loc->expr == expr
5108 	      || operand_equal_p (loc->expr, expr, 0)))
5109 	{
5110 	  /* If E is not a critical edge and DEST_BB
5111 	     dominates the existing location for the assertion, move
5112 	     the assertion up in the dominance tree by updating its
5113 	     location information.  */
5114 	  if ((e == NULL || !EDGE_CRITICAL_P (e))
5115 	      && dominated_by_p (CDI_DOMINATORS, loc->bb, dest_bb))
5116 	    {
5117 	      loc->bb = dest_bb;
5118 	      loc->e = e;
5119 	      loc->si = si;
5120 	      return;
5121 	    }
5122 	}
5123 
5124       /* Update the last node of the list and move to the next one.  */
5125       last_loc = loc;
5126       loc = loc->next;
5127     }
5128 
5129   /* If we didn't find an assertion already registered for
5130      NAME COMP_CODE VAL, add a new one at the end of the list of
5131      assertions associated with NAME.  */
5132   n = XNEW (struct assert_locus_d);
5133   n->bb = dest_bb;
5134   n->e = e;
5135   n->si = si;
5136   n->comp_code = comp_code;
5137   n->val = val;
5138   n->expr = expr;
5139   n->next = NULL;
5140 
5141   if (last_loc)
5142     last_loc->next = n;
5143   else
5144     asserts_for[SSA_NAME_VERSION (name)] = n;
5145 
5146   bitmap_set_bit (need_assert_for, SSA_NAME_VERSION (name));
5147 }
5148 
5149 /* (COND_OP0 COND_CODE COND_OP1) is a predicate which uses NAME.
5150    Extract a suitable test code and value and store them into *CODE_P and
5151    *VAL_P so the predicate is normalized to NAME *CODE_P *VAL_P.
5152 
5153    If no extraction was possible, return FALSE, otherwise return TRUE.
5154 
5155    If INVERT is true, then we invert the result stored into *CODE_P.  */
5156 
5157 static bool
5158 extract_code_and_val_from_cond_with_ops (tree name, enum tree_code cond_code,
5159 					 tree cond_op0, tree cond_op1,
5160 					 bool invert, enum tree_code *code_p,
5161 					 tree *val_p)
5162 {
5163   enum tree_code comp_code;
5164   tree val;
5165 
5166   /* Otherwise, we have a comparison of the form NAME COMP VAL
5167      or VAL COMP NAME.  */
5168   if (name == cond_op1)
5169     {
5170       /* If the predicate is of the form VAL COMP NAME, flip
5171 	 COMP around because we need to register NAME as the
5172 	 first operand in the predicate.  */
5173       comp_code = swap_tree_comparison (cond_code);
5174       val = cond_op0;
5175     }
5176   else
5177     {
5178       /* The comparison is of the form NAME COMP VAL, so the
5179 	 comparison code remains unchanged.  */
5180       comp_code = cond_code;
5181       val = cond_op1;
5182     }
5183 
5184   /* Invert the comparison code as necessary.  */
5185   if (invert)
5186     comp_code = invert_tree_comparison (comp_code, 0);
5187 
5188   /* VRP does not handle float types.  */
5189   if (SCALAR_FLOAT_TYPE_P (TREE_TYPE (val)))
5190     return false;
5191 
5192   /* Do not register always-false predicates.
5193      FIXME:  this works around a limitation in fold() when dealing with
5194      enumerations.  Given 'enum { N1, N2 } x;', fold will not
5195      fold 'if (x > N2)' to 'if (0)'.  */
5196   if ((comp_code == GT_EXPR || comp_code == LT_EXPR)
5197       && INTEGRAL_TYPE_P (TREE_TYPE (val)))
5198     {
5199       tree min = TYPE_MIN_VALUE (TREE_TYPE (val));
5200       tree max = TYPE_MAX_VALUE (TREE_TYPE (val));
5201 
5202       if (comp_code == GT_EXPR
5203 	  && (!max
5204 	      || compare_values (val, max) == 0))
5205 	return false;
5206 
5207       if (comp_code == LT_EXPR
5208 	  && (!min
5209 	      || compare_values (val, min) == 0))
5210 	return false;
5211     }
5212   *code_p = comp_code;
5213   *val_p = val;
5214   return true;
5215 }
5216 
5217 /* Find out smallest RES where RES > VAL && (RES & MASK) == RES, if any
5218    (otherwise return VAL).  VAL and MASK must be zero-extended for
5219    precision PREC.  If SGNBIT is non-zero, first xor VAL with SGNBIT
5220    (to transform signed values into unsigned) and at the end xor
5221    SGNBIT back.  */
5222 
5223 static wide_int
5224 masked_increment (const wide_int &val_in, const wide_int &mask,
5225 		  const wide_int &sgnbit, unsigned int prec)
5226 {
5227   wide_int bit = wi::one (prec), res;
5228   unsigned int i;
5229 
5230   wide_int val = val_in ^ sgnbit;
5231   for (i = 0; i < prec; i++, bit += bit)
5232     {
5233       res = mask;
5234       if ((res & bit) == 0)
5235 	continue;
5236       res = bit - 1;
5237       res = (val + bit).and_not (res);
5238       res &= mask;
5239       if (wi::gtu_p (res, val))
5240 	return res ^ sgnbit;
5241     }
5242   return val ^ sgnbit;
5243 }
5244 
5245 /* Try to register an edge assertion for SSA name NAME on edge E for
5246    the condition COND contributing to the conditional jump pointed to by BSI.
5247    Invert the condition COND if INVERT is true.  */
5248 
5249 static void
5250 register_edge_assert_for_2 (tree name, edge e, gimple_stmt_iterator bsi,
5251 			    enum tree_code cond_code,
5252 			    tree cond_op0, tree cond_op1, bool invert)
5253 {
5254   tree val;
5255   enum tree_code comp_code;
5256 
5257   if (!extract_code_and_val_from_cond_with_ops (name, cond_code,
5258 						cond_op0,
5259 						cond_op1,
5260 						invert, &comp_code, &val))
5261     return;
5262 
5263   /* Only register an ASSERT_EXPR if NAME was found in the sub-graph
5264      reachable from E.  */
5265   if (live_on_edge (e, name)
5266       && !has_single_use (name))
5267     register_new_assert_for (name, name, comp_code, val, NULL, e, bsi);
5268 
5269   /* In the case of NAME <= CST and NAME being defined as
5270      NAME = (unsigned) NAME2 + CST2 we can assert NAME2 >= -CST2
5271      and NAME2 <= CST - CST2.  We can do the same for NAME > CST.
5272      This catches range and anti-range tests.  */
5273   if ((comp_code == LE_EXPR
5274        || comp_code == GT_EXPR)
5275       && TREE_CODE (val) == INTEGER_CST
5276       && TYPE_UNSIGNED (TREE_TYPE (val)))
5277     {
5278       gimple def_stmt = SSA_NAME_DEF_STMT (name);
5279       tree cst2 = NULL_TREE, name2 = NULL_TREE, name3 = NULL_TREE;
5280 
5281       /* Extract CST2 from the (optional) addition.  */
5282       if (is_gimple_assign (def_stmt)
5283 	  && gimple_assign_rhs_code (def_stmt) == PLUS_EXPR)
5284 	{
5285 	  name2 = gimple_assign_rhs1 (def_stmt);
5286 	  cst2 = gimple_assign_rhs2 (def_stmt);
5287 	  if (TREE_CODE (name2) == SSA_NAME
5288 	      && TREE_CODE (cst2) == INTEGER_CST)
5289 	    def_stmt = SSA_NAME_DEF_STMT (name2);
5290 	}
5291 
5292       /* Extract NAME2 from the (optional) sign-changing cast.  */
5293       if (gimple_assign_cast_p (def_stmt))
5294 	{
5295 	  if (CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt))
5296 	      && ! TYPE_UNSIGNED (TREE_TYPE (gimple_assign_rhs1 (def_stmt)))
5297 	      && (TYPE_PRECISION (gimple_expr_type (def_stmt))
5298 		  == TYPE_PRECISION (TREE_TYPE (gimple_assign_rhs1 (def_stmt)))))
5299 	    name3 = gimple_assign_rhs1 (def_stmt);
5300 	}
5301 
5302       /* If name3 is used later, create an ASSERT_EXPR for it.  */
5303       if (name3 != NULL_TREE
5304       	  && TREE_CODE (name3) == SSA_NAME
5305 	  && (cst2 == NULL_TREE
5306 	      || TREE_CODE (cst2) == INTEGER_CST)
5307 	  && INTEGRAL_TYPE_P (TREE_TYPE (name3))
5308 	  && live_on_edge (e, name3)
5309 	  && !has_single_use (name3))
5310 	{
5311 	  tree tmp;
5312 
5313 	  /* Build an expression for the range test.  */
5314 	  tmp = build1 (NOP_EXPR, TREE_TYPE (name), name3);
5315 	  if (cst2 != NULL_TREE)
5316 	    tmp = build2 (PLUS_EXPR, TREE_TYPE (name), tmp, cst2);
5317 
5318 	  if (dump_file)
5319 	    {
5320 	      fprintf (dump_file, "Adding assert for ");
5321 	      print_generic_expr (dump_file, name3, 0);
5322 	      fprintf (dump_file, " from ");
5323 	      print_generic_expr (dump_file, tmp, 0);
5324 	      fprintf (dump_file, "\n");
5325 	    }
5326 
5327 	  register_new_assert_for (name3, tmp, comp_code, val, NULL, e, bsi);
5328 	}
5329 
5330       /* If name2 is used later, create an ASSERT_EXPR for it.  */
5331       if (name2 != NULL_TREE
5332       	  && TREE_CODE (name2) == SSA_NAME
5333 	  && TREE_CODE (cst2) == INTEGER_CST
5334 	  && INTEGRAL_TYPE_P (TREE_TYPE (name2))
5335 	  && live_on_edge (e, name2)
5336 	  && !has_single_use (name2))
5337 	{
5338 	  tree tmp;
5339 
5340 	  /* Build an expression for the range test.  */
5341 	  tmp = name2;
5342 	  if (TREE_TYPE (name) != TREE_TYPE (name2))
5343 	    tmp = build1 (NOP_EXPR, TREE_TYPE (name), tmp);
5344 	  if (cst2 != NULL_TREE)
5345 	    tmp = build2 (PLUS_EXPR, TREE_TYPE (name), tmp, cst2);
5346 
5347 	  if (dump_file)
5348 	    {
5349 	      fprintf (dump_file, "Adding assert for ");
5350 	      print_generic_expr (dump_file, name2, 0);
5351 	      fprintf (dump_file, " from ");
5352 	      print_generic_expr (dump_file, tmp, 0);
5353 	      fprintf (dump_file, "\n");
5354 	    }
5355 
5356 	  register_new_assert_for (name2, tmp, comp_code, val, NULL, e, bsi);
5357 	}
5358     }
5359 
5360   /* In the case of post-in/decrement tests like if (i++) ... and uses
5361      of the in/decremented value on the edge the extra name we want to
5362      assert for is not on the def chain of the name compared.  Instead
5363      it is in the set of use stmts.  */
5364   if ((comp_code == NE_EXPR
5365        || comp_code == EQ_EXPR)
5366       && TREE_CODE (val) == INTEGER_CST)
5367     {
5368       imm_use_iterator ui;
5369       gimple use_stmt;
5370       FOR_EACH_IMM_USE_STMT (use_stmt, ui, name)
5371 	{
5372 	  /* Cut off to use-stmts that are in the predecessor.  */
5373 	  if (gimple_bb (use_stmt) != e->src)
5374 	    continue;
5375 
5376 	  if (!is_gimple_assign (use_stmt))
5377 	    continue;
5378 
5379 	  enum tree_code code = gimple_assign_rhs_code (use_stmt);
5380 	  if (code != PLUS_EXPR
5381 	      && code != MINUS_EXPR)
5382 	    continue;
5383 
5384 	  tree cst = gimple_assign_rhs2 (use_stmt);
5385 	  if (TREE_CODE (cst) != INTEGER_CST)
5386 	    continue;
5387 
5388 	  tree name2 = gimple_assign_lhs (use_stmt);
5389 	  if (live_on_edge (e, name2))
5390 	    {
5391 	      cst = int_const_binop (code, val, cst);
5392 	      register_new_assert_for (name2, name2, comp_code, cst,
5393 				       NULL, e, bsi);
5394 	    }
5395 	}
5396     }
5397 
5398   if (TREE_CODE_CLASS (comp_code) == tcc_comparison
5399       && TREE_CODE (val) == INTEGER_CST)
5400     {
5401       gimple def_stmt = SSA_NAME_DEF_STMT (name);
5402       tree name2 = NULL_TREE, names[2], cst2 = NULL_TREE;
5403       tree val2 = NULL_TREE;
5404       unsigned int prec = TYPE_PRECISION (TREE_TYPE (val));
5405       wide_int mask = wi::zero (prec);
5406       unsigned int nprec = prec;
5407       enum tree_code rhs_code = ERROR_MARK;
5408 
5409       if (is_gimple_assign (def_stmt))
5410 	rhs_code = gimple_assign_rhs_code (def_stmt);
5411 
5412       /* Add asserts for NAME cmp CST and NAME being defined
5413 	 as NAME = (int) NAME2.  */
5414       if (!TYPE_UNSIGNED (TREE_TYPE (val))
5415 	  && (comp_code == LE_EXPR || comp_code == LT_EXPR
5416 	      || comp_code == GT_EXPR || comp_code == GE_EXPR)
5417 	  && gimple_assign_cast_p (def_stmt))
5418 	{
5419 	  name2 = gimple_assign_rhs1 (def_stmt);
5420 	  if (CONVERT_EXPR_CODE_P (rhs_code)
5421 	      && INTEGRAL_TYPE_P (TREE_TYPE (name2))
5422 	      && TYPE_UNSIGNED (TREE_TYPE (name2))
5423 	      && prec == TYPE_PRECISION (TREE_TYPE (name2))
5424 	      && (comp_code == LE_EXPR || comp_code == GT_EXPR
5425 		  || !tree_int_cst_equal (val,
5426 					  TYPE_MIN_VALUE (TREE_TYPE (val))))
5427 	      && live_on_edge (e, name2)
5428 	      && !has_single_use (name2))
5429 	    {
5430 	      tree tmp, cst;
5431 	      enum tree_code new_comp_code = comp_code;
5432 
5433 	      cst = fold_convert (TREE_TYPE (name2),
5434 				  TYPE_MIN_VALUE (TREE_TYPE (val)));
5435 	      /* Build an expression for the range test.  */
5436 	      tmp = build2 (PLUS_EXPR, TREE_TYPE (name2), name2, cst);
5437 	      cst = fold_build2 (PLUS_EXPR, TREE_TYPE (name2), cst,
5438 				 fold_convert (TREE_TYPE (name2), val));
5439 	      if (comp_code == LT_EXPR || comp_code == GE_EXPR)
5440 		{
5441 		  new_comp_code = comp_code == LT_EXPR ? LE_EXPR : GT_EXPR;
5442 		  cst = fold_build2 (MINUS_EXPR, TREE_TYPE (name2), cst,
5443 				     build_int_cst (TREE_TYPE (name2), 1));
5444 		}
5445 
5446 	      if (dump_file)
5447 		{
5448 		  fprintf (dump_file, "Adding assert for ");
5449 		  print_generic_expr (dump_file, name2, 0);
5450 		  fprintf (dump_file, " from ");
5451 		  print_generic_expr (dump_file, tmp, 0);
5452 		  fprintf (dump_file, "\n");
5453 		}
5454 
5455 	      register_new_assert_for (name2, tmp, new_comp_code, cst, NULL,
5456 				       e, bsi);
5457 	    }
5458 	}
5459 
5460       /* Add asserts for NAME cmp CST and NAME being defined as
5461 	 NAME = NAME2 >> CST2.
5462 
5463 	 Extract CST2 from the right shift.  */
5464       if (rhs_code == RSHIFT_EXPR)
5465 	{
5466 	  name2 = gimple_assign_rhs1 (def_stmt);
5467 	  cst2 = gimple_assign_rhs2 (def_stmt);
5468 	  if (TREE_CODE (name2) == SSA_NAME
5469 	      && tree_fits_uhwi_p (cst2)
5470 	      && INTEGRAL_TYPE_P (TREE_TYPE (name2))
5471 	      && IN_RANGE (tree_to_uhwi (cst2), 1, prec - 1)
5472 	      && prec == GET_MODE_PRECISION (TYPE_MODE (TREE_TYPE (val)))
5473 	      && live_on_edge (e, name2)
5474 	      && !has_single_use (name2))
5475 	    {
5476 	      mask = wi::mask (tree_to_uhwi (cst2), false, prec);
5477 	      val2 = fold_binary (LSHIFT_EXPR, TREE_TYPE (val), val, cst2);
5478 	    }
5479 	}
5480       if (val2 != NULL_TREE
5481 	  && TREE_CODE (val2) == INTEGER_CST
5482 	  && simple_cst_equal (fold_build2 (RSHIFT_EXPR,
5483 					    TREE_TYPE (val),
5484 					    val2, cst2), val))
5485 	{
5486 	  enum tree_code new_comp_code = comp_code;
5487 	  tree tmp, new_val;
5488 
5489 	  tmp = name2;
5490 	  if (comp_code == EQ_EXPR || comp_code == NE_EXPR)
5491 	    {
5492 	      if (!TYPE_UNSIGNED (TREE_TYPE (val)))
5493 		{
5494 		  tree type = build_nonstandard_integer_type (prec, 1);
5495 		  tmp = build1 (NOP_EXPR, type, name2);
5496 		  val2 = fold_convert (type, val2);
5497 		}
5498 	      tmp = fold_build2 (MINUS_EXPR, TREE_TYPE (tmp), tmp, val2);
5499 	      new_val = wide_int_to_tree (TREE_TYPE (tmp), mask);
5500 	      new_comp_code = comp_code == EQ_EXPR ? LE_EXPR : GT_EXPR;
5501 	    }
5502 	  else if (comp_code == LT_EXPR || comp_code == GE_EXPR)
5503 	    {
5504 	      wide_int minval
5505 		= wi::min_value (prec, TYPE_SIGN (TREE_TYPE (val)));
5506 	      new_val = val2;
5507 	      if (minval == new_val)
5508 		new_val = NULL_TREE;
5509 	    }
5510 	  else
5511 	    {
5512 	      wide_int maxval
5513 		= wi::max_value (prec, TYPE_SIGN (TREE_TYPE (val)));
5514 	      mask |= val2;
5515 	      if (mask == maxval)
5516 		new_val = NULL_TREE;
5517 	      else
5518 		new_val = wide_int_to_tree (TREE_TYPE (val2), mask);
5519 	    }
5520 
5521 	  if (new_val)
5522 	    {
5523 	      if (dump_file)
5524 		{
5525 		  fprintf (dump_file, "Adding assert for ");
5526 		  print_generic_expr (dump_file, name2, 0);
5527 		  fprintf (dump_file, " from ");
5528 		  print_generic_expr (dump_file, tmp, 0);
5529 		  fprintf (dump_file, "\n");
5530 		}
5531 
5532 	      register_new_assert_for (name2, tmp, new_comp_code, new_val,
5533 				       NULL, e, bsi);
5534 	    }
5535 	}
5536 
5537       /* Add asserts for NAME cmp CST and NAME being defined as
5538 	 NAME = NAME2 & CST2.
5539 
5540 	 Extract CST2 from the and.
5541 
5542 	 Also handle
5543 	 NAME = (unsigned) NAME2;
5544 	 casts where NAME's type is unsigned and has smaller precision
5545 	 than NAME2's type as if it was NAME = NAME2 & MASK.  */
5546       names[0] = NULL_TREE;
5547       names[1] = NULL_TREE;
5548       cst2 = NULL_TREE;
5549       if (rhs_code == BIT_AND_EXPR
5550 	  || (CONVERT_EXPR_CODE_P (rhs_code)
5551 	      && TREE_CODE (TREE_TYPE (val)) == INTEGER_TYPE
5552 	      && TYPE_UNSIGNED (TREE_TYPE (val))
5553 	      && TYPE_PRECISION (TREE_TYPE (gimple_assign_rhs1 (def_stmt)))
5554 		 > prec))
5555 	{
5556 	  name2 = gimple_assign_rhs1 (def_stmt);
5557 	  if (rhs_code == BIT_AND_EXPR)
5558 	    cst2 = gimple_assign_rhs2 (def_stmt);
5559 	  else
5560 	    {
5561 	      cst2 = TYPE_MAX_VALUE (TREE_TYPE (val));
5562 	      nprec = TYPE_PRECISION (TREE_TYPE (name2));
5563 	    }
5564 	  if (TREE_CODE (name2) == SSA_NAME
5565 	      && INTEGRAL_TYPE_P (TREE_TYPE (name2))
5566 	      && TREE_CODE (cst2) == INTEGER_CST
5567 	      && !integer_zerop (cst2)
5568 	      && (nprec > 1
5569 		  || TYPE_UNSIGNED (TREE_TYPE (val))))
5570 	    {
5571 	      gimple def_stmt2 = SSA_NAME_DEF_STMT (name2);
5572 	      if (gimple_assign_cast_p (def_stmt2))
5573 		{
5574 		  names[1] = gimple_assign_rhs1 (def_stmt2);
5575 		  if (!CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt2))
5576 		      || !INTEGRAL_TYPE_P (TREE_TYPE (names[1]))
5577 		      || (TYPE_PRECISION (TREE_TYPE (name2))
5578 			  != TYPE_PRECISION (TREE_TYPE (names[1])))
5579 		      || !live_on_edge (e, names[1])
5580 		      || has_single_use (names[1]))
5581 		    names[1] = NULL_TREE;
5582 		}
5583 	      if (live_on_edge (e, name2)
5584 		  && !has_single_use (name2))
5585 		names[0] = name2;
5586 	    }
5587 	}
5588       if (names[0] || names[1])
5589 	{
5590 	  wide_int minv, maxv, valv, cst2v;
5591 	  wide_int tem, sgnbit;
5592 	  bool valid_p = false, valn, cst2n;
5593 	  enum tree_code ccode = comp_code;
5594 
5595 	  valv = wide_int::from (val, nprec, UNSIGNED);
5596 	  cst2v = wide_int::from (cst2, nprec, UNSIGNED);
5597 	  valn = wi::neg_p (valv, TYPE_SIGN (TREE_TYPE (val)));
5598 	  cst2n = wi::neg_p (cst2v, TYPE_SIGN (TREE_TYPE (val)));
5599 	  /* If CST2 doesn't have most significant bit set,
5600 	     but VAL is negative, we have comparison like
5601 	     if ((x & 0x123) > -4) (always true).  Just give up.  */
5602 	  if (!cst2n && valn)
5603 	    ccode = ERROR_MARK;
5604 	  if (cst2n)
5605 	    sgnbit = wi::set_bit_in_zero (nprec - 1, nprec);
5606 	  else
5607 	    sgnbit = wi::zero (nprec);
5608 	  minv = valv & cst2v;
5609 	  switch (ccode)
5610 	    {
5611 	    case EQ_EXPR:
5612 	      /* Minimum unsigned value for equality is VAL & CST2
5613 		 (should be equal to VAL, otherwise we probably should
5614 		 have folded the comparison into false) and
5615 		 maximum unsigned value is VAL | ~CST2.  */
5616 	      maxv = valv | ~cst2v;
5617 	      valid_p = true;
5618 	      break;
5619 
5620 	    case NE_EXPR:
5621 	      tem = valv | ~cst2v;
5622 	      /* If VAL is 0, handle (X & CST2) != 0 as (X & CST2) > 0U.  */
5623 	      if (valv == 0)
5624 		{
5625 		  cst2n = false;
5626 		  sgnbit = wi::zero (nprec);
5627 		  goto gt_expr;
5628 		}
5629 	      /* If (VAL | ~CST2) is all ones, handle it as
5630 		 (X & CST2) < VAL.  */
5631 	      if (tem == -1)
5632 		{
5633 		  cst2n = false;
5634 		  valn = false;
5635 		  sgnbit = wi::zero (nprec);
5636 		  goto lt_expr;
5637 		}
5638 	      if (!cst2n && wi::neg_p (cst2v))
5639 		sgnbit = wi::set_bit_in_zero (nprec - 1, nprec);
5640 	      if (sgnbit != 0)
5641 		{
5642 		  if (valv == sgnbit)
5643 		    {
5644 		      cst2n = true;
5645 		      valn = true;
5646 		      goto gt_expr;
5647 		    }
5648 		  if (tem == wi::mask (nprec - 1, false, nprec))
5649 		    {
5650 		      cst2n = true;
5651 		      goto lt_expr;
5652 		    }
5653 		  if (!cst2n)
5654 		    sgnbit = wi::zero (nprec);
5655 		}
5656 	      break;
5657 
5658 	    case GE_EXPR:
5659 	      /* Minimum unsigned value for >= if (VAL & CST2) == VAL
5660 		 is VAL and maximum unsigned value is ~0.  For signed
5661 		 comparison, if CST2 doesn't have most significant bit
5662 		 set, handle it similarly.  If CST2 has MSB set,
5663 		 the minimum is the same, and maximum is ~0U/2.  */
5664 	      if (minv != valv)
5665 		{
5666 		  /* If (VAL & CST2) != VAL, X & CST2 can't be equal to
5667 		     VAL.  */
5668 		  minv = masked_increment (valv, cst2v, sgnbit, nprec);
5669 		  if (minv == valv)
5670 		    break;
5671 		}
5672 	      maxv = wi::mask (nprec - (cst2n ? 1 : 0), false, nprec);
5673 	      valid_p = true;
5674 	      break;
5675 
5676 	    case GT_EXPR:
5677 	    gt_expr:
5678 	      /* Find out smallest MINV where MINV > VAL
5679 		 && (MINV & CST2) == MINV, if any.  If VAL is signed and
5680 		 CST2 has MSB set, compute it biased by 1 << (nprec - 1).  */
5681 	      minv = masked_increment (valv, cst2v, sgnbit, nprec);
5682 	      if (minv == valv)
5683 		break;
5684 	      maxv = wi::mask (nprec - (cst2n ? 1 : 0), false, nprec);
5685 	      valid_p = true;
5686 	      break;
5687 
5688 	    case LE_EXPR:
5689 	      /* Minimum unsigned value for <= is 0 and maximum
5690 		 unsigned value is VAL | ~CST2 if (VAL & CST2) == VAL.
5691 		 Otherwise, find smallest VAL2 where VAL2 > VAL
5692 		 && (VAL2 & CST2) == VAL2 and use (VAL2 - 1) | ~CST2
5693 		 as maximum.
5694 		 For signed comparison, if CST2 doesn't have most
5695 		 significant bit set, handle it similarly.  If CST2 has
5696 		 MSB set, the maximum is the same and minimum is INT_MIN.  */
5697 	      if (minv == valv)
5698 		maxv = valv;
5699 	      else
5700 		{
5701 		  maxv = masked_increment (valv, cst2v, sgnbit, nprec);
5702 		  if (maxv == valv)
5703 		    break;
5704 		  maxv -= 1;
5705 		}
5706 	      maxv |= ~cst2v;
5707 	      minv = sgnbit;
5708 	      valid_p = true;
5709 	      break;
5710 
5711 	    case LT_EXPR:
5712 	    lt_expr:
5713 	      /* Minimum unsigned value for < is 0 and maximum
5714 		 unsigned value is (VAL-1) | ~CST2 if (VAL & CST2) == VAL.
5715 		 Otherwise, find smallest VAL2 where VAL2 > VAL
5716 		 && (VAL2 & CST2) == VAL2 and use (VAL2 - 1) | ~CST2
5717 		 as maximum.
5718 		 For signed comparison, if CST2 doesn't have most
5719 		 significant bit set, handle it similarly.  If CST2 has
5720 		 MSB set, the maximum is the same and minimum is INT_MIN.  */
5721 	      if (minv == valv)
5722 		{
5723 		  if (valv == sgnbit)
5724 		    break;
5725 		  maxv = valv;
5726 		}
5727 	      else
5728 		{
5729 		  maxv = masked_increment (valv, cst2v, sgnbit, nprec);
5730 		  if (maxv == valv)
5731 		    break;
5732 		}
5733 	      maxv -= 1;
5734 	      maxv |= ~cst2v;
5735 	      minv = sgnbit;
5736 	      valid_p = true;
5737 	      break;
5738 
5739 	    default:
5740 	      break;
5741 	    }
5742 	  if (valid_p
5743 	      && (maxv - minv) != -1)
5744 	    {
5745 	      tree tmp, new_val, type;
5746 	      int i;
5747 
5748 	      for (i = 0; i < 2; i++)
5749 		if (names[i])
5750 		  {
5751 		    wide_int maxv2 = maxv;
5752 		    tmp = names[i];
5753 		    type = TREE_TYPE (names[i]);
5754 		    if (!TYPE_UNSIGNED (type))
5755 		      {
5756 			type = build_nonstandard_integer_type (nprec, 1);
5757 			tmp = build1 (NOP_EXPR, type, names[i]);
5758 		      }
5759 		    if (minv != 0)
5760 		      {
5761 			tmp = build2 (PLUS_EXPR, type, tmp,
5762 				      wide_int_to_tree (type, -minv));
5763 			maxv2 = maxv - minv;
5764 		      }
5765 		    new_val = wide_int_to_tree (type, maxv2);
5766 
5767 		    if (dump_file)
5768 		      {
5769 			fprintf (dump_file, "Adding assert for ");
5770 			print_generic_expr (dump_file, names[i], 0);
5771 			fprintf (dump_file, " from ");
5772 			print_generic_expr (dump_file, tmp, 0);
5773 			fprintf (dump_file, "\n");
5774 		      }
5775 
5776 		    register_new_assert_for (names[i], tmp, LE_EXPR,
5777 					     new_val, NULL, e, bsi);
5778 		  }
5779 	    }
5780 	}
5781     }
5782 }
5783 
5784 /* OP is an operand of a truth value expression which is known to have
5785    a particular value.  Register any asserts for OP and for any
5786    operands in OP's defining statement.
5787 
5788    If CODE is EQ_EXPR, then we want to register OP is zero (false),
5789    if CODE is NE_EXPR, then we want to register OP is nonzero (true).   */
5790 
5791 static void
5792 register_edge_assert_for_1 (tree op, enum tree_code code,
5793 			    edge e, gimple_stmt_iterator bsi)
5794 {
5795   gimple op_def;
5796   tree val;
5797   enum tree_code rhs_code;
5798 
5799   /* We only care about SSA_NAMEs.  */
5800   if (TREE_CODE (op) != SSA_NAME)
5801     return;
5802 
5803   /* We know that OP will have a zero or nonzero value.  If OP is used
5804      more than once go ahead and register an assert for OP.  */
5805   if (live_on_edge (e, op)
5806       && !has_single_use (op))
5807     {
5808       val = build_int_cst (TREE_TYPE (op), 0);
5809       register_new_assert_for (op, op, code, val, NULL, e, bsi);
5810     }
5811 
5812   /* Now look at how OP is set.  If it's set from a comparison,
5813      a truth operation or some bit operations, then we may be able
5814      to register information about the operands of that assignment.  */
5815   op_def = SSA_NAME_DEF_STMT (op);
5816   if (gimple_code (op_def) != GIMPLE_ASSIGN)
5817     return;
5818 
5819   rhs_code = gimple_assign_rhs_code (op_def);
5820 
5821   if (TREE_CODE_CLASS (rhs_code) == tcc_comparison)
5822     {
5823       bool invert = (code == EQ_EXPR ? true : false);
5824       tree op0 = gimple_assign_rhs1 (op_def);
5825       tree op1 = gimple_assign_rhs2 (op_def);
5826 
5827       if (TREE_CODE (op0) == SSA_NAME)
5828         register_edge_assert_for_2 (op0, e, bsi, rhs_code, op0, op1, invert);
5829       if (TREE_CODE (op1) == SSA_NAME)
5830         register_edge_assert_for_2 (op1, e, bsi, rhs_code, op0, op1, invert);
5831     }
5832   else if ((code == NE_EXPR
5833 	    && gimple_assign_rhs_code (op_def) == BIT_AND_EXPR)
5834 	   || (code == EQ_EXPR
5835 	       && gimple_assign_rhs_code (op_def) == BIT_IOR_EXPR))
5836     {
5837       /* Recurse on each operand.  */
5838       tree op0 = gimple_assign_rhs1 (op_def);
5839       tree op1 = gimple_assign_rhs2 (op_def);
5840       if (TREE_CODE (op0) == SSA_NAME
5841 	  && has_single_use (op0))
5842 	register_edge_assert_for_1 (op0, code, e, bsi);
5843       if (TREE_CODE (op1) == SSA_NAME
5844 	  && has_single_use (op1))
5845 	register_edge_assert_for_1 (op1, code, e, bsi);
5846     }
5847   else if (gimple_assign_rhs_code (op_def) == BIT_NOT_EXPR
5848 	   && TYPE_PRECISION (TREE_TYPE (gimple_assign_lhs (op_def))) == 1)
5849     {
5850       /* Recurse, flipping CODE.  */
5851       code = invert_tree_comparison (code, false);
5852       register_edge_assert_for_1 (gimple_assign_rhs1 (op_def), code, e, bsi);
5853     }
5854   else if (gimple_assign_rhs_code (op_def) == SSA_NAME)
5855     {
5856       /* Recurse through the copy.  */
5857       register_edge_assert_for_1 (gimple_assign_rhs1 (op_def), code, e, bsi);
5858     }
5859   else if (CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (op_def)))
5860     {
5861       /* Recurse through the type conversion, unless it is a narrowing
5862 	 conversion or conversion from non-integral type.  */
5863       tree rhs = gimple_assign_rhs1 (op_def);
5864       if (INTEGRAL_TYPE_P (TREE_TYPE (rhs))
5865 	  && (TYPE_PRECISION (TREE_TYPE (rhs))
5866 	      <= TYPE_PRECISION (TREE_TYPE (op))))
5867 	register_edge_assert_for_1 (rhs, code, e, bsi);
5868     }
5869 }
5870 
5871 /* Try to register an edge assertion for SSA name NAME on edge E for
5872    the condition COND contributing to the conditional jump pointed to by
5873    SI.  */
5874 
5875 static void
5876 register_edge_assert_for (tree name, edge e, gimple_stmt_iterator si,
5877 			  enum tree_code cond_code, tree cond_op0,
5878 			  tree cond_op1)
5879 {
5880   tree val;
5881   enum tree_code comp_code;
5882   bool is_else_edge = (e->flags & EDGE_FALSE_VALUE) != 0;
5883 
5884   /* Do not attempt to infer anything in names that flow through
5885      abnormal edges.  */
5886   if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (name))
5887     return;
5888 
5889   if (!extract_code_and_val_from_cond_with_ops (name, cond_code,
5890 						cond_op0, cond_op1,
5891 						is_else_edge,
5892 						&comp_code, &val))
5893     return;
5894 
5895   /* Register ASSERT_EXPRs for name.  */
5896   register_edge_assert_for_2 (name, e, si, cond_code, cond_op0,
5897 			      cond_op1, is_else_edge);
5898 
5899 
5900   /* If COND is effectively an equality test of an SSA_NAME against
5901      the value zero or one, then we may be able to assert values
5902      for SSA_NAMEs which flow into COND.  */
5903 
5904   /* In the case of NAME == 1 or NAME != 0, for BIT_AND_EXPR defining
5905      statement of NAME we can assert both operands of the BIT_AND_EXPR
5906      have nonzero value.  */
5907   if (((comp_code == EQ_EXPR && integer_onep (val))
5908        || (comp_code == NE_EXPR && integer_zerop (val))))
5909     {
5910       gimple def_stmt = SSA_NAME_DEF_STMT (name);
5911 
5912       if (is_gimple_assign (def_stmt)
5913 	  && gimple_assign_rhs_code (def_stmt) == BIT_AND_EXPR)
5914 	{
5915 	  tree op0 = gimple_assign_rhs1 (def_stmt);
5916 	  tree op1 = gimple_assign_rhs2 (def_stmt);
5917 	  register_edge_assert_for_1 (op0, NE_EXPR, e, si);
5918 	  register_edge_assert_for_1 (op1, NE_EXPR, e, si);
5919 	}
5920     }
5921 
5922   /* In the case of NAME == 0 or NAME != 1, for BIT_IOR_EXPR defining
5923      statement of NAME we can assert both operands of the BIT_IOR_EXPR
5924      have zero value.  */
5925   if (((comp_code == EQ_EXPR && integer_zerop (val))
5926        || (comp_code == NE_EXPR && integer_onep (val))))
5927     {
5928       gimple def_stmt = SSA_NAME_DEF_STMT (name);
5929 
5930       /* For BIT_IOR_EXPR only if NAME == 0 both operands have
5931 	 necessarily zero value, or if type-precision is one.  */
5932       if (is_gimple_assign (def_stmt)
5933 	  && (gimple_assign_rhs_code (def_stmt) == BIT_IOR_EXPR
5934 	      && (TYPE_PRECISION (TREE_TYPE (name)) == 1
5935 	          || comp_code == EQ_EXPR)))
5936 	{
5937 	  tree op0 = gimple_assign_rhs1 (def_stmt);
5938 	  tree op1 = gimple_assign_rhs2 (def_stmt);
5939 	  register_edge_assert_for_1 (op0, EQ_EXPR, e, si);
5940 	  register_edge_assert_for_1 (op1, EQ_EXPR, e, si);
5941 	}
5942     }
5943 }
5944 
5945 
5946 /* Determine whether the outgoing edges of BB should receive an
5947    ASSERT_EXPR for each of the operands of BB's LAST statement.
5948    The last statement of BB must be a COND_EXPR.
5949 
5950    If any of the sub-graphs rooted at BB have an interesting use of
5951    the predicate operands, an assert location node is added to the
5952    list of assertions for the corresponding operands.  */
5953 
5954 static void
5955 find_conditional_asserts (basic_block bb, gcond *last)
5956 {
5957   gimple_stmt_iterator bsi;
5958   tree op;
5959   edge_iterator ei;
5960   edge e;
5961   ssa_op_iter iter;
5962 
5963   bsi = gsi_for_stmt (last);
5964 
5965   /* Look for uses of the operands in each of the sub-graphs
5966      rooted at BB.  We need to check each of the outgoing edges
5967      separately, so that we know what kind of ASSERT_EXPR to
5968      insert.  */
5969   FOR_EACH_EDGE (e, ei, bb->succs)
5970     {
5971       if (e->dest == bb)
5972 	continue;
5973 
5974       /* Register the necessary assertions for each operand in the
5975 	 conditional predicate.  */
5976       FOR_EACH_SSA_TREE_OPERAND (op, last, iter, SSA_OP_USE)
5977 	register_edge_assert_for (op, e, bsi,
5978 				  gimple_cond_code (last),
5979 				  gimple_cond_lhs (last),
5980 				  gimple_cond_rhs (last));
5981     }
5982 }
5983 
5984 struct case_info
5985 {
5986   tree expr;
5987   basic_block bb;
5988 };
5989 
5990 /* Compare two case labels sorting first by the destination bb index
5991    and then by the case value.  */
5992 
5993 static int
5994 compare_case_labels (const void *p1, const void *p2)
5995 {
5996   const struct case_info *ci1 = (const struct case_info *) p1;
5997   const struct case_info *ci2 = (const struct case_info *) p2;
5998   int idx1 = ci1->bb->index;
5999   int idx2 = ci2->bb->index;
6000 
6001   if (idx1 < idx2)
6002     return -1;
6003   else if (idx1 == idx2)
6004     {
6005       /* Make sure the default label is first in a group.  */
6006       if (!CASE_LOW (ci1->expr))
6007 	return -1;
6008       else if (!CASE_LOW (ci2->expr))
6009 	return 1;
6010       else
6011 	return tree_int_cst_compare (CASE_LOW (ci1->expr),
6012 				     CASE_LOW (ci2->expr));
6013     }
6014   else
6015     return 1;
6016 }
6017 
6018 /* Determine whether the outgoing edges of BB should receive an
6019    ASSERT_EXPR for each of the operands of BB's LAST statement.
6020    The last statement of BB must be a SWITCH_EXPR.
6021 
6022    If any of the sub-graphs rooted at BB have an interesting use of
6023    the predicate operands, an assert location node is added to the
6024    list of assertions for the corresponding operands.  */
6025 
6026 static void
6027 find_switch_asserts (basic_block bb, gswitch *last)
6028 {
6029   gimple_stmt_iterator bsi;
6030   tree op;
6031   edge e;
6032   struct case_info *ci;
6033   size_t n = gimple_switch_num_labels (last);
6034 #if GCC_VERSION >= 4000
6035   unsigned int idx;
6036 #else
6037   /* Work around GCC 3.4 bug (PR 37086).  */
6038   volatile unsigned int idx;
6039 #endif
6040 
6041   bsi = gsi_for_stmt (last);
6042   op = gimple_switch_index (last);
6043   if (TREE_CODE (op) != SSA_NAME)
6044     return;
6045 
6046   /* Build a vector of case labels sorted by destination label.  */
6047   ci = XNEWVEC (struct case_info, n);
6048   for (idx = 0; idx < n; ++idx)
6049     {
6050       ci[idx].expr = gimple_switch_label (last, idx);
6051       ci[idx].bb = label_to_block (CASE_LABEL (ci[idx].expr));
6052     }
6053   qsort (ci, n, sizeof (struct case_info), compare_case_labels);
6054 
6055   for (idx = 0; idx < n; ++idx)
6056     {
6057       tree min, max;
6058       tree cl = ci[idx].expr;
6059       basic_block cbb = ci[idx].bb;
6060 
6061       min = CASE_LOW (cl);
6062       max = CASE_HIGH (cl);
6063 
6064       /* If there are multiple case labels with the same destination
6065 	 we need to combine them to a single value range for the edge.  */
6066       if (idx + 1 < n && cbb == ci[idx + 1].bb)
6067 	{
6068 	  /* Skip labels until the last of the group.  */
6069 	  do {
6070 	    ++idx;
6071 	  } while (idx < n && cbb == ci[idx].bb);
6072 	  --idx;
6073 
6074 	  /* Pick up the maximum of the case label range.  */
6075 	  if (CASE_HIGH (ci[idx].expr))
6076 	    max = CASE_HIGH (ci[idx].expr);
6077 	  else
6078 	    max = CASE_LOW (ci[idx].expr);
6079 	}
6080 
6081       /* Nothing to do if the range includes the default label until we
6082 	 can register anti-ranges.  */
6083       if (min == NULL_TREE)
6084 	continue;
6085 
6086       /* Find the edge to register the assert expr on.  */
6087       e = find_edge (bb, cbb);
6088 
6089       /* Register the necessary assertions for the operand in the
6090 	 SWITCH_EXPR.  */
6091       register_edge_assert_for (op, e, bsi,
6092 				max ? GE_EXPR : EQ_EXPR,
6093 				op, fold_convert (TREE_TYPE (op), min));
6094       if (max)
6095 	register_edge_assert_for (op, e, bsi, LE_EXPR, op,
6096 				  fold_convert (TREE_TYPE (op), max));
6097     }
6098 
6099   XDELETEVEC (ci);
6100 }
6101 
6102 
6103 /* Traverse all the statements in block BB looking for statements that
6104    may generate useful assertions for the SSA names in their operand.
6105    If a statement produces a useful assertion A for name N_i, then the
6106    list of assertions already generated for N_i is scanned to
6107    determine if A is actually needed.
6108 
6109    If N_i already had the assertion A at a location dominating the
6110    current location, then nothing needs to be done.  Otherwise, the
6111    new location for A is recorded instead.
6112 
6113    1- For every statement S in BB, all the variables used by S are
6114       added to bitmap FOUND_IN_SUBGRAPH.
6115 
6116    2- If statement S uses an operand N in a way that exposes a known
6117       value range for N, then if N was not already generated by an
6118       ASSERT_EXPR, create a new assert location for N.  For instance,
6119       if N is a pointer and the statement dereferences it, we can
6120       assume that N is not NULL.
6121 
6122    3- COND_EXPRs are a special case of #2.  We can derive range
6123       information from the predicate but need to insert different
6124       ASSERT_EXPRs for each of the sub-graphs rooted at the
6125       conditional block.  If the last statement of BB is a conditional
6126       expression of the form 'X op Y', then
6127 
6128       a) Remove X and Y from the set FOUND_IN_SUBGRAPH.
6129 
6130       b) If the conditional is the only entry point to the sub-graph
6131 	 corresponding to the THEN_CLAUSE, recurse into it.  On
6132 	 return, if X and/or Y are marked in FOUND_IN_SUBGRAPH, then
6133 	 an ASSERT_EXPR is added for the corresponding variable.
6134 
6135       c) Repeat step (b) on the ELSE_CLAUSE.
6136 
6137       d) Mark X and Y in FOUND_IN_SUBGRAPH.
6138 
6139       For instance,
6140 
6141 	    if (a == 9)
6142 	      b = a;
6143 	    else
6144 	      b = c + 1;
6145 
6146       In this case, an assertion on the THEN clause is useful to
6147       determine that 'a' is always 9 on that edge.  However, an assertion
6148       on the ELSE clause would be unnecessary.
6149 
6150    4- If BB does not end in a conditional expression, then we recurse
6151       into BB's dominator children.
6152 
6153    At the end of the recursive traversal, every SSA name will have a
6154    list of locations where ASSERT_EXPRs should be added.  When a new
6155    location for name N is found, it is registered by calling
6156    register_new_assert_for.  That function keeps track of all the
6157    registered assertions to prevent adding unnecessary assertions.
6158    For instance, if a pointer P_4 is dereferenced more than once in a
6159    dominator tree, only the location dominating all the dereference of
6160    P_4 will receive an ASSERT_EXPR.  */
6161 
6162 static void
6163 find_assert_locations_1 (basic_block bb, sbitmap live)
6164 {
6165   gimple last;
6166 
6167   last = last_stmt (bb);
6168 
6169   /* If BB's last statement is a conditional statement involving integer
6170      operands, determine if we need to add ASSERT_EXPRs.  */
6171   if (last
6172       && gimple_code (last) == GIMPLE_COND
6173       && !fp_predicate (last)
6174       && !ZERO_SSA_OPERANDS (last, SSA_OP_USE))
6175     find_conditional_asserts (bb, as_a <gcond *> (last));
6176 
6177   /* If BB's last statement is a switch statement involving integer
6178      operands, determine if we need to add ASSERT_EXPRs.  */
6179   if (last
6180       && gimple_code (last) == GIMPLE_SWITCH
6181       && !ZERO_SSA_OPERANDS (last, SSA_OP_USE))
6182     find_switch_asserts (bb, as_a <gswitch *> (last));
6183 
6184   /* Traverse all the statements in BB marking used names and looking
6185      for statements that may infer assertions for their used operands.  */
6186   for (gimple_stmt_iterator si = gsi_last_bb (bb); !gsi_end_p (si);
6187        gsi_prev (&si))
6188     {
6189       gimple stmt;
6190       tree op;
6191       ssa_op_iter i;
6192 
6193       stmt = gsi_stmt (si);
6194 
6195       if (is_gimple_debug (stmt))
6196 	continue;
6197 
6198       /* See if we can derive an assertion for any of STMT's operands.  */
6199       FOR_EACH_SSA_TREE_OPERAND (op, stmt, i, SSA_OP_USE)
6200 	{
6201 	  tree value;
6202 	  enum tree_code comp_code;
6203 
6204 	  /* If op is not live beyond this stmt, do not bother to insert
6205 	     asserts for it.  */
6206 	  if (!bitmap_bit_p (live, SSA_NAME_VERSION (op)))
6207 	    continue;
6208 
6209 	  /* If OP is used in such a way that we can infer a value
6210 	     range for it, and we don't find a previous assertion for
6211 	     it, create a new assertion location node for OP.  */
6212 	  if (infer_value_range (stmt, op, &comp_code, &value))
6213 	    {
6214 	      /* If we are able to infer a nonzero value range for OP,
6215 		 then walk backwards through the use-def chain to see if OP
6216 		 was set via a typecast.
6217 
6218 		 If so, then we can also infer a nonzero value range
6219 		 for the operand of the NOP_EXPR.  */
6220 	      if (comp_code == NE_EXPR && integer_zerop (value))
6221 		{
6222 		  tree t = op;
6223 		  gimple def_stmt = SSA_NAME_DEF_STMT (t);
6224 
6225 		  while (is_gimple_assign (def_stmt)
6226 			 && CONVERT_EXPR_CODE_P
6227 			     (gimple_assign_rhs_code (def_stmt))
6228 			 && TREE_CODE
6229 			     (gimple_assign_rhs1 (def_stmt)) == SSA_NAME
6230 			 && POINTER_TYPE_P
6231 			     (TREE_TYPE (gimple_assign_rhs1 (def_stmt))))
6232 		    {
6233 		      t = gimple_assign_rhs1 (def_stmt);
6234 		      def_stmt = SSA_NAME_DEF_STMT (t);
6235 
6236 		      /* Note we want to register the assert for the
6237 			 operand of the NOP_EXPR after SI, not after the
6238 			 conversion.  */
6239 		      if (! has_single_use (t))
6240 			register_new_assert_for (t, t, comp_code, value,
6241 						 bb, NULL, si);
6242 		    }
6243 		}
6244 
6245 	      register_new_assert_for (op, op, comp_code, value, bb, NULL, si);
6246 	    }
6247 	}
6248 
6249       /* Update live.  */
6250       FOR_EACH_SSA_TREE_OPERAND (op, stmt, i, SSA_OP_USE)
6251 	bitmap_set_bit (live, SSA_NAME_VERSION (op));
6252       FOR_EACH_SSA_TREE_OPERAND (op, stmt, i, SSA_OP_DEF)
6253 	bitmap_clear_bit (live, SSA_NAME_VERSION (op));
6254     }
6255 
6256   /* Traverse all PHI nodes in BB, updating live.  */
6257   for (gphi_iterator si = gsi_start_phis (bb); !gsi_end_p (si);
6258        gsi_next (&si))
6259     {
6260       use_operand_p arg_p;
6261       ssa_op_iter i;
6262       gphi *phi = si.phi ();
6263       tree res = gimple_phi_result (phi);
6264 
6265       if (virtual_operand_p (res))
6266 	continue;
6267 
6268       FOR_EACH_PHI_ARG (arg_p, phi, i, SSA_OP_USE)
6269 	{
6270 	  tree arg = USE_FROM_PTR (arg_p);
6271 	  if (TREE_CODE (arg) == SSA_NAME)
6272 	    bitmap_set_bit (live, SSA_NAME_VERSION (arg));
6273 	}
6274 
6275       bitmap_clear_bit (live, SSA_NAME_VERSION (res));
6276     }
6277 }
6278 
6279 /* Do an RPO walk over the function computing SSA name liveness
6280    on-the-fly and deciding on assert expressions to insert.  */
6281 
6282 static void
6283 find_assert_locations (void)
6284 {
6285   int *rpo = XNEWVEC (int, last_basic_block_for_fn (cfun));
6286   int *bb_rpo = XNEWVEC (int, last_basic_block_for_fn (cfun));
6287   int *last_rpo = XCNEWVEC (int, last_basic_block_for_fn (cfun));
6288   int rpo_cnt, i;
6289 
6290   live = XCNEWVEC (sbitmap, last_basic_block_for_fn (cfun));
6291   rpo_cnt = pre_and_rev_post_order_compute (NULL, rpo, false);
6292   for (i = 0; i < rpo_cnt; ++i)
6293     bb_rpo[rpo[i]] = i;
6294 
6295   /* Pre-seed loop latch liveness from loop header PHI nodes.  Due to
6296      the order we compute liveness and insert asserts we otherwise
6297      fail to insert asserts into the loop latch.  */
6298   loop_p loop;
6299   FOR_EACH_LOOP (loop, 0)
6300     {
6301       i = loop->latch->index;
6302       unsigned int j = single_succ_edge (loop->latch)->dest_idx;
6303       for (gphi_iterator gsi = gsi_start_phis (loop->header);
6304 	   !gsi_end_p (gsi); gsi_next (&gsi))
6305 	{
6306 	  gphi *phi = gsi.phi ();
6307 	  if (virtual_operand_p (gimple_phi_result (phi)))
6308 	    continue;
6309 	  tree arg = gimple_phi_arg_def (phi, j);
6310 	  if (TREE_CODE (arg) == SSA_NAME)
6311 	    {
6312 	      if (live[i] == NULL)
6313 		{
6314 		  live[i] = sbitmap_alloc (num_ssa_names);
6315 		  bitmap_clear (live[i]);
6316 		}
6317 	      bitmap_set_bit (live[i], SSA_NAME_VERSION (arg));
6318 	    }
6319 	}
6320     }
6321 
6322   for (i = rpo_cnt - 1; i >= 0; --i)
6323     {
6324       basic_block bb = BASIC_BLOCK_FOR_FN (cfun, rpo[i]);
6325       edge e;
6326       edge_iterator ei;
6327 
6328       if (!live[rpo[i]])
6329 	{
6330 	  live[rpo[i]] = sbitmap_alloc (num_ssa_names);
6331 	  bitmap_clear (live[rpo[i]]);
6332 	}
6333 
6334       /* Process BB and update the live information with uses in
6335          this block.  */
6336       find_assert_locations_1 (bb, live[rpo[i]]);
6337 
6338       /* Merge liveness into the predecessor blocks and free it.  */
6339       if (!bitmap_empty_p (live[rpo[i]]))
6340 	{
6341 	  int pred_rpo = i;
6342 	  FOR_EACH_EDGE (e, ei, bb->preds)
6343 	    {
6344 	      int pred = e->src->index;
6345 	      if ((e->flags & EDGE_DFS_BACK) || pred == ENTRY_BLOCK)
6346 		continue;
6347 
6348 	      if (!live[pred])
6349 		{
6350 		  live[pred] = sbitmap_alloc (num_ssa_names);
6351 		  bitmap_clear (live[pred]);
6352 		}
6353 	      bitmap_ior (live[pred], live[pred], live[rpo[i]]);
6354 
6355 	      if (bb_rpo[pred] < pred_rpo)
6356 		pred_rpo = bb_rpo[pred];
6357 	    }
6358 
6359 	  /* Record the RPO number of the last visited block that needs
6360 	     live information from this block.  */
6361 	  last_rpo[rpo[i]] = pred_rpo;
6362 	}
6363       else
6364 	{
6365 	  sbitmap_free (live[rpo[i]]);
6366 	  live[rpo[i]] = NULL;
6367 	}
6368 
6369       /* We can free all successors live bitmaps if all their
6370          predecessors have been visited already.  */
6371       FOR_EACH_EDGE (e, ei, bb->succs)
6372 	if (last_rpo[e->dest->index] == i
6373 	    && live[e->dest->index])
6374 	  {
6375 	    sbitmap_free (live[e->dest->index]);
6376 	    live[e->dest->index] = NULL;
6377 	  }
6378     }
6379 
6380   XDELETEVEC (rpo);
6381   XDELETEVEC (bb_rpo);
6382   XDELETEVEC (last_rpo);
6383   for (i = 0; i < last_basic_block_for_fn (cfun); ++i)
6384     if (live[i])
6385       sbitmap_free (live[i]);
6386   XDELETEVEC (live);
6387 }
6388 
6389 /* Create an ASSERT_EXPR for NAME and insert it in the location
6390    indicated by LOC.  Return true if we made any edge insertions.  */
6391 
6392 static bool
6393 process_assert_insertions_for (tree name, assert_locus_t loc)
6394 {
6395   /* Build the comparison expression NAME_i COMP_CODE VAL.  */
6396   gimple stmt;
6397   tree cond;
6398   gimple assert_stmt;
6399   edge_iterator ei;
6400   edge e;
6401 
6402   /* If we have X <=> X do not insert an assert expr for that.  */
6403   if (loc->expr == loc->val)
6404     return false;
6405 
6406   cond = build2 (loc->comp_code, boolean_type_node, loc->expr, loc->val);
6407   assert_stmt = build_assert_expr_for (cond, name);
6408   if (loc->e)
6409     {
6410       /* We have been asked to insert the assertion on an edge.  This
6411 	 is used only by COND_EXPR and SWITCH_EXPR assertions.  */
6412       gcc_checking_assert (gimple_code (gsi_stmt (loc->si)) == GIMPLE_COND
6413 			   || (gimple_code (gsi_stmt (loc->si))
6414 			       == GIMPLE_SWITCH));
6415 
6416       gsi_insert_on_edge (loc->e, assert_stmt);
6417       return true;
6418     }
6419 
6420   /* Otherwise, we can insert right after LOC->SI iff the
6421      statement must not be the last statement in the block.  */
6422   stmt = gsi_stmt (loc->si);
6423   if (!stmt_ends_bb_p (stmt))
6424     {
6425       gsi_insert_after (&loc->si, assert_stmt, GSI_SAME_STMT);
6426       return false;
6427     }
6428 
6429   /* If STMT must be the last statement in BB, we can only insert new
6430      assertions on the non-abnormal edge out of BB.  Note that since
6431      STMT is not control flow, there may only be one non-abnormal edge
6432      out of BB.  */
6433   FOR_EACH_EDGE (e, ei, loc->bb->succs)
6434     if (!(e->flags & EDGE_ABNORMAL))
6435       {
6436 	gsi_insert_on_edge (e, assert_stmt);
6437 	return true;
6438       }
6439 
6440   gcc_unreachable ();
6441 }
6442 
6443 
6444 /* Process all the insertions registered for every name N_i registered
6445    in NEED_ASSERT_FOR.  The list of assertions to be inserted are
6446    found in ASSERTS_FOR[i].  */
6447 
6448 static void
6449 process_assert_insertions (void)
6450 {
6451   unsigned i;
6452   bitmap_iterator bi;
6453   bool update_edges_p = false;
6454   int num_asserts = 0;
6455 
6456   if (dump_file && (dump_flags & TDF_DETAILS))
6457     dump_all_asserts (dump_file);
6458 
6459   EXECUTE_IF_SET_IN_BITMAP (need_assert_for, 0, i, bi)
6460     {
6461       assert_locus_t loc = asserts_for[i];
6462       gcc_assert (loc);
6463 
6464       while (loc)
6465 	{
6466 	  assert_locus_t next = loc->next;
6467 	  update_edges_p |= process_assert_insertions_for (ssa_name (i), loc);
6468 	  free (loc);
6469 	  loc = next;
6470 	  num_asserts++;
6471 	}
6472     }
6473 
6474   if (update_edges_p)
6475     gsi_commit_edge_inserts ();
6476 
6477   statistics_counter_event (cfun, "Number of ASSERT_EXPR expressions inserted",
6478 			    num_asserts);
6479 }
6480 
6481 
6482 /* Traverse the flowgraph looking for conditional jumps to insert range
6483    expressions.  These range expressions are meant to provide information
6484    to optimizations that need to reason in terms of value ranges.  They
6485    will not be expanded into RTL.  For instance, given:
6486 
6487    x = ...
6488    y = ...
6489    if (x < y)
6490      y = x - 2;
6491    else
6492      x = y + 3;
6493 
6494    this pass will transform the code into:
6495 
6496    x = ...
6497    y = ...
6498    if (x < y)
6499     {
6500       x = ASSERT_EXPR <x, x < y>
6501       y = x - 2
6502     }
6503    else
6504     {
6505       y = ASSERT_EXPR <y, x >= y>
6506       x = y + 3
6507     }
6508 
6509    The idea is that once copy and constant propagation have run, other
6510    optimizations will be able to determine what ranges of values can 'x'
6511    take in different paths of the code, simply by checking the reaching
6512    definition of 'x'.  */
6513 
6514 static void
6515 insert_range_assertions (void)
6516 {
6517   need_assert_for = BITMAP_ALLOC (NULL);
6518   asserts_for = XCNEWVEC (assert_locus_t, num_ssa_names);
6519 
6520   calculate_dominance_info (CDI_DOMINATORS);
6521 
6522   find_assert_locations ();
6523   if (!bitmap_empty_p (need_assert_for))
6524     {
6525       process_assert_insertions ();
6526       update_ssa (TODO_update_ssa_no_phi);
6527     }
6528 
6529   if (dump_file && (dump_flags & TDF_DETAILS))
6530     {
6531       fprintf (dump_file, "\nSSA form after inserting ASSERT_EXPRs\n");
6532       dump_function_to_file (current_function_decl, dump_file, dump_flags);
6533     }
6534 
6535   free (asserts_for);
6536   BITMAP_FREE (need_assert_for);
6537 }
6538 
6539 /* Checks one ARRAY_REF in REF, located at LOCUS. Ignores flexible arrays
6540    and "struct" hacks. If VRP can determine that the
6541    array subscript is a constant, check if it is outside valid
6542    range. If the array subscript is a RANGE, warn if it is
6543    non-overlapping with valid range.
6544    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
6545 
6546 static void
6547 check_array_ref (location_t location, tree ref, bool ignore_off_by_one)
6548 {
6549   value_range_t* vr = NULL;
6550   tree low_sub, up_sub;
6551   tree low_bound, up_bound, up_bound_p1;
6552   tree base;
6553 
6554   if (TREE_NO_WARNING (ref))
6555     return;
6556 
6557   low_sub = up_sub = TREE_OPERAND (ref, 1);
6558   up_bound = array_ref_up_bound (ref);
6559 
6560   /* Can not check flexible arrays.  */
6561   if (!up_bound
6562       || TREE_CODE (up_bound) != INTEGER_CST)
6563     return;
6564 
6565   /* Accesses to trailing arrays via pointers may access storage
6566      beyond the types array bounds.  */
6567   base = get_base_address (ref);
6568   if ((warn_array_bounds < 2)
6569       && base && TREE_CODE (base) == MEM_REF)
6570     {
6571       tree cref, next = NULL_TREE;
6572 
6573       if (TREE_CODE (TREE_OPERAND (ref, 0)) != COMPONENT_REF)
6574 	return;
6575 
6576       cref = TREE_OPERAND (ref, 0);
6577       if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
6578 	for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
6579 	     next && TREE_CODE (next) != FIELD_DECL;
6580 	     next = DECL_CHAIN (next))
6581 	  ;
6582 
6583       /* If this is the last field in a struct type or a field in a
6584 	 union type do not warn.  */
6585       if (!next)
6586 	return;
6587     }
6588 
6589   low_bound = array_ref_low_bound (ref);
6590   up_bound_p1 = int_const_binop (PLUS_EXPR, up_bound,
6591 				 build_int_cst (TREE_TYPE (up_bound), 1));
6592 
6593   if (TREE_CODE (low_sub) == SSA_NAME)
6594     {
6595       vr = get_value_range (low_sub);
6596       if (vr->type == VR_RANGE || vr->type == VR_ANTI_RANGE)
6597         {
6598           low_sub = vr->type == VR_RANGE ? vr->max : vr->min;
6599           up_sub = vr->type == VR_RANGE ? vr->min : vr->max;
6600         }
6601     }
6602 
6603   if (vr && vr->type == VR_ANTI_RANGE)
6604     {
6605       if (TREE_CODE (up_sub) == INTEGER_CST
6606           && tree_int_cst_lt (up_bound, up_sub)
6607           && TREE_CODE (low_sub) == INTEGER_CST
6608           && tree_int_cst_lt (low_sub, low_bound))
6609         {
6610           warning_at (location, OPT_Warray_bounds,
6611 		      "array subscript is outside array bounds");
6612           TREE_NO_WARNING (ref) = 1;
6613         }
6614     }
6615   else if (TREE_CODE (up_sub) == INTEGER_CST
6616 	   && (ignore_off_by_one
6617 	       ? (tree_int_cst_lt (up_bound, up_sub)
6618 		  && !tree_int_cst_equal (up_bound_p1, up_sub))
6619 	       : (tree_int_cst_lt (up_bound, up_sub)
6620 		  || tree_int_cst_equal (up_bound_p1, up_sub))))
6621     {
6622       if (dump_file && (dump_flags & TDF_DETAILS))
6623 	{
6624 	  fprintf (dump_file, "Array bound warning for ");
6625 	  dump_generic_expr (MSG_NOTE, TDF_SLIM, ref);
6626 	  fprintf (dump_file, "\n");
6627 	}
6628       warning_at (location, OPT_Warray_bounds,
6629 		  "array subscript is above array bounds");
6630       TREE_NO_WARNING (ref) = 1;
6631     }
6632   else if (TREE_CODE (low_sub) == INTEGER_CST
6633            && tree_int_cst_lt (low_sub, low_bound))
6634     {
6635       if (dump_file && (dump_flags & TDF_DETAILS))
6636 	{
6637 	  fprintf (dump_file, "Array bound warning for ");
6638 	  dump_generic_expr (MSG_NOTE, TDF_SLIM, ref);
6639 	  fprintf (dump_file, "\n");
6640 	}
6641       warning_at (location, OPT_Warray_bounds,
6642 		  "array subscript is below array bounds");
6643       TREE_NO_WARNING (ref) = 1;
6644     }
6645 }
6646 
6647 /* Searches if the expr T, located at LOCATION computes
6648    address of an ARRAY_REF, and call check_array_ref on it.  */
6649 
6650 static void
6651 search_for_addr_array (tree t, location_t location)
6652 {
6653   while (TREE_CODE (t) == SSA_NAME)
6654     {
6655       gimple g = SSA_NAME_DEF_STMT (t);
6656 
6657       if (gimple_code (g) != GIMPLE_ASSIGN)
6658 	return;
6659 
6660       if (get_gimple_rhs_class (gimple_assign_rhs_code (g))
6661 	  != GIMPLE_SINGLE_RHS)
6662 	return;
6663 
6664       t = gimple_assign_rhs1 (g);
6665     }
6666 
6667 
6668   /* We are only interested in addresses of ARRAY_REF's.  */
6669   if (TREE_CODE (t) != ADDR_EXPR)
6670     return;
6671 
6672   /* Check each ARRAY_REFs in the reference chain. */
6673   do
6674     {
6675       if (TREE_CODE (t) == ARRAY_REF)
6676 	check_array_ref (location, t, true /*ignore_off_by_one*/);
6677 
6678       t = TREE_OPERAND (t, 0);
6679     }
6680   while (handled_component_p (t));
6681 
6682   if (TREE_CODE (t) == MEM_REF
6683       && TREE_CODE (TREE_OPERAND (t, 0)) == ADDR_EXPR
6684       && !TREE_NO_WARNING (t))
6685     {
6686       tree tem = TREE_OPERAND (TREE_OPERAND (t, 0), 0);
6687       tree low_bound, up_bound, el_sz;
6688       offset_int idx;
6689       if (TREE_CODE (TREE_TYPE (tem)) != ARRAY_TYPE
6690 	  || TREE_CODE (TREE_TYPE (TREE_TYPE (tem))) == ARRAY_TYPE
6691 	  || !TYPE_DOMAIN (TREE_TYPE (tem)))
6692 	return;
6693 
6694       low_bound = TYPE_MIN_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
6695       up_bound = TYPE_MAX_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
6696       el_sz = TYPE_SIZE_UNIT (TREE_TYPE (TREE_TYPE (tem)));
6697       if (!low_bound
6698 	  || TREE_CODE (low_bound) != INTEGER_CST
6699 	  || !up_bound
6700 	  || TREE_CODE (up_bound) != INTEGER_CST
6701 	  || !el_sz
6702 	  || TREE_CODE (el_sz) != INTEGER_CST)
6703 	return;
6704 
6705       idx = mem_ref_offset (t);
6706       idx = wi::sdiv_trunc (idx, wi::to_offset (el_sz));
6707       if (wi::lts_p (idx, 0))
6708 	{
6709 	  if (dump_file && (dump_flags & TDF_DETAILS))
6710 	    {
6711 	      fprintf (dump_file, "Array bound warning for ");
6712 	      dump_generic_expr (MSG_NOTE, TDF_SLIM, t);
6713 	      fprintf (dump_file, "\n");
6714 	    }
6715 	  warning_at (location, OPT_Warray_bounds,
6716 		      "array subscript is below array bounds");
6717 	  TREE_NO_WARNING (t) = 1;
6718 	}
6719       else if (wi::gts_p (idx, (wi::to_offset (up_bound)
6720 				- wi::to_offset (low_bound) + 1)))
6721 	{
6722 	  if (dump_file && (dump_flags & TDF_DETAILS))
6723 	    {
6724 	      fprintf (dump_file, "Array bound warning for ");
6725 	      dump_generic_expr (MSG_NOTE, TDF_SLIM, t);
6726 	      fprintf (dump_file, "\n");
6727 	    }
6728 	  warning_at (location, OPT_Warray_bounds,
6729 		      "array subscript is above array bounds");
6730 	  TREE_NO_WARNING (t) = 1;
6731 	}
6732     }
6733 }
6734 
6735 /* walk_tree() callback that checks if *TP is
6736    an ARRAY_REF inside an ADDR_EXPR (in which an array
6737    subscript one outside the valid range is allowed). Call
6738    check_array_ref for each ARRAY_REF found. The location is
6739    passed in DATA.  */
6740 
6741 static tree
6742 check_array_bounds (tree *tp, int *walk_subtree, void *data)
6743 {
6744   tree t = *tp;
6745   struct walk_stmt_info *wi = (struct walk_stmt_info *) data;
6746   location_t location;
6747 
6748   if (EXPR_HAS_LOCATION (t))
6749     location = EXPR_LOCATION (t);
6750   else
6751     {
6752       location_t *locp = (location_t *) wi->info;
6753       location = *locp;
6754     }
6755 
6756   *walk_subtree = TRUE;
6757 
6758   if (TREE_CODE (t) == ARRAY_REF)
6759     check_array_ref (location, t, false /*ignore_off_by_one*/);
6760 
6761   if (TREE_CODE (t) == MEM_REF
6762       || (TREE_CODE (t) == RETURN_EXPR && TREE_OPERAND (t, 0)))
6763     search_for_addr_array (TREE_OPERAND (t, 0), location);
6764 
6765   if (TREE_CODE (t) == ADDR_EXPR)
6766     *walk_subtree = FALSE;
6767 
6768   return NULL_TREE;
6769 }
6770 
6771 /* Walk over all statements of all reachable BBs and call check_array_bounds
6772    on them.  */
6773 
6774 static void
6775 check_all_array_refs (void)
6776 {
6777   basic_block bb;
6778   gimple_stmt_iterator si;
6779 
6780   FOR_EACH_BB_FN (bb, cfun)
6781     {
6782       edge_iterator ei;
6783       edge e;
6784       bool executable = false;
6785 
6786       /* Skip blocks that were found to be unreachable.  */
6787       FOR_EACH_EDGE (e, ei, bb->preds)
6788 	executable |= !!(e->flags & EDGE_EXECUTABLE);
6789       if (!executable)
6790 	continue;
6791 
6792       for (si = gsi_start_bb (bb); !gsi_end_p (si); gsi_next (&si))
6793 	{
6794 	  gimple stmt = gsi_stmt (si);
6795 	  struct walk_stmt_info wi;
6796 	  if (!gimple_has_location (stmt))
6797 	    continue;
6798 
6799 	  if (is_gimple_call (stmt))
6800 	    {
6801 	      size_t i;
6802 	      size_t n = gimple_call_num_args (stmt);
6803 	      for (i = 0; i < n; i++)
6804 		{
6805 		  tree arg = gimple_call_arg (stmt, i);
6806 		  search_for_addr_array (arg, gimple_location (stmt));
6807 		}
6808 	    }
6809 	  else
6810 	    {
6811 	      memset (&wi, 0, sizeof (wi));
6812 	      wi.info = CONST_CAST (void *, (const void *)
6813 				    gimple_location_ptr (stmt));
6814 
6815 	      walk_gimple_op (gsi_stmt (si),
6816 			      check_array_bounds,
6817 			      &wi);
6818 	    }
6819 	}
6820     }
6821 }
6822 
6823 /* Return true if all imm uses of VAR are either in STMT, or
6824    feed (optionally through a chain of single imm uses) GIMPLE_COND
6825    in basic block COND_BB.  */
6826 
6827 static bool
6828 all_imm_uses_in_stmt_or_feed_cond (tree var, gimple stmt, basic_block cond_bb)
6829 {
6830   use_operand_p use_p, use2_p;
6831   imm_use_iterator iter;
6832 
6833   FOR_EACH_IMM_USE_FAST (use_p, iter, var)
6834     if (USE_STMT (use_p) != stmt)
6835       {
6836 	gimple use_stmt = USE_STMT (use_p), use_stmt2;
6837 	if (is_gimple_debug (use_stmt))
6838 	  continue;
6839 	while (is_gimple_assign (use_stmt)
6840 	       && TREE_CODE (gimple_assign_lhs (use_stmt)) == SSA_NAME
6841 	       && single_imm_use (gimple_assign_lhs (use_stmt),
6842 				  &use2_p, &use_stmt2))
6843 	  use_stmt = use_stmt2;
6844 	if (gimple_code (use_stmt) != GIMPLE_COND
6845 	    || gimple_bb (use_stmt) != cond_bb)
6846 	  return false;
6847       }
6848   return true;
6849 }
6850 
6851 /* Handle
6852    _4 = x_3 & 31;
6853    if (_4 != 0)
6854      goto <bb 6>;
6855    else
6856      goto <bb 7>;
6857    <bb 6>:
6858    __builtin_unreachable ();
6859    <bb 7>:
6860    x_5 = ASSERT_EXPR <x_3, ...>;
6861    If x_3 has no other immediate uses (checked by caller),
6862    var is the x_3 var from ASSERT_EXPR, we can clear low 5 bits
6863    from the non-zero bitmask.  */
6864 
6865 static void
6866 maybe_set_nonzero_bits (basic_block bb, tree var)
6867 {
6868   edge e = single_pred_edge (bb);
6869   basic_block cond_bb = e->src;
6870   gimple stmt = last_stmt (cond_bb);
6871   tree cst;
6872 
6873   if (stmt == NULL
6874       || gimple_code (stmt) != GIMPLE_COND
6875       || gimple_cond_code (stmt) != ((e->flags & EDGE_TRUE_VALUE)
6876 				     ? EQ_EXPR : NE_EXPR)
6877       || TREE_CODE (gimple_cond_lhs (stmt)) != SSA_NAME
6878       || !integer_zerop (gimple_cond_rhs (stmt)))
6879     return;
6880 
6881   stmt = SSA_NAME_DEF_STMT (gimple_cond_lhs (stmt));
6882   if (!is_gimple_assign (stmt)
6883       || gimple_assign_rhs_code (stmt) != BIT_AND_EXPR
6884       || TREE_CODE (gimple_assign_rhs2 (stmt)) != INTEGER_CST)
6885     return;
6886   if (gimple_assign_rhs1 (stmt) != var)
6887     {
6888       gimple stmt2;
6889 
6890       if (TREE_CODE (gimple_assign_rhs1 (stmt)) != SSA_NAME)
6891 	return;
6892       stmt2 = SSA_NAME_DEF_STMT (gimple_assign_rhs1 (stmt));
6893       if (!gimple_assign_cast_p (stmt2)
6894 	  || gimple_assign_rhs1 (stmt2) != var
6895 	  || !CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (stmt2))
6896 	  || (TYPE_PRECISION (TREE_TYPE (gimple_assign_rhs1 (stmt)))
6897 			      != TYPE_PRECISION (TREE_TYPE (var))))
6898 	return;
6899     }
6900   cst = gimple_assign_rhs2 (stmt);
6901   set_nonzero_bits (var, wi::bit_and_not (get_nonzero_bits (var), cst));
6902 }
6903 
6904 /* Convert range assertion expressions into the implied copies and
6905    copy propagate away the copies.  Doing the trivial copy propagation
6906    here avoids the need to run the full copy propagation pass after
6907    VRP.
6908 
6909    FIXME, this will eventually lead to copy propagation removing the
6910    names that had useful range information attached to them.  For
6911    instance, if we had the assertion N_i = ASSERT_EXPR <N_j, N_j > 3>,
6912    then N_i will have the range [3, +INF].
6913 
6914    However, by converting the assertion into the implied copy
6915    operation N_i = N_j, we will then copy-propagate N_j into the uses
6916    of N_i and lose the range information.  We may want to hold on to
6917    ASSERT_EXPRs a little while longer as the ranges could be used in
6918    things like jump threading.
6919 
6920    The problem with keeping ASSERT_EXPRs around is that passes after
6921    VRP need to handle them appropriately.
6922 
6923    Another approach would be to make the range information a first
6924    class property of the SSA_NAME so that it can be queried from
6925    any pass.  This is made somewhat more complex by the need for
6926    multiple ranges to be associated with one SSA_NAME.  */
6927 
6928 static void
6929 remove_range_assertions (void)
6930 {
6931   basic_block bb;
6932   gimple_stmt_iterator si;
6933   /* 1 if looking at ASSERT_EXPRs immediately at the beginning of
6934      a basic block preceeded by GIMPLE_COND branching to it and
6935      __builtin_trap, -1 if not yet checked, 0 otherwise.  */
6936   int is_unreachable;
6937 
6938   /* Note that the BSI iterator bump happens at the bottom of the
6939      loop and no bump is necessary if we're removing the statement
6940      referenced by the current BSI.  */
6941   FOR_EACH_BB_FN (bb, cfun)
6942     for (si = gsi_after_labels (bb), is_unreachable = -1; !gsi_end_p (si);)
6943       {
6944 	gimple stmt = gsi_stmt (si);
6945 	gimple use_stmt;
6946 
6947 	if (is_gimple_assign (stmt)
6948 	    && gimple_assign_rhs_code (stmt) == ASSERT_EXPR)
6949 	  {
6950 	    tree lhs = gimple_assign_lhs (stmt);
6951 	    tree rhs = gimple_assign_rhs1 (stmt);
6952 	    tree var;
6953 	    tree cond = fold (ASSERT_EXPR_COND (rhs));
6954 	    use_operand_p use_p;
6955 	    imm_use_iterator iter;
6956 
6957 	    gcc_assert (cond != boolean_false_node);
6958 
6959 	    var = ASSERT_EXPR_VAR (rhs);
6960 	    gcc_assert (TREE_CODE (var) == SSA_NAME);
6961 
6962 	    if (!POINTER_TYPE_P (TREE_TYPE (lhs))
6963 		&& SSA_NAME_RANGE_INFO (lhs))
6964 	      {
6965 		if (is_unreachable == -1)
6966 		  {
6967 		    is_unreachable = 0;
6968 		    if (single_pred_p (bb)
6969 			&& assert_unreachable_fallthru_edge_p
6970 						    (single_pred_edge (bb)))
6971 		      is_unreachable = 1;
6972 		  }
6973 		/* Handle
6974 		   if (x_7 >= 10 && x_7 < 20)
6975 		     __builtin_unreachable ();
6976 		   x_8 = ASSERT_EXPR <x_7, ...>;
6977 		   if the only uses of x_7 are in the ASSERT_EXPR and
6978 		   in the condition.  In that case, we can copy the
6979 		   range info from x_8 computed in this pass also
6980 		   for x_7.  */
6981 		if (is_unreachable
6982 		    && all_imm_uses_in_stmt_or_feed_cond (var, stmt,
6983 							  single_pred (bb)))
6984 		  {
6985 		    set_range_info (var, SSA_NAME_RANGE_TYPE (lhs),
6986 				    SSA_NAME_RANGE_INFO (lhs)->get_min (),
6987 				    SSA_NAME_RANGE_INFO (lhs)->get_max ());
6988 		    maybe_set_nonzero_bits (bb, var);
6989 		  }
6990 	      }
6991 
6992 	    /* Propagate the RHS into every use of the LHS.  */
6993 	    FOR_EACH_IMM_USE_STMT (use_stmt, iter, lhs)
6994 	      FOR_EACH_IMM_USE_ON_STMT (use_p, iter)
6995 		SET_USE (use_p, var);
6996 
6997 	    /* And finally, remove the copy, it is not needed.  */
6998 	    gsi_remove (&si, true);
6999 	    release_defs (stmt);
7000 	  }
7001 	else
7002 	  {
7003 	    if (!is_gimple_debug (gsi_stmt (si)))
7004 	      is_unreachable = 0;
7005 	    gsi_next (&si);
7006 	  }
7007       }
7008 }
7009 
7010 
7011 /* Return true if STMT is interesting for VRP.  */
7012 
7013 static bool
7014 stmt_interesting_for_vrp (gimple stmt)
7015 {
7016   if (gimple_code (stmt) == GIMPLE_PHI)
7017     {
7018       tree res = gimple_phi_result (stmt);
7019       return (!virtual_operand_p (res)
7020 	      && (INTEGRAL_TYPE_P (TREE_TYPE (res))
7021 		  || POINTER_TYPE_P (TREE_TYPE (res))));
7022     }
7023   else if (is_gimple_assign (stmt) || is_gimple_call (stmt))
7024     {
7025       tree lhs = gimple_get_lhs (stmt);
7026 
7027       /* In general, assignments with virtual operands are not useful
7028 	 for deriving ranges, with the obvious exception of calls to
7029 	 builtin functions.  */
7030       if (lhs && TREE_CODE (lhs) == SSA_NAME
7031 	  && (INTEGRAL_TYPE_P (TREE_TYPE (lhs))
7032 	      || POINTER_TYPE_P (TREE_TYPE (lhs)))
7033 	  && (is_gimple_call (stmt)
7034 	      || !gimple_vuse (stmt)))
7035 	return true;
7036       else if (is_gimple_call (stmt) && gimple_call_internal_p (stmt))
7037 	switch (gimple_call_internal_fn (stmt))
7038 	  {
7039 	  case IFN_ADD_OVERFLOW:
7040 	  case IFN_SUB_OVERFLOW:
7041 	  case IFN_MUL_OVERFLOW:
7042 	    /* These internal calls return _Complex integer type,
7043 	       but are interesting to VRP nevertheless.  */
7044 	    if (lhs && TREE_CODE (lhs) == SSA_NAME)
7045 	      return true;
7046 	    break;
7047 	  default:
7048 	    break;
7049 	  }
7050     }
7051   else if (gimple_code (stmt) == GIMPLE_COND
7052 	   || gimple_code (stmt) == GIMPLE_SWITCH)
7053     return true;
7054 
7055   return false;
7056 }
7057 
7058 
7059 /* Initialize local data structures for VRP.  */
7060 
7061 static void
7062 vrp_initialize (void)
7063 {
7064   basic_block bb;
7065 
7066   values_propagated = false;
7067   num_vr_values = num_ssa_names;
7068   vr_value = XCNEWVEC (value_range_t *, num_vr_values);
7069   vr_phi_edge_counts = XCNEWVEC (int, num_ssa_names);
7070 
7071   FOR_EACH_BB_FN (bb, cfun)
7072     {
7073       for (gphi_iterator si = gsi_start_phis (bb); !gsi_end_p (si);
7074 	   gsi_next (&si))
7075 	{
7076 	  gphi *phi = si.phi ();
7077 	  if (!stmt_interesting_for_vrp (phi))
7078 	    {
7079 	      tree lhs = PHI_RESULT (phi);
7080 	      set_value_range_to_varying (get_value_range (lhs));
7081 	      prop_set_simulate_again (phi, false);
7082 	    }
7083 	  else
7084 	    prop_set_simulate_again (phi, true);
7085 	}
7086 
7087       for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si);
7088 	   gsi_next (&si))
7089         {
7090 	  gimple stmt = gsi_stmt (si);
7091 
7092  	  /* If the statement is a control insn, then we do not
7093  	     want to avoid simulating the statement once.  Failure
7094  	     to do so means that those edges will never get added.  */
7095 	  if (stmt_ends_bb_p (stmt))
7096 	    prop_set_simulate_again (stmt, true);
7097 	  else if (!stmt_interesting_for_vrp (stmt))
7098 	    {
7099 	      set_defs_to_varying (stmt);
7100 	      prop_set_simulate_again (stmt, false);
7101 	    }
7102 	  else
7103 	    prop_set_simulate_again (stmt, true);
7104 	}
7105     }
7106 }
7107 
7108 /* Return the singleton value-range for NAME or NAME.  */
7109 
7110 static inline tree
7111 vrp_valueize (tree name)
7112 {
7113   if (TREE_CODE (name) == SSA_NAME)
7114     {
7115       value_range_t *vr = get_value_range (name);
7116       if (vr->type == VR_RANGE
7117 	  && (vr->min == vr->max
7118 	      || operand_equal_p (vr->min, vr->max, 0)))
7119 	return vr->min;
7120     }
7121   return name;
7122 }
7123 
7124 /* Return the singleton value-range for NAME if that is a constant
7125    but signal to not follow SSA edges.  */
7126 
7127 static inline tree
7128 vrp_valueize_1 (tree name)
7129 {
7130   if (TREE_CODE (name) == SSA_NAME)
7131     {
7132       /* If the definition may be simulated again we cannot follow
7133          this SSA edge as the SSA propagator does not necessarily
7134 	 re-visit the use.  */
7135       gimple def_stmt = SSA_NAME_DEF_STMT (name);
7136       if (!gimple_nop_p (def_stmt)
7137 	  && prop_simulate_again_p (def_stmt))
7138 	return NULL_TREE;
7139       value_range_t *vr = get_value_range (name);
7140       if (range_int_cst_singleton_p (vr))
7141 	return vr->min;
7142     }
7143   return name;
7144 }
7145 
7146 /* Visit assignment STMT.  If it produces an interesting range, record
7147    the SSA name in *OUTPUT_P.  */
7148 
7149 static enum ssa_prop_result
7150 vrp_visit_assignment_or_call (gimple stmt, tree *output_p)
7151 {
7152   tree lhs;
7153   enum gimple_code code = gimple_code (stmt);
7154   lhs = gimple_get_lhs (stmt);
7155 
7156   /* We only keep track of ranges in integral and pointer types.  */
7157   if (TREE_CODE (lhs) == SSA_NAME
7158       && ((INTEGRAL_TYPE_P (TREE_TYPE (lhs))
7159 	   /* It is valid to have NULL MIN/MAX values on a type.  See
7160 	      build_range_type.  */
7161 	   && TYPE_MIN_VALUE (TREE_TYPE (lhs))
7162 	   && TYPE_MAX_VALUE (TREE_TYPE (lhs)))
7163 	  || POINTER_TYPE_P (TREE_TYPE (lhs))))
7164     {
7165       value_range_t new_vr = VR_INITIALIZER;
7166 
7167       /* Try folding the statement to a constant first.  */
7168       tree tem = gimple_fold_stmt_to_constant_1 (stmt, vrp_valueize,
7169 						 vrp_valueize_1);
7170       if (tem && is_gimple_min_invariant (tem))
7171 	set_value_range_to_value (&new_vr, tem, NULL);
7172       /* Then dispatch to value-range extracting functions.  */
7173       else if (code == GIMPLE_CALL)
7174 	extract_range_basic (&new_vr, stmt);
7175       else
7176 	extract_range_from_assignment (&new_vr, as_a <gassign *> (stmt));
7177 
7178       if (update_value_range (lhs, &new_vr))
7179 	{
7180 	  *output_p = lhs;
7181 
7182 	  if (dump_file && (dump_flags & TDF_DETAILS))
7183 	    {
7184 	      fprintf (dump_file, "Found new range for ");
7185 	      print_generic_expr (dump_file, lhs, 0);
7186 	      fprintf (dump_file, ": ");
7187 	      dump_value_range (dump_file, &new_vr);
7188 	      fprintf (dump_file, "\n");
7189 	    }
7190 
7191 	  if (new_vr.type == VR_VARYING)
7192 	    return SSA_PROP_VARYING;
7193 
7194 	  return SSA_PROP_INTERESTING;
7195 	}
7196 
7197       return SSA_PROP_NOT_INTERESTING;
7198     }
7199   else if (is_gimple_call (stmt) && gimple_call_internal_p (stmt))
7200     switch (gimple_call_internal_fn (stmt))
7201       {
7202       case IFN_ADD_OVERFLOW:
7203       case IFN_SUB_OVERFLOW:
7204       case IFN_MUL_OVERFLOW:
7205 	/* These internal calls return _Complex integer type,
7206 	   which VRP does not track, but the immediate uses
7207 	   thereof might be interesting.  */
7208 	if (lhs && TREE_CODE (lhs) == SSA_NAME)
7209 	  {
7210 	    imm_use_iterator iter;
7211 	    use_operand_p use_p;
7212 	    enum ssa_prop_result res = SSA_PROP_VARYING;
7213 
7214 	    set_value_range_to_varying (get_value_range (lhs));
7215 
7216 	    FOR_EACH_IMM_USE_FAST (use_p, iter, lhs)
7217 	      {
7218 		gimple use_stmt = USE_STMT (use_p);
7219 		if (!is_gimple_assign (use_stmt))
7220 		  continue;
7221 		enum tree_code rhs_code = gimple_assign_rhs_code (use_stmt);
7222 		if (rhs_code != REALPART_EXPR && rhs_code != IMAGPART_EXPR)
7223 		  continue;
7224 		tree rhs1 = gimple_assign_rhs1 (use_stmt);
7225 		tree use_lhs = gimple_assign_lhs (use_stmt);
7226 		if (TREE_CODE (rhs1) != rhs_code
7227 		    || TREE_OPERAND (rhs1, 0) != lhs
7228 		    || TREE_CODE (use_lhs) != SSA_NAME
7229 		    || !stmt_interesting_for_vrp (use_stmt)
7230 		    || (!INTEGRAL_TYPE_P (TREE_TYPE (use_lhs))
7231 			|| !TYPE_MIN_VALUE (TREE_TYPE (use_lhs))
7232 			|| !TYPE_MAX_VALUE (TREE_TYPE (use_lhs))))
7233 		  continue;
7234 
7235 		/* If there is a change in the value range for any of the
7236 		   REALPART_EXPR/IMAGPART_EXPR immediate uses, return
7237 		   SSA_PROP_INTERESTING.  If there are any REALPART_EXPR
7238 		   or IMAGPART_EXPR immediate uses, but none of them have
7239 		   a change in their value ranges, return
7240 		   SSA_PROP_NOT_INTERESTING.  If there are no
7241 		   {REAL,IMAG}PART_EXPR uses at all,
7242 		   return SSA_PROP_VARYING.  */
7243 		value_range_t new_vr = VR_INITIALIZER;
7244 		extract_range_basic (&new_vr, use_stmt);
7245 		value_range_t *old_vr = get_value_range (use_lhs);
7246 		if (old_vr->type != new_vr.type
7247 		    || !vrp_operand_equal_p (old_vr->min, new_vr.min)
7248 		    || !vrp_operand_equal_p (old_vr->max, new_vr.max)
7249 		    || !vrp_bitmap_equal_p (old_vr->equiv, new_vr.equiv))
7250 		  res = SSA_PROP_INTERESTING;
7251 		else
7252 		  res = SSA_PROP_NOT_INTERESTING;
7253 		BITMAP_FREE (new_vr.equiv);
7254 		if (res == SSA_PROP_INTERESTING)
7255 		  {
7256 		    *output_p = lhs;
7257 		    return res;
7258 		  }
7259 	      }
7260 
7261 	    return res;
7262 	  }
7263 	break;
7264       default:
7265 	break;
7266       }
7267 
7268   /* Every other statement produces no useful ranges.  */
7269   set_defs_to_varying (stmt);
7270 
7271   return SSA_PROP_VARYING;
7272 }
7273 
7274 /* Helper that gets the value range of the SSA_NAME with version I
7275    or a symbolic range containing the SSA_NAME only if the value range
7276    is varying or undefined.  */
7277 
7278 static inline value_range_t
7279 get_vr_for_comparison (int i)
7280 {
7281   value_range_t vr = *get_value_range (ssa_name (i));
7282 
7283   /* If name N_i does not have a valid range, use N_i as its own
7284      range.  This allows us to compare against names that may
7285      have N_i in their ranges.  */
7286   if (vr.type == VR_VARYING || vr.type == VR_UNDEFINED)
7287     {
7288       vr.type = VR_RANGE;
7289       vr.min = ssa_name (i);
7290       vr.max = ssa_name (i);
7291     }
7292 
7293   return vr;
7294 }
7295 
7296 /* Compare all the value ranges for names equivalent to VAR with VAL
7297    using comparison code COMP.  Return the same value returned by
7298    compare_range_with_value, including the setting of
7299    *STRICT_OVERFLOW_P.  */
7300 
7301 static tree
7302 compare_name_with_value (enum tree_code comp, tree var, tree val,
7303 			 bool *strict_overflow_p)
7304 {
7305   bitmap_iterator bi;
7306   unsigned i;
7307   bitmap e;
7308   tree retval, t;
7309   int used_strict_overflow;
7310   bool sop;
7311   value_range_t equiv_vr;
7312 
7313   /* Get the set of equivalences for VAR.  */
7314   e = get_value_range (var)->equiv;
7315 
7316   /* Start at -1.  Set it to 0 if we do a comparison without relying
7317      on overflow, or 1 if all comparisons rely on overflow.  */
7318   used_strict_overflow = -1;
7319 
7320   /* Compare vars' value range with val.  */
7321   equiv_vr = get_vr_for_comparison (SSA_NAME_VERSION (var));
7322   sop = false;
7323   retval = compare_range_with_value (comp, &equiv_vr, val, &sop);
7324   if (retval)
7325     used_strict_overflow = sop ? 1 : 0;
7326 
7327   /* If the equiv set is empty we have done all work we need to do.  */
7328   if (e == NULL)
7329     {
7330       if (retval
7331 	  && used_strict_overflow > 0)
7332 	*strict_overflow_p = true;
7333       return retval;
7334     }
7335 
7336   EXECUTE_IF_SET_IN_BITMAP (e, 0, i, bi)
7337     {
7338       equiv_vr = get_vr_for_comparison (i);
7339       sop = false;
7340       t = compare_range_with_value (comp, &equiv_vr, val, &sop);
7341       if (t)
7342 	{
7343 	  /* If we get different answers from different members
7344 	     of the equivalence set this check must be in a dead
7345 	     code region.  Folding it to a trap representation
7346 	     would be correct here.  For now just return don't-know.  */
7347 	  if (retval != NULL
7348 	      && t != retval)
7349 	    {
7350 	      retval = NULL_TREE;
7351 	      break;
7352 	    }
7353 	  retval = t;
7354 
7355 	  if (!sop)
7356 	    used_strict_overflow = 0;
7357 	  else if (used_strict_overflow < 0)
7358 	    used_strict_overflow = 1;
7359 	}
7360     }
7361 
7362   if (retval
7363       && used_strict_overflow > 0)
7364     *strict_overflow_p = true;
7365 
7366   return retval;
7367 }
7368 
7369 
7370 /* Given a comparison code COMP and names N1 and N2, compare all the
7371    ranges equivalent to N1 against all the ranges equivalent to N2
7372    to determine the value of N1 COMP N2.  Return the same value
7373    returned by compare_ranges.  Set *STRICT_OVERFLOW_P to indicate
7374    whether we relied on an overflow infinity in the comparison.  */
7375 
7376 
7377 static tree
7378 compare_names (enum tree_code comp, tree n1, tree n2,
7379 	       bool *strict_overflow_p)
7380 {
7381   tree t, retval;
7382   bitmap e1, e2;
7383   bitmap_iterator bi1, bi2;
7384   unsigned i1, i2;
7385   int used_strict_overflow;
7386   static bitmap_obstack *s_obstack = NULL;
7387   static bitmap s_e1 = NULL, s_e2 = NULL;
7388 
7389   /* Compare the ranges of every name equivalent to N1 against the
7390      ranges of every name equivalent to N2.  */
7391   e1 = get_value_range (n1)->equiv;
7392   e2 = get_value_range (n2)->equiv;
7393 
7394   /* Use the fake bitmaps if e1 or e2 are not available.  */
7395   if (s_obstack == NULL)
7396     {
7397       s_obstack = XNEW (bitmap_obstack);
7398       bitmap_obstack_initialize (s_obstack);
7399       s_e1 = BITMAP_ALLOC (s_obstack);
7400       s_e2 = BITMAP_ALLOC (s_obstack);
7401     }
7402   if (e1 == NULL)
7403     e1 = s_e1;
7404   if (e2 == NULL)
7405     e2 = s_e2;
7406 
7407   /* Add N1 and N2 to their own set of equivalences to avoid
7408      duplicating the body of the loop just to check N1 and N2
7409      ranges.  */
7410   bitmap_set_bit (e1, SSA_NAME_VERSION (n1));
7411   bitmap_set_bit (e2, SSA_NAME_VERSION (n2));
7412 
7413   /* If the equivalence sets have a common intersection, then the two
7414      names can be compared without checking their ranges.  */
7415   if (bitmap_intersect_p (e1, e2))
7416     {
7417       bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
7418       bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
7419 
7420       return (comp == EQ_EXPR || comp == GE_EXPR || comp == LE_EXPR)
7421 	     ? boolean_true_node
7422 	     : boolean_false_node;
7423     }
7424 
7425   /* Start at -1.  Set it to 0 if we do a comparison without relying
7426      on overflow, or 1 if all comparisons rely on overflow.  */
7427   used_strict_overflow = -1;
7428 
7429   /* Otherwise, compare all the equivalent ranges.  First, add N1 and
7430      N2 to their own set of equivalences to avoid duplicating the body
7431      of the loop just to check N1 and N2 ranges.  */
7432   EXECUTE_IF_SET_IN_BITMAP (e1, 0, i1, bi1)
7433     {
7434       value_range_t vr1 = get_vr_for_comparison (i1);
7435 
7436       t = retval = NULL_TREE;
7437       EXECUTE_IF_SET_IN_BITMAP (e2, 0, i2, bi2)
7438 	{
7439 	  bool sop = false;
7440 
7441 	  value_range_t vr2 = get_vr_for_comparison (i2);
7442 
7443 	  t = compare_ranges (comp, &vr1, &vr2, &sop);
7444 	  if (t)
7445 	    {
7446 	      /* If we get different answers from different members
7447 		 of the equivalence set this check must be in a dead
7448 		 code region.  Folding it to a trap representation
7449 		 would be correct here.  For now just return don't-know.  */
7450 	      if (retval != NULL
7451 		  && t != retval)
7452 		{
7453 		  bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
7454 		  bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
7455 		  return NULL_TREE;
7456 		}
7457 	      retval = t;
7458 
7459 	      if (!sop)
7460 		used_strict_overflow = 0;
7461 	      else if (used_strict_overflow < 0)
7462 		used_strict_overflow = 1;
7463 	    }
7464 	}
7465 
7466       if (retval)
7467 	{
7468 	  bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
7469 	  bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
7470 	  if (used_strict_overflow > 0)
7471 	    *strict_overflow_p = true;
7472 	  return retval;
7473 	}
7474     }
7475 
7476   /* None of the equivalent ranges are useful in computing this
7477      comparison.  */
7478   bitmap_clear_bit (e1, SSA_NAME_VERSION (n1));
7479   bitmap_clear_bit (e2, SSA_NAME_VERSION (n2));
7480   return NULL_TREE;
7481 }
7482 
7483 /* Helper function for vrp_evaluate_conditional_warnv.  */
7484 
7485 static tree
7486 vrp_evaluate_conditional_warnv_with_ops_using_ranges (enum tree_code code,
7487 						      tree op0, tree op1,
7488 						      bool * strict_overflow_p)
7489 {
7490   value_range_t *vr0, *vr1;
7491 
7492   vr0 = (TREE_CODE (op0) == SSA_NAME) ? get_value_range (op0) : NULL;
7493   vr1 = (TREE_CODE (op1) == SSA_NAME) ? get_value_range (op1) : NULL;
7494 
7495   tree res = NULL_TREE;
7496   if (vr0 && vr1)
7497     res = compare_ranges (code, vr0, vr1, strict_overflow_p);
7498   if (!res && vr0)
7499     res = compare_range_with_value (code, vr0, op1, strict_overflow_p);
7500   if (!res && vr1)
7501     res = (compare_range_with_value
7502 	    (swap_tree_comparison (code), vr1, op0, strict_overflow_p));
7503   return res;
7504 }
7505 
7506 /* Helper function for vrp_evaluate_conditional_warnv. */
7507 
7508 static tree
7509 vrp_evaluate_conditional_warnv_with_ops (enum tree_code code, tree op0,
7510 					 tree op1, bool use_equiv_p,
7511 					 bool *strict_overflow_p, bool *only_ranges)
7512 {
7513   tree ret;
7514   if (only_ranges)
7515     *only_ranges = true;
7516 
7517   /* We only deal with integral and pointer types.  */
7518   if (!INTEGRAL_TYPE_P (TREE_TYPE (op0))
7519       && !POINTER_TYPE_P (TREE_TYPE (op0)))
7520     return NULL_TREE;
7521 
7522   if (use_equiv_p)
7523     {
7524       if (only_ranges
7525           && (ret = vrp_evaluate_conditional_warnv_with_ops_using_ranges
7526 	              (code, op0, op1, strict_overflow_p)))
7527 	return ret;
7528       *only_ranges = false;
7529       if (TREE_CODE (op0) == SSA_NAME && TREE_CODE (op1) == SSA_NAME)
7530 	return compare_names (code, op0, op1, strict_overflow_p);
7531       else if (TREE_CODE (op0) == SSA_NAME)
7532 	return compare_name_with_value (code, op0, op1, strict_overflow_p);
7533       else if (TREE_CODE (op1) == SSA_NAME)
7534 	return (compare_name_with_value
7535 		(swap_tree_comparison (code), op1, op0, strict_overflow_p));
7536     }
7537   else
7538     return vrp_evaluate_conditional_warnv_with_ops_using_ranges (code, op0, op1,
7539 								 strict_overflow_p);
7540   return NULL_TREE;
7541 }
7542 
7543 /* Given (CODE OP0 OP1) within STMT, try to simplify it based on value range
7544    information.  Return NULL if the conditional can not be evaluated.
7545    The ranges of all the names equivalent with the operands in COND
7546    will be used when trying to compute the value.  If the result is
7547    based on undefined signed overflow, issue a warning if
7548    appropriate.  */
7549 
7550 static tree
7551 vrp_evaluate_conditional (enum tree_code code, tree op0, tree op1, gimple stmt)
7552 {
7553   bool sop;
7554   tree ret;
7555   bool only_ranges;
7556 
7557   /* Some passes and foldings leak constants with overflow flag set
7558      into the IL.  Avoid doing wrong things with these and bail out.  */
7559   if ((TREE_CODE (op0) == INTEGER_CST
7560        && TREE_OVERFLOW (op0))
7561       || (TREE_CODE (op1) == INTEGER_CST
7562 	  && TREE_OVERFLOW (op1)))
7563     return NULL_TREE;
7564 
7565   sop = false;
7566   ret = vrp_evaluate_conditional_warnv_with_ops (code, op0, op1, true, &sop,
7567   						 &only_ranges);
7568 
7569   if (ret && sop)
7570     {
7571       enum warn_strict_overflow_code wc;
7572       const char* warnmsg;
7573 
7574       if (is_gimple_min_invariant (ret))
7575 	{
7576 	  wc = WARN_STRICT_OVERFLOW_CONDITIONAL;
7577 	  warnmsg = G_("assuming signed overflow does not occur when "
7578 		       "simplifying conditional to constant");
7579 	}
7580       else
7581 	{
7582 	  wc = WARN_STRICT_OVERFLOW_COMPARISON;
7583 	  warnmsg = G_("assuming signed overflow does not occur when "
7584 		       "simplifying conditional");
7585 	}
7586 
7587       if (issue_strict_overflow_warning (wc))
7588 	{
7589 	  location_t location;
7590 
7591 	  if (!gimple_has_location (stmt))
7592 	    location = input_location;
7593 	  else
7594 	    location = gimple_location (stmt);
7595 	  warning_at (location, OPT_Wstrict_overflow, "%s", warnmsg);
7596 	}
7597     }
7598 
7599   if (warn_type_limits
7600       && ret && only_ranges
7601       && TREE_CODE_CLASS (code) == tcc_comparison
7602       && TREE_CODE (op0) == SSA_NAME)
7603     {
7604       /* If the comparison is being folded and the operand on the LHS
7605 	 is being compared against a constant value that is outside of
7606 	 the natural range of OP0's type, then the predicate will
7607 	 always fold regardless of the value of OP0.  If -Wtype-limits
7608 	 was specified, emit a warning.  */
7609       tree type = TREE_TYPE (op0);
7610       value_range_t *vr0 = get_value_range (op0);
7611 
7612       if (vr0->type == VR_RANGE
7613 	  && INTEGRAL_TYPE_P (type)
7614 	  && vrp_val_is_min (vr0->min)
7615 	  && vrp_val_is_max (vr0->max)
7616 	  && is_gimple_min_invariant (op1))
7617 	{
7618 	  location_t location;
7619 
7620 	  if (!gimple_has_location (stmt))
7621 	    location = input_location;
7622 	  else
7623 	    location = gimple_location (stmt);
7624 
7625 	  warning_at (location, OPT_Wtype_limits,
7626 		      integer_zerop (ret)
7627 		      ? G_("comparison always false "
7628                            "due to limited range of data type")
7629 		      : G_("comparison always true "
7630                            "due to limited range of data type"));
7631 	}
7632     }
7633 
7634   return ret;
7635 }
7636 
7637 
7638 /* Visit conditional statement STMT.  If we can determine which edge
7639    will be taken out of STMT's basic block, record it in
7640    *TAKEN_EDGE_P and return SSA_PROP_INTERESTING.  Otherwise, return
7641    SSA_PROP_VARYING.  */
7642 
7643 static enum ssa_prop_result
7644 vrp_visit_cond_stmt (gcond *stmt, edge *taken_edge_p)
7645 {
7646   tree val;
7647   bool sop;
7648 
7649   *taken_edge_p = NULL;
7650 
7651   if (dump_file && (dump_flags & TDF_DETAILS))
7652     {
7653       tree use;
7654       ssa_op_iter i;
7655 
7656       fprintf (dump_file, "\nVisiting conditional with predicate: ");
7657       print_gimple_stmt (dump_file, stmt, 0, 0);
7658       fprintf (dump_file, "\nWith known ranges\n");
7659 
7660       FOR_EACH_SSA_TREE_OPERAND (use, stmt, i, SSA_OP_USE)
7661 	{
7662 	  fprintf (dump_file, "\t");
7663 	  print_generic_expr (dump_file, use, 0);
7664 	  fprintf (dump_file, ": ");
7665 	  dump_value_range (dump_file, vr_value[SSA_NAME_VERSION (use)]);
7666 	}
7667 
7668       fprintf (dump_file, "\n");
7669     }
7670 
7671   /* Compute the value of the predicate COND by checking the known
7672      ranges of each of its operands.
7673 
7674      Note that we cannot evaluate all the equivalent ranges here
7675      because those ranges may not yet be final and with the current
7676      propagation strategy, we cannot determine when the value ranges
7677      of the names in the equivalence set have changed.
7678 
7679      For instance, given the following code fragment
7680 
7681         i_5 = PHI <8, i_13>
7682 	...
7683      	i_14 = ASSERT_EXPR <i_5, i_5 != 0>
7684 	if (i_14 == 1)
7685 	  ...
7686 
7687      Assume that on the first visit to i_14, i_5 has the temporary
7688      range [8, 8] because the second argument to the PHI function is
7689      not yet executable.  We derive the range ~[0, 0] for i_14 and the
7690      equivalence set { i_5 }.  So, when we visit 'if (i_14 == 1)' for
7691      the first time, since i_14 is equivalent to the range [8, 8], we
7692      determine that the predicate is always false.
7693 
7694      On the next round of propagation, i_13 is determined to be
7695      VARYING, which causes i_5 to drop down to VARYING.  So, another
7696      visit to i_14 is scheduled.  In this second visit, we compute the
7697      exact same range and equivalence set for i_14, namely ~[0, 0] and
7698      { i_5 }.  But we did not have the previous range for i_5
7699      registered, so vrp_visit_assignment thinks that the range for
7700      i_14 has not changed.  Therefore, the predicate 'if (i_14 == 1)'
7701      is not visited again, which stops propagation from visiting
7702      statements in the THEN clause of that if().
7703 
7704      To properly fix this we would need to keep the previous range
7705      value for the names in the equivalence set.  This way we would've
7706      discovered that from one visit to the other i_5 changed from
7707      range [8, 8] to VR_VARYING.
7708 
7709      However, fixing this apparent limitation may not be worth the
7710      additional checking.  Testing on several code bases (GCC, DLV,
7711      MICO, TRAMP3D and SPEC2000) showed that doing this results in
7712      4 more predicates folded in SPEC.  */
7713   sop = false;
7714 
7715   val = vrp_evaluate_conditional_warnv_with_ops (gimple_cond_code (stmt),
7716 						 gimple_cond_lhs (stmt),
7717 						 gimple_cond_rhs (stmt),
7718 						 false, &sop, NULL);
7719   if (val)
7720     {
7721       if (!sop)
7722 	*taken_edge_p = find_taken_edge (gimple_bb (stmt), val);
7723       else
7724 	{
7725 	  if (dump_file && (dump_flags & TDF_DETAILS))
7726 	    fprintf (dump_file,
7727 		     "\nIgnoring predicate evaluation because "
7728 		     "it assumes that signed overflow is undefined");
7729 	  val = NULL_TREE;
7730 	}
7731     }
7732 
7733   if (dump_file && (dump_flags & TDF_DETAILS))
7734     {
7735       fprintf (dump_file, "\nPredicate evaluates to: ");
7736       if (val == NULL_TREE)
7737 	fprintf (dump_file, "DON'T KNOW\n");
7738       else
7739 	print_generic_stmt (dump_file, val, 0);
7740     }
7741 
7742   return (*taken_edge_p) ? SSA_PROP_INTERESTING : SSA_PROP_VARYING;
7743 }
7744 
7745 /* Searches the case label vector VEC for the index *IDX of the CASE_LABEL
7746    that includes the value VAL.  The search is restricted to the range
7747    [START_IDX, n - 1] where n is the size of VEC.
7748 
7749    If there is a CASE_LABEL for VAL, its index is placed in IDX and true is
7750    returned.
7751 
7752    If there is no CASE_LABEL for VAL and there is one that is larger than VAL,
7753    it is placed in IDX and false is returned.
7754 
7755    If VAL is larger than any CASE_LABEL, n is placed on IDX and false is
7756    returned. */
7757 
7758 static bool
7759 find_case_label_index (gswitch *stmt, size_t start_idx, tree val, size_t *idx)
7760 {
7761   size_t n = gimple_switch_num_labels (stmt);
7762   size_t low, high;
7763 
7764   /* Find case label for minimum of the value range or the next one.
7765      At each iteration we are searching in [low, high - 1]. */
7766 
7767   for (low = start_idx, high = n; high != low; )
7768     {
7769       tree t;
7770       int cmp;
7771       /* Note that i != high, so we never ask for n. */
7772       size_t i = (high + low) / 2;
7773       t = gimple_switch_label (stmt, i);
7774 
7775       /* Cache the result of comparing CASE_LOW and val.  */
7776       cmp = tree_int_cst_compare (CASE_LOW (t), val);
7777 
7778       if (cmp == 0)
7779 	{
7780 	  /* Ranges cannot be empty. */
7781 	  *idx = i;
7782 	  return true;
7783 	}
7784       else if (cmp > 0)
7785         high = i;
7786       else
7787 	{
7788 	  low = i + 1;
7789 	  if (CASE_HIGH (t) != NULL
7790 	      && tree_int_cst_compare (CASE_HIGH (t), val) >= 0)
7791 	    {
7792 	      *idx = i;
7793 	      return true;
7794 	    }
7795         }
7796     }
7797 
7798   *idx = high;
7799   return false;
7800 }
7801 
7802 /* Searches the case label vector VEC for the range of CASE_LABELs that is used
7803    for values between MIN and MAX. The first index is placed in MIN_IDX. The
7804    last index is placed in MAX_IDX. If the range of CASE_LABELs is empty
7805    then MAX_IDX < MIN_IDX.
7806    Returns true if the default label is not needed. */
7807 
7808 static bool
7809 find_case_label_range (gswitch *stmt, tree min, tree max, size_t *min_idx,
7810 		       size_t *max_idx)
7811 {
7812   size_t i, j;
7813   bool min_take_default = !find_case_label_index (stmt, 1, min, &i);
7814   bool max_take_default = !find_case_label_index (stmt, i, max, &j);
7815 
7816   if (i == j
7817       && min_take_default
7818       && max_take_default)
7819     {
7820       /* Only the default case label reached.
7821          Return an empty range. */
7822       *min_idx = 1;
7823       *max_idx = 0;
7824       return false;
7825     }
7826   else
7827     {
7828       bool take_default = min_take_default || max_take_default;
7829       tree low, high;
7830       size_t k;
7831 
7832       if (max_take_default)
7833 	j--;
7834 
7835       /* If the case label range is continuous, we do not need
7836 	 the default case label.  Verify that.  */
7837       high = CASE_LOW (gimple_switch_label (stmt, i));
7838       if (CASE_HIGH (gimple_switch_label (stmt, i)))
7839 	high = CASE_HIGH (gimple_switch_label (stmt, i));
7840       for (k = i + 1; k <= j; ++k)
7841 	{
7842 	  low = CASE_LOW (gimple_switch_label (stmt, k));
7843 	  if (!integer_onep (int_const_binop (MINUS_EXPR, low, high)))
7844 	    {
7845 	      take_default = true;
7846 	      break;
7847 	    }
7848 	  high = low;
7849 	  if (CASE_HIGH (gimple_switch_label (stmt, k)))
7850 	    high = CASE_HIGH (gimple_switch_label (stmt, k));
7851 	}
7852 
7853       *min_idx = i;
7854       *max_idx = j;
7855       return !take_default;
7856     }
7857 }
7858 
7859 /* Searches the case label vector VEC for the ranges of CASE_LABELs that are
7860    used in range VR.  The indices are placed in MIN_IDX1, MAX_IDX, MIN_IDX2 and
7861    MAX_IDX2.  If the ranges of CASE_LABELs are empty then MAX_IDX1 < MIN_IDX1.
7862    Returns true if the default label is not needed.  */
7863 
7864 static bool
7865 find_case_label_ranges (gswitch *stmt, value_range_t *vr, size_t *min_idx1,
7866 			size_t *max_idx1, size_t *min_idx2,
7867 			size_t *max_idx2)
7868 {
7869   size_t i, j, k, l;
7870   unsigned int n = gimple_switch_num_labels (stmt);
7871   bool take_default;
7872   tree case_low, case_high;
7873   tree min = vr->min, max = vr->max;
7874 
7875   gcc_checking_assert (vr->type == VR_RANGE || vr->type == VR_ANTI_RANGE);
7876 
7877   take_default = !find_case_label_range (stmt, min, max, &i, &j);
7878 
7879   /* Set second range to emtpy.  */
7880   *min_idx2 = 1;
7881   *max_idx2 = 0;
7882 
7883   if (vr->type == VR_RANGE)
7884     {
7885       *min_idx1 = i;
7886       *max_idx1 = j;
7887       return !take_default;
7888     }
7889 
7890   /* Set first range to all case labels.  */
7891   *min_idx1 = 1;
7892   *max_idx1 = n - 1;
7893 
7894   if (i > j)
7895     return false;
7896 
7897   /* Make sure all the values of case labels [i , j] are contained in
7898      range [MIN, MAX].  */
7899   case_low = CASE_LOW (gimple_switch_label (stmt, i));
7900   case_high = CASE_HIGH (gimple_switch_label (stmt, j));
7901   if (tree_int_cst_compare (case_low, min) < 0)
7902     i += 1;
7903   if (case_high != NULL_TREE
7904       && tree_int_cst_compare (max, case_high) < 0)
7905     j -= 1;
7906 
7907   if (i > j)
7908     return false;
7909 
7910   /* If the range spans case labels [i, j], the corresponding anti-range spans
7911      the labels [1, i - 1] and [j + 1, n -  1].  */
7912   k = j + 1;
7913   l = n - 1;
7914   if (k > l)
7915     {
7916       k = 1;
7917       l = 0;
7918     }
7919 
7920   j = i - 1;
7921   i = 1;
7922   if (i > j)
7923     {
7924       i = k;
7925       j = l;
7926       k = 1;
7927       l = 0;
7928     }
7929 
7930   *min_idx1 = i;
7931   *max_idx1 = j;
7932   *min_idx2 = k;
7933   *max_idx2 = l;
7934   return false;
7935 }
7936 
7937 /* Visit switch statement STMT.  If we can determine which edge
7938    will be taken out of STMT's basic block, record it in
7939    *TAKEN_EDGE_P and return SSA_PROP_INTERESTING.  Otherwise, return
7940    SSA_PROP_VARYING.  */
7941 
7942 static enum ssa_prop_result
7943 vrp_visit_switch_stmt (gswitch *stmt, edge *taken_edge_p)
7944 {
7945   tree op, val;
7946   value_range_t *vr;
7947   size_t i = 0, j = 0, k, l;
7948   bool take_default;
7949 
7950   *taken_edge_p = NULL;
7951   op = gimple_switch_index (stmt);
7952   if (TREE_CODE (op) != SSA_NAME)
7953     return SSA_PROP_VARYING;
7954 
7955   vr = get_value_range (op);
7956   if (dump_file && (dump_flags & TDF_DETAILS))
7957     {
7958       fprintf (dump_file, "\nVisiting switch expression with operand ");
7959       print_generic_expr (dump_file, op, 0);
7960       fprintf (dump_file, " with known range ");
7961       dump_value_range (dump_file, vr);
7962       fprintf (dump_file, "\n");
7963     }
7964 
7965   if ((vr->type != VR_RANGE
7966        && vr->type != VR_ANTI_RANGE)
7967       || symbolic_range_p (vr))
7968     return SSA_PROP_VARYING;
7969 
7970   /* Find the single edge that is taken from the switch expression.  */
7971   take_default = !find_case_label_ranges (stmt, vr, &i, &j, &k, &l);
7972 
7973   /* Check if the range spans no CASE_LABEL. If so, we only reach the default
7974      label */
7975   if (j < i)
7976     {
7977       gcc_assert (take_default);
7978       val = gimple_switch_default_label (stmt);
7979     }
7980   else
7981     {
7982       /* Check if labels with index i to j and maybe the default label
7983 	 are all reaching the same label.  */
7984 
7985       val = gimple_switch_label (stmt, i);
7986       if (take_default
7987 	  && CASE_LABEL (gimple_switch_default_label (stmt))
7988 	  != CASE_LABEL (val))
7989 	{
7990 	  if (dump_file && (dump_flags & TDF_DETAILS))
7991 	    fprintf (dump_file, "  not a single destination for this "
7992 		     "range\n");
7993           return SSA_PROP_VARYING;
7994 	}
7995       for (++i; i <= j; ++i)
7996         {
7997           if (CASE_LABEL (gimple_switch_label (stmt, i)) != CASE_LABEL (val))
7998 	    {
7999 	      if (dump_file && (dump_flags & TDF_DETAILS))
8000 		fprintf (dump_file, "  not a single destination for this "
8001 			 "range\n");
8002 	      return SSA_PROP_VARYING;
8003 	    }
8004         }
8005       for (; k <= l; ++k)
8006         {
8007           if (CASE_LABEL (gimple_switch_label (stmt, k)) != CASE_LABEL (val))
8008 	    {
8009 	      if (dump_file && (dump_flags & TDF_DETAILS))
8010 		fprintf (dump_file, "  not a single destination for this "
8011 			 "range\n");
8012 	      return SSA_PROP_VARYING;
8013 	    }
8014         }
8015     }
8016 
8017   *taken_edge_p = find_edge (gimple_bb (stmt),
8018 			     label_to_block (CASE_LABEL (val)));
8019 
8020   if (dump_file && (dump_flags & TDF_DETAILS))
8021     {
8022       fprintf (dump_file, "  will take edge to ");
8023       print_generic_stmt (dump_file, CASE_LABEL (val), 0);
8024     }
8025 
8026   return SSA_PROP_INTERESTING;
8027 }
8028 
8029 
8030 /* Evaluate statement STMT.  If the statement produces a useful range,
8031    return SSA_PROP_INTERESTING and record the SSA name with the
8032    interesting range into *OUTPUT_P.
8033 
8034    If STMT is a conditional branch and we can determine its truth
8035    value, the taken edge is recorded in *TAKEN_EDGE_P.
8036 
8037    If STMT produces a varying value, return SSA_PROP_VARYING.  */
8038 
8039 static enum ssa_prop_result
8040 vrp_visit_stmt (gimple stmt, edge *taken_edge_p, tree *output_p)
8041 {
8042   if (dump_file && (dump_flags & TDF_DETAILS))
8043     {
8044       fprintf (dump_file, "\nVisiting statement:\n");
8045       print_gimple_stmt (dump_file, stmt, 0, dump_flags);
8046     }
8047 
8048   if (!stmt_interesting_for_vrp (stmt))
8049     gcc_assert (stmt_ends_bb_p (stmt));
8050   else if (is_gimple_assign (stmt) || is_gimple_call (stmt))
8051     return vrp_visit_assignment_or_call (stmt, output_p);
8052   else if (gimple_code (stmt) == GIMPLE_COND)
8053     return vrp_visit_cond_stmt (as_a <gcond *> (stmt), taken_edge_p);
8054   else if (gimple_code (stmt) == GIMPLE_SWITCH)
8055     return vrp_visit_switch_stmt (as_a <gswitch *> (stmt), taken_edge_p);
8056 
8057   /* All other statements produce nothing of interest for VRP, so mark
8058      their outputs varying and prevent further simulation.  */
8059   set_defs_to_varying (stmt);
8060 
8061   return SSA_PROP_VARYING;
8062 }
8063 
8064 /* Union the two value-ranges { *VR0TYPE, *VR0MIN, *VR0MAX } and
8065    { VR1TYPE, VR0MIN, VR0MAX } and store the result
8066    in { *VR0TYPE, *VR0MIN, *VR0MAX }.  This may not be the smallest
8067    possible such range.  The resulting range is not canonicalized.  */
8068 
8069 static void
8070 union_ranges (enum value_range_type *vr0type,
8071 	      tree *vr0min, tree *vr0max,
8072 	      enum value_range_type vr1type,
8073 	      tree vr1min, tree vr1max)
8074 {
8075   bool mineq = operand_equal_p (*vr0min, vr1min, 0);
8076   bool maxeq = operand_equal_p (*vr0max, vr1max, 0);
8077 
8078   /* [] is vr0, () is vr1 in the following classification comments.  */
8079   if (mineq && maxeq)
8080     {
8081       /* [(  )] */
8082       if (*vr0type == vr1type)
8083 	/* Nothing to do for equal ranges.  */
8084 	;
8085       else if ((*vr0type == VR_RANGE
8086 		&& vr1type == VR_ANTI_RANGE)
8087 	       || (*vr0type == VR_ANTI_RANGE
8088 		   && vr1type == VR_RANGE))
8089 	{
8090 	  /* For anti-range with range union the result is varying.  */
8091 	  goto give_up;
8092 	}
8093       else
8094 	gcc_unreachable ();
8095     }
8096   else if (operand_less_p (*vr0max, vr1min) == 1
8097 	   || operand_less_p (vr1max, *vr0min) == 1)
8098     {
8099       /* [ ] ( ) or ( ) [ ]
8100 	 If the ranges have an empty intersection, result of the union
8101 	 operation is the anti-range or if both are anti-ranges
8102 	 it covers all.  */
8103       if (*vr0type == VR_ANTI_RANGE
8104 	  && vr1type == VR_ANTI_RANGE)
8105 	goto give_up;
8106       else if (*vr0type == VR_ANTI_RANGE
8107 	       && vr1type == VR_RANGE)
8108 	;
8109       else if (*vr0type == VR_RANGE
8110 	       && vr1type == VR_ANTI_RANGE)
8111 	{
8112 	  *vr0type = vr1type;
8113 	  *vr0min = vr1min;
8114 	  *vr0max = vr1max;
8115 	}
8116       else if (*vr0type == VR_RANGE
8117 	       && vr1type == VR_RANGE)
8118 	{
8119 	  /* The result is the convex hull of both ranges.  */
8120 	  if (operand_less_p (*vr0max, vr1min) == 1)
8121 	    {
8122 	      /* If the result can be an anti-range, create one.  */
8123 	      if (TREE_CODE (*vr0max) == INTEGER_CST
8124 		  && TREE_CODE (vr1min) == INTEGER_CST
8125 		  && vrp_val_is_min (*vr0min)
8126 		  && vrp_val_is_max (vr1max))
8127 		{
8128 		  tree min = int_const_binop (PLUS_EXPR,
8129 					      *vr0max,
8130 					      build_int_cst (TREE_TYPE (*vr0max), 1));
8131 		  tree max = int_const_binop (MINUS_EXPR,
8132 					      vr1min,
8133 					      build_int_cst (TREE_TYPE (vr1min), 1));
8134 		  if (!operand_less_p (max, min))
8135 		    {
8136 		      *vr0type = VR_ANTI_RANGE;
8137 		      *vr0min = min;
8138 		      *vr0max = max;
8139 		    }
8140 		  else
8141 		    *vr0max = vr1max;
8142 		}
8143 	      else
8144 		*vr0max = vr1max;
8145 	    }
8146 	  else
8147 	    {
8148 	      /* If the result can be an anti-range, create one.  */
8149 	      if (TREE_CODE (vr1max) == INTEGER_CST
8150 		  && TREE_CODE (*vr0min) == INTEGER_CST
8151 		  && vrp_val_is_min (vr1min)
8152 		  && vrp_val_is_max (*vr0max))
8153 		{
8154 		  tree min = int_const_binop (PLUS_EXPR,
8155 					      vr1max,
8156 					      build_int_cst (TREE_TYPE (vr1max), 1));
8157 		  tree max = int_const_binop (MINUS_EXPR,
8158 					      *vr0min,
8159 					      build_int_cst (TREE_TYPE (*vr0min), 1));
8160 		  if (!operand_less_p (max, min))
8161 		    {
8162 		      *vr0type = VR_ANTI_RANGE;
8163 		      *vr0min = min;
8164 		      *vr0max = max;
8165 		    }
8166 		  else
8167 		    *vr0min = vr1min;
8168 		}
8169 	      else
8170 		*vr0min = vr1min;
8171 	    }
8172 	}
8173       else
8174 	gcc_unreachable ();
8175     }
8176   else if ((maxeq || operand_less_p (vr1max, *vr0max) == 1)
8177 	   && (mineq || operand_less_p (*vr0min, vr1min) == 1))
8178     {
8179       /* [ (  ) ] or [(  ) ] or [ (  )] */
8180       if (*vr0type == VR_RANGE
8181 	  && vr1type == VR_RANGE)
8182 	;
8183       else if (*vr0type == VR_ANTI_RANGE
8184 	       && vr1type == VR_ANTI_RANGE)
8185 	{
8186 	  *vr0type = vr1type;
8187 	  *vr0min = vr1min;
8188 	  *vr0max = vr1max;
8189 	}
8190       else if (*vr0type == VR_ANTI_RANGE
8191 	       && vr1type == VR_RANGE)
8192 	{
8193 	  /* Arbitrarily choose the right or left gap.  */
8194 	  if (!mineq && TREE_CODE (vr1min) == INTEGER_CST)
8195 	    *vr0max = int_const_binop (MINUS_EXPR, vr1min,
8196 				       build_int_cst (TREE_TYPE (vr1min), 1));
8197 	  else if (!maxeq && TREE_CODE (vr1max) == INTEGER_CST)
8198 	    *vr0min = int_const_binop (PLUS_EXPR, vr1max,
8199 				       build_int_cst (TREE_TYPE (vr1max), 1));
8200 	  else
8201 	    goto give_up;
8202 	}
8203       else if (*vr0type == VR_RANGE
8204 	       && vr1type == VR_ANTI_RANGE)
8205 	/* The result covers everything.  */
8206 	goto give_up;
8207       else
8208 	gcc_unreachable ();
8209     }
8210   else if ((maxeq || operand_less_p (*vr0max, vr1max) == 1)
8211 	   && (mineq || operand_less_p (vr1min, *vr0min) == 1))
8212     {
8213       /* ( [  ] ) or ([  ] ) or ( [  ]) */
8214       if (*vr0type == VR_RANGE
8215 	  && vr1type == VR_RANGE)
8216 	{
8217 	  *vr0type = vr1type;
8218 	  *vr0min = vr1min;
8219 	  *vr0max = vr1max;
8220 	}
8221       else if (*vr0type == VR_ANTI_RANGE
8222 	       && vr1type == VR_ANTI_RANGE)
8223 	;
8224       else if (*vr0type == VR_RANGE
8225 	       && vr1type == VR_ANTI_RANGE)
8226 	{
8227 	  *vr0type = VR_ANTI_RANGE;
8228 	  if (!mineq && TREE_CODE (*vr0min) == INTEGER_CST)
8229 	    {
8230 	      *vr0max = int_const_binop (MINUS_EXPR, *vr0min,
8231 					 build_int_cst (TREE_TYPE (*vr0min), 1));
8232 	      *vr0min = vr1min;
8233 	    }
8234 	  else if (!maxeq && TREE_CODE (*vr0max) == INTEGER_CST)
8235 	    {
8236 	      *vr0min = int_const_binop (PLUS_EXPR, *vr0max,
8237 					 build_int_cst (TREE_TYPE (*vr0max), 1));
8238 	      *vr0max = vr1max;
8239 	    }
8240 	  else
8241 	    goto give_up;
8242 	}
8243       else if (*vr0type == VR_ANTI_RANGE
8244 	       && vr1type == VR_RANGE)
8245 	/* The result covers everything.  */
8246 	goto give_up;
8247       else
8248 	gcc_unreachable ();
8249     }
8250   else if ((operand_less_p (vr1min, *vr0max) == 1
8251 	    || operand_equal_p (vr1min, *vr0max, 0))
8252 	   && operand_less_p (*vr0min, vr1min) == 1
8253 	   && operand_less_p (*vr0max, vr1max) == 1)
8254     {
8255       /* [  (  ]  ) or [   ](   ) */
8256       if (*vr0type == VR_RANGE
8257 	  && vr1type == VR_RANGE)
8258 	*vr0max = vr1max;
8259       else if (*vr0type == VR_ANTI_RANGE
8260 	       && vr1type == VR_ANTI_RANGE)
8261 	*vr0min = vr1min;
8262       else if (*vr0type == VR_ANTI_RANGE
8263 	       && vr1type == VR_RANGE)
8264 	{
8265 	  if (TREE_CODE (vr1min) == INTEGER_CST)
8266 	    *vr0max = int_const_binop (MINUS_EXPR, vr1min,
8267 				       build_int_cst (TREE_TYPE (vr1min), 1));
8268 	  else
8269 	    goto give_up;
8270 	}
8271       else if (*vr0type == VR_RANGE
8272 	       && vr1type == VR_ANTI_RANGE)
8273 	{
8274 	  if (TREE_CODE (*vr0max) == INTEGER_CST)
8275 	    {
8276 	      *vr0type = vr1type;
8277 	      *vr0min = int_const_binop (PLUS_EXPR, *vr0max,
8278 					 build_int_cst (TREE_TYPE (*vr0max), 1));
8279 	      *vr0max = vr1max;
8280 	    }
8281 	  else
8282 	    goto give_up;
8283 	}
8284       else
8285 	gcc_unreachable ();
8286     }
8287   else if ((operand_less_p (*vr0min, vr1max) == 1
8288 	    || operand_equal_p (*vr0min, vr1max, 0))
8289 	   && operand_less_p (vr1min, *vr0min) == 1
8290 	   && operand_less_p (vr1max, *vr0max) == 1)
8291     {
8292       /* (  [  )  ] or (   )[   ] */
8293       if (*vr0type == VR_RANGE
8294 	  && vr1type == VR_RANGE)
8295 	*vr0min = vr1min;
8296       else if (*vr0type == VR_ANTI_RANGE
8297 	       && vr1type == VR_ANTI_RANGE)
8298 	*vr0max = vr1max;
8299       else if (*vr0type == VR_ANTI_RANGE
8300 	       && vr1type == VR_RANGE)
8301 	{
8302 	  if (TREE_CODE (vr1max) == INTEGER_CST)
8303 	    *vr0min = int_const_binop (PLUS_EXPR, vr1max,
8304 				       build_int_cst (TREE_TYPE (vr1max), 1));
8305 	  else
8306 	    goto give_up;
8307 	}
8308       else if (*vr0type == VR_RANGE
8309 	       && vr1type == VR_ANTI_RANGE)
8310 	{
8311 	  if (TREE_CODE (*vr0min) == INTEGER_CST)
8312 	    {
8313 	      *vr0type = vr1type;
8314 	      *vr0min = vr1min;
8315 	      *vr0max = int_const_binop (MINUS_EXPR, *vr0min,
8316 					 build_int_cst (TREE_TYPE (*vr0min), 1));
8317 	    }
8318 	  else
8319 	    goto give_up;
8320 	}
8321       else
8322 	gcc_unreachable ();
8323     }
8324   else
8325     goto give_up;
8326 
8327   return;
8328 
8329 give_up:
8330   *vr0type = VR_VARYING;
8331   *vr0min = NULL_TREE;
8332   *vr0max = NULL_TREE;
8333 }
8334 
8335 /* Intersect the two value-ranges { *VR0TYPE, *VR0MIN, *VR0MAX } and
8336    { VR1TYPE, VR0MIN, VR0MAX } and store the result
8337    in { *VR0TYPE, *VR0MIN, *VR0MAX }.  This may not be the smallest
8338    possible such range.  The resulting range is not canonicalized.  */
8339 
8340 static void
8341 intersect_ranges (enum value_range_type *vr0type,
8342 		  tree *vr0min, tree *vr0max,
8343 		  enum value_range_type vr1type,
8344 		  tree vr1min, tree vr1max)
8345 {
8346   bool mineq = operand_equal_p (*vr0min, vr1min, 0);
8347   bool maxeq = operand_equal_p (*vr0max, vr1max, 0);
8348 
8349   /* [] is vr0, () is vr1 in the following classification comments.  */
8350   if (mineq && maxeq)
8351     {
8352       /* [(  )] */
8353       if (*vr0type == vr1type)
8354 	/* Nothing to do for equal ranges.  */
8355 	;
8356       else if ((*vr0type == VR_RANGE
8357 		&& vr1type == VR_ANTI_RANGE)
8358 	       || (*vr0type == VR_ANTI_RANGE
8359 		   && vr1type == VR_RANGE))
8360 	{
8361 	  /* For anti-range with range intersection the result is empty.  */
8362 	  *vr0type = VR_UNDEFINED;
8363 	  *vr0min = NULL_TREE;
8364 	  *vr0max = NULL_TREE;
8365 	}
8366       else
8367 	gcc_unreachable ();
8368     }
8369   else if (operand_less_p (*vr0max, vr1min) == 1
8370 	   || operand_less_p (vr1max, *vr0min) == 1)
8371     {
8372       /* [ ] ( ) or ( ) [ ]
8373 	 If the ranges have an empty intersection, the result of the
8374 	 intersect operation is the range for intersecting an
8375 	 anti-range with a range or empty when intersecting two ranges.  */
8376       if (*vr0type == VR_RANGE
8377 	  && vr1type == VR_ANTI_RANGE)
8378 	;
8379       else if (*vr0type == VR_ANTI_RANGE
8380 	       && vr1type == VR_RANGE)
8381 	{
8382 	  *vr0type = vr1type;
8383 	  *vr0min = vr1min;
8384 	  *vr0max = vr1max;
8385 	}
8386       else if (*vr0type == VR_RANGE
8387 	       && vr1type == VR_RANGE)
8388 	{
8389 	  *vr0type = VR_UNDEFINED;
8390 	  *vr0min = NULL_TREE;
8391 	  *vr0max = NULL_TREE;
8392 	}
8393       else if (*vr0type == VR_ANTI_RANGE
8394 	       && vr1type == VR_ANTI_RANGE)
8395 	{
8396 	  /* If the anti-ranges are adjacent to each other merge them.  */
8397 	  if (TREE_CODE (*vr0max) == INTEGER_CST
8398 	      && TREE_CODE (vr1min) == INTEGER_CST
8399 	      && operand_less_p (*vr0max, vr1min) == 1
8400 	      && integer_onep (int_const_binop (MINUS_EXPR,
8401 						vr1min, *vr0max)))
8402 	    *vr0max = vr1max;
8403 	  else if (TREE_CODE (vr1max) == INTEGER_CST
8404 		   && TREE_CODE (*vr0min) == INTEGER_CST
8405 		   && operand_less_p (vr1max, *vr0min) == 1
8406 		   && integer_onep (int_const_binop (MINUS_EXPR,
8407 						     *vr0min, vr1max)))
8408 	    *vr0min = vr1min;
8409 	  /* Else arbitrarily take VR0.  */
8410 	}
8411     }
8412   else if ((maxeq || operand_less_p (vr1max, *vr0max) == 1)
8413 	   && (mineq || operand_less_p (*vr0min, vr1min) == 1))
8414     {
8415       /* [ (  ) ] or [(  ) ] or [ (  )] */
8416       if (*vr0type == VR_RANGE
8417 	  && vr1type == VR_RANGE)
8418 	{
8419 	  /* If both are ranges the result is the inner one.  */
8420 	  *vr0type = vr1type;
8421 	  *vr0min = vr1min;
8422 	  *vr0max = vr1max;
8423 	}
8424       else if (*vr0type == VR_RANGE
8425 	       && vr1type == VR_ANTI_RANGE)
8426 	{
8427 	  /* Choose the right gap if the left one is empty.  */
8428 	  if (mineq)
8429 	    {
8430 	      if (TREE_CODE (vr1max) == INTEGER_CST)
8431 		*vr0min = int_const_binop (PLUS_EXPR, vr1max,
8432 					   build_int_cst (TREE_TYPE (vr1max), 1));
8433 	      else
8434 		*vr0min = vr1max;
8435 	    }
8436 	  /* Choose the left gap if the right one is empty.  */
8437 	  else if (maxeq)
8438 	    {
8439 	      if (TREE_CODE (vr1min) == INTEGER_CST)
8440 		*vr0max = int_const_binop (MINUS_EXPR, vr1min,
8441 					   build_int_cst (TREE_TYPE (vr1min), 1));
8442 	      else
8443 		*vr0max = vr1min;
8444 	    }
8445 	  /* Choose the anti-range if the range is effectively varying.  */
8446 	  else if (vrp_val_is_min (*vr0min)
8447 		   && vrp_val_is_max (*vr0max))
8448 	    {
8449 	      *vr0type = vr1type;
8450 	      *vr0min = vr1min;
8451 	      *vr0max = vr1max;
8452 	    }
8453 	  /* Else choose the range.  */
8454 	}
8455       else if (*vr0type == VR_ANTI_RANGE
8456 	       && vr1type == VR_ANTI_RANGE)
8457 	/* If both are anti-ranges the result is the outer one.  */
8458 	;
8459       else if (*vr0type == VR_ANTI_RANGE
8460 	       && vr1type == VR_RANGE)
8461 	{
8462 	  /* The intersection is empty.  */
8463 	  *vr0type = VR_UNDEFINED;
8464 	  *vr0min = NULL_TREE;
8465 	  *vr0max = NULL_TREE;
8466 	}
8467       else
8468 	gcc_unreachable ();
8469     }
8470   else if ((maxeq || operand_less_p (*vr0max, vr1max) == 1)
8471 	   && (mineq || operand_less_p (vr1min, *vr0min) == 1))
8472     {
8473       /* ( [  ] ) or ([  ] ) or ( [  ]) */
8474       if (*vr0type == VR_RANGE
8475 	  && vr1type == VR_RANGE)
8476 	/* Choose the inner range.  */
8477 	;
8478       else if (*vr0type == VR_ANTI_RANGE
8479 	       && vr1type == VR_RANGE)
8480 	{
8481 	  /* Choose the right gap if the left is empty.  */
8482 	  if (mineq)
8483 	    {
8484 	      *vr0type = VR_RANGE;
8485 	      if (TREE_CODE (*vr0max) == INTEGER_CST)
8486 		*vr0min = int_const_binop (PLUS_EXPR, *vr0max,
8487 					   build_int_cst (TREE_TYPE (*vr0max), 1));
8488 	      else
8489 		*vr0min = *vr0max;
8490 	      *vr0max = vr1max;
8491 	    }
8492 	  /* Choose the left gap if the right is empty.  */
8493 	  else if (maxeq)
8494 	    {
8495 	      *vr0type = VR_RANGE;
8496 	      if (TREE_CODE (*vr0min) == INTEGER_CST)
8497 		*vr0max = int_const_binop (MINUS_EXPR, *vr0min,
8498 					   build_int_cst (TREE_TYPE (*vr0min), 1));
8499 	      else
8500 		*vr0max = *vr0min;
8501 	      *vr0min = vr1min;
8502 	    }
8503 	  /* Choose the anti-range if the range is effectively varying.  */
8504 	  else if (vrp_val_is_min (vr1min)
8505 		   && vrp_val_is_max (vr1max))
8506 	    ;
8507 	  /* Else choose the range.  */
8508 	  else
8509 	    {
8510 	      *vr0type = vr1type;
8511 	      *vr0min = vr1min;
8512 	      *vr0max = vr1max;
8513 	    }
8514 	}
8515       else if (*vr0type == VR_ANTI_RANGE
8516 	       && vr1type == VR_ANTI_RANGE)
8517 	{
8518 	  /* If both are anti-ranges the result is the outer one.  */
8519 	  *vr0type = vr1type;
8520 	  *vr0min = vr1min;
8521 	  *vr0max = vr1max;
8522 	}
8523       else if (vr1type == VR_ANTI_RANGE
8524 	       && *vr0type == VR_RANGE)
8525 	{
8526 	  /* The intersection is empty.  */
8527 	  *vr0type = VR_UNDEFINED;
8528 	  *vr0min = NULL_TREE;
8529 	  *vr0max = NULL_TREE;
8530 	}
8531       else
8532 	gcc_unreachable ();
8533     }
8534   else if ((operand_less_p (vr1min, *vr0max) == 1
8535 	    || operand_equal_p (vr1min, *vr0max, 0))
8536 	   && operand_less_p (*vr0min, vr1min) == 1)
8537     {
8538       /* [  (  ]  ) or [  ](  ) */
8539       if (*vr0type == VR_ANTI_RANGE
8540 	  && vr1type == VR_ANTI_RANGE)
8541 	*vr0max = vr1max;
8542       else if (*vr0type == VR_RANGE
8543 	       && vr1type == VR_RANGE)
8544 	*vr0min = vr1min;
8545       else if (*vr0type == VR_RANGE
8546 	       && vr1type == VR_ANTI_RANGE)
8547 	{
8548 	  if (TREE_CODE (vr1min) == INTEGER_CST)
8549 	    *vr0max = int_const_binop (MINUS_EXPR, vr1min,
8550 				       build_int_cst (TREE_TYPE (vr1min), 1));
8551 	  else
8552 	    *vr0max = vr1min;
8553 	}
8554       else if (*vr0type == VR_ANTI_RANGE
8555 	       && vr1type == VR_RANGE)
8556 	{
8557 	  *vr0type = VR_RANGE;
8558 	  if (TREE_CODE (*vr0max) == INTEGER_CST)
8559 	    *vr0min = int_const_binop (PLUS_EXPR, *vr0max,
8560 				       build_int_cst (TREE_TYPE (*vr0max), 1));
8561 	  else
8562 	    *vr0min = *vr0max;
8563 	  *vr0max = vr1max;
8564 	}
8565       else
8566 	gcc_unreachable ();
8567     }
8568   else if ((operand_less_p (*vr0min, vr1max) == 1
8569 	    || operand_equal_p (*vr0min, vr1max, 0))
8570 	   && operand_less_p (vr1min, *vr0min) == 1)
8571     {
8572       /* (  [  )  ] or (  )[  ] */
8573       if (*vr0type == VR_ANTI_RANGE
8574 	  && vr1type == VR_ANTI_RANGE)
8575 	*vr0min = vr1min;
8576       else if (*vr0type == VR_RANGE
8577 	       && vr1type == VR_RANGE)
8578 	*vr0max = vr1max;
8579       else if (*vr0type == VR_RANGE
8580 	       && vr1type == VR_ANTI_RANGE)
8581 	{
8582 	  if (TREE_CODE (vr1max) == INTEGER_CST)
8583 	    *vr0min = int_const_binop (PLUS_EXPR, vr1max,
8584 				       build_int_cst (TREE_TYPE (vr1max), 1));
8585 	  else
8586 	    *vr0min = vr1max;
8587 	}
8588       else if (*vr0type == VR_ANTI_RANGE
8589 	       && vr1type == VR_RANGE)
8590 	{
8591 	  *vr0type = VR_RANGE;
8592 	  if (TREE_CODE (*vr0min) == INTEGER_CST)
8593 	    *vr0max = int_const_binop (MINUS_EXPR, *vr0min,
8594 				       build_int_cst (TREE_TYPE (*vr0min), 1));
8595 	  else
8596 	    *vr0max = *vr0min;
8597 	  *vr0min = vr1min;
8598 	}
8599       else
8600 	gcc_unreachable ();
8601     }
8602 
8603   /* As a fallback simply use { *VRTYPE, *VR0MIN, *VR0MAX } as
8604      result for the intersection.  That's always a conservative
8605      correct estimate.  */
8606 
8607   return;
8608 }
8609 
8610 
8611 /* Intersect the two value-ranges *VR0 and *VR1 and store the result
8612    in *VR0.  This may not be the smallest possible such range.  */
8613 
8614 static void
8615 vrp_intersect_ranges_1 (value_range_t *vr0, value_range_t *vr1)
8616 {
8617   value_range_t saved;
8618 
8619   /* If either range is VR_VARYING the other one wins.  */
8620   if (vr1->type == VR_VARYING)
8621     return;
8622   if (vr0->type == VR_VARYING)
8623     {
8624       copy_value_range (vr0, vr1);
8625       return;
8626     }
8627 
8628   /* When either range is VR_UNDEFINED the resulting range is
8629      VR_UNDEFINED, too.  */
8630   if (vr0->type == VR_UNDEFINED)
8631     return;
8632   if (vr1->type == VR_UNDEFINED)
8633     {
8634       set_value_range_to_undefined (vr0);
8635       return;
8636     }
8637 
8638   /* Save the original vr0 so we can return it as conservative intersection
8639      result when our worker turns things to varying.  */
8640   saved = *vr0;
8641   intersect_ranges (&vr0->type, &vr0->min, &vr0->max,
8642 		    vr1->type, vr1->min, vr1->max);
8643   /* Make sure to canonicalize the result though as the inversion of a
8644      VR_RANGE can still be a VR_RANGE.  */
8645   set_and_canonicalize_value_range (vr0, vr0->type,
8646 				    vr0->min, vr0->max, vr0->equiv);
8647   /* If that failed, use the saved original VR0.  */
8648   if (vr0->type == VR_VARYING)
8649     {
8650       *vr0 = saved;
8651       return;
8652     }
8653   /* If the result is VR_UNDEFINED there is no need to mess with
8654      the equivalencies.  */
8655   if (vr0->type == VR_UNDEFINED)
8656     return;
8657 
8658   /* The resulting set of equivalences for range intersection is the union of
8659      the two sets.  */
8660   if (vr0->equiv && vr1->equiv && vr0->equiv != vr1->equiv)
8661     bitmap_ior_into (vr0->equiv, vr1->equiv);
8662   else if (vr1->equiv && !vr0->equiv)
8663     {
8664       vr0->equiv = BITMAP_ALLOC (NULL);
8665       bitmap_copy (vr0->equiv, vr1->equiv);
8666     }
8667 }
8668 
8669 static void
8670 vrp_intersect_ranges (value_range_t *vr0, value_range_t *vr1)
8671 {
8672   if (dump_file && (dump_flags & TDF_DETAILS))
8673     {
8674       fprintf (dump_file, "Intersecting\n  ");
8675       dump_value_range (dump_file, vr0);
8676       fprintf (dump_file, "\nand\n  ");
8677       dump_value_range (dump_file, vr1);
8678       fprintf (dump_file, "\n");
8679     }
8680   vrp_intersect_ranges_1 (vr0, vr1);
8681   if (dump_file && (dump_flags & TDF_DETAILS))
8682     {
8683       fprintf (dump_file, "to\n  ");
8684       dump_value_range (dump_file, vr0);
8685       fprintf (dump_file, "\n");
8686     }
8687 }
8688 
8689 /* Meet operation for value ranges.  Given two value ranges VR0 and
8690    VR1, store in VR0 a range that contains both VR0 and VR1.  This
8691    may not be the smallest possible such range.  */
8692 
8693 static void
8694 vrp_meet_1 (value_range_t *vr0, value_range_t *vr1)
8695 {
8696   value_range_t saved;
8697 
8698   if (vr0->type == VR_UNDEFINED)
8699     {
8700       set_value_range (vr0, vr1->type, vr1->min, vr1->max, vr1->equiv);
8701       return;
8702     }
8703 
8704   if (vr1->type == VR_UNDEFINED)
8705     {
8706       /* VR0 already has the resulting range.  */
8707       return;
8708     }
8709 
8710   if (vr0->type == VR_VARYING)
8711     {
8712       /* Nothing to do.  VR0 already has the resulting range.  */
8713       return;
8714     }
8715 
8716   if (vr1->type == VR_VARYING)
8717     {
8718       set_value_range_to_varying (vr0);
8719       return;
8720     }
8721 
8722   saved = *vr0;
8723   union_ranges (&vr0->type, &vr0->min, &vr0->max,
8724 		vr1->type, vr1->min, vr1->max);
8725   if (vr0->type == VR_VARYING)
8726     {
8727       /* Failed to find an efficient meet.  Before giving up and setting
8728 	 the result to VARYING, see if we can at least derive a useful
8729 	 anti-range.  FIXME, all this nonsense about distinguishing
8730 	 anti-ranges from ranges is necessary because of the odd
8731 	 semantics of range_includes_zero_p and friends.  */
8732       if (((saved.type == VR_RANGE
8733 	    && range_includes_zero_p (saved.min, saved.max) == 0)
8734 	   || (saved.type == VR_ANTI_RANGE
8735 	       && range_includes_zero_p (saved.min, saved.max) == 1))
8736 	  && ((vr1->type == VR_RANGE
8737 	       && range_includes_zero_p (vr1->min, vr1->max) == 0)
8738 	      || (vr1->type == VR_ANTI_RANGE
8739 		  && range_includes_zero_p (vr1->min, vr1->max) == 1)))
8740 	{
8741 	  set_value_range_to_nonnull (vr0, TREE_TYPE (saved.min));
8742 
8743 	  /* Since this meet operation did not result from the meeting of
8744 	     two equivalent names, VR0 cannot have any equivalences.  */
8745 	  if (vr0->equiv)
8746 	    bitmap_clear (vr0->equiv);
8747 	  return;
8748 	}
8749 
8750       set_value_range_to_varying (vr0);
8751       return;
8752     }
8753   set_and_canonicalize_value_range (vr0, vr0->type, vr0->min, vr0->max,
8754 				    vr0->equiv);
8755   if (vr0->type == VR_VARYING)
8756     return;
8757 
8758   /* The resulting set of equivalences is always the intersection of
8759      the two sets.  */
8760   if (vr0->equiv && vr1->equiv && vr0->equiv != vr1->equiv)
8761     bitmap_and_into (vr0->equiv, vr1->equiv);
8762   else if (vr0->equiv && !vr1->equiv)
8763     bitmap_clear (vr0->equiv);
8764 }
8765 
8766 static void
8767 vrp_meet (value_range_t *vr0, value_range_t *vr1)
8768 {
8769   if (dump_file && (dump_flags & TDF_DETAILS))
8770     {
8771       fprintf (dump_file, "Meeting\n  ");
8772       dump_value_range (dump_file, vr0);
8773       fprintf (dump_file, "\nand\n  ");
8774       dump_value_range (dump_file, vr1);
8775       fprintf (dump_file, "\n");
8776     }
8777   vrp_meet_1 (vr0, vr1);
8778   if (dump_file && (dump_flags & TDF_DETAILS))
8779     {
8780       fprintf (dump_file, "to\n  ");
8781       dump_value_range (dump_file, vr0);
8782       fprintf (dump_file, "\n");
8783     }
8784 }
8785 
8786 
8787 /* Visit all arguments for PHI node PHI that flow through executable
8788    edges.  If a valid value range can be derived from all the incoming
8789    value ranges, set a new range for the LHS of PHI.  */
8790 
8791 static enum ssa_prop_result
8792 vrp_visit_phi_node (gphi *phi)
8793 {
8794   size_t i;
8795   tree lhs = PHI_RESULT (phi);
8796   value_range_t *lhs_vr = get_value_range (lhs);
8797   value_range_t vr_result = VR_INITIALIZER;
8798   bool first = true;
8799   int edges, old_edges;
8800   struct loop *l;
8801 
8802   if (dump_file && (dump_flags & TDF_DETAILS))
8803     {
8804       fprintf (dump_file, "\nVisiting PHI node: ");
8805       print_gimple_stmt (dump_file, phi, 0, dump_flags);
8806     }
8807 
8808   edges = 0;
8809   for (i = 0; i < gimple_phi_num_args (phi); i++)
8810     {
8811       edge e = gimple_phi_arg_edge (phi, i);
8812 
8813       if (dump_file && (dump_flags & TDF_DETAILS))
8814 	{
8815 	  fprintf (dump_file,
8816 	      "    Argument #%d (%d -> %d %sexecutable)\n",
8817 	      (int) i, e->src->index, e->dest->index,
8818 	      (e->flags & EDGE_EXECUTABLE) ? "" : "not ");
8819 	}
8820 
8821       if (e->flags & EDGE_EXECUTABLE)
8822 	{
8823 	  tree arg = PHI_ARG_DEF (phi, i);
8824 	  value_range_t vr_arg;
8825 
8826 	  ++edges;
8827 
8828 	  if (TREE_CODE (arg) == SSA_NAME)
8829 	    {
8830 	      vr_arg = *(get_value_range (arg));
8831 	      /* Do not allow equivalences or symbolic ranges to leak in from
8832 		 backedges.  That creates invalid equivalencies.
8833 		 See PR53465 and PR54767.  */
8834 	      if (e->flags & EDGE_DFS_BACK)
8835 		{
8836 		  if (vr_arg.type == VR_RANGE
8837 		      || vr_arg.type == VR_ANTI_RANGE)
8838 		    {
8839 		      vr_arg.equiv = NULL;
8840 		      if (symbolic_range_p (&vr_arg))
8841 			{
8842 			  vr_arg.type = VR_VARYING;
8843 			  vr_arg.min = NULL_TREE;
8844 			  vr_arg.max = NULL_TREE;
8845 			}
8846 		    }
8847 		}
8848 	      else
8849 		{
8850 		  /* If the non-backedge arguments range is VR_VARYING then
8851 		     we can still try recording a simple equivalence.  */
8852 		  if (vr_arg.type == VR_VARYING)
8853 		    {
8854 		      vr_arg.type = VR_RANGE;
8855 		      vr_arg.min = arg;
8856 		      vr_arg.max = arg;
8857 		      vr_arg.equiv = NULL;
8858 		    }
8859 		}
8860 	    }
8861 	  else
8862 	    {
8863 	      if (TREE_OVERFLOW_P (arg))
8864 		arg = drop_tree_overflow (arg);
8865 
8866 	      vr_arg.type = VR_RANGE;
8867 	      vr_arg.min = arg;
8868 	      vr_arg.max = arg;
8869 	      vr_arg.equiv = NULL;
8870 	    }
8871 
8872 	  if (dump_file && (dump_flags & TDF_DETAILS))
8873 	    {
8874 	      fprintf (dump_file, "\t");
8875 	      print_generic_expr (dump_file, arg, dump_flags);
8876 	      fprintf (dump_file, ": ");
8877 	      dump_value_range (dump_file, &vr_arg);
8878 	      fprintf (dump_file, "\n");
8879 	    }
8880 
8881 	  if (first)
8882 	    copy_value_range (&vr_result, &vr_arg);
8883 	  else
8884 	    vrp_meet (&vr_result, &vr_arg);
8885 	  first = false;
8886 
8887 	  if (vr_result.type == VR_VARYING)
8888 	    break;
8889 	}
8890     }
8891 
8892   if (vr_result.type == VR_VARYING)
8893     goto varying;
8894   else if (vr_result.type == VR_UNDEFINED)
8895     goto update_range;
8896 
8897   old_edges = vr_phi_edge_counts[SSA_NAME_VERSION (lhs)];
8898   vr_phi_edge_counts[SSA_NAME_VERSION (lhs)] = edges;
8899 
8900   /* To prevent infinite iterations in the algorithm, derive ranges
8901      when the new value is slightly bigger or smaller than the
8902      previous one.  We don't do this if we have seen a new executable
8903      edge; this helps us avoid an overflow infinity for conditionals
8904      which are not in a loop.  If the old value-range was VR_UNDEFINED
8905      use the updated range and iterate one more time.  */
8906   if (edges > 0
8907       && gimple_phi_num_args (phi) > 1
8908       && edges == old_edges
8909       && lhs_vr->type != VR_UNDEFINED)
8910     {
8911       /* Compare old and new ranges, fall back to varying if the
8912          values are not comparable.  */
8913       int cmp_min = compare_values (lhs_vr->min, vr_result.min);
8914       if (cmp_min == -2)
8915 	goto varying;
8916       int cmp_max = compare_values (lhs_vr->max, vr_result.max);
8917       if (cmp_max == -2)
8918 	goto varying;
8919 
8920       /* For non VR_RANGE or for pointers fall back to varying if
8921 	 the range changed.  */
8922       if ((lhs_vr->type != VR_RANGE || vr_result.type != VR_RANGE
8923 	   || POINTER_TYPE_P (TREE_TYPE (lhs)))
8924 	  && (cmp_min != 0 || cmp_max != 0))
8925 	goto varying;
8926 
8927       /* If the new minimum is larger than than the previous one
8928 	 retain the old value.  If the new minimum value is smaller
8929 	 than the previous one and not -INF go all the way to -INF + 1.
8930 	 In the first case, to avoid infinite bouncing between different
8931 	 minimums, and in the other case to avoid iterating millions of
8932 	 times to reach -INF.  Going to -INF + 1 also lets the following
8933 	 iteration compute whether there will be any overflow, at the
8934 	 expense of one additional iteration.  */
8935       if (cmp_min < 0)
8936 	vr_result.min = lhs_vr->min;
8937       else if (cmp_min > 0
8938 	       && !vrp_val_is_min (vr_result.min))
8939 	vr_result.min
8940 	  = int_const_binop (PLUS_EXPR,
8941 			     vrp_val_min (TREE_TYPE (vr_result.min)),
8942 			     build_int_cst (TREE_TYPE (vr_result.min), 1));
8943 
8944       /* Similarly for the maximum value.  */
8945       if (cmp_max > 0)
8946 	vr_result.max = lhs_vr->max;
8947       else if (cmp_max < 0
8948 	       && !vrp_val_is_max (vr_result.max))
8949 	vr_result.max
8950 	  = int_const_binop (MINUS_EXPR,
8951 			     vrp_val_max (TREE_TYPE (vr_result.min)),
8952 			     build_int_cst (TREE_TYPE (vr_result.min), 1));
8953 
8954       /* If we dropped either bound to +-INF then if this is a loop
8955 	 PHI node SCEV may known more about its value-range.  */
8956       if ((cmp_min > 0 || cmp_min < 0
8957 	   || cmp_max < 0 || cmp_max > 0)
8958 	  && (l = loop_containing_stmt (phi))
8959 	  && l->header == gimple_bb (phi))
8960 	adjust_range_with_scev (&vr_result, l, phi, lhs);
8961 
8962       /* If we will end up with a (-INF, +INF) range, set it to
8963 	 VARYING.  Same if the previous max value was invalid for
8964 	 the type and we end up with vr_result.min > vr_result.max.  */
8965       if ((vrp_val_is_max (vr_result.max)
8966 	   && vrp_val_is_min (vr_result.min))
8967 	  || compare_values (vr_result.min,
8968 			     vr_result.max) > 0)
8969 	goto varying;
8970     }
8971 
8972   /* If the new range is different than the previous value, keep
8973      iterating.  */
8974 update_range:
8975   if (update_value_range (lhs, &vr_result))
8976     {
8977       if (dump_file && (dump_flags & TDF_DETAILS))
8978 	{
8979 	  fprintf (dump_file, "Found new range for ");
8980 	  print_generic_expr (dump_file, lhs, 0);
8981 	  fprintf (dump_file, ": ");
8982 	  dump_value_range (dump_file, &vr_result);
8983 	  fprintf (dump_file, "\n");
8984 	}
8985 
8986       if (vr_result.type == VR_VARYING)
8987 	return SSA_PROP_VARYING;
8988 
8989       return SSA_PROP_INTERESTING;
8990     }
8991 
8992   /* Nothing changed, don't add outgoing edges.  */
8993   return SSA_PROP_NOT_INTERESTING;
8994 
8995   /* No match found.  Set the LHS to VARYING.  */
8996 varying:
8997   set_value_range_to_varying (lhs_vr);
8998   return SSA_PROP_VARYING;
8999 }
9000 
9001 /* Simplify boolean operations if the source is known
9002    to be already a boolean.  */
9003 static bool
9004 simplify_truth_ops_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
9005 {
9006   enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
9007   tree lhs, op0, op1;
9008   bool need_conversion;
9009 
9010   /* We handle only !=/== case here.  */
9011   gcc_assert (rhs_code == EQ_EXPR || rhs_code == NE_EXPR);
9012 
9013   op0 = gimple_assign_rhs1 (stmt);
9014   if (!op_with_boolean_value_range_p (op0))
9015     return false;
9016 
9017   op1 = gimple_assign_rhs2 (stmt);
9018   if (!op_with_boolean_value_range_p (op1))
9019     return false;
9020 
9021   /* Reduce number of cases to handle to NE_EXPR.  As there is no
9022      BIT_XNOR_EXPR we cannot replace A == B with a single statement.  */
9023   if (rhs_code == EQ_EXPR)
9024     {
9025       if (TREE_CODE (op1) == INTEGER_CST)
9026 	op1 = int_const_binop (BIT_XOR_EXPR, op1,
9027 			       build_int_cst (TREE_TYPE (op1), 1));
9028       else
9029 	return false;
9030     }
9031 
9032   lhs = gimple_assign_lhs (stmt);
9033   need_conversion
9034     = !useless_type_conversion_p (TREE_TYPE (lhs), TREE_TYPE (op0));
9035 
9036   /* Make sure to not sign-extend a 1-bit 1 when converting the result.  */
9037   if (need_conversion
9038       && !TYPE_UNSIGNED (TREE_TYPE (op0))
9039       && TYPE_PRECISION (TREE_TYPE (op0)) == 1
9040       && TYPE_PRECISION (TREE_TYPE (lhs)) > 1)
9041     return false;
9042 
9043   /* For A != 0 we can substitute A itself.  */
9044   if (integer_zerop (op1))
9045     gimple_assign_set_rhs_with_ops (gsi,
9046 				    need_conversion
9047 				    ? NOP_EXPR : TREE_CODE (op0), op0);
9048   /* For A != B we substitute A ^ B.  Either with conversion.  */
9049   else if (need_conversion)
9050     {
9051       tree tem = make_ssa_name (TREE_TYPE (op0));
9052       gassign *newop
9053 	= gimple_build_assign (tem, BIT_XOR_EXPR, op0, op1);
9054       gsi_insert_before (gsi, newop, GSI_SAME_STMT);
9055       gimple_assign_set_rhs_with_ops (gsi, NOP_EXPR, tem);
9056     }
9057   /* Or without.  */
9058   else
9059     gimple_assign_set_rhs_with_ops (gsi, BIT_XOR_EXPR, op0, op1);
9060   update_stmt (gsi_stmt (*gsi));
9061 
9062   return true;
9063 }
9064 
9065 /* Simplify a division or modulo operator to a right shift or
9066    bitwise and if the first operand is unsigned or is greater
9067    than zero and the second operand is an exact power of two.
9068    For TRUNC_MOD_EXPR op0 % op1 with constant op1, optimize it
9069    into just op0 if op0's range is known to be a subset of
9070    [-op1 + 1, op1 - 1] for signed and [0, op1 - 1] for unsigned
9071    modulo.  */
9072 
9073 static bool
9074 simplify_div_or_mod_using_ranges (gimple stmt)
9075 {
9076   enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
9077   tree val = NULL;
9078   tree op0 = gimple_assign_rhs1 (stmt);
9079   tree op1 = gimple_assign_rhs2 (stmt);
9080   value_range_t *vr = get_value_range (op0);
9081 
9082   if (rhs_code == TRUNC_MOD_EXPR
9083       && TREE_CODE (op1) == INTEGER_CST
9084       && tree_int_cst_sgn (op1) == 1
9085       && range_int_cst_p (vr)
9086       && tree_int_cst_lt (vr->max, op1))
9087     {
9088       if (TYPE_UNSIGNED (TREE_TYPE (op0))
9089 	  || tree_int_cst_sgn (vr->min) >= 0
9090 	  || tree_int_cst_lt (fold_unary (NEGATE_EXPR, TREE_TYPE (op1), op1),
9091 			      vr->min))
9092 	{
9093 	  /* If op0 already has the range op0 % op1 has,
9094 	     then TRUNC_MOD_EXPR won't change anything.  */
9095 	  gimple_stmt_iterator gsi = gsi_for_stmt (stmt);
9096 	  gimple_assign_set_rhs_from_tree (&gsi, op0);
9097 	  update_stmt (stmt);
9098 	  return true;
9099 	}
9100     }
9101 
9102   if (!integer_pow2p (op1))
9103     return false;
9104 
9105   if (TYPE_UNSIGNED (TREE_TYPE (op0)))
9106     {
9107       val = integer_one_node;
9108     }
9109   else
9110     {
9111       bool sop = false;
9112 
9113       val = compare_range_with_value (GE_EXPR, vr, integer_zero_node, &sop);
9114 
9115       if (val
9116 	  && sop
9117 	  && integer_onep (val)
9118 	  && issue_strict_overflow_warning (WARN_STRICT_OVERFLOW_MISC))
9119 	{
9120 	  location_t location;
9121 
9122 	  if (!gimple_has_location (stmt))
9123 	    location = input_location;
9124 	  else
9125 	    location = gimple_location (stmt);
9126 	  warning_at (location, OPT_Wstrict_overflow,
9127 		      "assuming signed overflow does not occur when "
9128 		      "simplifying %</%> or %<%%%> to %<>>%> or %<&%>");
9129 	}
9130     }
9131 
9132   if (val && integer_onep (val))
9133     {
9134       tree t;
9135 
9136       if (rhs_code == TRUNC_DIV_EXPR)
9137 	{
9138 	  t = build_int_cst (integer_type_node, tree_log2 (op1));
9139 	  gimple_assign_set_rhs_code (stmt, RSHIFT_EXPR);
9140 	  gimple_assign_set_rhs1 (stmt, op0);
9141 	  gimple_assign_set_rhs2 (stmt, t);
9142 	}
9143       else
9144 	{
9145 	  t = build_int_cst (TREE_TYPE (op1), 1);
9146 	  t = int_const_binop (MINUS_EXPR, op1, t);
9147 	  t = fold_convert (TREE_TYPE (op0), t);
9148 
9149 	  gimple_assign_set_rhs_code (stmt, BIT_AND_EXPR);
9150 	  gimple_assign_set_rhs1 (stmt, op0);
9151 	  gimple_assign_set_rhs2 (stmt, t);
9152 	}
9153 
9154       update_stmt (stmt);
9155       return true;
9156     }
9157 
9158   return false;
9159 }
9160 
9161 /* If the operand to an ABS_EXPR is >= 0, then eliminate the
9162    ABS_EXPR.  If the operand is <= 0, then simplify the
9163    ABS_EXPR into a NEGATE_EXPR.  */
9164 
9165 static bool
9166 simplify_abs_using_ranges (gimple stmt)
9167 {
9168   tree val = NULL;
9169   tree op = gimple_assign_rhs1 (stmt);
9170   tree type = TREE_TYPE (op);
9171   value_range_t *vr = get_value_range (op);
9172 
9173   if (TYPE_UNSIGNED (type))
9174     {
9175       val = integer_zero_node;
9176     }
9177   else if (vr)
9178     {
9179       bool sop = false;
9180 
9181       val = compare_range_with_value (LE_EXPR, vr, integer_zero_node, &sop);
9182       if (!val)
9183 	{
9184 	  sop = false;
9185 	  val = compare_range_with_value (GE_EXPR, vr, integer_zero_node,
9186 					  &sop);
9187 
9188 	  if (val)
9189 	    {
9190 	      if (integer_zerop (val))
9191 		val = integer_one_node;
9192 	      else if (integer_onep (val))
9193 		val = integer_zero_node;
9194 	    }
9195 	}
9196 
9197       if (val
9198 	  && (integer_onep (val) || integer_zerop (val)))
9199 	{
9200 	  if (sop && issue_strict_overflow_warning (WARN_STRICT_OVERFLOW_MISC))
9201 	    {
9202 	      location_t location;
9203 
9204 	      if (!gimple_has_location (stmt))
9205 		location = input_location;
9206 	      else
9207 		location = gimple_location (stmt);
9208 	      warning_at (location, OPT_Wstrict_overflow,
9209 			  "assuming signed overflow does not occur when "
9210 			  "simplifying %<abs (X)%> to %<X%> or %<-X%>");
9211 	    }
9212 
9213 	  gimple_assign_set_rhs1 (stmt, op);
9214 	  if (integer_onep (val))
9215 	    gimple_assign_set_rhs_code (stmt, NEGATE_EXPR);
9216 	  else
9217 	    gimple_assign_set_rhs_code (stmt, SSA_NAME);
9218 	  update_stmt (stmt);
9219 	  return true;
9220 	}
9221     }
9222 
9223   return false;
9224 }
9225 
9226 /* Optimize away redundant BIT_AND_EXPR and BIT_IOR_EXPR.
9227    If all the bits that are being cleared by & are already
9228    known to be zero from VR, or all the bits that are being
9229    set by | are already known to be one from VR, the bit
9230    operation is redundant.  */
9231 
9232 static bool
9233 simplify_bit_ops_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
9234 {
9235   tree op0 = gimple_assign_rhs1 (stmt);
9236   tree op1 = gimple_assign_rhs2 (stmt);
9237   tree op = NULL_TREE;
9238   value_range_t vr0 = VR_INITIALIZER;
9239   value_range_t vr1 = VR_INITIALIZER;
9240   wide_int may_be_nonzero0, may_be_nonzero1;
9241   wide_int must_be_nonzero0, must_be_nonzero1;
9242   wide_int mask;
9243 
9244   if (TREE_CODE (op0) == SSA_NAME)
9245     vr0 = *(get_value_range (op0));
9246   else if (is_gimple_min_invariant (op0))
9247     set_value_range_to_value (&vr0, op0, NULL);
9248   else
9249     return false;
9250 
9251   if (TREE_CODE (op1) == SSA_NAME)
9252     vr1 = *(get_value_range (op1));
9253   else if (is_gimple_min_invariant (op1))
9254     set_value_range_to_value (&vr1, op1, NULL);
9255   else
9256     return false;
9257 
9258   if (!zero_nonzero_bits_from_vr (TREE_TYPE (op0), &vr0, &may_be_nonzero0,
9259 				  &must_be_nonzero0))
9260     return false;
9261   if (!zero_nonzero_bits_from_vr (TREE_TYPE (op1), &vr1, &may_be_nonzero1,
9262 				  &must_be_nonzero1))
9263     return false;
9264 
9265   switch (gimple_assign_rhs_code (stmt))
9266     {
9267     case BIT_AND_EXPR:
9268       mask = may_be_nonzero0.and_not (must_be_nonzero1);
9269       if (mask == 0)
9270 	{
9271 	  op = op0;
9272 	  break;
9273 	}
9274       mask = may_be_nonzero1.and_not (must_be_nonzero0);
9275       if (mask == 0)
9276 	{
9277 	  op = op1;
9278 	  break;
9279 	}
9280       break;
9281     case BIT_IOR_EXPR:
9282       mask = may_be_nonzero0.and_not (must_be_nonzero1);
9283       if (mask == 0)
9284 	{
9285 	  op = op1;
9286 	  break;
9287 	}
9288       mask = may_be_nonzero1.and_not (must_be_nonzero0);
9289       if (mask == 0)
9290 	{
9291 	  op = op0;
9292 	  break;
9293 	}
9294       break;
9295     default:
9296       gcc_unreachable ();
9297     }
9298 
9299   if (op == NULL_TREE)
9300     return false;
9301 
9302   gimple_assign_set_rhs_with_ops (gsi, TREE_CODE (op), op);
9303   update_stmt (gsi_stmt (*gsi));
9304   return true;
9305 }
9306 
9307 /* We are comparing trees OP0 and OP1 using COND_CODE.  OP0 has
9308    a known value range VR.
9309 
9310    If there is one and only one value which will satisfy the
9311    conditional, then return that value.  Else return NULL.
9312 
9313    If signed overflow must be undefined for the value to satisfy
9314    the conditional, then set *STRICT_OVERFLOW_P to true.  */
9315 
9316 static tree
9317 test_for_singularity (enum tree_code cond_code, tree op0,
9318 		      tree op1, value_range_t *vr,
9319 		      bool *strict_overflow_p)
9320 {
9321   tree min = NULL;
9322   tree max = NULL;
9323 
9324   /* Extract minimum/maximum values which satisfy the
9325      the conditional as it was written.  */
9326   if (cond_code == LE_EXPR || cond_code == LT_EXPR)
9327     {
9328       /* This should not be negative infinity; there is no overflow
9329 	 here.  */
9330       min = TYPE_MIN_VALUE (TREE_TYPE (op0));
9331 
9332       max = op1;
9333       if (cond_code == LT_EXPR && !is_overflow_infinity (max))
9334 	{
9335 	  tree one = build_int_cst (TREE_TYPE (op0), 1);
9336 	  max = fold_build2 (MINUS_EXPR, TREE_TYPE (op0), max, one);
9337 	  if (EXPR_P (max))
9338 	    TREE_NO_WARNING (max) = 1;
9339 	}
9340     }
9341   else if (cond_code == GE_EXPR || cond_code == GT_EXPR)
9342     {
9343       /* This should not be positive infinity; there is no overflow
9344 	 here.  */
9345       max = TYPE_MAX_VALUE (TREE_TYPE (op0));
9346 
9347       min = op1;
9348       if (cond_code == GT_EXPR && !is_overflow_infinity (min))
9349 	{
9350 	  tree one = build_int_cst (TREE_TYPE (op0), 1);
9351 	  min = fold_build2 (PLUS_EXPR, TREE_TYPE (op0), min, one);
9352 	  if (EXPR_P (min))
9353 	    TREE_NO_WARNING (min) = 1;
9354 	}
9355     }
9356 
9357   /* Now refine the minimum and maximum values using any
9358      value range information we have for op0.  */
9359   if (min && max)
9360     {
9361       if (compare_values (vr->min, min) == 1)
9362 	min = vr->min;
9363       if (compare_values (vr->max, max) == -1)
9364 	max = vr->max;
9365 
9366       /* If the new min/max values have converged to a single value,
9367 	 then there is only one value which can satisfy the condition,
9368 	 return that value.  */
9369       if (operand_equal_p (min, max, 0) && is_gimple_min_invariant (min))
9370 	{
9371 	  if ((cond_code == LE_EXPR || cond_code == LT_EXPR)
9372 	      && is_overflow_infinity (vr->max))
9373 	    *strict_overflow_p = true;
9374 	  if ((cond_code == GE_EXPR || cond_code == GT_EXPR)
9375 	      && is_overflow_infinity (vr->min))
9376 	    *strict_overflow_p = true;
9377 
9378 	  return min;
9379 	}
9380     }
9381   return NULL;
9382 }
9383 
9384 /* Return whether the value range *VR fits in an integer type specified
9385    by PRECISION and UNSIGNED_P.  */
9386 
9387 static bool
9388 range_fits_type_p (value_range_t *vr, unsigned dest_precision, signop dest_sgn)
9389 {
9390   tree src_type;
9391   unsigned src_precision;
9392   widest_int tem;
9393   signop src_sgn;
9394 
9395   /* We can only handle integral and pointer types.  */
9396   src_type = TREE_TYPE (vr->min);
9397   if (!INTEGRAL_TYPE_P (src_type)
9398       && !POINTER_TYPE_P (src_type))
9399     return false;
9400 
9401   /* An extension is fine unless VR is SIGNED and dest_sgn is UNSIGNED,
9402      and so is an identity transform.  */
9403   src_precision = TYPE_PRECISION (TREE_TYPE (vr->min));
9404   src_sgn = TYPE_SIGN (src_type);
9405   if ((src_precision < dest_precision
9406        && !(dest_sgn == UNSIGNED && src_sgn == SIGNED))
9407       || (src_precision == dest_precision && src_sgn == dest_sgn))
9408     return true;
9409 
9410   /* Now we can only handle ranges with constant bounds.  */
9411   if (vr->type != VR_RANGE
9412       || TREE_CODE (vr->min) != INTEGER_CST
9413       || TREE_CODE (vr->max) != INTEGER_CST)
9414     return false;
9415 
9416   /* For sign changes, the MSB of the wide_int has to be clear.
9417      An unsigned value with its MSB set cannot be represented by
9418      a signed wide_int, while a negative value cannot be represented
9419      by an unsigned wide_int.  */
9420   if (src_sgn != dest_sgn
9421       && (wi::lts_p (vr->min, 0) || wi::lts_p (vr->max, 0)))
9422     return false;
9423 
9424   /* Then we can perform the conversion on both ends and compare
9425      the result for equality.  */
9426   tem = wi::ext (wi::to_widest (vr->min), dest_precision, dest_sgn);
9427   if (tem != wi::to_widest (vr->min))
9428     return false;
9429   tem = wi::ext (wi::to_widest (vr->max), dest_precision, dest_sgn);
9430   if (tem != wi::to_widest (vr->max))
9431     return false;
9432 
9433   return true;
9434 }
9435 
9436 /* Simplify a conditional using a relational operator to an equality
9437    test if the range information indicates only one value can satisfy
9438    the original conditional.  */
9439 
9440 static bool
9441 simplify_cond_using_ranges (gcond *stmt)
9442 {
9443   tree op0 = gimple_cond_lhs (stmt);
9444   tree op1 = gimple_cond_rhs (stmt);
9445   enum tree_code cond_code = gimple_cond_code (stmt);
9446 
9447   if (cond_code != NE_EXPR
9448       && cond_code != EQ_EXPR
9449       && TREE_CODE (op0) == SSA_NAME
9450       && INTEGRAL_TYPE_P (TREE_TYPE (op0))
9451       && is_gimple_min_invariant (op1))
9452     {
9453       value_range_t *vr = get_value_range (op0);
9454 
9455       /* If we have range information for OP0, then we might be
9456 	 able to simplify this conditional. */
9457       if (vr->type == VR_RANGE)
9458 	{
9459 	  enum warn_strict_overflow_code wc = WARN_STRICT_OVERFLOW_COMPARISON;
9460 	  bool sop = false;
9461 	  tree new_tree = test_for_singularity (cond_code, op0, op1, vr, &sop);
9462 
9463 	  if (new_tree
9464 	      && (!sop || TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (op0))))
9465 	    {
9466 	      if (dump_file)
9467 		{
9468 		  fprintf (dump_file, "Simplified relational ");
9469 		  print_gimple_stmt (dump_file, stmt, 0, 0);
9470 		  fprintf (dump_file, " into ");
9471 		}
9472 
9473 	      gimple_cond_set_code (stmt, EQ_EXPR);
9474 	      gimple_cond_set_lhs (stmt, op0);
9475 	      gimple_cond_set_rhs (stmt, new_tree);
9476 
9477 	      update_stmt (stmt);
9478 
9479 	      if (dump_file)
9480 		{
9481 		  print_gimple_stmt (dump_file, stmt, 0, 0);
9482 		  fprintf (dump_file, "\n");
9483 		}
9484 
9485 	      if (sop && issue_strict_overflow_warning (wc))
9486 	        {
9487 	          location_t location = input_location;
9488 	          if (gimple_has_location (stmt))
9489 		    location = gimple_location (stmt);
9490 
9491 	          warning_at (location, OPT_Wstrict_overflow,
9492 			      "assuming signed overflow does not occur when "
9493 			      "simplifying conditional");
9494 	        }
9495 
9496 	      return true;
9497 	    }
9498 
9499 	  /* Try again after inverting the condition.  We only deal
9500 	     with integral types here, so no need to worry about
9501 	     issues with inverting FP comparisons.  */
9502 	  sop = false;
9503 	  new_tree = test_for_singularity
9504 		       (invert_tree_comparison (cond_code, false),
9505 			op0, op1, vr, &sop);
9506 
9507 	  if (new_tree
9508 	      && (!sop || TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (op0))))
9509 	    {
9510 	      if (dump_file)
9511 		{
9512 		  fprintf (dump_file, "Simplified relational ");
9513 		  print_gimple_stmt (dump_file, stmt, 0, 0);
9514 		  fprintf (dump_file, " into ");
9515 		}
9516 
9517 	      gimple_cond_set_code (stmt, NE_EXPR);
9518 	      gimple_cond_set_lhs (stmt, op0);
9519 	      gimple_cond_set_rhs (stmt, new_tree);
9520 
9521 	      update_stmt (stmt);
9522 
9523 	      if (dump_file)
9524 		{
9525 		  print_gimple_stmt (dump_file, stmt, 0, 0);
9526 		  fprintf (dump_file, "\n");
9527 		}
9528 
9529 	      if (sop && issue_strict_overflow_warning (wc))
9530 	        {
9531 	          location_t location = input_location;
9532 	          if (gimple_has_location (stmt))
9533 		    location = gimple_location (stmt);
9534 
9535 	          warning_at (location, OPT_Wstrict_overflow,
9536 			      "assuming signed overflow does not occur when "
9537 			      "simplifying conditional");
9538 	        }
9539 
9540 	      return true;
9541 	    }
9542 	}
9543     }
9544 
9545   /* If we have a comparison of an SSA_NAME (OP0) against a constant,
9546      see if OP0 was set by a type conversion where the source of
9547      the conversion is another SSA_NAME with a range that fits
9548      into the range of OP0's type.
9549 
9550      If so, the conversion is redundant as the earlier SSA_NAME can be
9551      used for the comparison directly if we just massage the constant in the
9552      comparison.  */
9553   if (TREE_CODE (op0) == SSA_NAME
9554       && TREE_CODE (op1) == INTEGER_CST)
9555     {
9556       gimple def_stmt = SSA_NAME_DEF_STMT (op0);
9557       tree innerop;
9558 
9559       if (!is_gimple_assign (def_stmt)
9560 	  || !CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt)))
9561 	return false;
9562 
9563       innerop = gimple_assign_rhs1 (def_stmt);
9564 
9565       if (TREE_CODE (innerop) == SSA_NAME
9566 	  && !POINTER_TYPE_P (TREE_TYPE (innerop))
9567 	  && !SSA_NAME_OCCURS_IN_ABNORMAL_PHI (innerop))
9568 	{
9569 	  value_range_t *vr = get_value_range (innerop);
9570 
9571 	  if (range_int_cst_p (vr)
9572 	      && range_fits_type_p (vr,
9573 				    TYPE_PRECISION (TREE_TYPE (op0)),
9574 				    TYPE_SIGN (TREE_TYPE (op0)))
9575 	      && int_fits_type_p (op1, TREE_TYPE (innerop))
9576 	      /* The range must not have overflowed, or if it did overflow
9577 		 we must not be wrapping/trapping overflow and optimizing
9578 		 with strict overflow semantics.  */
9579 	      && ((!is_negative_overflow_infinity (vr->min)
9580 	           && !is_positive_overflow_infinity (vr->max))
9581 		  || TYPE_OVERFLOW_UNDEFINED (TREE_TYPE (innerop))))
9582 	    {
9583 	      /* If the range overflowed and the user has asked for warnings
9584 		 when strict overflow semantics were used to optimize code,
9585 		 issue an appropriate warning.  */
9586 	      if (cond_code != EQ_EXPR && cond_code != NE_EXPR
9587 		  && (is_negative_overflow_infinity (vr->min)
9588 		      || is_positive_overflow_infinity (vr->max))
9589 		  && issue_strict_overflow_warning (WARN_STRICT_OVERFLOW_CONDITIONAL))
9590 		{
9591 		  location_t location;
9592 
9593 		  if (!gimple_has_location (stmt))
9594 		    location = input_location;
9595 		  else
9596 		    location = gimple_location (stmt);
9597 		  warning_at (location, OPT_Wstrict_overflow,
9598 			      "assuming signed overflow does not occur when "
9599 			      "simplifying conditional");
9600 		}
9601 
9602 	      tree newconst = fold_convert (TREE_TYPE (innerop), op1);
9603 	      gimple_cond_set_lhs (stmt, innerop);
9604 	      gimple_cond_set_rhs (stmt, newconst);
9605 	      return true;
9606 	    }
9607 	}
9608     }
9609 
9610   return false;
9611 }
9612 
9613 /* Simplify a switch statement using the value range of the switch
9614    argument.  */
9615 
9616 static bool
9617 simplify_switch_using_ranges (gswitch *stmt)
9618 {
9619   tree op = gimple_switch_index (stmt);
9620   value_range_t *vr;
9621   bool take_default;
9622   edge e;
9623   edge_iterator ei;
9624   size_t i = 0, j = 0, n, n2;
9625   tree vec2;
9626   switch_update su;
9627   size_t k = 1, l = 0;
9628 
9629   if (TREE_CODE (op) == SSA_NAME)
9630     {
9631       vr = get_value_range (op);
9632 
9633       /* We can only handle integer ranges.  */
9634       if ((vr->type != VR_RANGE
9635 	   && vr->type != VR_ANTI_RANGE)
9636 	  || symbolic_range_p (vr))
9637 	return false;
9638 
9639       /* Find case label for min/max of the value range.  */
9640       take_default = !find_case_label_ranges (stmt, vr, &i, &j, &k, &l);
9641     }
9642   else if (TREE_CODE (op) == INTEGER_CST)
9643     {
9644       take_default = !find_case_label_index (stmt, 1, op, &i);
9645       if (take_default)
9646 	{
9647 	  i = 1;
9648 	  j = 0;
9649 	}
9650       else
9651 	{
9652 	  j = i;
9653 	}
9654     }
9655   else
9656     return false;
9657 
9658   n = gimple_switch_num_labels (stmt);
9659 
9660   /* Bail out if this is just all edges taken.  */
9661   if (i == 1
9662       && j == n - 1
9663       && take_default)
9664     return false;
9665 
9666   /* Build a new vector of taken case labels.  */
9667   vec2 = make_tree_vec (j - i + 1 + l - k + 1 + (int)take_default);
9668   n2 = 0;
9669 
9670   /* Add the default edge, if necessary.  */
9671   if (take_default)
9672     TREE_VEC_ELT (vec2, n2++) = gimple_switch_default_label (stmt);
9673 
9674   for (; i <= j; ++i, ++n2)
9675     TREE_VEC_ELT (vec2, n2) = gimple_switch_label (stmt, i);
9676 
9677   for (; k <= l; ++k, ++n2)
9678     TREE_VEC_ELT (vec2, n2) = gimple_switch_label (stmt, k);
9679 
9680   /* Mark needed edges.  */
9681   for (i = 0; i < n2; ++i)
9682     {
9683       e = find_edge (gimple_bb (stmt),
9684 		     label_to_block (CASE_LABEL (TREE_VEC_ELT (vec2, i))));
9685       e->aux = (void *)-1;
9686     }
9687 
9688   /* Queue not needed edges for later removal.  */
9689   FOR_EACH_EDGE (e, ei, gimple_bb (stmt)->succs)
9690     {
9691       if (e->aux == (void *)-1)
9692 	{
9693 	  e->aux = NULL;
9694 	  continue;
9695 	}
9696 
9697       if (dump_file && (dump_flags & TDF_DETAILS))
9698 	{
9699 	  fprintf (dump_file, "removing unreachable case label\n");
9700 	}
9701       to_remove_edges.safe_push (e);
9702       e->flags &= ~EDGE_EXECUTABLE;
9703     }
9704 
9705   /* And queue an update for the stmt.  */
9706   su.stmt = stmt;
9707   su.vec = vec2;
9708   to_update_switch_stmts.safe_push (su);
9709   return false;
9710 }
9711 
9712 /* Simplify an integral conversion from an SSA name in STMT.  */
9713 
9714 static bool
9715 simplify_conversion_using_ranges (gimple stmt)
9716 {
9717   tree innerop, middleop, finaltype;
9718   gimple def_stmt;
9719   value_range_t *innervr;
9720   signop inner_sgn, middle_sgn, final_sgn;
9721   unsigned inner_prec, middle_prec, final_prec;
9722   widest_int innermin, innermed, innermax, middlemin, middlemed, middlemax;
9723 
9724   finaltype = TREE_TYPE (gimple_assign_lhs (stmt));
9725   if (!INTEGRAL_TYPE_P (finaltype))
9726     return false;
9727   middleop = gimple_assign_rhs1 (stmt);
9728   def_stmt = SSA_NAME_DEF_STMT (middleop);
9729   if (!is_gimple_assign (def_stmt)
9730       || !CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def_stmt)))
9731     return false;
9732   innerop = gimple_assign_rhs1 (def_stmt);
9733   if (TREE_CODE (innerop) != SSA_NAME
9734       || SSA_NAME_OCCURS_IN_ABNORMAL_PHI (innerop))
9735     return false;
9736 
9737   /* Get the value-range of the inner operand.  */
9738   innervr = get_value_range (innerop);
9739   if (innervr->type != VR_RANGE
9740       || TREE_CODE (innervr->min) != INTEGER_CST
9741       || TREE_CODE (innervr->max) != INTEGER_CST)
9742     return false;
9743 
9744   /* Simulate the conversion chain to check if the result is equal if
9745      the middle conversion is removed.  */
9746   innermin = wi::to_widest (innervr->min);
9747   innermax = wi::to_widest (innervr->max);
9748 
9749   inner_prec = TYPE_PRECISION (TREE_TYPE (innerop));
9750   middle_prec = TYPE_PRECISION (TREE_TYPE (middleop));
9751   final_prec = TYPE_PRECISION (finaltype);
9752 
9753   /* If the first conversion is not injective, the second must not
9754      be widening.  */
9755   if (wi::gtu_p (innermax - innermin,
9756 		 wi::mask <widest_int> (middle_prec, false))
9757       && middle_prec < final_prec)
9758     return false;
9759   /* We also want a medium value so that we can track the effect that
9760      narrowing conversions with sign change have.  */
9761   inner_sgn = TYPE_SIGN (TREE_TYPE (innerop));
9762   if (inner_sgn == UNSIGNED)
9763     innermed = wi::shifted_mask <widest_int> (1, inner_prec - 1, false);
9764   else
9765     innermed = 0;
9766   if (wi::cmp (innermin, innermed, inner_sgn) >= 0
9767       || wi::cmp (innermed, innermax, inner_sgn) >= 0)
9768     innermed = innermin;
9769 
9770   middle_sgn = TYPE_SIGN (TREE_TYPE (middleop));
9771   middlemin = wi::ext (innermin, middle_prec, middle_sgn);
9772   middlemed = wi::ext (innermed, middle_prec, middle_sgn);
9773   middlemax = wi::ext (innermax, middle_prec, middle_sgn);
9774 
9775   /* Require that the final conversion applied to both the original
9776      and the intermediate range produces the same result.  */
9777   final_sgn = TYPE_SIGN (finaltype);
9778   if (wi::ext (middlemin, final_prec, final_sgn)
9779 	 != wi::ext (innermin, final_prec, final_sgn)
9780       || wi::ext (middlemed, final_prec, final_sgn)
9781 	 != wi::ext (innermed, final_prec, final_sgn)
9782       || wi::ext (middlemax, final_prec, final_sgn)
9783 	 != wi::ext (innermax, final_prec, final_sgn))
9784     return false;
9785 
9786   gimple_assign_set_rhs1 (stmt, innerop);
9787   update_stmt (stmt);
9788   return true;
9789 }
9790 
9791 /* Simplify a conversion from integral SSA name to float in STMT.  */
9792 
9793 static bool
9794 simplify_float_conversion_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
9795 {
9796   tree rhs1 = gimple_assign_rhs1 (stmt);
9797   value_range_t *vr = get_value_range (rhs1);
9798   machine_mode fltmode = TYPE_MODE (TREE_TYPE (gimple_assign_lhs (stmt)));
9799   machine_mode mode;
9800   tree tem;
9801   gassign *conv;
9802 
9803   /* We can only handle constant ranges.  */
9804   if (vr->type != VR_RANGE
9805       || TREE_CODE (vr->min) != INTEGER_CST
9806       || TREE_CODE (vr->max) != INTEGER_CST)
9807     return false;
9808 
9809   /* First check if we can use a signed type in place of an unsigned.  */
9810   if (TYPE_UNSIGNED (TREE_TYPE (rhs1))
9811       && (can_float_p (fltmode, TYPE_MODE (TREE_TYPE (rhs1)), 0)
9812 	  != CODE_FOR_nothing)
9813       && range_fits_type_p (vr, TYPE_PRECISION (TREE_TYPE (rhs1)), SIGNED))
9814     mode = TYPE_MODE (TREE_TYPE (rhs1));
9815   /* If we can do the conversion in the current input mode do nothing.  */
9816   else if (can_float_p (fltmode, TYPE_MODE (TREE_TYPE (rhs1)),
9817 			TYPE_UNSIGNED (TREE_TYPE (rhs1))) != CODE_FOR_nothing)
9818     return false;
9819   /* Otherwise search for a mode we can use, starting from the narrowest
9820      integer mode available.  */
9821   else
9822     {
9823       mode = GET_CLASS_NARROWEST_MODE (MODE_INT);
9824       do
9825 	{
9826 	  /* If we cannot do a signed conversion to float from mode
9827 	     or if the value-range does not fit in the signed type
9828 	     try with a wider mode.  */
9829 	  if (can_float_p (fltmode, mode, 0) != CODE_FOR_nothing
9830 	      && range_fits_type_p (vr, GET_MODE_PRECISION (mode), SIGNED))
9831 	    break;
9832 
9833 	  mode = GET_MODE_WIDER_MODE (mode);
9834 	  /* But do not widen the input.  Instead leave that to the
9835 	     optabs expansion code.  */
9836 	  if (GET_MODE_PRECISION (mode) > TYPE_PRECISION (TREE_TYPE (rhs1)))
9837 	    return false;
9838 	}
9839       while (mode != VOIDmode);
9840       if (mode == VOIDmode)
9841 	return false;
9842     }
9843 
9844   /* It works, insert a truncation or sign-change before the
9845      float conversion.  */
9846   tem = make_ssa_name (build_nonstandard_integer_type
9847 			  (GET_MODE_PRECISION (mode), 0));
9848   conv = gimple_build_assign (tem, NOP_EXPR, rhs1);
9849   gsi_insert_before (gsi, conv, GSI_SAME_STMT);
9850   gimple_assign_set_rhs1 (stmt, tem);
9851   update_stmt (stmt);
9852 
9853   return true;
9854 }
9855 
9856 /* Simplify an internal fn call using ranges if possible.  */
9857 
9858 static bool
9859 simplify_internal_call_using_ranges (gimple_stmt_iterator *gsi, gimple stmt)
9860 {
9861   enum tree_code subcode;
9862   bool is_ubsan = false;
9863   bool ovf = false;
9864   switch (gimple_call_internal_fn (stmt))
9865     {
9866     case IFN_UBSAN_CHECK_ADD:
9867       subcode = PLUS_EXPR;
9868       is_ubsan = true;
9869       break;
9870     case IFN_UBSAN_CHECK_SUB:
9871       subcode = MINUS_EXPR;
9872       is_ubsan = true;
9873       break;
9874     case IFN_UBSAN_CHECK_MUL:
9875       subcode = MULT_EXPR;
9876       is_ubsan = true;
9877       break;
9878     case IFN_ADD_OVERFLOW:
9879       subcode = PLUS_EXPR;
9880       break;
9881     case IFN_SUB_OVERFLOW:
9882       subcode = MINUS_EXPR;
9883       break;
9884     case IFN_MUL_OVERFLOW:
9885       subcode = MULT_EXPR;
9886       break;
9887     default:
9888       return false;
9889     }
9890 
9891   tree op0 = gimple_call_arg (stmt, 0);
9892   tree op1 = gimple_call_arg (stmt, 1);
9893   tree type;
9894   if (is_ubsan)
9895     type = TREE_TYPE (op0);
9896   else if (gimple_call_lhs (stmt) == NULL_TREE)
9897     return false;
9898   else
9899     type = TREE_TYPE (TREE_TYPE (gimple_call_lhs (stmt)));
9900   if (!check_for_binary_op_overflow (subcode, type, op0, op1, &ovf)
9901       || (is_ubsan && ovf))
9902     return false;
9903 
9904   gimple g;
9905   location_t loc = gimple_location (stmt);
9906   if (is_ubsan)
9907     g = gimple_build_assign (gimple_call_lhs (stmt), subcode, op0, op1);
9908   else
9909     {
9910       int prec = TYPE_PRECISION (type);
9911       tree utype = type;
9912       if (ovf
9913 	  || !useless_type_conversion_p (type, TREE_TYPE (op0))
9914 	  || !useless_type_conversion_p (type, TREE_TYPE (op1)))
9915 	utype = build_nonstandard_integer_type (prec, 1);
9916       if (TREE_CODE (op0) == INTEGER_CST)
9917 	op0 = fold_convert (utype, op0);
9918       else if (!useless_type_conversion_p (utype, TREE_TYPE (op0)))
9919 	{
9920 	  g = gimple_build_assign (make_ssa_name (utype), NOP_EXPR, op0);
9921 	  gimple_set_location (g, loc);
9922 	  gsi_insert_before (gsi, g, GSI_SAME_STMT);
9923 	  op0 = gimple_assign_lhs (g);
9924 	}
9925       if (TREE_CODE (op1) == INTEGER_CST)
9926 	op1 = fold_convert (utype, op1);
9927       else if (!useless_type_conversion_p (utype, TREE_TYPE (op1)))
9928 	{
9929 	  g = gimple_build_assign (make_ssa_name (utype), NOP_EXPR, op1);
9930 	  gimple_set_location (g, loc);
9931 	  gsi_insert_before (gsi, g, GSI_SAME_STMT);
9932 	  op1 = gimple_assign_lhs (g);
9933 	}
9934       g = gimple_build_assign (make_ssa_name (utype), subcode, op0, op1);
9935       gimple_set_location (g, loc);
9936       gsi_insert_before (gsi, g, GSI_SAME_STMT);
9937       if (utype != type)
9938 	{
9939 	  g = gimple_build_assign (make_ssa_name (type), NOP_EXPR,
9940 				   gimple_assign_lhs (g));
9941 	  gimple_set_location (g, loc);
9942 	  gsi_insert_before (gsi, g, GSI_SAME_STMT);
9943 	}
9944       g = gimple_build_assign (gimple_call_lhs (stmt), COMPLEX_EXPR,
9945 			       gimple_assign_lhs (g),
9946 			       build_int_cst (type, ovf));
9947     }
9948   gimple_set_location (g, loc);
9949   gsi_replace (gsi, g, false);
9950   return true;
9951 }
9952 
9953 /* Simplify STMT using ranges if possible.  */
9954 
9955 static bool
9956 simplify_stmt_using_ranges (gimple_stmt_iterator *gsi)
9957 {
9958   gimple stmt = gsi_stmt (*gsi);
9959   if (is_gimple_assign (stmt))
9960     {
9961       enum tree_code rhs_code = gimple_assign_rhs_code (stmt);
9962       tree rhs1 = gimple_assign_rhs1 (stmt);
9963 
9964       switch (rhs_code)
9965 	{
9966 	case EQ_EXPR:
9967 	case NE_EXPR:
9968           /* Transform EQ_EXPR, NE_EXPR into BIT_XOR_EXPR or identity
9969 	     if the RHS is zero or one, and the LHS are known to be boolean
9970 	     values.  */
9971 	  if (INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
9972 	    return simplify_truth_ops_using_ranges (gsi, stmt);
9973 	  break;
9974 
9975       /* Transform TRUNC_DIV_EXPR and TRUNC_MOD_EXPR into RSHIFT_EXPR
9976 	 and BIT_AND_EXPR respectively if the first operand is greater
9977 	 than zero and the second operand is an exact power of two.
9978 	 Also optimize TRUNC_MOD_EXPR away if the second operand is
9979 	 constant and the first operand already has the right value
9980 	 range.  */
9981 	case TRUNC_DIV_EXPR:
9982 	case TRUNC_MOD_EXPR:
9983 	  if (TREE_CODE (rhs1) == SSA_NAME
9984 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
9985 	    return simplify_div_or_mod_using_ranges (stmt);
9986 	  break;
9987 
9988       /* Transform ABS (X) into X or -X as appropriate.  */
9989 	case ABS_EXPR:
9990 	  if (TREE_CODE (rhs1) == SSA_NAME
9991 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
9992 	    return simplify_abs_using_ranges (stmt);
9993 	  break;
9994 
9995 	case BIT_AND_EXPR:
9996 	case BIT_IOR_EXPR:
9997 	  /* Optimize away BIT_AND_EXPR and BIT_IOR_EXPR
9998 	     if all the bits being cleared are already cleared or
9999 	     all the bits being set are already set.  */
10000 	  if (INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
10001 	    return simplify_bit_ops_using_ranges (gsi, stmt);
10002 	  break;
10003 
10004 	CASE_CONVERT:
10005 	  if (TREE_CODE (rhs1) == SSA_NAME
10006 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
10007 	    return simplify_conversion_using_ranges (stmt);
10008 	  break;
10009 
10010 	case FLOAT_EXPR:
10011 	  if (TREE_CODE (rhs1) == SSA_NAME
10012 	      && INTEGRAL_TYPE_P (TREE_TYPE (rhs1)))
10013 	    return simplify_float_conversion_using_ranges (gsi, stmt);
10014 	  break;
10015 
10016 	default:
10017 	  break;
10018 	}
10019     }
10020   else if (gimple_code (stmt) == GIMPLE_COND)
10021     return simplify_cond_using_ranges (as_a <gcond *> (stmt));
10022   else if (gimple_code (stmt) == GIMPLE_SWITCH)
10023     return simplify_switch_using_ranges (as_a <gswitch *> (stmt));
10024   else if (is_gimple_call (stmt)
10025 	   && gimple_call_internal_p (stmt))
10026     return simplify_internal_call_using_ranges (gsi, stmt);
10027 
10028   return false;
10029 }
10030 
10031 /* If the statement pointed by SI has a predicate whose value can be
10032    computed using the value range information computed by VRP, compute
10033    its value and return true.  Otherwise, return false.  */
10034 
10035 static bool
10036 fold_predicate_in (gimple_stmt_iterator *si)
10037 {
10038   bool assignment_p = false;
10039   tree val;
10040   gimple stmt = gsi_stmt (*si);
10041 
10042   if (is_gimple_assign (stmt)
10043       && TREE_CODE_CLASS (gimple_assign_rhs_code (stmt)) == tcc_comparison)
10044     {
10045       assignment_p = true;
10046       val = vrp_evaluate_conditional (gimple_assign_rhs_code (stmt),
10047 				      gimple_assign_rhs1 (stmt),
10048 				      gimple_assign_rhs2 (stmt),
10049 				      stmt);
10050     }
10051   else if (gcond *cond_stmt = dyn_cast <gcond *> (stmt))
10052     val = vrp_evaluate_conditional (gimple_cond_code (cond_stmt),
10053 				    gimple_cond_lhs (cond_stmt),
10054 				    gimple_cond_rhs (cond_stmt),
10055 				    stmt);
10056   else
10057     return false;
10058 
10059   if (val)
10060     {
10061       if (assignment_p)
10062         val = fold_convert (gimple_expr_type (stmt), val);
10063 
10064       if (dump_file)
10065 	{
10066 	  fprintf (dump_file, "Folding predicate ");
10067 	  print_gimple_expr (dump_file, stmt, 0, 0);
10068 	  fprintf (dump_file, " to ");
10069 	  print_generic_expr (dump_file, val, 0);
10070 	  fprintf (dump_file, "\n");
10071 	}
10072 
10073       if (is_gimple_assign (stmt))
10074 	gimple_assign_set_rhs_from_tree (si, val);
10075       else
10076 	{
10077 	  gcc_assert (gimple_code (stmt) == GIMPLE_COND);
10078 	  gcond *cond_stmt = as_a <gcond *> (stmt);
10079 	  if (integer_zerop (val))
10080 	    gimple_cond_make_false (cond_stmt);
10081 	  else if (integer_onep (val))
10082 	    gimple_cond_make_true (cond_stmt);
10083 	  else
10084 	    gcc_unreachable ();
10085 	}
10086 
10087       return true;
10088     }
10089 
10090   return false;
10091 }
10092 
10093 /* Callback for substitute_and_fold folding the stmt at *SI.  */
10094 
10095 static bool
10096 vrp_fold_stmt (gimple_stmt_iterator *si)
10097 {
10098   if (fold_predicate_in (si))
10099     return true;
10100 
10101   return simplify_stmt_using_ranges (si);
10102 }
10103 
10104 /* Stack of dest,src equivalency pairs that need to be restored after
10105    each attempt to thread a block's incoming edge to an outgoing edge.
10106 
10107    A NULL entry is used to mark the end of pairs which need to be
10108    restored.  */
10109 static vec<tree> equiv_stack;
10110 
10111 /* A trivial wrapper so that we can present the generic jump threading
10112    code with a simple API for simplifying statements.  STMT is the
10113    statement we want to simplify, WITHIN_STMT provides the location
10114    for any overflow warnings.  */
10115 
10116 static tree
10117 simplify_stmt_for_jump_threading (gimple stmt, gimple within_stmt)
10118 {
10119   if (gcond *cond_stmt = dyn_cast <gcond *> (stmt))
10120     return vrp_evaluate_conditional (gimple_cond_code (cond_stmt),
10121 				     gimple_cond_lhs (cond_stmt),
10122 				     gimple_cond_rhs (cond_stmt),
10123 				     within_stmt);
10124 
10125   if (gassign *assign_stmt = dyn_cast <gassign *> (stmt))
10126     {
10127       value_range_t new_vr = VR_INITIALIZER;
10128       tree lhs = gimple_assign_lhs (assign_stmt);
10129 
10130       if (TREE_CODE (lhs) == SSA_NAME
10131 	  && (INTEGRAL_TYPE_P (TREE_TYPE (lhs))
10132 	      || POINTER_TYPE_P (TREE_TYPE (lhs))))
10133 	{
10134 	  extract_range_from_assignment (&new_vr, assign_stmt);
10135 	  if (range_int_cst_singleton_p (&new_vr))
10136 	    return new_vr.min;
10137 	}
10138     }
10139 
10140   return NULL_TREE;
10141 }
10142 
10143 /* Blocks which have more than one predecessor and more than
10144    one successor present jump threading opportunities, i.e.,
10145    when the block is reached from a specific predecessor, we
10146    may be able to determine which of the outgoing edges will
10147    be traversed.  When this optimization applies, we are able
10148    to avoid conditionals at runtime and we may expose secondary
10149    optimization opportunities.
10150 
10151    This routine is effectively a driver for the generic jump
10152    threading code.  It basically just presents the generic code
10153    with edges that may be suitable for jump threading.
10154 
10155    Unlike DOM, we do not iterate VRP if jump threading was successful.
10156    While iterating may expose new opportunities for VRP, it is expected
10157    those opportunities would be very limited and the compile time cost
10158    to expose those opportunities would be significant.
10159 
10160    As jump threading opportunities are discovered, they are registered
10161    for later realization.  */
10162 
10163 static void
10164 identify_jump_threads (void)
10165 {
10166   basic_block bb;
10167   gcond *dummy;
10168   int i;
10169   edge e;
10170 
10171   /* Ugh.  When substituting values earlier in this pass we can
10172      wipe the dominance information.  So rebuild the dominator
10173      information as we need it within the jump threading code.  */
10174   calculate_dominance_info (CDI_DOMINATORS);
10175 
10176   /* We do not allow VRP information to be used for jump threading
10177      across a back edge in the CFG.  Otherwise it becomes too
10178      difficult to avoid eliminating loop exit tests.  Of course
10179      EDGE_DFS_BACK is not accurate at this time so we have to
10180      recompute it.  */
10181   mark_dfs_back_edges ();
10182 
10183   /* Do not thread across edges we are about to remove.  Just marking
10184      them as EDGE_DFS_BACK will do.  */
10185   FOR_EACH_VEC_ELT (to_remove_edges, i, e)
10186     e->flags |= EDGE_DFS_BACK;
10187 
10188   /* Allocate our unwinder stack to unwind any temporary equivalences
10189      that might be recorded.  */
10190   equiv_stack.create (20);
10191 
10192   /* To avoid lots of silly node creation, we create a single
10193      conditional and just modify it in-place when attempting to
10194      thread jumps.  */
10195   dummy = gimple_build_cond (EQ_EXPR,
10196 			     integer_zero_node, integer_zero_node,
10197 			     NULL, NULL);
10198 
10199   /* Walk through all the blocks finding those which present a
10200      potential jump threading opportunity.  We could set this up
10201      as a dominator walker and record data during the walk, but
10202      I doubt it's worth the effort for the classes of jump
10203      threading opportunities we are trying to identify at this
10204      point in compilation.  */
10205   FOR_EACH_BB_FN (bb, cfun)
10206     {
10207       gimple last;
10208 
10209       /* If the generic jump threading code does not find this block
10210 	 interesting, then there is nothing to do.  */
10211       if (! potentially_threadable_block (bb))
10212 	continue;
10213 
10214       last = last_stmt (bb);
10215 
10216       /* We're basically looking for a switch or any kind of conditional with
10217 	 integral or pointer type arguments.  Note the type of the second
10218 	 argument will be the same as the first argument, so no need to
10219 	 check it explicitly.
10220 
10221 	 We also handle the case where there are no statements in the
10222 	 block.  This come up with forwarder blocks that are not
10223 	 optimized away because they lead to a loop header.  But we do
10224 	 want to thread through them as we can sometimes thread to the
10225 	 loop exit which is obviously profitable.  */
10226       if (!last
10227 	  || gimple_code (last) == GIMPLE_SWITCH
10228 	  || (gimple_code (last) == GIMPLE_COND
10229       	      && TREE_CODE (gimple_cond_lhs (last)) == SSA_NAME
10230 	      && (INTEGRAL_TYPE_P (TREE_TYPE (gimple_cond_lhs (last)))
10231 		  || POINTER_TYPE_P (TREE_TYPE (gimple_cond_lhs (last))))
10232 	      && (TREE_CODE (gimple_cond_rhs (last)) == SSA_NAME
10233 		  || is_gimple_min_invariant (gimple_cond_rhs (last)))))
10234 	{
10235 	  edge_iterator ei;
10236 
10237 	  /* We've got a block with multiple predecessors and multiple
10238 	     successors which also ends in a suitable conditional or
10239 	     switch statement.  For each predecessor, see if we can thread
10240 	     it to a specific successor.  */
10241 	  FOR_EACH_EDGE (e, ei, bb->preds)
10242 	    {
10243 	      /* Do not thread across back edges or abnormal edges
10244 		 in the CFG.  */
10245 	      if (e->flags & (EDGE_DFS_BACK | EDGE_COMPLEX))
10246 		continue;
10247 
10248 	      thread_across_edge (dummy, e, true, &equiv_stack,
10249 				  simplify_stmt_for_jump_threading);
10250 	    }
10251 	}
10252     }
10253 
10254   /* We do not actually update the CFG or SSA graphs at this point as
10255      ASSERT_EXPRs are still in the IL and cfg cleanup code does not yet
10256      handle ASSERT_EXPRs gracefully.  */
10257 }
10258 
10259 /* We identified all the jump threading opportunities earlier, but could
10260    not transform the CFG at that time.  This routine transforms the
10261    CFG and arranges for the dominator tree to be rebuilt if necessary.
10262 
10263    Note the SSA graph update will occur during the normal TODO
10264    processing by the pass manager.  */
10265 static void
10266 finalize_jump_threads (void)
10267 {
10268   thread_through_all_blocks (false);
10269   equiv_stack.release ();
10270 }
10271 
10272 
10273 /* Traverse all the blocks folding conditionals with known ranges.  */
10274 
10275 static void
10276 vrp_finalize (void)
10277 {
10278   size_t i;
10279 
10280   values_propagated = true;
10281 
10282   if (dump_file)
10283     {
10284       fprintf (dump_file, "\nValue ranges after VRP:\n\n");
10285       dump_all_value_ranges (dump_file);
10286       fprintf (dump_file, "\n");
10287     }
10288 
10289   substitute_and_fold (op_with_constant_singleton_value_range,
10290 		       vrp_fold_stmt, false);
10291 
10292   if (warn_array_bounds && first_pass_instance)
10293     check_all_array_refs ();
10294 
10295   /* We must identify jump threading opportunities before we release
10296      the datastructures built by VRP.  */
10297   identify_jump_threads ();
10298 
10299   /* Set value range to non pointer SSA_NAMEs.  */
10300   for (i  = 0; i < num_vr_values; i++)
10301     if (vr_value[i])
10302       {
10303 	tree name = ssa_name (i);
10304 
10305       if (!name
10306 	  || POINTER_TYPE_P (TREE_TYPE (name))
10307 	  || (vr_value[i]->type == VR_VARYING)
10308 	  || (vr_value[i]->type == VR_UNDEFINED))
10309 	continue;
10310 
10311 	if ((TREE_CODE (vr_value[i]->min) == INTEGER_CST)
10312 	    && (TREE_CODE (vr_value[i]->max) == INTEGER_CST)
10313 	    && (vr_value[i]->type == VR_RANGE
10314 		|| vr_value[i]->type == VR_ANTI_RANGE))
10315 	  set_range_info (name, vr_value[i]->type, vr_value[i]->min,
10316 			  vr_value[i]->max);
10317       }
10318 
10319   /* Free allocated memory.  */
10320   for (i = 0; i < num_vr_values; i++)
10321     if (vr_value[i])
10322       {
10323 	BITMAP_FREE (vr_value[i]->equiv);
10324 	free (vr_value[i]);
10325       }
10326 
10327   free (vr_value);
10328   free (vr_phi_edge_counts);
10329 
10330   /* So that we can distinguish between VRP data being available
10331      and not available.  */
10332   vr_value = NULL;
10333   vr_phi_edge_counts = NULL;
10334 }
10335 
10336 
10337 /* Main entry point to VRP (Value Range Propagation).  This pass is
10338    loosely based on J. R. C. Patterson, ``Accurate Static Branch
10339    Prediction by Value Range Propagation,'' in SIGPLAN Conference on
10340    Programming Language Design and Implementation, pp. 67-78, 1995.
10341    Also available at http://citeseer.ist.psu.edu/patterson95accurate.html
10342 
10343    This is essentially an SSA-CCP pass modified to deal with ranges
10344    instead of constants.
10345 
10346    While propagating ranges, we may find that two or more SSA name
10347    have equivalent, though distinct ranges.  For instance,
10348 
10349      1	x_9 = p_3->a;
10350      2	p_4 = ASSERT_EXPR <p_3, p_3 != 0>
10351      3	if (p_4 == q_2)
10352      4	  p_5 = ASSERT_EXPR <p_4, p_4 == q_2>;
10353      5	endif
10354      6	if (q_2)
10355 
10356    In the code above, pointer p_5 has range [q_2, q_2], but from the
10357    code we can also determine that p_5 cannot be NULL and, if q_2 had
10358    a non-varying range, p_5's range should also be compatible with it.
10359 
10360    These equivalences are created by two expressions: ASSERT_EXPR and
10361    copy operations.  Since p_5 is an assertion on p_4, and p_4 was the
10362    result of another assertion, then we can use the fact that p_5 and
10363    p_4 are equivalent when evaluating p_5's range.
10364 
10365    Together with value ranges, we also propagate these equivalences
10366    between names so that we can take advantage of information from
10367    multiple ranges when doing final replacement.  Note that this
10368    equivalency relation is transitive but not symmetric.
10369 
10370    In the example above, p_5 is equivalent to p_4, q_2 and p_3, but we
10371    cannot assert that q_2 is equivalent to p_5 because q_2 may be used
10372    in contexts where that assertion does not hold (e.g., in line 6).
10373 
10374    TODO, the main difference between this pass and Patterson's is that
10375    we do not propagate edge probabilities.  We only compute whether
10376    edges can be taken or not.  That is, instead of having a spectrum
10377    of jump probabilities between 0 and 1, we only deal with 0, 1 and
10378    DON'T KNOW.  In the future, it may be worthwhile to propagate
10379    probabilities to aid branch prediction.  */
10380 
10381 static unsigned int
10382 execute_vrp (void)
10383 {
10384   int i;
10385   edge e;
10386   switch_update *su;
10387 
10388   loop_optimizer_init (LOOPS_NORMAL | LOOPS_HAVE_RECORDED_EXITS);
10389   rewrite_into_loop_closed_ssa (NULL, TODO_update_ssa);
10390   scev_initialize ();
10391 
10392   /* ???  This ends up using stale EDGE_DFS_BACK for liveness computation.
10393      Inserting assertions may split edges which will invalidate
10394      EDGE_DFS_BACK.  */
10395   insert_range_assertions ();
10396 
10397   to_remove_edges.create (10);
10398   to_update_switch_stmts.create (5);
10399   threadedge_initialize_values ();
10400 
10401   /* For visiting PHI nodes we need EDGE_DFS_BACK computed.  */
10402   mark_dfs_back_edges ();
10403 
10404   vrp_initialize ();
10405   ssa_propagate (vrp_visit_stmt, vrp_visit_phi_node);
10406   vrp_finalize ();
10407 
10408   free_numbers_of_iterations_estimates ();
10409 
10410   /* ASSERT_EXPRs must be removed before finalizing jump threads
10411      as finalizing jump threads calls the CFG cleanup code which
10412      does not properly handle ASSERT_EXPRs.  */
10413   remove_range_assertions ();
10414 
10415   /* If we exposed any new variables, go ahead and put them into
10416      SSA form now, before we handle jump threading.  This simplifies
10417      interactions between rewriting of _DECL nodes into SSA form
10418      and rewriting SSA_NAME nodes into SSA form after block
10419      duplication and CFG manipulation.  */
10420   update_ssa (TODO_update_ssa);
10421 
10422   finalize_jump_threads ();
10423 
10424   /* Remove dead edges from SWITCH_EXPR optimization.  This leaves the
10425      CFG in a broken state and requires a cfg_cleanup run.  */
10426   FOR_EACH_VEC_ELT (to_remove_edges, i, e)
10427     remove_edge (e);
10428   /* Update SWITCH_EXPR case label vector.  */
10429   FOR_EACH_VEC_ELT (to_update_switch_stmts, i, su)
10430     {
10431       size_t j;
10432       size_t n = TREE_VEC_LENGTH (su->vec);
10433       tree label;
10434       gimple_switch_set_num_labels (su->stmt, n);
10435       for (j = 0; j < n; j++)
10436 	gimple_switch_set_label (su->stmt, j, TREE_VEC_ELT (su->vec, j));
10437       /* As we may have replaced the default label with a regular one
10438 	 make sure to make it a real default label again.  This ensures
10439 	 optimal expansion.  */
10440       label = gimple_switch_label (su->stmt, 0);
10441       CASE_LOW (label) = NULL_TREE;
10442       CASE_HIGH (label) = NULL_TREE;
10443     }
10444 
10445   if (to_remove_edges.length () > 0)
10446     {
10447       free_dominance_info (CDI_DOMINATORS);
10448       loops_state_set (LOOPS_NEED_FIXUP);
10449     }
10450 
10451   to_remove_edges.release ();
10452   to_update_switch_stmts.release ();
10453   threadedge_finalize_values ();
10454 
10455   scev_finalize ();
10456   loop_optimizer_finalize ();
10457   return 0;
10458 }
10459 
10460 namespace {
10461 
10462 const pass_data pass_data_vrp =
10463 {
10464   GIMPLE_PASS, /* type */
10465   "vrp", /* name */
10466   OPTGROUP_NONE, /* optinfo_flags */
10467   TV_TREE_VRP, /* tv_id */
10468   PROP_ssa, /* properties_required */
10469   0, /* properties_provided */
10470   0, /* properties_destroyed */
10471   0, /* todo_flags_start */
10472   ( TODO_cleanup_cfg | TODO_update_ssa ), /* todo_flags_finish */
10473 };
10474 
10475 class pass_vrp : public gimple_opt_pass
10476 {
10477 public:
10478   pass_vrp (gcc::context *ctxt)
10479     : gimple_opt_pass (pass_data_vrp, ctxt)
10480   {}
10481 
10482   /* opt_pass methods: */
10483   opt_pass * clone () { return new pass_vrp (m_ctxt); }
10484   virtual bool gate (function *) { return flag_tree_vrp != 0; }
10485   virtual unsigned int execute (function *) { return execute_vrp (); }
10486 
10487 }; // class pass_vrp
10488 
10489 } // anon namespace
10490 
10491 gimple_opt_pass *
10492 make_pass_vrp (gcc::context *ctxt)
10493 {
10494   return new pass_vrp (ctxt);
10495 }
10496