[Bug tree-optimization/23127] New: VRP propagates negation of antirange incorrectly

["rmorganl at u dot washington dot edu" <gcc-bugzilla at gcc dot gnu dot org>]

VRP miscompiles the following testcase at -O2:

#include <stdlib.h>

void test(int x)
{
        if (x == 1)
                abort();
        else
        {
                int a = -x;
                if (a != 1)
                        abort();
        }
}

int main()
{
        test(-1);
        return 0;
}


The problem is this piece of code:

      /* Negating an anti-range doesn't really do anything to it.  The
         new range will also not take on the same range of values
         excluded by the original anti-range.  */
      if (vr0.type == VR_ANTI_RANGE)
        {
          copy_value_range (vr, &vr0);
          return;
        }

which is obviously wrong. It leads to VRP concluding that since x is ~[1,1], a
is also ~[1,1], and removing the condition on the abort.

-- 
           Summary: VRP propagates negation of antirange incorrectly
           Product: gcc
           Version: 4.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: tree-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: rmorganl at u dot washington dot edu
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-cygwin
  GCC host triplet: i686-pc-cygwin
GCC target triplet: i686-pc-cygwin


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=23127