[PATCH] fold-undefined-pointer-offsetting

[Richard Biener]

This avoids breaking the old broken pointer offsetting via
(T)(ptr - ((T)0)->x) which should have used offsetof.  Breakage
was exposed by the introduction of POINTER_DIFF_EXPR and making
PTA not considering that producing a pointer.  The mitigation
for simple cases is to canonicalize

  _2 = _1 - 8B;
  o_9 = (struct obj *) _2;

to

  o_9 = &MEM[_1 + -8B];

eliding one statement and the offending pointer subtraction.

Bootstrapped and tested on x86_64-unknown-linux-gnu, applied.

Richard.

2020-03-11  Richard Biener  <rguenther@suse.de>

	* match.pd ((T *)(ptr - ptr-cst) -> &MEM[ptr + -ptr-cst]):
	New pattern.

	* gcc.dg/torture/20200311-1.c: New testcase.
---
 gcc/match.pd                              |  9 +++++++++
 gcc/testsuite/gcc.dg/torture/20200311-1.c | 26 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 gcc/testsuite/gcc.dg/torture/20200311-1.c

diff --git a/gcc/match.pd b/gcc/match.pd
index 19df0c404a4..9cb37740f1e 100644
--- a/gcc/match.pd
+++ b/gcc/match.pd
@@ -1864,6 +1864,15 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT)
    (if (ptr_difference_const (@0, @1, &diff))
     { build_int_cst_type (type, diff); }))))
 
+/* Canonicalize (T *)(ptr - ptr-cst) to &MEM[ptr + -ptr-cst].  */
+(simplify
+ (convert (pointer_diff @0 INTEGER_CST@1))
+ (if (POINTER_TYPE_P (type))
+  { build_fold_addr_expr_with_type
+      (build2 (MEM_REF, char_type_node, @0,
+	       wide_int_to_tree (ptr_type_node, wi::neg (wi::to_wide (@1)))),
+	       type); }))
+
 /* If arg0 is derived from the address of an object or function, we may
    be able to fold this expression using the object or function's
    alignment.  */
diff --git a/gcc/testsuite/gcc.dg/torture/20200311-1.c b/gcc/testsuite/gcc.dg/torture/20200311-1.c
new file mode 100644
index 00000000000..ac82b6b7a0b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/20200311-1.c
@@ -0,0 +1,26 @@
+/* { dg-do run } */
+
+struct list { struct list *n; };
+
+struct obj {
+    int n;
+    struct list l;
+} _o;
+
+struct list _l = { .n = &_o.l };
+
+int main(int argc, char *argv[])
+{
+  struct obj *o = &_o;
+  _o.l.n = &_l;
+  while (&o->l != &_l)
+    /* Note the following is invoking undefined behavior but in
+       this kind of "obvious" cases we don't want to break things
+       unnecessarily and thus we avoid analyzing o as pointing
+       to nothing via the undefined pointer subtraction.  Instead
+       we canonicalize the pointer subtraction followed by the
+       pointer conversion to pointer offsetting.  */
+    o = ((struct obj *)((const char *)(o->l.n)
+			- (const char *)&((struct obj *)0)->l));
+  return 0;
+}
-- 
2.16.4