Consider tree.c:upper_bound_in_type
Suppose that outer is ulong64 and that inner is int32. Then the function
returns 2^32-1, which is wrong. Since we are widening a signed value, we need
to use a sign extension. The largest value after casting to ulong64 is actually
2^64-1, which occurs when sign-extending (int32) -1.
Consider tree.c:lower_bound_in_type
Suppose that outer is int32 and that inner is ulong64. Then the function
returns 0, which is wrong. Since we are narrowing, the result of a cast
can take all values of int32. The smallest value after casting to int32 is
-2^31, which occurs when we narrow 2^31.
These functions are used from fold-const.c, but I was unable to come up with a
testcase that exposed this bug.
This bug showed up as a latent bug while I was working on PR20139.
I've got a patch to fix this.
--
Summary: upper_bound_in_type and lower_bound_in_type are buggy
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: tree-optimization
AssignedTo: kazu at gcc dot gnu dot org
ReportedBy: kazu at gcc dot gnu dot org
CC: gcc-bugs at gcc dot gnu dot org
OtherBugsDependingO 20139
nThis:
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22360
