[gcc r15-9864] tree-optimization/120654 - ICE with range query from IVOPTs

[Richard Biener via Gcc-cvs]

https://gcc.gnu.org/g:d8a9467163addaf61297443b41f381420d5af7f5

commit r15-9864-gd8a9467163addaf61297443b41f381420d5af7f5
Author: Richard Biener <rguent...@suse.de>
Date:   Fri Jun 20 11:14:38 2025 +0200

    tree-optimization/120654 - ICE with range query from IVOPTs
    
    The following ICEs as we hand down an UNDEFINED range to where it
    isn't expected.  Put the guard that's there earlier.
    
            PR tree-optimization/120654
            * vr-values.cc (range_fits_type_p): Check for undefined_p ()
            before accessing type ().
    
            * gcc.dg/torture/pr120654.c: New testcase.
    
    (cherry picked from commit 6bd1223bd55ed60fa5dbfd4a8444e133e5e933f5)

Diff:
---
 gcc/testsuite/gcc.dg/torture/pr120654.c | 24 ++++++++++++++++++++++++
 gcc/vr-values.cc                        | 10 +++++-----
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/torture/pr120654.c 
b/gcc/testsuite/gcc.dg/torture/pr120654.c
new file mode 100644
index 000000000000..3819b78281d0
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr120654.c
@@ -0,0 +1,24 @@
+/* { dg-do compile } */
+
+int a, c, e, f, h, j;
+long g, k;
+void *malloc(long);
+void free(void *);
+int b(int m) {
+  if (m || a)
+    return 1;
+  return 0.0f;
+}
+int d(int m, int p2) { return b(m) + m + (1 + p2 + p2); }
+int i() {
+  long l[] = {2, 9, 7, 8, g, g, 9, 0, 2, g};
+  e = l[c] << 6;
+}
+void n() {
+  long o;
+  int *p = malloc(sizeof(int));
+  k = 1 % j;
+  for (; i() + f + h; o++)
+    if (p[d(j + 6, (int)k + 1992695866) + h + f + j + (int)k - 1 + o])
+      free(p);
+}
diff --git a/gcc/vr-values.cc b/gcc/vr-values.cc
index 4c787593b95a..5a1ab2b2f1b1 100644
--- a/gcc/vr-values.cc
+++ b/gcc/vr-values.cc
@@ -1023,6 +1023,10 @@ range_fits_type_p (const irange *vr,
   widest_int tem;
   signop src_sgn;
 
+  /* Now we can only handle ranges with constant bounds.  */
+  if (vr->undefined_p () || vr->varying_p ())
+    return false;
+
   /* We can only handle integral and pointer types.  */
   src_type = vr->type ();
   if (!INTEGRAL_TYPE_P (src_type)
@@ -1031,17 +1035,13 @@ range_fits_type_p (const irange *vr,
 
   /* An extension is fine unless VR is SIGNED and dest_sgn is UNSIGNED,
      and so is an identity transform.  */
-  src_precision = TYPE_PRECISION (vr->type ());
+  src_precision = TYPE_PRECISION (src_type);
   src_sgn = TYPE_SIGN (src_type);
   if ((src_precision < dest_precision
        && !(dest_sgn == UNSIGNED && src_sgn == SIGNED))
       || (src_precision == dest_precision && src_sgn == dest_sgn))
     return true;
 
-  /* Now we can only handle ranges with constant bounds.  */
-  if (vr->undefined_p () || vr->varying_p ())
-    return false;
-
   wide_int vrmin = vr->lower_bound ();
   wide_int vrmax = vr->upper_bound ();