[PATCH] Fix ICE in ipa-cp due to cost addition overflow (PR 96806)

[Feng Xue OS via Gcc-patches]

This patch is to fix a bug that cost that is used to evaluate clone candidate
becomes negative due to integer overflow.

Feng
---
2020-08-31  Feng Xue  <f...@os.amperecomputing.com>

gcc/
        PR tree-optimization/96806
        * ipa-cp.c (decide_about_value): Use safe_add to avoid cost addition
        overflow.

gcc/testsuite/
        PR tree-optimization/96806
        * g++.dg/ipa/pr96806.C: New test.
From 8d92b4ca4be2303a73f0a2441e57564488ca1c23 Mon Sep 17 00:00:00 2001
From: Feng Xue <f...@os.amperecomputing.com>
Date: Mon, 31 Aug 2020 15:00:52 +0800
Subject: [PATCH] ipa/96806 - Fix ICE in ipa-cp due to integer addition
 overflow

2020-08-31  Feng Xue  <f...@os.amperecomputing.com>

gcc/
        PR tree-optimization/96806
        * ipa-cp.c (decide_about_value): Use safe_add to avoid cost addition
	overflow.

gcc/testsuite/
        PR tree-optimization/96806
        * g++.dg/ipa/pr96806.C: New test.
---
 gcc/ipa-cp.c                       |  8 ++---
 gcc/testsuite/g++.dg/ipa/pr96806.C | 53 ++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+), 4 deletions(-)
 create mode 100644 gcc/testsuite/g++.dg/ipa/pr96806.C

diff --git a/gcc/ipa-cp.c b/gcc/ipa-cp.c
index e4910a04ffa..8e5d6e2a393 100644
--- a/gcc/ipa-cp.c
+++ b/gcc/ipa-cp.c
@@ -5480,11 +5480,11 @@ decide_about_value (struct cgraph_node *node, int index, HOST_WIDE_INT offset,
 				   freq_sum, count_sum,
 				   val->local_size_cost)
       && !good_cloning_opportunity_p (node,
-				      val->local_time_benefit
-				      + val->prop_time_benefit,
+				      safe_add (val->local_time_benefit,
+						val->prop_time_benefit),
 				      freq_sum, count_sum,
-				      val->local_size_cost
-				      + val->prop_size_cost))
+				      safe_add (val->local_size_cost,
+						val->prop_size_cost)))
     return false;
 
   if (dump_file)
diff --git a/gcc/testsuite/g++.dg/ipa/pr96806.C b/gcc/testsuite/g++.dg/ipa/pr96806.C
new file mode 100644
index 00000000000..28fdf7787a1
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ipa/pr96806.C
@@ -0,0 +1,53 @@
+/* { dg-do compile } */                                                                        
+/* { dg-options "-std=c++11 -O -fipa-cp -fipa-cp-clone --param=ipa-cp-max-recursive-depth=94 --param=logical-op-non-short-circuit=0" } */
+
+enum a {};
+struct m;
+struct n {
+  a d;
+};
+int o(int, int);
+struct p {
+  char d;
+  char aa;
+  p *ab;
+  bool q() const {
+    int h = d & 4;
+    return h;
+  }
+  char r() const { return aa; }
+  int s(const m *, bool) const;
+} l;
+struct t {
+  p *ac;
+  p *u() { return ac; }
+  p *v(int);
+};
+int w(const p *, const p *, const m *, int = 0);
+struct m : n {
+  struct {
+    t *ad;
+  } ae;
+  char x() const;
+  p *y(int z) const { return ae.ad ? nullptr : ae.ad->v(z); }
+} j;
+int w(const p *z, const p *af, const m *ag, int ah) {
+  int a, g = z->s(ag, true), i = af->s(ag, true);
+  if (af->q()) {
+    if (ag->x())
+      return 0;
+    ah++;
+    char b = af->r();
+    p *c = ag->y(b), *e = ag->ae.ad->u();
+    int d = w(z, c, ag, ah), f = w(z, af ? e : af->ab, ag, ah);
+    a = f ? d : f;
+    return a;
+  }
+  if (g || i == 1)
+    return ag->d ? o(g, i) : o(g, i);
+  return 0;
+}
+void ai() {
+  for (p k;;)
+    w(&k, &l, &j);
+}
-- 
2.17.1