From 56b92750f83724177d2c6eae30c208e935a56a37 Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Thu, 30 Jan 2020 21:28:17 +0100
Subject: [PATCH] combine: Punt on out of range rotate counts [PR93505]

What happens on this testcase is with the out of bounds rotate we get:
Trying 13 -> 16:
   13: r129:SI=r132:DI#0<-<0x20
      REG_DEAD r132:DI
   16: r123:DI=r129:SI<0
      REG_DEAD r129:SI
Successfully matched this instruction:
(set (reg/v:DI 123 [ <retval> ])
    (const_int 0 [0]))
during combine.  So, perhaps we could also change simplify-rtx.c to punt
if it is out of bounds rather than trying to optimize anything.
Or, but probably GCC11 material, if we decide that ROTATE/ROTATERT doesn't
have out of bounds counts or introduce targetm.rotate_truncation_mask,
we should truncate the argument instead of punting.
Punting is better for backports though.

2020-01-30  Jakub Jelinek  <jakub@redhat.com>

	PR middle-end/93505
	* combine.c (simplify_comparison) <case ROTATE>: Punt on out of range
	rotate counts.

	* gcc.c-torture/compile/pr93505.c: New test.
---
 gcc/ChangeLog                                 |  6 ++++++
 gcc/combine.c                                 |  3 ++-
 gcc/testsuite/ChangeLog                       |  5 +++++
 gcc/testsuite/gcc.c-torture/compile/pr93505.c | 15 +++++++++++++++
 4 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/gcc.c-torture/compile/pr93505.c

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 7132bf00d0e..f2cc0276600 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,9 @@
+2020-01-30  Jakub Jelinek  <jakub@redhat.com>
+
+	PR middle-end/93505
+	* combine.c (simplify_comparison) <case ROTATE>: Punt on out of range
+	rotate counts.
+
 2020-01-30  Andrew Stubbs  <ams@codesourcery.com>
 
 	* config/gcn/gcn.c (print_operand): Handle LTGT.
diff --git a/gcc/combine.c b/gcc/combine.c
index 0272e754297..d44b9c3bf95 100644
--- a/gcc/combine.c
+++ b/gcc/combine.c
@@ -12410,7 +12410,8 @@ simplify_comparison (enum rtx_code code, rtx *pop0, rtx *pop1)
 	     bit.  This will be converted into a ZERO_EXTRACT.  */
 	  if (const_op == 0 && sign_bit_comparison_p
 	      && CONST_INT_P (XEXP (op0, 1))
-	      && mode_width <= HOST_BITS_PER_WIDE_INT)
+	      && mode_width <= HOST_BITS_PER_WIDE_INT
+	      && UINTVAL (XEXP (op0, 1)) < mode_width)
 	    {
 	      op0 = simplify_and_const_int (NULL_RTX, mode, XEXP (op0, 0),
 					    (HOST_WIDE_INT_1U
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 269adb29e94..ce53e2c8bf8 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2020-01-30  Jakub Jelinek  <jakub@redhat.com>
+
+	PR middle-end/93505
+	* gcc.c-torture/compile/pr93505.c: New test.
+
 2020-01-30  Jeff Law  <law@redhat.com
 
 	* gcc.dg/tree-ssa/ssa-dse-26.c: Make existing dg-final scan
diff --git a/gcc/testsuite/gcc.c-torture/compile/pr93505.c b/gcc/testsuite/gcc.c-torture/compile/pr93505.c
new file mode 100644
index 00000000000..0627962eae5
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/pr93505.c
@@ -0,0 +1,15 @@
+/* PR middle-end/93505 */
+
+unsigned a;
+
+unsigned
+foo (unsigned x)
+{
+  unsigned int y = 32 - __builtin_bswap64 (-a);
+  /* This would be UB (x << 32) at runtime.  Ensure we don't
+     invoke UB in the compiler because of that (visible with
+     bootstrap-ubsan).  */
+  x = x << y | x >> (-y & 31);
+  x >>= 31;
+  return x;
+}
-- 
2.30.2