[Bug middle-end/118692] [15 Regression] ICE: in tree_to_poly_uint64, at tree.cc:3350 with out-of-bounds string ops

[rguenth at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118692

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|ice-checking                |

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Oh, and

#define bitsize_int(L) size_int_kind (L, stk_bitsizetype)
extern tree size_int_kind (poly_int64, enum size_type_kind);

so bitsize_int truncates as well.  The following fixes the ICE
but generates wrong code (the * 8 / 8 truncates/sign-extends).
The wrong-code is very old - before poly-int size_int_kind had
a HOST_WIDE_INT argument.

foo:
.LFB0:
        .cfi_startproc
        movabsq $-1079849033811971180, %rax
        movupd  -8(%rsp,%rax), %xmm0
        addpd   cf(%rip), %xmm0
        movaps  %xmm0, cf(%rip)
        ret


diff --git a/gcc/tree-eh.cc b/gcc/tree-eh.cc
index 7015189a2de..128744eebdd 100644
--- a/gcc/tree-eh.cc
+++ b/gcc/tree-eh.cc
@@ -2652,16 +2652,14 @@ range_in_array_bounds_p (tree ref)
 static bool
 bit_field_ref_in_bounds_p (tree expr)
 {
-  tree size_tree;
-  poly_uint64 size_max, min, wid, max;
-
-  size_tree = TYPE_SIZE (TREE_TYPE (TREE_OPERAND (expr, 0)));
-  if (!size_tree || !poly_int_tree_p (size_tree, &size_max))
+  tree size_tree = TYPE_SIZE (TREE_TYPE (TREE_OPERAND (expr, 0)));
+  if (!size_tree || !poly_int_tree_p (size_tree))
     return false;

-  min = bit_field_offset (expr);
-  wid = bit_field_size (expr);
-  max = min + wid;
+  poly_offset_int size_max = wi::to_poly_offset (size_tree);
+  poly_offset_int min = wi::to_poly_offset (TREE_OPERAND (expr, 2));
+  poly_offset_int wid = wi::to_poly_offset (TREE_OPERAND (expr, 1));
+  poly_offset_int max = min + wid;
   if (maybe_lt (max, min)
       || maybe_lt (size_max, max))
     return false;