https://gcc.gnu.org/g:cfe5827cb0217028ca993aec0b3d916c1f514d64
commit r16-8882-gcfe5827cb0217028ca993aec0b3d916c1f514d64 Author: Richard Biener <[email protected]> Date: Mon Apr 27 09:00:40 2026 +0200 tree-optimization/125025 - ICE with niter analysis and UBSAN The following avoids trying to compute the absolute step by negating a signed step, instead, as done in one other place already, first convert to unsigned and then negate. PR tree-optimization/125025 * tree-ssa-loop-niter.cc (number_of_iterations_ne): Avoid negation of most negative signed integer. (number_of_iterations_lt): Likewise. * gcc.dg/torture/pr125025.c: New testcase. (cherry picked from commit 6d218b0ffbd54ca438e904fccad86d226f26bb91) Diff: --- gcc/testsuite/gcc.dg/torture/pr125025.c | 20 ++++++++++++++++++++ gcc/tree-ssa-loop-niter.cc | 8 ++++---- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/gcc/testsuite/gcc.dg/torture/pr125025.c b/gcc/testsuite/gcc.dg/torture/pr125025.c new file mode 100644 index 000000000000..ba156bb69d42 --- /dev/null +++ b/gcc/testsuite/gcc.dg/torture/pr125025.c @@ -0,0 +1,20 @@ +/* { dg-do compile } */ +/* { dg-additional-options "-fsanitize=undefined" } */ + +void f2(signed char a0) +{ + signed char v4; + _Bool c7; + signed char v8 = 91; + v4 = v8 + v8; + v8 = 15 - 50; + a0 = v8 * v4; + v8 = v4 - a0; +lbl_br10: + c7 = a0 <= 0; + if (c7) + return; + v4 = v8 - 24; + a0 = a0 + v4; + goto lbl_br10; +} diff --git a/gcc/tree-ssa-loop-niter.cc b/gcc/tree-ssa-loop-niter.cc index 207bf8ccf60f..c1a807db6cba 100644 --- a/gcc/tree-ssa-loop-niter.cc +++ b/gcc/tree-ssa-loop-niter.cc @@ -988,8 +988,8 @@ number_of_iterations_ne (class loop *loop, tree type, affine_iv *iv, if BNDS->below in the result is nonnegative. */ if (tree_int_cst_sign_bit (iv->step)) { - s = fold_convert (niter_type, - fold_build1 (NEGATE_EXPR, type, iv->step)); + s = fold_build1 (NEGATE_EXPR, niter_type, + fold_convert (niter_type, iv->step)); c = fold_build2 (MINUS_EXPR, niter_type, fold_convert (niter_type, iv->base), fold_convert (niter_type, final)); @@ -1633,8 +1633,8 @@ number_of_iterations_lt (class loop *loop, tree type, affine_iv *iv0, if (integer_nonzerop (iv0->step)) step = fold_convert (niter_type, iv0->step); else - step = fold_convert (niter_type, - fold_build1 (NEGATE_EXPR, type, iv1->step)); + step = fold_build1 (NEGATE_EXPR, niter_type, + fold_convert (niter_type, iv1->step)); /* If we can determine the final value of the control iv exactly, we can transform the condition to != comparison. In particular, this will be
