/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc

Bug Summary

File:	build/gcc/tree-ssa-threadedge.cc
Warning:	line 1387, column 6 2nd function call argument is an uninitialized value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-suse-linux -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name tree-ssa-threadedge.cc -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model static -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/buildworker/marxinbox-gcc-clang-static-analyzer/objdir/gcc -resource-dir /usr/lib64/clang/15.0.7 -D IN_GCC -D HAVE_CONFIG_H -I . -I . -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/. -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../include -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libcpp/include -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libcody -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libdecnumber -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libdecnumber/bid -I ../libdecnumber -I /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libbacktrace -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/13/../../../../include/c++/13 -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/13/../../../../include/c++/13/x86_64-suse-linux -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/13/../../../../include/c++/13/backward -internal-isystem /usr/lib64/clang/15.0.7/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/13/../../../../x86_64-suse-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-narrowing -Wwrite-strings -Wno-long-long -Wno-variadic-macros -Wno-overlength-strings -fdeprecated-macro -fdebug-compilation-dir=/buildworker/marxinbox-gcc-clang-static-analyzer/objdir/gcc -ferror-limit 19 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=plist-html -analyzer-config silence-checkers=core.NullDereference -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /buildworker/marxinbox-gcc-clang-static-analyzer/objdir/clang-static-analyzer/2023-03-27-141847-20772-1/report-F1tZsu.plist -x c++ /buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc
1/* SSA Jump Threading
 Copyright (C) 2005-2023 Free Software Foundation, Inc.
 Contributed by Jeff Law  <law@redhat.com>

5This file is part of GCC.

7GCC is free software; you can redistribute it and/or modify
8it under the terms of the GNU General Public License as published by
9the Free Software Foundation; either version 3, or (at your option)
10any later version.

12GCC is distributed in the hope that it will be useful,
13but WITHOUT ANY WARRANTY; without even the implied warranty of
14MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15GNU General Public License for more details.

17You should have received a copy of the GNU General Public License
18along with GCC; see the file COPYING3.  If not see
19<http://www.gnu.org/licenses/>.  */

21#include "config.h"
22#include "system.h"
23#include "coretypes.h"
24#include "backend.h"
25#include "tree.h"
26#include "gimple.h"
27#include "predict.h"
28#include "ssa.h"
29#include "fold-const.h"
30#include "cfgloop.h"
31#include "gimple-iterator.h"
32#include "tree-cfg.h"
33#include "tree-ssa-threadupdate.h"
34#include "tree-ssa-scopedtables.h"
35#include "tree-ssa-threadedge.h"
36#include "gimple-fold.h"
37#include "cfganal.h"
38#include "alloc-pool.h"
39#include "vr-values.h"
40#include "gimple-range.h"
41#include "gimple-range-path.h"

43/* To avoid code explosion due to jump threading, we limit the
 number of statements we are going to copy.  This variable
 holds the number of statements currently seen that we'll have
 to copy as part of the jump threading process.  */
47static int stmt_count;

49/* Array to record value-handles per SSA_NAME.  */
50vec<tree> ssa_name_values;

52/* Set the value for the SSA name NAME to VALUE.  */

54void
55set_ssa_name_value (tree name, tree value)
56{
if (SSA_NAME_VERSION (name)(tree_check ((name), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 57, __FUNCTION__, (SSA_NAME)))->base.u.version >= ssa_name_values.length ())
  ssa_name_values.safe_grow_cleared (SSA_NAME_VERSION (name)(tree_check ((name), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 58, __FUNCTION__, (SSA_NAME)))->base.u.version + 1, true);
if (value && TREE_OVERFLOW_P (value)((tree_code_type_tmpl <0>::tree_code_type[(int) (((enum
 tree_code) (value)->base.code))] == tcc_constant) &&
 ((tree_class_check ((value), (tcc_constant), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 59, __FUNCTION__))->base.public_flag)))
  value = drop_tree_overflow (value);
ssa_name_values[SSA_NAME_VERSION (name)(tree_check ((name), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 61, __FUNCTION__, (SSA_NAME)))->base.u.version] = value;
62}

64jump_threader::jump_threader (jt_simplifier *simplifier, jt_state *state)
65{
/* Initialize the per SSA_NAME value-handles array.  */
gcc_assert (!ssa_name_values.exists ())((void)(!(!ssa_name_values.exists ()) ? fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 67, __FUNCTION__), 0 : 0));
ssa_name_values.create (num_ssa_names(vec_safe_length ((cfun + 0)->gimple_df->ssa_names)));

dummy_cond = gimple_build_cond (NE_EXPR, integer_zero_nodeglobal_trees[TI_INTEGER_ZERO],
		  integer_zero_nodeglobal_trees[TI_INTEGER_ZERO], NULLnullptr, NULLnullptr);

m_registry = new fwd_jt_path_registry ();
m_simplifier = simplifier;
m_state = state;
76}

78jump_threader::~jump_threader (void)
79{
ssa_name_values.release ();
ggc_free (dummy_cond);
delete m_registry;
83}

85void
86jump_threader::remove_jump_threads_including (edge_def *e)
87{
m_registry->remove_jump_threads_including (e);
89}

91bool
92jump_threader::thread_through_all_blocks (bool may_peel_loop_headers)
93{
return m_registry->thread_through_all_blocks (may_peel_loop_headers);
95}

97static inline bool
98has_phis_p (basic_block bb)
99{
return !gsi_end_p (gsi_start_phis (bb));
101}

103/* Return TRUE for a block with PHIs but no statements.  */

105static bool
106empty_block_with_phis_p (basic_block bb)
107{
return gsi_end_p (gsi_start_nondebug_bb (bb)) && has_phis_p (bb);
109}

111/* Return TRUE if we may be able to thread an incoming edge into
 BB to an outgoing edge from BB.  Return FALSE otherwise.  */

114static bool
115potentially_threadable_block (basic_block bb)
116{
gimple_stmt_iterator gsi;

/* Special case.  We can get blocks that are forwarders, but are
   not optimized away because they forward from outside a loop
   to the loop header.   We want to thread through them as we can
   sometimes thread to the loop exit, which is obviously profitable.
   The interesting case here is when the block has PHIs.  */
if (empty_block_with_phis_p (bb))
  return true;

/* If BB has a single successor or a single predecessor, then
   there is no threading opportunity.  */
if (single_succ_p (bb) || single_pred_p (bb))
  return false;

/* If BB does not end with a conditional, switch or computed goto,
   then there is no threading opportunity.  */
gsi = gsi_last_bb (bb);
if (gsi_end_p (gsi)
    || ! gsi_stmt (gsi)
    || (gimple_code (gsi_stmt (gsi)) != GIMPLE_COND
 && gimple_code (gsi_stmt (gsi)) != GIMPLE_GOTO
 && gimple_code (gsi_stmt (gsi)) != GIMPLE_SWITCH))
  return false;

return true;
143}

145/* Record temporary equivalences created by PHIs at the target of the
 edge E.

 If a PHI which prevents threading is encountered, then return FALSE
 indicating we should not thread this edge, else return TRUE.  */

151bool
152jump_threader::record_temporary_equivalences_from_phis (edge e)
153{
gphi_iterator gsi;

/* Each PHI creates a temporary equivalence, record them.
   These are context sensitive equivalences and will be removed
   later.  */
for (gsi = gsi_start_phis (e->dest); !gsi_end_p (gsi); gsi_next (&gsi))
  {
    gphi *phi = gsi.phi ();
    tree src = PHI_ARG_DEF_FROM_EDGE (phi, e)gimple_phi_arg_def (((phi)), ((e)->dest_idx));
    tree dst = gimple_phi_result (phi);

    /* If the desired argument is not the same as this PHI's result
and it is set by a PHI in E->dest, then we cannot thread
through E->dest.  */
    if (src != dst
 && TREE_CODE (src)((enum tree_code) (src)->base.code) == SSA_NAME
 && gimple_code (SSA_NAME_DEF_STMT (src)(tree_check ((src), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 170, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt) == GIMPLE_PHI
 && gimple_bb (SSA_NAME_DEF_STMT (src)(tree_check ((src), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 171, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt) == e->dest)
return false;

    /* We consider any non-virtual PHI as a statement since it
count result in a constant assignment or copy operation.  */
    if (!virtual_operand_p (dst))
stmt_count++;

    m_state->register_equiv (dst, src, /*update_range=*/true);
  }
return true;
182}

184/* Valueize hook for gimple_fold_stmt_to_constant_1.  */

186static tree
187threadedge_valueize (tree t)
188{
if (TREE_CODE (t)((enum tree_code) (t)->base.code) == SSA_NAME)
  {
    tree tem = SSA_NAME_VALUE (t)((tree_check ((t), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 191, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((t), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 191, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr);
    if (tem)
return tem;
  }
return t;
196}

198/* Try to simplify each statement in E->dest, ultimately leading to
 a simplification of the COND_EXPR at the end of E->dest.

 Record unwind information for temporary equivalences onto STACK.

 Uses M_SIMPLIFIER to further simplify statements using pass specific
 information.

 We might consider marking just those statements which ultimately
 feed the COND_EXPR.  It's not clear if the overhead of bookkeeping
 would be recovered by trying to simplify fewer statements.

 If we are able to simplify a statement into the form
 SSA_NAME = (SSA_NAME | gimple invariant), then we can record
 a context sensitive equivalence which may help us simplify
 later statements in E->dest.  */

215gimple *
216jump_threader::record_temporary_equivalences_from_stmts_at_dest (edge e)
217{
gimple *stmt = NULLnullptr;
gimple_stmt_iterator gsi;
int max_stmt_count;

max_stmt_count = param_max_jump_thread_duplication_stmtsglobal_options.x_param_max_jump_thread_duplication_stmts;

/* Walk through each statement in the block recording equivalences
   we discover.  Note any equivalences we discover are context
   sensitive (ie, are dependent on traversing E) and must be unwound
   when we're finished processing E.  */
for (gsi = gsi_start_bb (e->dest); !gsi_end_p (gsi); gsi_next (&gsi))
  {
    stmt = gsi_stmt (gsi);

    /* Ignore empty statements and labels.  */
    if (gimple_code (stmt) == GIMPLE_NOP
 || gimple_code (stmt) == GIMPLE_LABEL
 || is_gimple_debug (stmt))
continue;

    /* If the statement has volatile operands, then we assume we
cannot thread through this block.  This is overly
conservative in some ways.  */
    if (gimple_code (stmt) == GIMPLE_ASM
 && gimple_asm_volatile_p (as_a <gasm *> (stmt)))
return NULLnullptr;

    /* If the statement is a unique builtin, we cannot thread
through here.  */
    if (gimple_code (stmt) == GIMPLE_CALL
 && gimple_call_internal_p (stmt)
 && gimple_call_internal_unique_p (stmt))
return NULLnullptr;

    /* We cannot thread through __builtin_constant_p, because an
expression that is constant on two threading paths may become
non-constant (i.e.: phi) when they merge.  */
    if (gimple_call_builtin_p (stmt, BUILT_IN_CONSTANT_P))
return NULLnullptr;

    /* If duplicating this block is going to cause too much code
expansion, then do not thread through this block.  */
    stmt_count++;
    if (stmt_count > max_stmt_count)
{
 /* If any of the stmts in the PATH's dests are going to be
    killed due to threading, grow the max count
    accordingly.  */
 if (max_stmt_count
     == param_max_jump_thread_duplication_stmtsglobal_options.x_param_max_jump_thread_duplication_stmts)
   {
     max_stmt_count += estimate_threading_killed_stmts (e->dest);
     if (dump_file)
fprintf (dump_file, "threading bb %i up to %i stmts\n",
	 e->dest->index, max_stmt_count);
   }
 /* If we're still past the limit, we're done.  */
 if (stmt_count > max_stmt_count)
   return NULLnullptr;
}

    m_state->record_ranges_from_stmt (stmt, true);

    /* If this is not a statement that sets an SSA_NAME to a new
value, then do not try to simplify this statement as it will
not simplify in any way that is helpful for jump threading.  */
    if ((gimple_code (stmt) != GIMPLE_ASSIGN
         || TREE_CODE (gimple_assign_lhs (stmt))((enum tree_code) (gimple_assign_lhs (stmt))->base.code) != SSA_NAME)
        && (gimple_code (stmt) != GIMPLE_CALL
            || gimple_call_lhs (stmt) == NULL_TREE(tree) nullptr
            || TREE_CODE (gimple_call_lhs (stmt))((enum tree_code) (gimple_call_lhs (stmt))->base.code) != SSA_NAME))
continue;

    /* The result of __builtin_object_size depends on all the arguments
of a phi node. Temporarily using only one edge produces invalid
results. For example

if (x < 6)
  goto l;
else
  goto l;

l:
r = PHI <&w[2].a[1](2), &a.a[6](3)>
__builtin_object_size (r, 0)

The result of __builtin_object_size is defined to be the maximum of
remaining bytes. If we use only one edge on the phi, the result will
change to be the remaining bytes for the corresponding phi argument.

Similarly for __builtin_constant_p:

r = PHI <1(2), 2(3)>
__builtin_constant_p (r)

Both PHI arguments are constant, but x ? 1 : 2 is still not
constant.  */

    if (is_gimple_call (stmt))
{
 tree fndecl = gimple_call_fndecl (stmt);
 if (fndecl
     && fndecl_built_in_p (fndecl, BUILT_IN_NORMAL)
     && (DECL_FUNCTION_CODE (fndecl) == BUILT_IN_OBJECT_SIZE
  || DECL_FUNCTION_CODE (fndecl) == BUILT_IN_CONSTANT_P))
   continue;
}

    m_state->register_equivs_stmt (stmt, e->src, m_simplifier);
  }
return stmt;
329}

331/* Simplify the control statement at the end of the block E->dest.

 Use SIMPLIFY (a pointer to a callback function) to further simplify
 a condition using pass specific information.

 Return the simplified condition or NULL if simplification could
 not be performed.  When simplifying a GIMPLE_SWITCH, we may return
 the CASE_LABEL_EXPR that will be taken.  */

340tree
341jump_threader::simplify_control_stmt_condition (edge e, gimple *stmt)
342{
tree cond, cached_lhs;
enum gimple_code code = gimple_code (stmt);

/* For comparisons, we have to update both operands, then try
   to simplify the comparison.  */
if (code == GIMPLE_COND)
  {
    tree op0, op1;
    enum tree_code cond_code;

    op0 = gimple_cond_lhs (stmt);
    op1 = gimple_cond_rhs (stmt);
    cond_code = gimple_cond_code (stmt);

    /* Get the current value of both operands.  */
    if (TREE_CODE (op0)((enum tree_code) (op0)->base.code) == SSA_NAME)
{
 for (int i = 0; i < 2; i++)
   {
     if (TREE_CODE (op0)((enum tree_code) (op0)->base.code) == SSA_NAME
  && SSA_NAME_VALUE (op0)((tree_check ((op0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 363, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((op0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 363, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr))
op0 = SSA_NAME_VALUE (op0)((tree_check ((op0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 364, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((op0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 364, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr);
     else
break;
   }
}

    if (TREE_CODE (op1)((enum tree_code) (op1)->base.code) == SSA_NAME)
{
 for (int i = 0; i < 2; i++)
   {
     if (TREE_CODE (op1)((enum tree_code) (op1)->base.code) == SSA_NAME
  && SSA_NAME_VALUE (op1)((tree_check ((op1), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 375, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((op1), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 375, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr))
op1 = SSA_NAME_VALUE (op1)((tree_check ((op1), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 376, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((op1), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 376, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr);
     else
break;
   }
}

    const unsigned recursion_limit = 4;

    cached_lhs
= simplify_control_stmt_condition_1 (e, stmt, op0, cond_code, op1,
			     recursion_limit);

    /* If we were testing an integer/pointer against a constant,
then we can trace the value of the SSA_NAME.  If a value is
found, then the condition will collapse to a constant.

Return the SSA_NAME we want to trace back rather than the full
expression and give the threader a chance to find its value.  */
    if (cached_lhs == NULLnullptr)
{
 /* Recover the original operands.  They may have been simplified
    using context sensitive equivalences.  Those context sensitive
    equivalences may not be valid on paths.  */
 tree op0 = gimple_cond_lhs (stmt);
 tree op1 = gimple_cond_rhs (stmt);

 if ((INTEGRAL_TYPE_P (TREE_TYPE (op0))(((enum tree_code) (((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 402, __FUNCTION__))->typed.type))->base.code) == ENUMERAL_TYPE
 || ((enum tree_code) (((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 402, __FUNCTION__))->typed.type))->base.code) == BOOLEAN_TYPE
 || ((enum tree_code) (((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 402, __FUNCTION__))->typed.type))->base.code) == INTEGER_TYPE
)
      || POINTER_TYPE_P (TREE_TYPE (op0))(((enum tree_code) (((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 403, __FUNCTION__))->typed.type))->base.code) == POINTER_TYPE
 || ((enum tree_code) (((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 403, __FUNCTION__))->typed.type))->base.code) == REFERENCE_TYPE
))
     && TREE_CODE (op0)((enum tree_code) (op0)->base.code) == SSA_NAME
     && TREE_CODE (op1)((enum tree_code) (op1)->base.code) == INTEGER_CST)
   return op0;
}

    return cached_lhs;
  }

if (code == GIMPLE_SWITCH)
  cond = gimple_switch_index (as_a <gswitch *> (stmt));
else if (code == GIMPLE_GOTO)
  cond = gimple_goto_dest (stmt);
else
  gcc_unreachable ()(fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 417, __FUNCTION__));

/* We can have conditionals which just test the state of a variable
   rather than use a relational operator.  These are simpler to handle.  */
if (TREE_CODE (cond)((enum tree_code) (cond)->base.code) == SSA_NAME)
  {
    tree original_lhs = cond;
    cached_lhs = cond;

    /* Get the variable's current value from the equivalence chains.

It is possible to get loops in the SSA_NAME_VALUE chains
(consider threading the backedge of a loop where we have
a loop invariant SSA_NAME used in the condition).  */
    if (cached_lhs)
{
 for (int i = 0; i < 2; i++)
   {
     if (TREE_CODE (cached_lhs)((enum tree_code) (cached_lhs)->base.code) == SSA_NAME
  && SSA_NAME_VALUE (cached_lhs)((tree_check ((cached_lhs), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 436, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((cached_lhs), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 436, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr))
cached_lhs = SSA_NAME_VALUE (cached_lhs)((tree_check ((cached_lhs), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 437, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((cached_lhs), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 437, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr);
     else
break;
   }
}

    /* If we haven't simplified to an invariant yet, then use the
pass specific callback to try and simplify it further.  */
    if (cached_lhs && ! is_gimple_min_invariant (cached_lhs))
{
 if (code == GIMPLE_SWITCH)
   {
     /* Replace the index operand of the GIMPLE_SWITCH with any LHS
 we found before handing off to VRP.  If simplification is
        possible, the simplified value will be a CASE_LABEL_EXPR of
 the label that is proven to be taken.  */
     gswitch *dummy_switch = as_a<gswitch *> (gimple_copy (stmt));
     gimple_switch_set_index (dummy_switch, cached_lhs);
     cached_lhs = m_simplifier->simplify (dummy_switch, stmt, e->src,
				   m_state);
     ggc_free (dummy_switch);
   }
 else
   cached_lhs = m_simplifier->simplify (stmt, stmt, e->src, m_state);
}

    /* We couldn't find an invariant.  But, callers of this
function may be able to do something useful with the
unmodified destination.  */
    if (!cached_lhs)
cached_lhs = original_lhs;
  }
else
  cached_lhs = NULLnullptr;

return cached_lhs;
473}

475/* Recursive helper for simplify_control_stmt_condition.  */

477tree
478jump_threader::simplify_control_stmt_condition_1
			(edge e,
			 gimple *stmt,
			 tree op0,
			 enum tree_code cond_code,
			 tree op1,
			 unsigned limit)
485{
if (limit == 0)
  return NULL_TREE(tree) nullptr;

/* We may need to canonicalize the comparison.  For
   example, op0 might be a constant while op1 is an
   SSA_NAME.  Failure to canonicalize will cause us to
   miss threading opportunities.  */
if (tree_swap_operands_p (op0, op1))
  {
    cond_code = swap_tree_comparison (cond_code);
    std::swap (op0, op1);
  }

/* If the condition has the form (A & B) CMP 0 or (A | B) CMP 0 then
   recurse into the LHS to see if there is a simplification that
   makes this condition always true or always false along the edge
   E.  */
if ((cond_code == EQ_EXPR || cond_code == NE_EXPR)
    && TREE_CODE (op0)((enum tree_code) (op0)->base.code) == SSA_NAME
    && integer_zerop (op1))
  {
    gimple *def_stmt = SSA_NAME_DEF_STMT (op0)(tree_check ((op0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 507, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt;
    if (gimple_code (def_stmt) != GIMPLE_ASSIGN)
      ;
    else if (gimple_assign_rhs_code (def_stmt) == BIT_AND_EXPR
      || gimple_assign_rhs_code (def_stmt) == BIT_IOR_EXPR)
{
 enum tree_code rhs_code = gimple_assign_rhs_code (def_stmt);
 const tree rhs1 = gimple_assign_rhs1 (def_stmt);
 const tree rhs2 = gimple_assign_rhs2 (def_stmt);

 /* Is A != 0 ?  */
 const tree res1
   = simplify_control_stmt_condition_1 (e, def_stmt,
				 rhs1, NE_EXPR, op1,
				 limit - 1);
 if (res1 == NULL_TREE(tree) nullptr)
   ;
 else if (rhs_code == BIT_AND_EXPR && integer_zerop (res1))
   {
     /* If A == 0 then (A & B) != 0 is always false.  */
     if (cond_code == NE_EXPR)
       return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
     /* If A == 0 then (A & B) == 0 is always true.  */
     if (cond_code == EQ_EXPR)
return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
   }
 else if (rhs_code == BIT_IOR_EXPR && integer_nonzerop (res1))
   {
     /* If A != 0 then (A | B) != 0 is always true.  */
     if (cond_code == NE_EXPR)
return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
     /* If A != 0 then (A | B) == 0 is always false.  */
     if (cond_code == EQ_EXPR)
return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
   }

 /* Is B != 0 ?  */
 const tree res2
   = simplify_control_stmt_condition_1 (e, def_stmt,
				 rhs2, NE_EXPR, op1,
				 limit - 1);
 if (res2 == NULL_TREE(tree) nullptr)
   ;
 else if (rhs_code == BIT_AND_EXPR && integer_zerop (res2))
   {
     /* If B == 0 then (A & B) != 0 is always false.  */
     if (cond_code == NE_EXPR)
       return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
     /* If B == 0 then (A & B) == 0 is always true.  */
     if (cond_code == EQ_EXPR)
return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
   }
 else if (rhs_code == BIT_IOR_EXPR && integer_nonzerop (res2))
   {
     /* If B != 0 then (A | B) != 0 is always true.  */
     if (cond_code == NE_EXPR)
return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
     /* If B != 0 then (A | B) == 0 is always false.  */
     if (cond_code == EQ_EXPR)
return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
   }

 if (res1 != NULL_TREE(tree) nullptr && res2 != NULL_TREE(tree) nullptr)
   {
     if (rhs_code == BIT_AND_EXPR
  && TYPE_PRECISION (TREE_TYPE (op0))((tree_class_check ((((contains_struct_check ((op0), (TS_TYPED
), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 572, __FUNCTION__))->typed.type)), (tcc_type), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 572, __FUNCTION__))->type_common.precision) == 1
  && integer_nonzerop (res1)
  && integer_nonzerop (res2))
{
  /* If A != 0 and B != 0 then (bool)(A & B) != 0 is true.  */
  if (cond_code == NE_EXPR)
    return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
  /* If A != 0 and B != 0 then (bool)(A & B) == 0 is false.  */
  if (cond_code == EQ_EXPR)
    return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
}

     if (rhs_code == BIT_IOR_EXPR
  && integer_zerop (res1)
  && integer_zerop (res2))
{
  /* If A == 0 and B == 0 then (A | B) != 0 is false.  */
  if (cond_code == NE_EXPR)
    return boolean_false_nodeglobal_trees[TI_BOOLEAN_FALSE];
  /* If A == 0 and B == 0 then (A | B) == 0 is true.  */
  if (cond_code == EQ_EXPR)
    return boolean_true_nodeglobal_trees[TI_BOOLEAN_TRUE];
}
   }
}
    /* Handle (A CMP B) CMP 0.  */
    else if (TREE_CODE_CLASS (gimple_assign_rhs_code (def_stmt))tree_code_type_tmpl <0>::tree_code_type[(int) (gimple_assign_rhs_code
 (def_stmt))]
      == tcc_comparison)
{
 tree rhs1 = gimple_assign_rhs1 (def_stmt);
 tree rhs2 = gimple_assign_rhs2 (def_stmt);

 tree_code new_cond = gimple_assign_rhs_code (def_stmt);
 if (cond_code == EQ_EXPR)
   new_cond = invert_tree_comparison (new_cond, false);

 tree res
   = simplify_control_stmt_condition_1 (e, def_stmt,
				 rhs1, new_cond, rhs2,
				 limit - 1);
 if (res != NULL_TREE(tree) nullptr && is_gimple_min_invariant (res))
   return res;
}
  }

gimple_cond_set_code (dummy_cond, cond_code);
gimple_cond_set_lhs (dummy_cond, op0);
gimple_cond_set_rhs (dummy_cond, op1);

/* We absolutely do not care about any type conversions
   we only care about a zero/nonzero value.  */
fold_defer_overflow_warnings ();

tree res = fold_binary (cond_code, boolean_type_node, op0, op1)fold_binary_loc (((location_t) 0), cond_code, global_trees[TI_BOOLEAN_TYPE
], op0, op1);
if (res)
  while (CONVERT_EXPR_P (res)((((enum tree_code) (res)->base.code)) == NOP_EXPR || (((enum
 tree_code) (res)->base.code)) == CONVERT_EXPR))
    res = TREE_OPERAND (res, 0)(*((const_cast<tree*> (tree_operand_check ((res), (0), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 628, __FUNCTION__)))));

fold_undefer_overflow_warnings ((res && is_gimple_min_invariant (res)),
		  stmt, WARN_STRICT_OVERFLOW_CONDITIONAL);

/* If we have not simplified the condition down to an invariant,
   then use the pass specific callback to simplify the condition.  */
if (!res
    || !is_gimple_min_invariant (res))
  res = m_simplifier->simplify (dummy_cond, stmt, e->src, m_state);

return res;
640}

642/* Copy debug stmts from DEST's chain of single predecessors up to
 SRC, so that we don't lose the bindings as PHI nodes are introduced
 when DEST gains new predecessors.  */
645void
646propagate_threaded_block_debug_into (basic_block dest, basic_block src)
647{
if (!MAY_HAVE_DEBUG_BIND_STMTSglobal_options.x_flag_var_tracking_assignments)
  return;

if (!single_pred_p (dest))
  return;

gcc_checking_assert (dest != src)((void)(!(dest != src) ? fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 654, __FUNCTION__), 0 : 0));

gimple_stmt_iterator gsi = gsi_after_labels (dest);
int i = 0;
const int alloc_count = 16; // ?? Should this be a PARAM?

/* Estimate the number of debug vars overridden in the beginning of
   DEST, to tell how many we're going to need to begin with.  */
for (gimple_stmt_iterator si = gsi;
     i * 4 <= alloc_count * 3 && !gsi_end_p (si); gsi_next (&si))
  {
    gimple *stmt = gsi_stmt (si);
    if (!is_gimple_debug (stmt))
break;
    if (gimple_debug_nonbind_marker_p (stmt))
continue;
    i++;
  }

auto_vec<tree, alloc_count> fewvars;
hash_set<tree> *vars = NULLnullptr;

/* If we're already starting with 3/4 of alloc_count, go for a
   hash_set, otherwise start with an unordered stack-allocated
   VEC.  */
if (i * 4 > alloc_count * 3)
  vars = new hash_set<tree>;

/* Now go through the initial debug stmts in DEST again, this time
   actually inserting in VARS or FEWVARS.  Don't bother checking for
   duplicates in FEWVARS.  */
for (gimple_stmt_iterator si = gsi; !gsi_end_p (si); gsi_next (&si))
  {
    gimple *stmt = gsi_stmt (si);
    if (!is_gimple_debug (stmt))
break;

    tree var;

    if (gimple_debug_bind_p (stmt))
var = gimple_debug_bind_get_var (stmt);
    else if (gimple_debug_source_bind_p (stmt))
var = gimple_debug_source_bind_get_var (stmt);
    else if (gimple_debug_nonbind_marker_p (stmt))
continue;
    else
gcc_unreachable ()(fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 700, __FUNCTION__));

    if (vars)
vars->add (var);
    else
fewvars.quick_push (var);
  }

basic_block bb = dest;

do
  {
    bb = single_pred (bb);
    for (gimple_stmt_iterator si = gsi_last_bb (bb);
  !gsi_end_p (si); gsi_prev (&si))
{
 gimple *stmt = gsi_stmt (si);
 if (!is_gimple_debug (stmt))
   continue;

 tree var;

 if (gimple_debug_bind_p (stmt))
   var = gimple_debug_bind_get_var (stmt);
 else if (gimple_debug_source_bind_p (stmt))
   var = gimple_debug_source_bind_get_var (stmt);
 else if (gimple_debug_nonbind_marker_p (stmt))
   continue;
 else
   gcc_unreachable ()(fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 729, __FUNCTION__));

 /* Discard debug bind overlaps.  Unlike stmts from src,
    copied into a new block that will precede BB, debug bind
    stmts in bypassed BBs may actually be discarded if
    they're overwritten by subsequent debug bind stmts.  We
    want to copy binds for all modified variables, so that we
    retain a bind to the shared def if there is one, or to a
    newly introduced PHI node if there is one.  Our bind will
    end up reset if the value is dead, but that implies the
    variable couldn't have survived, so it's fine.  We are
    not actually running the code that performed the binds at
    this point, we're just adding binds so that they survive
    the new confluence, so markers should not be copied.  */
 if (vars && vars->add (var))
   continue;
 else if (!vars)
   {
     int i = fewvars.length ();
     while (i--)
if (fewvars[i] == var)
  break;
     if (i >= 0)
continue;
     else if (fewvars.length () < (unsigned) alloc_count)
fewvars.quick_push (var);
     else
{
  vars = new hash_set<tree>;
  for (i = 0; i < alloc_count; i++)
    vars->add (fewvars[i]);
  fewvars.release ();
  vars->add (var);
}
   }

 stmt = gimple_copy (stmt);
 /* ??? Should we drop the location of the copy to denote
    they're artificial bindings?  */
 gsi_insert_before (&gsi, stmt, GSI_NEW_STMT);
}
  }
while (bb != src && single_pred_p (bb));

if (vars)
  delete vars;
else if (fewvars.exists ())
  fewvars.release ();
777}

779/* See if TAKEN_EDGE->dest is a threadable block with no side effecs (ie, it
 need not be duplicated as part of the CFG/SSA updating process).

 If it is threadable, add it to PATH and VISITED and recurse, ultimately
 returning TRUE from the toplevel call.   Otherwise do nothing and
 return false.  */

786bool
787jump_threader::thread_around_empty_blocks (vec<jump_thread_edge *> *path,
			   edge taken_edge,
			   bitmap visited)
790{
basic_block bb = taken_edge->dest;
gimple_stmt_iterator gsi;
gimple *stmt;
tree cond;

/* The key property of these blocks is that they need not be duplicated
   when threading.  Thus they cannot have visible side effects such
   as PHI nodes.  */
if (has_phis_p (bb))
  return false;

/* Skip over DEBUG statements at the start of the block.  */
gsi = gsi_start_nondebug_bb (bb);

/* If the block has no statements, but does have a single successor, then
   it's just a forwarding block and we can thread through it trivially.

   However, note that just threading through empty blocks with single
   successors is not inherently profitable.  For the jump thread to
   be profitable, we must avoid a runtime conditional.

   By taking the return value from the recursive call, we get the
   desired effect of returning TRUE when we found a profitable jump
   threading opportunity and FALSE otherwise.

   This is particularly important when this routine is called after
   processing a joiner block.  Returning TRUE too aggressively in
   that case results in pointless duplication of the joiner block.  */
if (gsi_end_p (gsi))
  {
    if (single_succ_p (bb))
{
 taken_edge = single_succ_edge (bb);

 if ((taken_edge->flags & EDGE_DFS_BACK) != 0)
   return false;

 if (!bitmap_bit_p (visited, taken_edge->dest->index))
   {
     m_registry->push_edge (path, taken_edge, EDGE_NO_COPY_SRC_BLOCK);
     m_state->append_path (taken_edge->dest);
     bitmap_set_bit (visited, taken_edge->dest->index);
     return thread_around_empty_blocks (path, taken_edge, visited);
   }
}

    /* We have a block with no statements, but multiple successors?  */
    return false;
  }

/* The only real statements this block can have are a control
   flow altering statement.  Anything else stops the thread.  */
stmt = gsi_stmt (gsi);
if (gimple_code (stmt) != GIMPLE_COND
    && gimple_code (stmt) != GIMPLE_GOTO
    && gimple_code (stmt) != GIMPLE_SWITCH)
  return false;

/* Extract and simplify the condition.  */
cond = simplify_control_stmt_condition (taken_edge, stmt);

/* If the condition can be statically computed and we have not already
   visited the destination edge, then add the taken edge to our thread
   path.  */
if (cond != NULL_TREE(tree) nullptr
    && (is_gimple_min_invariant (cond)
 || TREE_CODE (cond)((enum tree_code) (cond)->base.code) == CASE_LABEL_EXPR))
  {
    if (TREE_CODE (cond)((enum tree_code) (cond)->base.code) == CASE_LABEL_EXPR)
taken_edge = find_edge (bb, label_to_block (cfun(cfun + 0), CASE_LABEL (cond)(*((const_cast<tree*> (tree_operand_check (((tree_check
 ((cond), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 860, __FUNCTION__, (CASE_LABEL_EXPR)))), (2), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 860, __FUNCTION__)))))));
    else
taken_edge = find_taken_edge (bb, cond);

    if (!taken_edge
 || (taken_edge->flags & EDGE_DFS_BACK) != 0)
return false;

    if (bitmap_bit_p (visited, taken_edge->dest->index))
return false;
    bitmap_set_bit (visited, taken_edge->dest->index);

    m_registry->push_edge (path, taken_edge, EDGE_NO_COPY_SRC_BLOCK);
    m_state->append_path (taken_edge->dest);

    thread_around_empty_blocks (path, taken_edge, visited);
    return true;
  }

return false;
880}

882/* We are exiting E->src, see if E->dest ends with a conditional
 jump which has a known value when reached via E.

 E->dest can have arbitrary side effects which, if threading is
 successful, will be maintained.

 Special care is necessary if E is a back edge in the CFG as we
 may have already recorded equivalences for E->dest into our
 various tables, including the result of the conditional at
 the end of E->dest.  Threading opportunities are severely
 limited in that case to avoid short-circuiting the loop
 incorrectly.

 Positive return value is success.  Zero return value is failure, but
 the block can still be duplicated as a joiner in a jump thread path,
 negative indicates the block should not be duplicated and thus is not
 suitable for a joiner in a jump threading path.  */

900int
901jump_threader::thread_through_normal_block (vec<jump_thread_edge *> *path,
			    edge e, bitmap visited)
903{
m_state->register_equivs_edge (e);

/* PHIs create temporary equivalences.
   Note that if we found a PHI that made the block non-threadable, then
   we need to bubble that up to our caller in the same manner we do
   when we prematurely stop processing statements below.  */
if (!record_temporary_equivalences_from_phis (e))
  return -1;

/* Now walk each statement recording any context sensitive
   temporary equivalences we can detect.  */
gimple *stmt = record_temporary_equivalences_from_stmts_at_dest (e);

/* There's two reasons STMT might be null, and distinguishing
   between them is important.

   First the block may not have had any statements.  For example, it
   might have some PHIs and unconditionally transfer control elsewhere.
   Such blocks are suitable for jump threading, particularly as a
   joiner block.

   The second reason would be if we did not process all the statements
   in the block (because there were too many to make duplicating the
   block profitable.   If we did not look at all the statements, then
   we may not have invalidated everything needing invalidation.  Thus
   we must signal to our caller that this block is not suitable for
   use as a joiner in a threading path.  */
if (!stmt)
  {
    /* First case.  The statement simply doesn't have any instructions, but
does have PHIs.  */
    if (empty_block_with_phis_p (e->dest))
return 0;

    /* Second case.  */
    return -1;
  }

/* If we stopped at a COND_EXPR or SWITCH_EXPR, see if we know which arm
   will be taken.  */
if (gimple_code (stmt) == GIMPLE_COND
    || gimple_code (stmt) == GIMPLE_GOTO
    || gimple_code (stmt) == GIMPLE_SWITCH)
  {
    tree cond;

    /* Extract and simplify the condition.  */
    cond = simplify_control_stmt_condition (e, stmt);

    if (!cond)
return 0;

    if (is_gimple_min_invariant (cond)
 || TREE_CODE (cond)((enum tree_code) (cond)->base.code) == CASE_LABEL_EXPR)
{
 edge taken_edge;
 if (TREE_CODE (cond)((enum tree_code) (cond)->base.code) == CASE_LABEL_EXPR)
   taken_edge = find_edge (e->dest,
		    label_to_block (cfun(cfun + 0), CASE_LABEL (cond)(*((const_cast<tree*> (tree_operand_check (((tree_check
 ((cond), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 962, __FUNCTION__, (CASE_LABEL_EXPR)))), (2), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 962, __FUNCTION__)))))));
 else
   taken_edge = find_taken_edge (e->dest, cond);

 basic_block dest = (taken_edge ? taken_edge->dest : NULLnullptr);

 /* DEST could be NULL for a computed jump to an absolute
    address.  */
 if (dest == NULLnullptr
     || dest == e->dest
     || (taken_edge->flags & EDGE_DFS_BACK) != 0
     || bitmap_bit_p (visited, dest->index))
   return 0;

 /* Only push the EDGE_START_JUMP_THREAD marker if this is
    first edge on the path.  */
 if (path->length () == 0)
   m_registry->push_edge (path, e, EDGE_START_JUMP_THREAD);

 m_registry->push_edge (path, taken_edge, EDGE_COPY_SRC_BLOCK);
 m_state->append_path (taken_edge->dest);

 /* See if we can thread through DEST as well, this helps capture
    secondary effects of threading without having to re-run DOM or
    VRP.

    We don't want to thread back to a block we have already
     visited.  This may be overly conservative.  */
 bitmap_set_bit (visited, dest->index);
 bitmap_set_bit (visited, e->dest->index);
 thread_around_empty_blocks (path, taken_edge, visited);
 return 1;
}
  }
return 0;
997}

999/* There are basic blocks look like:
 <P0>
 p0 = a CMP b ; or p0 = (INT) (a CMP b)
 goto <X>;

 <P1>
 p1 = c CMP d
 goto <X>;

 <X>
 # phi = PHI <p0 (P0), p1 (P1)>
 if (phi != 0) goto <Y>; else goto <Z>;

 Then, edge (P0,X) or (P1,X) could be marked as EDGE_START_JUMP_THREAD
 And edge (X,Y), (X,Z) is EDGE_COPY_SRC_JOINER_BLOCK

 Return true if E is (P0,X) or (P1,X)  */

1017bool
1018edge_forwards_cmp_to_conditional_jump_through_empty_bb_p (edge e)
1019{
/* See if there is only one stmt which is gcond.  */
gcond *gs;
if (!(gs = safe_dyn_cast<gcond *> (last_and_only_stmt (e->dest))))
  return false;

/* See if gcond's cond is "(phi !=/== 0/1)" in the basic block.  */
tree cond = gimple_cond_lhs (gs);
enum tree_code code = gimple_cond_code (gs);
tree rhs = gimple_cond_rhs (gs);
if (TREE_CODE (cond)((enum tree_code) (cond)->base.code) != SSA_NAME
    || (code != NE_EXPR && code != EQ_EXPR)
    || (!integer_onep (rhs) && !integer_zerop (rhs)))
  return false;
gphi *phi = dyn_cast <gphi *> (SSA_NAME_DEF_STMT (cond)(tree_check ((cond), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1033, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt);
if (phi == NULLnullptr || gimple_bb (phi) != e->dest)
  return false;

/* Check if phi's incoming value is CMP.  */
gassign *def;
tree value = PHI_ARG_DEF_FROM_EDGE (phi, e)gimple_phi_arg_def (((phi)), ((e)->dest_idx));
if (TREE_CODE (value)((enum tree_code) (value)->base.code) != SSA_NAME
    || !has_single_use (value)
    || !(def = dyn_cast <gassign *> (SSA_NAME_DEF_STMT (value)(tree_check ((value), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1042, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt)))
  return false;

/* Or if it is (INT) (a CMP b).  */
if (CONVERT_EXPR_CODE_P (gimple_assign_rhs_code (def))((gimple_assign_rhs_code (def)) == NOP_EXPR || (gimple_assign_rhs_code
 (def)) == CONVERT_EXPR))
  {
    value = gimple_assign_rhs1 (def);
    if (TREE_CODE (value)((enum tree_code) (value)->base.code) != SSA_NAME
 || !has_single_use (value)
 || !(def = dyn_cast<gassign *> (SSA_NAME_DEF_STMT (value)(tree_check ((value), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1051, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt)))
return false;
  }

if (TREE_CODE_CLASS (gimple_assign_rhs_code (def))tree_code_type_tmpl <0>::tree_code_type[(int) (gimple_assign_rhs_code
 (def))] != tcc_comparison)
  return false;

return true;
1059}

1061/* We are exiting E->src, see if E->dest ends with a conditional jump
 which has a known value when reached via E.  If so, thread the
 edge.  */

1065void
1066jump_threader::thread_across_edge (edge e)
1067{
auto_bitmap visited;

m_state->push (e);

stmt_count = 0;

vec<jump_thread_edge *> *path = m_registry->allocate_thread_path ();
bitmap_set_bit (visited, e->src->index);
bitmap_set_bit (visited, e->dest->index);

int threaded = 0;
if ((e->flags & EDGE_DFS_BACK) == 0)
  threaded = thread_through_normal_block (path, e, visited);

if (threaded > 0)
  {
    propagate_threaded_block_debug_into (path->last ()->e->dest,
			   e->dest);
    m_registry->register_jump_thread (path);
    m_state->pop ();
    return;
  }

gcc_checking_assert (path->length () == 0)((void)(!(path->length () == 0) ? fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1091, __FUNCTION__), 0 : 0));
path->release ();

if (threaded < 0)
  {
    /* The target block was deemed too big to duplicate.  Just quit
now rather than trying to use the block as a joiner in a jump
threading path.

This prevents unnecessary code growth, but more importantly if we
do not look at all the statements in the block, then we may have
missed some invalidations if we had traversed a backedge!  */
    m_state->pop ();
    return;
  }

/* We were unable to determine what out edge from E->dest is taken.  However,
  we might still be able to thread through successors of E->dest.  This
  often occurs when E->dest is a joiner block which then fans back out
  based on redundant tests.

  If so, we'll copy E->dest and redirect the appropriate predecessor to
  the copy.  Within the copy of E->dest, we'll thread one or more edges
  to points deeper in the CFG.

  This is a stopgap until we have a more structured approach to path
  isolation.  */
{
  edge taken_edge;
  edge_iterator ei;
  bool found;

  /* If E->dest has abnormal outgoing edges, then there's no guarantee
     we can safely redirect any of the edges.  Just punt those cases.  */
  FOR_EACH_EDGE (taken_edge, ei, e->dest->succs)for ((ei) = ei_start_1 (&((e->dest->succs))); ei_cond
 ((ei), &(taken_edge)); ei_next (&(ei)))
    if (taken_edge->flags & EDGE_COMPLEX(EDGE_ABNORMAL | EDGE_ABNORMAL_CALL | EDGE_EH | EDGE_PRESERVE
))
{
 m_state->pop ();
 return;
}

  /* Look at each successor of E->dest to see if we can thread through it.  */
  FOR_EACH_EDGE (taken_edge, ei, e->dest->succs)for ((ei) = ei_start_1 (&((e->dest->succs))); ei_cond
 ((ei), &(taken_edge)); ei_next (&(ei)))
    {
if ((e->flags & EDGE_DFS_BACK) != 0
   || (taken_edge->flags & EDGE_DFS_BACK) != 0)
 continue;

m_state->push (taken_edge);

/* Avoid threading to any block we have already visited.  */
bitmap_clear (visited);
bitmap_set_bit (visited, e->src->index);
bitmap_set_bit (visited, e->dest->index);
bitmap_set_bit (visited, taken_edge->dest->index);

vec<jump_thread_edge *> *path = m_registry->allocate_thread_path ();
m_registry->push_edge (path, e, EDGE_START_JUMP_THREAD);
m_registry->push_edge (path, taken_edge, EDGE_COPY_SRC_JOINER_BLOCK);

found = thread_around_empty_blocks (path, taken_edge, visited);

if (!found)
 found = thread_through_normal_block (path,
			       path->last ()->e, visited) > 0;

/* If we were able to thread through a successor of E->dest, then
  record the jump threading opportunity.  */
if (found
   || edge_forwards_cmp_to_conditional_jump_through_empty_bb_p (e))
 {
   if (taken_edge->dest != path->last ()->e->dest)
     propagate_threaded_block_debug_into (path->last ()->e->dest,
				   taken_edge->dest);
   m_registry->register_jump_thread (path);
 }
else
 path->release ();

m_state->pop ();
    }
}

m_state->pop ();
1175}

1177/* Return TRUE if BB has a single successor to a block with multiple
 incoming and outgoing edges.  */

1180bool
1181single_succ_to_potentially_threadable_block (basic_block bb)
1182{
int flags = (EDGE_IGNORE | EDGE_COMPLEX(EDGE_ABNORMAL | EDGE_ABNORMAL_CALL | EDGE_EH | EDGE_PRESERVE
) | EDGE_ABNORMAL);
return (single_succ_p (bb)
 && (single_succ_edge (bb)->flags & flags) == 0
 && potentially_threadable_block (single_succ (bb)));
1187}

1189/* Examine the outgoing edges from BB and conditionally
 try to thread them.  */

1192void
1193jump_threader::thread_outgoing_edges (basic_block bb)
1194{
int flags = (EDGE_IGNORE | EDGE_COMPLEX(EDGE_ABNORMAL | EDGE_ABNORMAL_CALL | EDGE_EH | EDGE_PRESERVE
) | EDGE_ABNORMAL);
gimple *last;

if (!flag_thread_jumpsglobal_options.x_flag_thread_jumps)
  return;

/* If we have an outgoing edge to a block with multiple incoming and
   outgoing edges, then we may be able to thread the edge, i.e., we
   may be able to statically determine which of the outgoing edges
   will be traversed when the incoming edge from BB is traversed.  */
if (single_succ_to_potentially_threadable_block (bb))
  thread_across_edge (single_succ_edge (bb));
else if ((last = last_stmt (bb))
  && gimple_code (last) == GIMPLE_COND
  && EDGE_COUNT (bb->succs)vec_safe_length (bb->succs) == 2
  && (EDGE_SUCC (bb, 0)(*(bb)->succs)[(0)]->flags & flags) == 0
  && (EDGE_SUCC (bb, 1)(*(bb)->succs)[(1)]->flags & flags) == 0)
  {
    edge true_edge, false_edge;

    extract_true_false_edges_from_block (bb, &true_edge, &false_edge);

    /* Only try to thread the edge if it reaches a target block with
more than one predecessor and more than one successor.  */
    if (potentially_threadable_block (true_edge->dest))
thread_across_edge (true_edge);

    /* Similarly for the ELSE arm.  */
    if (potentially_threadable_block (false_edge->dest))
thread_across_edge (false_edge);
  }
1226}

1228// Marker to keep track of the start of the current path.
1229const basic_block jt_state::BB_MARKER = (basic_block) -1;

1231// Record that E is being crossed.

1233void
1234jt_state::push (edge e)
1235{
m_blocks.safe_push (BB_MARKER);
if (m_blocks.length () == 1)
  m_blocks.safe_push (e->src);
m_blocks.safe_push (e->dest);
1240}

1242// Pop to the last pushed state.

1244void
1245jt_state::pop ()
1246{
if (!m_blocks.is_empty ())
  {
    while (m_blocks.last () != BB_MARKER)
m_blocks.pop ();
    // Pop marker.
    m_blocks.pop ();
  }
1254}

1256// Add BB to the list of blocks seen.

1258void
1259jt_state::append_path (basic_block bb)
1260{
gcc_checking_assert (!m_blocks.is_empty ())((void)(!(!m_blocks.is_empty ()) ? fancy_abort ("/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1261, __FUNCTION__), 0 : 0));
m_blocks.safe_push (bb);
1263}

1265void
1266jt_state::dump (FILE *out)
1267{
if (!m_blocks.is_empty ())
  {
    auto_vec<basic_block> path;
    get_path (path);
    dump_ranger (out, path);
  }
1274}

1276void
1277jt_state::debug ()
1278{
push_dump_file save (stderrstderr, TDF_DETAILS);
dump (stderrstderr);
1281}

1283// Convert the current path in jt_state into a path suitable for the
1284// path solver.  Return the resulting path in PATH.

1286void
1287jt_state::get_path (vec<basic_block> &path)
1288{
path.truncate (0);

for (int i = (int) m_blocks.length () - 1; i >= 0; --i)
  {
    basic_block bb = m_blocks[i];

    if (bb != BB_MARKER)
path.safe_push (bb);
  }
1298}

1300// Record an equivalence from DST to SRC.  If UPDATE_RANGE is TRUE,
1301// update the value range associated with DST.

1303void
1304jt_state::register_equiv (tree dest ATTRIBUTE_UNUSED__attribute__ ((__unused__)),
	  tree src ATTRIBUTE_UNUSED__attribute__ ((__unused__)),
	  bool update_range ATTRIBUTE_UNUSED__attribute__ ((__unused__)))
1307{
1308}

1310// Record any ranges calculated in STMT.  If TEMPORARY is TRUE, then
1311// this is a temporary equivalence and should be recorded into the
1312// unwind table, instead of the global table.

1314void
1315jt_state::record_ranges_from_stmt (gimple *,
		   bool temporary ATTRIBUTE_UNUSED__attribute__ ((__unused__)))
1317{
1318}

1320// Record any equivalences created by traversing E.

1322void
1323jt_state::register_equivs_edge (edge)
1324{
1325}

1327void
1328jt_state::register_equivs_stmt (gimple *stmt, basic_block bb,
		jt_simplifier *simplifier)
1330{
/* At this point we have a statement which assigns an RHS to an
   SSA_VAR on the LHS.  We want to try and simplify this statement
   to expose more context sensitive equivalences which in turn may
   allow us to simplify the condition at the end of the loop.

   Handle simple copy operations.  */
tree cached_lhs = NULLnullptr;
if (gimple_assign_single_p (stmt)
    && TREE_CODE (gimple_assign_rhs1 (stmt))((enum tree_code) (gimple_assign_rhs1 (stmt))->base.code) == SSA_NAME)
  cached_lhs = gimple_assign_rhs1 (stmt);
else
  {
    /* A statement that is not a trivial copy.
Try to fold the new expression.  Inserting the
expression into the hash table is unlikely to help.  */
    /* ???  The DOM callback below can be changed to setting
the mprts_hook around the call to thread_across_edge,
avoiding the use substitution.  */
    cached_lhs = gimple_fold_stmt_to_constant_1 (stmt,
				   threadedge_valueize);
    if (NUM_SSA_OPERANDS (stmt, SSA_OP_ALL_USES)num_ssa_operands (stmt, ((0x04) | 0x01)) != 0
1
Assuming the condition is true→
 && (!cached_lhs
2
←
Assuming 'cached_lhs' is null→
     || (TREE_CODE (cached_lhs)((enum tree_code) (cached_lhs)->base.code) != SSA_NAME
  && !is_gimple_min_invariant (cached_lhs))))
{
 /* We're going to temporarily copy propagate the operands
    and see if that allows us to simplify this statement.  */
 tree *copy;
 ssa_op_iter iter;
 use_operand_p use_p;
 unsigned int num, i = 0;

 num = NUM_SSA_OPERANDS (stmt, SSA_OP_ALL_USES)num_ssa_operands (stmt, ((0x04) | 0x01));
 copy = XALLOCAVEC (tree, num)((tree *) __builtin_alloca(sizeof (tree) * (num)));

 /* Make a copy of the uses & vuses into USES_COPY, then cprop into
    the operands.  */
 FOR_EACH_SSA_USE_OPERAND (use_p, stmt, iter, SSA_OP_ALL_USES)for (use_p = op_iter_init_use (&(iter), stmt, ((0x04) | 0x01
)); !op_iter_done (&(iter)); use_p = op_iter_next_use (&
(iter)))
3
←
Loop condition is false. Execution continues on line 1382→
   {
     tree tmp = NULLnullptr;
     tree use = USE_FROM_PTR (use_p)get_use_from_ptr (use_p);

     copy[i++] = use;
     if (TREE_CODE (use)((enum tree_code) (use)->base.code) == SSA_NAME)
tmp = SSA_NAME_VALUE (use)((tree_check ((use), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1375, __FUNCTION__, (SSA_NAME)))->base.u.version < ssa_name_values
.length () ? ssa_name_values[(tree_check ((use), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1375, __FUNCTION__, (SSA_NAME)))->base.u.version] : (tree
) nullptr);
     if (tmp)
SET_USE (use_p, tmp)set_ssa_use_from_ptr (use_p, tmp);
   }

 /* Do not pass state to avoid calling the ranger with the
    temporarily altered IL.  */
 cached_lhs = simplifier->simplify (stmt, stmt, bb, /*state=*/NULLnullptr);

 /* Restore the statement's original uses/defs.  */
 i = 0;
 FOR_EACH_SSA_USE_OPERAND (use_p, stmt, iter, SSA_OP_ALL_USES)for (use_p = op_iter_init_use (&(iter), stmt, ((0x04) | 0x01
)); !op_iter_done (&(iter)); use_p = op_iter_next_use (&
(iter)))
4
←
Assuming the condition is true→
5
←
Loop condition is true.  Entering loop body→
   SET_USE (use_p, copy[i++])set_ssa_use_from_ptr (use_p, copy[i++]);
6
←
2nd function call argument is an uninitialized value
}
  }

/* Record the context sensitive equivalence if we were able
   to simplify this statement.  */
if (cached_lhs
    && (TREE_CODE (cached_lhs)((enum tree_code) (cached_lhs)->base.code) == SSA_NAME
 || is_gimple_min_invariant (cached_lhs)))
  register_equiv (gimple_get_lhs (stmt), cached_lhs,
    /*update_range=*/false);
1398}

1400// Hybrid threader implementation.

1402hybrid_jt_simplifier::hybrid_jt_simplifier (gimple_ranger *r,
			    path_range_query *q)
1404{
m_ranger = r;
m_query = q;
1407}

1409tree
1410hybrid_jt_simplifier::simplify (gimple *stmt, gimple *, basic_block,
		jt_state *state)
1412{
auto_bitmap dependencies;
auto_vec<basic_block> path;

state->get_path (path);
compute_exit_dependencies (dependencies, path, stmt);
m_query->reset_path (path, dependencies);

if (gimple_code (stmt) == GIMPLE_COND
    || gimple_code (stmt) == GIMPLE_ASSIGN)
  {
    Value_Range r (gimple_range_type (stmt));
    tree ret;
    if (m_query->range_of_stmt (r, stmt) && r.singleton_p (&ret))
return ret;
  }
else if (gimple_code (stmt) == GIMPLE_SWITCH)
  {
    int_range_max r;
    gswitch *switch_stmt = dyn_cast <gswitch *> (stmt);
    tree index = gimple_switch_index (switch_stmt);
    if (m_query->range_of_expr (r, index, stmt))
return find_case_label_range (switch_stmt, &r);
  }
return NULLnullptr;
1437}

1439// Calculate the set of exit dependencies for a path and statement to
1440// be simplified.  This is different than the
1441// compute_exit_dependencies in the path solver because the forward
1442// threader asks questions about statements not necessarily in the
1443// path.  Using the default compute_exit_dependencies in the path
1444// solver gets noticeably less threads.

1446void
1447hybrid_jt_simplifier::compute_exit_dependencies (bitmap dependencies,
				 const vec<basic_block> &path,
				 gimple *stmt)
1450{
gori_compute &gori = m_ranger->gori ();

// Start with the imports to the final conditional.
bitmap_copy (dependencies, gori.imports (path[0]));

// Add any other interesting operands we may have missed.
if (gimple_bb (stmt) != path[0])
  {
    for (unsigned i = 0; i < gimple_num_ops (stmt); ++i)
{
 tree op = gimple_op (stmt, i);
 if (op
     && TREE_CODE (op)((enum tree_code) (op)->base.code) == SSA_NAME
     && Value_Range::supports_type_p (TREE_TYPE (op)((contains_struct_check ((op), (TS_TYPED), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1464, __FUNCTION__))->typed.type)))
   bitmap_set_bit (dependencies, SSA_NAME_VERSION (op)(tree_check ((op), "/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/tree-ssa-threadedge.cc"
, 1465, __FUNCTION__, (SSA_NAME)))->base.u.version);
}
  }
1468}