CbC/CbC_gcc: gcc/builtins.c comparison

comparison gcc/builtins.c @ 146:351920fa3827

merge

author	anatofuz <anatofuz@cr.ie.u-ryukyu.ac.jp>
date	Sun, 01 Mar 2020 16:13:28 +0900
parents	1830386684a0
children

comparison

equal deleted inserted replaced

-:8f4e72ab4e11
+:351920fa3827
 /* Expand builtin functions.
-Copyright (C) 1988-2018 Free Software Foundation, Inc.
+Copyright (C) 1988-2020 Free Software Foundation, Inc.
 This file is part of GCC.
 GCC is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free
 #include "rtl.h"
 #include "tree.h"
 #include "memmodel.h"
 #include "gimple.h"
 #include "predict.h"
-#include "params.h"
 #include "tm_p.h"
 #include "stringpool.h"
 #include "tree-vrp.h"
 #include "tree-ssanames.h"
 #include "expmed.h"
 #include "gimple-ssa-warn-restrict.h"
 #include "stor-layout.h"
 #include "calls.h"
 #include "varasm.h"
 #include "tree-object-size.h"
+#include "tree-ssa-strlen.h"
 #include "realmpfr.h"
 #include "cfgrtl.h"
 #include "except.h"
 #include "dojump.h"
 #include "explow.h"
 #include "gimple-fold.h"
 #include "intl.h"
 #include "file-prefix-map.h" /* remap_macro_filename()  */
 #include "gomp-constants.h"
 #include "omp-general.h"
+#include "tree-dfa.h"
 struct target_builtins default_target_builtins;
 #if SWITCHABLE_TARGET
 struct target_builtins *this_target_builtins = &default_target_builtins;
 #endif
 builtin_info_type builtin_info[(int)END_BUILTINS];
 /* Non-zero if __builtin_constant_p should be folded right away.  */
 bool force_folding_builtin_constant_p;
-static rtx c_readstr (const char *, scalar_int_mode);
 static int target_char_cast (tree, char *);
 static rtx get_memory_rtx (tree, tree);
 static int apply_args_size (void);
 static int apply_result_size (void);
 static rtx result_vector (int, rtx);
 static rtx expand_builtin_strncmp (tree, rtx, machine_mode);
 static rtx builtin_memcpy_read_str (void *, HOST_WIDE_INT, scalar_int_mode);
 static rtx expand_builtin_memchr (tree, rtx);
 static rtx expand_builtin_memcpy (tree, rtx);
 static rtx expand_builtin_memory_copy_args (tree dest, tree src, tree len,
-					    rtx target, tree exp, int endp);
+					    rtx target, tree exp,
+					    memop_ret retmode,
+					    bool might_overlap);
 static rtx expand_builtin_memmove (tree, rtx);
 static rtx expand_builtin_mempcpy (tree, rtx);
-static rtx expand_builtin_mempcpy_args (tree, tree, tree, rtx, tree, int);
+static rtx expand_builtin_mempcpy_args (tree, tree, tree, rtx, tree, memop_ret);
-static rtx expand_builtin_strcat (tree, rtx);
+static rtx expand_builtin_strcat (tree);
 static rtx expand_builtin_strcpy (tree, rtx);
 static rtx expand_builtin_strcpy_args (tree, tree, tree, rtx);
 static rtx expand_builtin_stpcpy (tree, rtx, machine_mode);
 static rtx expand_builtin_stpncpy (tree, rtx);
 static rtx expand_builtin_strncat (tree, rtx);
 static tree fold_builtin_isdigit (location_t, tree);
 static tree fold_builtin_fabs (location_t, tree, tree);
 static tree fold_builtin_abs (location_t, tree, tree);
 static tree fold_builtin_unordered_cmp (location_t, tree, tree, tree, enum tree_code,
 					enum tree_code);
-static tree fold_builtin_0 (location_t, tree);
-static tree fold_builtin_1 (location_t, tree, tree);
-static tree fold_builtin_2 (location_t, tree, tree, tree);
-static tree fold_builtin_3 (location_t, tree, tree, tree, tree);
 static tree fold_builtin_varargs (location_t, tree, tree*, int);
-static tree fold_builtin_strpbrk (location_t, tree, tree, tree);
+static tree fold_builtin_strpbrk (location_t, tree, tree, tree, tree);
-static tree fold_builtin_strspn (location_t, tree, tree);
+static tree fold_builtin_strspn (location_t, tree, tree, tree);
-static tree fold_builtin_strcspn (location_t, tree, tree);
+static tree fold_builtin_strcspn (location_t, tree, tree, tree);
 static rtx expand_builtin_object_size (tree);
 static rtx expand_builtin_memory_chk (tree, rtx, machine_mode,
 				      enum built_in_function);
 static void maybe_emit_chk_warning (tree, enum built_in_function);
 	      "referenced argument declared here");
 TREE_NO_WARNING (arg) = 1;
 }
 }
+/* For a call EXPR (which may be null) that expects a string argument
+and SRC as the argument, returns false if SRC is a character array
+with no terminating NUL.  When nonnull, BOUND is the number of
+characters in which to expect the terminating NUL.
+When EXPR is nonnull also issues a warning.  */
+bool
+check_nul_terminated_array (tree expr, tree src, tree bound /* = NULL_TREE */)
+{
+tree size;
+bool exact;
+tree nonstr = unterminated_array (src, &size, &exact);
+if (!nonstr)
+return true;
+/* NONSTR refers to the non-nul terminated constant array and SIZE
+is the constant size of the array in bytes.  EXACT is true when
+SIZE is exact.  */
+if (bound)
+{
+wide_int min, max;
+if (TREE_CODE (bound) == INTEGER_CST)
+	min = max = wi::to_wide (bound);
+else
+	{
+	  value_range_kind rng = get_range_info (bound, &min, &max);
+	  if (rng != VR_RANGE)
+	    return true;
+	}
+if (wi::leu_p (min, wi::to_wide (size)))
+	return true;
+}
+if (expr && !TREE_NO_WARNING (expr))
+{
+tree fndecl = get_callee_fndecl (expr);
+const char *fname = IDENTIFIER_POINTER (DECL_NAME (fndecl));
+warn_string_no_nul (EXPR_LOCATION (expr), fname, src, nonstr);
+}
+return false;
+}
 /* If EXP refers to an unterminated constant character array return
 the declaration of the object of which the array is a member or
 element and if SIZE is not null, set *SIZE to the size of
 the unterminated array and set *EXACT if the size is exact or
 clear it otherwise.  Otherwise return null.  */
 tree
 unterminated_array (tree exp, tree *size /* = NULL */, bool *exact /* = NULL */)
 {
 /* C_STRLEN will return NULL and set DECL in the info
 structure if EXP references a unterminated array.  */
-c_strlen_data data;
+c_strlen_data lendata = { };
-memset (&data, 0, sizeof (c_strlen_data));
+tree len = c_strlen (exp, 1, &lendata);
-tree len = c_strlen (exp, 1, &data);
+if (len == NULL_TREE && lendata.minlen && lendata.decl)
-if (len == NULL_TREE && data.len && data.decl)
 {
 if (size)
 	{
-	  len = data.len;
+	  len = lendata.minlen;
-	  if (data.off)
+	  if (lendata.off)
 	    {
-	      /* Constant offsets are already accounted for in data.len, but
+	      /* Constant offsets are already accounted for in LENDATA.MINLEN,
-		 not in a SSA_NAME + CST expression.  */
+		 but not in a SSA_NAME + CST expression.  */
-	      if (TREE_CODE (data.off) == INTEGER_CST)
+	      if (TREE_CODE (lendata.off) == INTEGER_CST)
 		*exact = true;
-	      else if (TREE_CODE (data.off) == PLUS_EXPR
+	      else if (TREE_CODE (lendata.off) == PLUS_EXPR
-		       && TREE_CODE (TREE_OPERAND (data.off, 1)) == INTEGER_CST)
+		       && TREE_CODE (TREE_OPERAND (lendata.off, 1)) == INTEGER_CST)
 		{
 		  /* Subtract the offset from the size of the array.  */
 		  *exact = false;
-		  tree temp = TREE_OPERAND (data.off, 1);
+		  tree temp = TREE_OPERAND (lendata.off, 1);
 		  temp = fold_convert (ssizetype, temp);
 		  len = fold_build2 (MINUS_EXPR, ssizetype, len, temp);
 		}
 	      else
 		*exact = false;
 	  else
 	    *exact = true;
 	  *size = len;
 	}
-return data.decl;
+return lendata.decl;
 }
 return NULL_TREE;
 }
 ONLY_VALUE should be nonzero if the result is not going to be emitted
 into the instruction stream and zero if it is going to be expanded.
 E.g. with i++ ? "foo" : "bar", if ONLY_VALUE is nonzero, constant 3
 is returned, otherwise NULL, since
-len = c_strlen (src, 1); if (len) expand_expr (len, ...); would not
+len = c_strlen (ARG, 1); if (len) expand_expr (len, ...); would not
 evaluate the side-effects.
 If ONLY_VALUE is two then we do not emit warnings about out-of-bound
 accesses.  Note that this implies the result is not going to be emitted
 into the instruction stream.
 Additional information about the string accessed may be recorded
-in DATA.  For example, if SRC references an unterminated string,
+in DATA.  For example, if ARG references an unterminated string,
 then the declaration will be stored in the DECL field.   If the
 length of the unterminated string can be determined, it'll be
 stored in the LEN field.  Note this length could well be different
 than what a C strlen call would return.
 4 for wide characer strings.  ELTSIZE is by default 1.
 The value returned is of type `ssizetype'.  */
 tree
-c_strlen (tree src, int only_value, c_strlen_data *data, unsigned eltsize)
+c_strlen (tree arg, int only_value, c_strlen_data *data, unsigned eltsize)
 {
 /* If we were not passed a DATA pointer, then get one to a local
 structure.  That avoids having to check DATA for NULL before
 each time we want to use it.  */
-c_strlen_data local_strlen_data;
+c_strlen_data local_strlen_data = { };
-memset (&local_strlen_data, 0, sizeof (c_strlen_data));
 if (!data)
 data = &local_strlen_data;
 gcc_checking_assert (eltsize == 1 || eltsize == 2 || eltsize == 4);
-STRIP_NOPS (src);
+tree src = STRIP_NOPS (arg);
 if (TREE_CODE (src) == COND_EXPR
 && (only_value || !TREE_SIDE_EFFECTS (TREE_OPERAND (src, 0))))
 {
 tree len1, len2;
 	return NULL_TREE;
 else if (len >= maxelts)
 	{
 	  data->decl = decl;
 	  data->off = byteoff;
-	  data->len = ssize_int (len);
+	  data->minlen = ssize_int (len);
 	  return NULL_TREE;
 	}
 /* For empty strings the result should be zero.  */
 if (len == 0)
 /* We don't know the starting offset, but we do know that the string
 	 has no internal zero bytes.  If the offset falls within the bounds
 	 of the string subtract the offset from the length of the string,
 	 and return that.  Otherwise the length is zero.  Take care to
 	 use SAVE_EXPR in case the OFFSET has side-effects.  */
-tree offsave = TREE_SIDE_EFFECTS (byteoff) ? save_expr (byteoff) : byteoff;
+tree offsave = TREE_SIDE_EFFECTS (byteoff) ? save_expr (byteoff)
-offsave = fold_convert (ssizetype, offsave);
+						 : byteoff;
+offsave = fold_convert_loc (loc, sizetype, offsave);
 tree condexp = fold_build2_loc (loc, LE_EXPR, boolean_type_node, offsave,
-				      build_int_cst (ssizetype, len));
+				      size_int (len));
-tree lenexp = size_diffop_loc (loc, ssize_int (len), offsave);
+tree lenexp = fold_build2_loc (loc, MINUS_EXPR, sizetype, size_int (len),
+				     offsave);
+lenexp = fold_convert_loc (loc, ssizetype, lenexp);
 return fold_build3_loc (loc, COND_EXPR, ssizetype, condexp, lenexp,
 			      build_zero_cst (ssizetype));
 }
 /* Offset from the beginning of the string in elements.  */
 /* If the offset is known to be out of bounds, warn, and call strlen at
 runtime.  */
 if (eltoff < 0 || eltoff >= maxelts)
 {
 /* Suppress multiple warnings for propagated constant strings.  */
 if (only_value != 2
-	  && !TREE_NO_WARNING (src))
+	  && !TREE_NO_WARNING (arg)
-{
+	  && warning_at (loc, OPT_Warray_bounds,
-	  warning_at (loc, OPT_Warray_bounds,
+			 "offset %qwi outside bounds of constant string",
-		      "offset %qwi outside bounds of constant string",
+			 eltoff))
-		      eltoff);
+	{
-TREE_NO_WARNING (src) = 1;
+	  if (decl)
-}
+	    inform (DECL_SOURCE_LOCATION (decl), "%qE declared here", decl);
+	  TREE_NO_WARNING (arg) = 1;
+	}
 return NULL_TREE;
 }
 /* If eltoff is larger than strelts but less than maxelts the
 string length is zero, since the excess memory will be zero.  */
 Set DECL/LEN so callers can examine them.  */
 if (len >= maxelts - eltoff)
 {
 data->decl = decl;
 data->off = byteoff;
-data->len = ssize_int (len);
+data->minlen = ssize_int (len);
 return NULL_TREE;
 }
 return ssize_int (len);
 }
 /* Return a constant integer corresponding to target reading
-GET_MODE_BITSIZE (MODE) bits from string constant STR.  */
+GET_MODE_BITSIZE (MODE) bits from string constant STR.  If
+NULL_TERMINATED_P, reading stops after '\0' character, all further ones
-static rtx
+are assumed to be zero, otherwise it reads as many characters
-c_readstr (const char *str, scalar_int_mode mode)
+as needed.  */
+rtx
+c_readstr (const char *str, scalar_int_mode mode,
+	   bool null_terminated_p/*=true*/)
 {
 HOST_WIDE_INT ch;
 unsigned int i, j;
 HOST_WIDE_INT tmp[MAX_BITSIZE_MODE_ANY_INT / HOST_BITS_PER_WIDE_INT];
 if (BYTES_BIG_ENDIAN != WORDS_BIG_ENDIAN
 	  && GET_MODE_SIZE (mode) >= UNITS_PER_WORD)
 	j = j + UNITS_PER_WORD - 2 * (j % UNITS_PER_WORD) - 1;
 j *= BITS_PER_UNIT;
-if (ch)
+if (ch || !null_terminated_p)
 	ch = (unsigned char) str[i];
 tmp[j / HOST_BITS_PER_WIDE_INT] |= ch << (j % HOST_BITS_PER_WIDE_INT);
 }
 wide_int c = wide_int::from_array (tmp, len, GET_MODE_PRECISION (mode));
 the buffer and use the rest of it for the stack save area, which
 is machine-dependent.  */
 mem = gen_rtx_MEM (Pmode, buf_addr);
 set_mem_alias_set (mem, setjmp_alias_set);
-emit_move_insn (mem, targetm.builtin_setjmp_frame_value ());
+emit_move_insn (mem, hard_frame_pointer_rtx);
 mem = gen_rtx_MEM (Pmode, plus_constant (Pmode, buf_addr,
 					   GET_MODE_SIZE (Pmode))),
 set_mem_alias_set (mem, setjmp_alias_set);
 /* Mark the static chain as clobbered here so life information
 doesn't get messed up for it.  */
 chain = rtx_for_static_chain (current_function_decl, true);
 if (chain && REG_P (chain))
 emit_clobber (chain);
-/* Now put in the code to restore the frame pointer, and argument
-pointer, if needed.  */
-if (! targetm.have_nonlocal_goto ())
-{
-/* First adjust our frame pointer to its actual value.  It was
-	 previously set to the start of the virtual area corresponding to
-	 the stacked variables when we branched here and now needs to be
-	 adjusted to the actual hardware fp value.
-	 Assignments to virtual registers are converted by
-	 instantiate_virtual_regs into the corresponding assignment
-	 to the underlying register (fp in this case) that makes
-	 the original assignment true.
-	 So the following insn will actually be decrementing fp by
-	 TARGET_STARTING_FRAME_OFFSET.  */
-emit_move_insn (virtual_stack_vars_rtx, hard_frame_pointer_rtx);
-/* Restoring the frame pointer also modifies the hard frame pointer.
-	 Mark it used (so that the previous assignment remains live once
-	 the frame pointer is eliminated) and clobbered (to represent the
-	 implicit update from the assignment).  */
-emit_use (hard_frame_pointer_rtx);
-emit_clobber (hard_frame_pointer_rtx);
-}
 if (!HARD_FRAME_POINTER_IS_ARG_POINTER && fixed_regs[ARG_POINTER_REGNUM])
 {
 /* If the argument pointer can be eliminated in favor of the
 	 frame pointer, we don't need to restore it.  We assume here
 	   get copied into the static_chain pointer, but it does not matter
 	   what that value is, because builtin_setjmp does not use it.  */
 	emit_insn (targetm.gen_nonlocal_goto (value, lab, stack, fp));
 else
 	{
-	  lab = copy_to_reg (lab);
 	  emit_clobber (gen_rtx_MEM (BLKmode, gen_rtx_SCRATCH (VOIDmode)));
 	  emit_clobber (gen_rtx_MEM (BLKmode, hard_frame_pointer_rtx));
+	  lab = copy_to_reg (lab);
+	  /* Restore the frame pointer and stack pointer.  We must use a
+	     temporary since the setjmp buffer may be a local.  */
+	  fp = copy_to_reg (fp);
+	  emit_stack_restore (SAVE_NONLOCAL, stack);
+	  /* Ensure the frame pointer move is not optimized.  */
+	  emit_insn (gen_blockage ());
+	  emit_clobber (hard_frame_pointer_rtx);
+	  emit_clobber (frame_pointer_rtx);
 	  emit_move_insn (hard_frame_pointer_rtx, fp);
-	  emit_stack_restore (SAVE_NONLOCAL, stack);
 	  emit_use (hard_frame_pointer_rtx);
 	  emit_use (stack_pointer_rtx);
 	  emit_indirect_jump (lab);
 	}
 /* ??? We no longer need to pass the static chain value, afaik.  */
 if (targetm.have_nonlocal_goto ())
 emit_insn (targetm.gen_nonlocal_goto (const0_rtx, r_label, r_sp, r_fp));
 else
 {
-r_label = copy_to_reg (r_label);
 emit_clobber (gen_rtx_MEM (BLKmode, gen_rtx_SCRATCH (VOIDmode)));
 emit_clobber (gen_rtx_MEM (BLKmode, hard_frame_pointer_rtx));
-/* Restore frame pointer for containing function.  */
+r_label = copy_to_reg (r_label);
+/* Restore the frame pointer and stack pointer.  We must use a
+	 temporary since the setjmp buffer may be a local.  */
+r_fp = copy_to_reg (r_fp);
+emit_stack_restore (SAVE_NONLOCAL, r_sp);
+/* Ensure the frame pointer move is not optimized.  */
+emit_insn (gen_blockage ());
+emit_clobber (hard_frame_pointer_rtx);
+emit_clobber (frame_pointer_rtx);
 emit_move_insn (hard_frame_pointer_rtx, r_fp);
-emit_stack_restore (SAVE_NONLOCAL, r_sp);
 /* USE of hard_frame_pointer_rtx added for consistency;
 	 not clear if really needed.  */
 emit_use (hard_frame_pointer_rtx);
 emit_use (stack_pointer_rtx);
 op2 = const0_rtx;
 }
 if (targetm.have_prefetch ())
 {
-struct expand_operand ops[3];
+class expand_operand ops[3];
 create_address_operand (&ops[0], op0);
 create_integer_operand (&ops[1], INTVAL (op1));
 create_integer_operand (&ops[2], INTVAL (op2));
 if (maybe_expand_insn (targetm.code_for_prefetch, 3, ops))
 if (!MEM_P (op0) && side_effects_p (op0))
 emit_insn (op0);
 }
 /* Get a MEM rtx for expression EXP which is the address of an operand
-to be used in a string instruction (cmpstrsi, movmemsi, ..).  LEN is
+to be used in a string instruction (cmpstrsi, cpymemsi, ..).  LEN is
 the maximum length of the block of memory that might be accessed or
 NULL if unknown.  */
 static rtx
 get_memory_rtx (tree exp, tree len)
 size = GET_MODE_SIZE (Pmode);
 /* Save the structure value address unless this is passed as an
 "invisible" first argument.  */
 if (struct_incoming_value)
-{
+emit_move_insn (adjust_address (registers, Pmode, size),
-emit_move_insn (adjust_address (registers, Pmode, size),
+		    copy_to_reg (struct_incoming_value));
-		      copy_to_reg (struct_incoming_value));
-size += GET_MODE_SIZE (Pmode);
-}
 /* Return the address of the block.  */
 return copy_addr_to_reg (XEXP (registers, 0));
 }
 rtx value = gen_reg_rtx (Pmode);
 emit_move_insn (value, adjust_address (arguments, Pmode, size));
 emit_move_insn (struct_value, value);
 if (REG_P (struct_value))
 	use_reg (&call_fusage, struct_value);
-size += GET_MODE_SIZE (Pmode);
 }
 /* All arguments and registers used for the call are set up by now!  */
 function = prepare_call_address (NULL, function, NULL, &call_fusage, 0, 0);
 CASE_MATHFN (POW10)
 CASE_MATHFN (REMAINDER)
 CASE_MATHFN (REMQUO)
 CASE_MATHFN_FLOATN (RINT)
 CASE_MATHFN_FLOATN (ROUND)
+CASE_MATHFN_FLOATN (ROUNDEVEN)
 CASE_MATHFN (SCALB)
 CASE_MATHFN (SCALBLN)
 CASE_MATHFN (SCALBN)
 CASE_MATHFN (SIGNBIT)
 CASE_MATHFN (SIGNIFICAND)
 icode = interclass_mathfn_icode (arg, fndecl);
 mode = TYPE_MODE (TREE_TYPE (arg));
 if (icode != CODE_FOR_nothing)
 {
-struct expand_operand ops[1];
+class expand_operand ops[1];
 rtx_insn *last = get_last_insn ();
 tree orig_arg = arg;
 /* Wrap the computation of the argument in a SAVE_EXPR, as we may
 	 need to expand the argument again.  This way, we will not perform
 tree fallback_fndecl;
 machine_mode mode;
 tree arg;
 if (!validate_arglist (exp, REAL_TYPE, VOID_TYPE))
-gcc_unreachable ();
+return NULL_RTX;
 arg = CALL_EXPR_ARG (exp, 0);
 switch (DECL_FUNCTION_CODE (fndecl))
 {
 tree arg;
 machine_mode mode;
 enum built_in_function fallback_fn = BUILT_IN_NONE;
 if (!validate_arglist (exp, REAL_TYPE, VOID_TYPE))
-gcc_unreachable ();
+return NULL_RTX;
 arg = CALL_EXPR_ARG (exp, 0);
 switch (DECL_FUNCTION_CODE (fndecl))
 {
 		       machine_mode target_mode)
 {
 if (!validate_arglist (exp, POINTER_TYPE, VOID_TYPE))
 return NULL_RTX;
-struct expand_operand ops[4];
+class expand_operand ops[4];
 rtx pat;
 tree len;
 tree src = CALL_EXPR_ARG (exp, 0);
 rtx src_reg;
 rtx_insn *before_strlen;
 tree maxobjsize = max_object_size ();
 tree func = get_callee_fndecl (exp);
 /* FIXME: Change c_strlen() to return sizetype instead of ssizetype
 so these conversions aren't necessary.  */
-c_strlen_data data;
+c_strlen_data lendata = { };
-memset (&data, 0, sizeof (c_strlen_data));
+tree len = c_strlen (src, 0, &lendata, 1);
-tree len = c_strlen (src, 0, &data, 1);
 if (len)
 len = fold_convert_loc (loc, TREE_TYPE (bound), len);
 if (TREE_CODE (bound) == INTEGER_CST)
 {
 	  && tree_int_cst_lt (maxobjsize, bound)
 	  && warning_at (loc, OPT_Wstringop_overflow_,
 			 "%K%qD specified bound %E "
 			 "exceeds maximum object size %E",
 			 exp, func, bound, maxobjsize))
-	  TREE_NO_WARNING (exp) = true;
+	TREE_NO_WARNING (exp) = true;
 bool exact = true;
 if (!len || TREE_CODE (len) != INTEGER_CST)
 	{
 	  /* Clear EXACT if LEN may be less than SRC suggests,
 	     such as in
 	       strnlen (&a[i], sizeof a)
 	     where the value of i is unknown.  Unless i's value is
 	     zero, the call is unsafe because the bound is greater. */
-	  data.decl = unterminated_array (src, &len, &exact);
+	  lendata.decl = unterminated_array (src, &len, &exact);
-	  if (!data.decl)
+	  if (!lendata.decl)
 	    return NULL_RTX;
 	}
-if (data.decl
+if (lendata.decl
 	  && !TREE_NO_WARNING (exp)
 	  && ((tree_int_cst_lt (len, bound))
 	      || !exact))
 	{
 	  location_t warnloc
 			       "of unterminated array")
 			  : G_("%K%qD specified bound %E may exceed the size "
 			       "of at most %E of unterminated array"),
 			  exp, func, bound, len))
 	    {
-	      inform (DECL_SOURCE_LOCATION (data.decl),
+	      inform (DECL_SOURCE_LOCATION (lendata.decl),
 		      "referenced argument declared here");
 	      TREE_NO_WARNING (exp) = true;
 	      return NULL_RTX;
 	    }
 	}
 enum value_range_kind rng = get_range_info (bound, &min, &max);
 if (rng != VR_RANGE)
 return NULL_RTX;
 if (!TREE_NO_WARNING (exp)
-&& wi::ltu_p (wi::to_wide (maxobjsize), min)
+&& wi::ltu_p (wi::to_wide (maxobjsize, min.get_precision ()), min)
 && warning_at (loc, OPT_Wstringop_overflow_,
 		     "%K%qD specified bound [%wu, %wu] "
 		     "exceeds maximum object size %E",
 		     exp, func, min.to_uhwi (), max.to_uhwi (), maxobjsize))
 TREE_NO_WARNING (exp) = true;
 bool exact = true;
 if (!len || TREE_CODE (len) != INTEGER_CST)
 {
-data.decl = unterminated_array (src, &len, &exact);
+lendata.decl = unterminated_array (src, &len, &exact);
-if (!data.decl)
+if (!lendata.decl)
 	return NULL_RTX;
 }
-if (data.decl
+if (lendata.decl
 && !TREE_NO_WARNING (exp)
 && (wi::ltu_p (wi::to_wide (len), min)
 	  || !exact))
 {
 location_t warnloc
 			   "the size %E of unterminated array")
 		      : G_("%K%qD specified bound [%wu, %wu] may exceed "
 			   "the size of at most %E of unterminated array"),
 		      exp, func, min.to_uhwi (), max.to_uhwi (), len))
 	{
-	  inform (DECL_SOURCE_LOCATION (data.decl),
+	  inform (DECL_SOURCE_LOCATION (lendata.decl),
 		  "referenced argument declared here");
 	  TREE_NO_WARNING (exp) = true;
 	}
 }
-if (data.decl)
+if (lendata.decl)
 return NULL_RTX;
 if (wi::gtu_p (min, wi::to_wide (len)))
 return expand_expr (len, target, target_mode, EXPAND_NORMAL);
 SIZE_MAX.
 If the call is successfully verified as safe return true, otherwise
 return false.  */
-static bool
+bool
 check_access (tree exp, tree, tree, tree dstwrite,
 	      tree maxread, tree srcstr, tree dstsize)
 {
 int opt = OPT_Wstringop_overflow_;
 	  /* Try to determine the range of lengths the source string
 	     refers to.  If it can be determined and is less than
 	     the upper bound given by MAXREAD add one to it for
 	     the terminating nul.  Otherwise, set it to one for
 	     the same reason, or to MAXREAD as appropriate.  */
-	  get_range_strlen (srcstr, range);
+	  c_strlen_data lendata = { };
+	  get_range_strlen (srcstr, &lendata, /* eltsize = */ 1);
+	  range[0] = lendata.minlen;
+	  range[1] = lendata.maxbound ? lendata.maxbound : lendata.maxlen;
 	  if (range[0] && (!maxread || TREE_CODE (maxread) == INTEGER_CST))
 	    {
 	      if (maxread && tree_int_cst_le (maxread, range[0]))
 		range[0] = range[1] = maxread;
 	      else
 location_t loc = tree_nonartificial_location (exp);
 loc = expansion_point_location_if_in_system_header (loc);
 bool warned;
 if (range[0] == range[1])
-	warned = warning_at (loc, opt,
+	warned = (func
-			     "%K%qD specified size %E "
+		  ? warning_at (loc, opt,
-			     "exceeds maximum object size %E",
+				"%K%qD specified size %E "
-			     exp, func, range[0], maxobjsize);
+				"exceeds maximum object size %E",
+				exp, func, range[0], maxobjsize)
+		  : warning_at (loc, opt,
+				"%Kspecified size %E "
+				"exceeds maximum object size %E",
+				exp, range[0], maxobjsize));
 else
-	warned = warning_at (loc, opt,
+	warned = (func
-			     "%K%qD specified size between %E and %E "
+		  ? warning_at (loc, opt,
-			     "exceeds maximum object size %E",
+				"%K%qD specified size between %E and %E "
-			     exp, func,
+				"exceeds maximum object size %E",
-			     range[0], range[1], maxobjsize);
+				exp, func,
+				range[0], range[1], maxobjsize)
+		  : warning_at (loc, opt,
+				"%Kspecified size between %E and %E "
+				"exceeds maximum object size %E",
+				exp, range[0], range[1], maxobjsize));
 if (warned)
 	TREE_NO_WARNING (exp) = true;
 return false;
 }
 	    return false;
 	  location_t loc = tree_nonartificial_location (exp);
 	  loc = expansion_point_location_if_in_system_header (loc);
+	  bool warned = false;
 	  if (dstwrite == slen && at_least_one)
 	    {
 	      /* This is a call to strcpy with a destination of 0 size
 		 and a source of unknown length.  The call will write
 		 at least one byte past the end of the destination.  */
-	      warning_at (loc, opt,
+	      warned = (func
-			  "%K%qD writing %E or more bytes into a region "
+			? warning_at (loc, opt,
-			  "of size %E overflows the destination",
+				      "%K%qD writing %E or more bytes into "
-			  exp, func, range[0], dstsize);
+				      "a region of size %E overflows "
+				      "the destination",
+				      exp, func, range[0], dstsize)
+			: warning_at (loc, opt,
+				      "%Kwriting %E or more bytes into "
+				      "a region of size %E overflows "
+				      "the destination",
+				      exp, range[0], dstsize));
 	    }
 	  else if (tree_int_cst_equal (range[0], range[1]))
-	    warning_n (loc, opt, tree_to_uhwi (range[0]),
+	    warned = (func
-		       "%K%qD writing %E byte into a region "
+		      ? warning_n (loc, opt, tree_to_uhwi (range[0]),
-		       "of size %E overflows the destination",
+				   "%K%qD writing %E byte into a region "
-		       "%K%qD writing %E bytes into a region "
+				   "of size %E overflows the destination",
-		       "of size %E overflows the destination",
+				   "%K%qD writing %E bytes into a region "
-		       exp, func, range[0], dstsize);
+				   "of size %E overflows the destination",
+				   exp, func, range[0], dstsize)
+		      : warning_n (loc, opt, tree_to_uhwi (range[0]),
+				   "%Kwriting %E byte into a region "
+				   "of size %E overflows the destination",
+				   "%Kwriting %E bytes into a region "
+				   "of size %E overflows the destination",
+				   exp, range[0], dstsize));
 	  else if (tree_int_cst_sign_bit (range[1]))
 	    {
 	      /* Avoid printing the upper bound if it's invalid.  */
-	      warning_at (loc, opt,
+	      warned = (func
-			  "%K%qD writing %E or more bytes into a region "
+			? warning_at (loc, opt,
-			  "of size %E overflows the destination",
+				      "%K%qD writing %E or more bytes into "
-			  exp, func, range[0], dstsize);
+				      "a region of size %E overflows "
+				      "the destination",
+				      exp, func, range[0], dstsize)
+			: warning_at (loc, opt,
+				      "%Kwriting %E or more bytes into "
+				      "a region of size %E overflows "
+				      "the destination",
+				      exp, range[0], dstsize));
 	    }
 	  else
-	    warning_at (loc, opt,
+	    warned = (func
-			"%K%qD writing between %E and %E bytes into "
+		      ? warning_at (loc, opt,
-			"a region of size %E overflows the destination",
+				    "%K%qD writing between %E and %E bytes "
-			exp, func, range[0], range[1],
+				    "into a region of size %E overflows "
-			dstsize);
+				    "the destination",
+				    exp, func, range[0], range[1],
+				    dstsize)
+		      : warning_at (loc, opt,
+				    "%Kwriting between %E and %E bytes "
+				    "into a region of size %E overflows "
+				    "the destination",
+				    exp, range[0], range[1],
+				    dstsize));
+	  if (warned)
+	    TREE_NO_WARNING (exp) = true;
 	  /* Return error when an overflow has been detected.  */
 	  return false;
 	}
 }
 of the destination object if known, or against the maximum size
 of an object.  */
 if (maxread)
 {
 get_size_range (maxread, range);
-/* Use the lower end for MAXREAD from now on.  */
-if (range[0])
-	maxread = range[0];
 if (range[0] && dstsize && tree_fits_uhwi_p (dstsize))
 	{
 	  location_t loc = tree_nonartificial_location (exp);
 	  loc = expansion_point_location_if_in_system_header (loc);
 	  if (tree_int_cst_lt (maxobjsize, range[0]))
 	    {
 	      if (TREE_NO_WARNING (exp))
 		return false;
+	      bool warned = false;
 	      /* Warn about crazy big sizes first since that's more
 		 likely to be meaningful than saying that the bound
 		 is greater than the object size if both are big.  */
 	      if (range[0] == range[1])
-		warning_at (loc, opt,
+		warned = (func
-			    "%K%qD specified bound %E "
+			  ? warning_at (loc, opt,
-			    "exceeds maximum object size %E",
+					"%K%qD specified bound %E "
-			    exp, func,
+					"exceeds maximum object size %E",
-			    range[0], maxobjsize);
+					exp, func, range[0], maxobjsize)
+			  : warning_at (loc, opt,
+					"%Kspecified bound %E "
+					"exceeds maximum object size %E",
+					exp, range[0], maxobjsize));
 	      else
-		warning_at (loc, opt,
+		warned = (func
-			    "%K%qD specified bound between %E and %E "
+			  ? warning_at (loc, opt,
-			    "exceeds maximum object size %E",
+					"%K%qD specified bound between "
-			    exp, func,
+					"%E and %E exceeds maximum object "
-			    range[0], range[1], maxobjsize);
+					"size %E",
+					exp, func,
+					range[0], range[1], maxobjsize)
+			  : warning_at (loc, opt,
+					"%Kspecified bound between "
+					"%E and %E exceeds maximum object "
+					"size %E",
+					exp, range[0], range[1], maxobjsize));
+	      if (warned)
+		TREE_NO_WARNING (exp) = true;
 	      return false;
 	    }
 	  if (dstsize != maxobjsize && tree_int_cst_lt (dstsize, range[0]))
 	    {
 	      if (TREE_NO_WARNING (exp))
 		return false;
+	      bool warned = false;
 	      if (tree_int_cst_equal (range[0], range[1]))
-		warning_at (loc, opt,
+		warned = (func
-			    "%K%qD specified bound %E "
+			  ? warning_at (loc, opt,
-			    "exceeds destination size %E",
+					"%K%qD specified bound %E "
-			    exp, func,
+					"exceeds destination size %E",
-			    range[0], dstsize);
+					exp, func,
+					range[0], dstsize)
+			  : warning_at (loc, opt,
+					"%Kspecified bound %E "
+					"exceeds destination size %E",
+					exp, range[0], dstsize));
 	      else
-		warning_at (loc, opt,
+		warned = (func
-			    "%K%qD specified bound between %E and %E "
+			  ? warning_at (loc, opt,
-			    "exceeds destination size %E",
+					"%K%qD specified bound between %E "
-			    exp, func,
+					"and %E exceeds destination size %E",
-			    range[0], range[1], dstsize);
+					exp, func,
+					range[0], range[1], dstsize)
+			  : warning_at (loc, opt,
+					"%Kspecified bound between %E "
+					"and %E exceeds destination size %E",
+					exp,
+					range[0], range[1], dstsize));
+	      if (warned)
+		TREE_NO_WARNING (exp) = true;
 	      return false;
 	    }
 	}
 }
 && tree_int_cst_lt (slen, range[0]))
 {
 if (TREE_NO_WARNING (exp))
 	return false;
+bool warned = false;
 location_t loc = tree_nonartificial_location (exp);
+loc = expansion_point_location_if_in_system_header (loc);
 if (tree_int_cst_equal (range[0], range[1]))
-	warning_n (loc, opt, tree_to_uhwi (range[0]),
+	warned = (func
-		   "%K%qD reading %E byte from a region of size %E",
+		  ? warning_n (loc, opt, tree_to_uhwi (range[0]),
-		   "%K%qD reading %E bytes from a region of size %E",
+			       "%K%qD reading %E byte from a region of size %E",
-		    exp, func, range[0], slen);
+			       "%K%qD reading %E bytes from a region of size %E",
+			       exp, func, range[0], slen)
+		  : warning_n (loc, opt, tree_to_uhwi (range[0]),
+			       "%Kreading %E byte from a region of size %E",
+			       "%Kreading %E bytes from a region of size %E",
+			       exp, range[0], slen));
 else if (tree_int_cst_sign_bit (range[1]))
 	{
 	  /* Avoid printing the upper bound if it's invalid.  */
-	  warning_at (loc, opt,
+	  warned = (func
-		      "%K%qD reading %E or more bytes from a region "
+		    ? warning_at (loc, opt,
-		      "of size %E",
+				  "%K%qD reading %E or more bytes from a region "
-		      exp, func, range[0], slen);
+				  "of size %E",
+				  exp, func, range[0], slen)
+		    : warning_at (loc, opt,
+				  "%Kreading %E or more bytes from a region "
+				  "of size %E",
+				  exp, range[0], slen));
 	}
 else
-	warning_at (loc, opt,
+	warned = (func
-		    "%K%qD reading between %E and %E bytes from a region "
+		  ? warning_at (loc, opt,
-		    "of size %E",
+				"%K%qD reading between %E and %E bytes from "
-		    exp, func, range[0], range[1], slen);
+				"a region of size %E",
+				exp, func, range[0], range[1], slen)
+		  : warning_at (loc, opt,
+				"%Kreading between %E and %E bytes from "
+				"a region of size %E",
+				exp, range[0], range[1], slen));
+if (warned)
+	TREE_NO_WARNING (exp) = true;
 return false;
 }
 return true;
+}
+/* If STMT is a call to an allocation function, returns the constant
+size of the object allocated by the call represented as sizetype.
+If nonnull, sets RNG1[] to the range of the size.  */
+tree
+gimple_call_alloc_size (gimple *stmt, wide_int rng1[2] /* = NULL */,
+			const vr_values *rvals /* = NULL */)
+{
+if (!stmt)
+return NULL_TREE;
+tree allocfntype;
+if (tree fndecl = gimple_call_fndecl (stmt))
+allocfntype = TREE_TYPE (fndecl);
+else
+allocfntype = gimple_call_fntype (stmt);
+if (!allocfntype)
+return NULL_TREE;
+unsigned argidx1 = UINT_MAX, argidx2 = UINT_MAX;
+tree at = lookup_attribute ("alloc_size", TYPE_ATTRIBUTES (allocfntype));
+if (!at)
+{
+if (!gimple_call_builtin_p (stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
+	return NULL_TREE;
+argidx1 = 0;
+}
+unsigned nargs = gimple_call_num_args (stmt);
+if (argidx1 == UINT_MAX)
+{
+tree atval = TREE_VALUE (at);
+if (!atval)
+	return NULL_TREE;
+argidx1 = TREE_INT_CST_LOW (TREE_VALUE (atval)) - 1;
+if (nargs <= argidx1)
+	return NULL_TREE;
+atval = TREE_CHAIN (atval);
+if (atval)
+	{
+	  argidx2 = TREE_INT_CST_LOW (TREE_VALUE (atval)) - 1;
+	  if (nargs <= argidx2)
+	    return NULL_TREE;
+	}
+}
+tree size = gimple_call_arg (stmt, argidx1);
+wide_int rng1_buf[2];
+/* If RNG1 is not set, use the buffer.  */
+if (!rng1)
+rng1 = rng1_buf;
+if (!get_range (size, rng1, rvals))
+return NULL_TREE;
+if (argidx2 > nargs && TREE_CODE (size) == INTEGER_CST)
+return fold_convert (sizetype, size);
+/* To handle ranges do the math in wide_int and return the product
+of the upper bounds as a constant.  Ignore anti-ranges.  */
+tree n = argidx2 < nargs ? gimple_call_arg (stmt, argidx2) : integer_one_node;
+wide_int rng2[2];
+if (!get_range (n, rng2, rvals))
+return NULL_TREE;
+/* Extend to the maximum precision to avoid overflow.  */
+const int prec = ADDR_MAX_PRECISION;
+rng1[0] = wide_int::from (rng1[0], prec, UNSIGNED);
+rng1[1] = wide_int::from (rng1[1], prec, UNSIGNED);
+rng2[0] = wide_int::from (rng2[0], prec, UNSIGNED);
+rng2[1] = wide_int::from (rng2[1], prec, UNSIGNED);
+/* Compute products of both bounds for the caller but return the lesser
+of SIZE_MAX and the product of the upper bounds as a constant.  */
+rng1[0] = rng1[0] * rng2[0];
+rng1[1] = rng1[1] * rng2[1];
+tree size_max = TYPE_MAX_VALUE (sizetype);
+if (wi::gtu_p (rng1[1], wi::to_wide (size_max, prec)))
+{
+rng1[1] = wi::to_wide (size_max);
+return size_max;
+}
+return wide_int_to_tree (sizetype, rng1[1]);
+}
+/* Helper for compute_objsize.  Returns the constant size of the DEST
+if it refers to a variable or field and sets *PDECL to the DECL and
+*POFF to zero.  Otherwise returns null for other nodes.  */
+static tree
+addr_decl_size (tree dest, tree *pdecl, tree *poff)
+{
+if (TREE_CODE (dest) == ADDR_EXPR)
+dest = TREE_OPERAND (dest, 0);
+if (DECL_P (dest))
+{
+*pdecl = dest;
+*poff = integer_zero_node;
+if (tree size = DECL_SIZE_UNIT (dest))
+	return TREE_CODE (size) == INTEGER_CST ? size : NULL_TREE;
+}
+if (TREE_CODE (dest) == COMPONENT_REF)
+{
+*pdecl = TREE_OPERAND (dest, 1);
+*poff = integer_zero_node;
+/* Only return constant sizes for now while callers depend on it.  */
+if (tree size = component_ref_size (dest))
+	return TREE_CODE (size) == INTEGER_CST ? size : NULL_TREE;
+}
+return NULL_TREE;
 }
 /* Helper to compute the size of the object referenced by the DEST
 expression which must have pointer type, using Object Size type
-OSTYPE (only the least significant 2 bits are used).  Return
+OSTYPE (only the least significant 2 bits are used).
-an estimate of the size of the object if successful or NULL when
+Returns an estimate of the size of the object represented as
-the size cannot be determined.  When the referenced object involves
+a sizetype constant if successful or NULL when the size cannot
-a non-constant offset in some range the returned value represents
+be determined.
-the largest size given the smallest non-negative offset in the
+When the referenced object involves a non-constant offset in some
-range.  The function is intended for diagnostics and should not
+range the returned value represents the largest size given the
-be used to influence code generation or optimization.  */
+smallest non-negative offset in the range.
+If nonnull, sets *PDECL to the decl of the referenced subobject
+if it can be determined, or to null otherwise.  Likewise, when
+POFF is nonnull *POFF is set to the offset into *PDECL.
+The function is intended for diagnostics and should not be used
+to influence code generation or optimization.  */
 tree
-compute_objsize (tree dest, int ostype)
+compute_objsize (tree dest, int ostype, tree *pdecl /* = NULL */,
-{
+		 tree *poff /* = NULL */, const vr_values *rvals /* = NULL */)
-unsigned HOST_WIDE_INT size;
+{
+tree dummy_decl = NULL_TREE;
+if (!pdecl)
+pdecl = &dummy_decl;
+tree dummy_off = NULL_TREE;
+if (!poff)
+poff = &dummy_off;
 /* Only the two least significant bits are meaningful.  */
 ostype &= 3;
-if (compute_builtin_object_size (dest, ostype, &size))
+if (ostype)
+/* Except for overly permissive calls to memcpy and other raw
+memory functions with zero OSTYPE, detect the size from simple
+DECLs first to more reliably than compute_builtin_object_size
+set *PDECL and *POFF.  */
+if (tree size = addr_decl_size (dest, pdecl, poff))
+return size;
+unsigned HOST_WIDE_INT size;
+if (compute_builtin_object_size (dest, ostype, &size, pdecl, poff))
 return build_int_cst (sizetype, size);
 if (TREE_CODE (dest) == SSA_NAME)
 {
 gimple *stmt = SSA_NAME_DEF_STMT (dest);
+if (is_gimple_call (stmt))
+	{
+	  /* If STMT is a call to an allocation function get the size
+	     from its argument(s).  If successful, also set *PDECL to
+	     DEST for the caller to include in diagnostics.  */
+	  if (tree size = gimple_call_alloc_size (stmt))
+	    {
+	      *pdecl = dest;
+	      *poff = integer_zero_node;
+	      return size;
+	    }
+	  return NULL_TREE;
+	}
 if (!is_gimple_assign (stmt))
 	return NULL_TREE;
 dest = gimple_assign_rhs1 (stmt);
 	     such an offset here and use it to adjust the constant
 	     size.  */
 	  tree off = gimple_assign_rhs2 (stmt);
 	  if (TREE_CODE (off) == INTEGER_CST)
 	    {
-	      if (tree size = compute_objsize (dest, ostype))
+	      if (tree size = compute_objsize (dest, ostype, pdecl, poff))
 		{
 		  wide_int wioff = wi::to_wide (off);
 		  wide_int wisiz = wi::to_wide (size);
 		  /* Ignore negative offsets for now.  For others,
 		     use the lower bound as the most optimistic
 		     estimate of the (remaining) size.  */
-		  if (wi::sign_mask (wioff))
+		  if (wi::neg_p (wioff))
 		    ;
-		  else if (wi::ltu_p (wioff, wisiz))
-		    return wide_int_to_tree (TREE_TYPE (size),
-					     wi::sub (wisiz, wioff));
 		  else
-		    return size_zero_node;
+		    {
+		      if (*poff)
+			{
+			  *poff = fold_convert (ptrdiff_type_node, *poff);
+			  off = fold_convert (ptrdiff_type_node, *poff);
+			  *poff = size_binop (PLUS_EXPR, *poff, off);
+			}
+		      else
+			*poff = off;
+		      if (wi::ltu_p (wioff, wisiz))
+			return wide_int_to_tree (TREE_TYPE (size),
+						 wi::sub (wisiz, wioff));
+		      return size_zero_node;
+		    }
 		}
 	    }
 	  else if (TREE_CODE (off) == SSA_NAME
-	      && INTEGRAL_TYPE_P (TREE_TYPE (off)))
+		   && INTEGRAL_TYPE_P (TREE_TYPE (off)))
 	    {
 	      wide_int min, max;
 	      enum value_range_kind rng = get_range_info (off, &min, &max);
 	      if (rng == VR_RANGE)
-		{
+		if (tree size = compute_objsize (dest, ostype, pdecl, poff))
-		  if (tree size = compute_objsize (dest, ostype))
+		  {
-		    {
+		    wide_int wisiz = wi::to_wide (size);
-		      wide_int wisiz = wi::to_wide (size);
+		    /* Ignore negative offsets for now.  For others,
-		      /* Ignore negative offsets for now.  For others,
+		       use the lower bound as the most optimistic
-			 use the lower bound as the most optimistic
+		       estimate of the (remaining)size.  */
-			 estimate of the (remaining)size.  */
+		    if (wi::neg_p (min) || wi::neg_p (max))
-		      if (wi::sign_mask (min))
+		      ;
-			;
+		    else
-		      else if (wi::ltu_p (min, wisiz))
+		      {
-			return wide_int_to_tree (TREE_TYPE (size),
+			/* FIXME: For now, since the offset is non-constant,
-						 wi::sub (wisiz, min));
+			   clear *POFF to keep it from being "misused."
-		      else
+			   Eventually *POFF will need to become a range that
+			   can be properly added to the outer offset if it
+			   too is one.  */
+			*poff = NULL_TREE;
+			if (wi::ltu_p (min, wisiz))
+			  return wide_int_to_tree (TREE_TYPE (size),
+						   wi::sub (wisiz, min));
 			return size_zero_node;
-		    }
+		      }
-		}
+		  }
 	    }
 	}
 else if (code != ADDR_EXPR)
 	return NULL_TREE;
 }
 /* Unless computing the largest size (for memcpy and other raw memory
 functions), try to determine the size of the object from its type.  */
 if (!ostype)
 return NULL_TREE;
-if (TREE_CODE (dest) != ADDR_EXPR)
+if (TREE_CODE (dest) == ARRAY_REF
-return NULL_TREE;
+|| TREE_CODE (dest) == MEM_REF)
+{
+tree ref = TREE_OPERAND (dest, 0);
+tree reftype = TREE_TYPE (ref);
+if (TREE_CODE (dest) == MEM_REF && TREE_CODE (reftype) == POINTER_TYPE)
+	{
+	  /* Give up for MEM_REFs of vector types; those may be synthesized
+	     from multiple assignments to consecutive data members.  See PR
+	     93200.
+	     FIXME: Deal with this more generally, e.g., by marking up such
+	     MEM_REFs at the time they're created.  */
+	  reftype = TREE_TYPE (reftype);
+	  if (TREE_CODE (reftype) == VECTOR_TYPE)
+	    return NULL_TREE;
+	}
+tree off = TREE_OPERAND (dest, 1);
+if (tree size = compute_objsize (ref, ostype, pdecl, poff))
+	{
+	  /* If the declaration of the destination object is known
+	     to have zero size, return zero.  */
+	  if (integer_zerop (size)
+	      && *pdecl && DECL_P (*pdecl)
+	      && *poff && integer_zerop (*poff))
+	    return size_zero_node;
+	  /* A valid offset into a declared object cannot be negative.
+	     A zero size with a zero "inner" offset is still zero size
+	     regardless of the "other" offset OFF.  */
+	  if (*poff
+	      && ((integer_zerop (*poff) && integer_zerop (size))
+		  || (TREE_CODE (*poff) == INTEGER_CST
+		      && tree_int_cst_sgn (*poff) < 0)))
+	    return size_zero_node;
+	  wide_int offrng[2];
+	  if (!get_range (off, offrng, rvals))
+	    return NULL_TREE;
+	  /* Convert to the same precision to keep wide_int from "helpfully"
+	     crashing whenever it sees other arguments.  */
+	  const unsigned sizprec = TYPE_PRECISION (sizetype);
+	  offrng[0] = wide_int::from (offrng[0], sizprec, SIGNED);
+	  offrng[1] = wide_int::from (offrng[1], sizprec, SIGNED);
+	  /* Adjust SIZE either up or down by the sum of *POFF and OFF
+	     above.  */
+	  if (TREE_CODE (dest) == ARRAY_REF)
+	    {
+	      tree lowbnd = array_ref_low_bound (dest);
+	      if (!integer_zerop (lowbnd) && tree_fits_uhwi_p (lowbnd))
+		{
+		  /* Adjust the offset by the low bound of the array
+		     domain (normally zero but 1 in Fortran).  */
+		  unsigned HOST_WIDE_INT lb = tree_to_uhwi (lowbnd);
+		  offrng[0] -= lb;
+		  offrng[1] -= lb;
+		}
+	      /* Convert the array index into a byte offset.  */
+	      tree eltype = TREE_TYPE (dest);
+	      tree tpsize = TYPE_SIZE_UNIT (eltype);
+	      if (tpsize && TREE_CODE (tpsize) == INTEGER_CST)
+		{
+		  wide_int wsz = wi::to_wide (tpsize, offrng->get_precision ());
+		  offrng[0] *= wsz;
+		  offrng[1] *= wsz;
+		}
+	      else
+		return NULL_TREE;
+	    }
+	  wide_int wisize = wi::to_wide (size);
+	  if (!*poff)
+	    {
+	      /* If the "inner" offset is unknown and the "outer" offset
+		 is either negative or less than SIZE, return the size
+		 minus the offset.  This may be overly optimistic in
+		 the first case if the inner offset happens to be less
+		 than the absolute value of the outer offset.  */
+	      if (wi::neg_p (offrng[0]))
+		return size;
+	      if (wi::ltu_p (offrng[0], wisize))
+		return build_int_cst (sizetype, (wisize - offrng[0]).to_uhwi ());
+	      return size_zero_node;
+	    }
+	  /* Convert to the same precision to keep wide_int from "helpfuly"
+	     crashing whenever it sees other argumments.  */
+	  offrng[0] = wide_int::from (offrng[0], sizprec, SIGNED);
+	  offrng[1] = wide_int::from (offrng[1], sizprec, SIGNED);
+	  tree dstoff = *poff;
+	  if (integer_zerop (*poff))
+	    *poff = off;
+	  else if (!integer_zerop (off))
+	    {
+	      *poff = fold_convert (ptrdiff_type_node, *poff);
+	      off = fold_convert (ptrdiff_type_node, off);
+	      *poff = size_binop (PLUS_EXPR, *poff, off);
+	    }
+	  if (!wi::neg_p (offrng[0]))
+	    {
+	      if (TREE_CODE (size) != INTEGER_CST)
+		return NULL_TREE;
+	      /* Return the difference between the size and the offset
+		 or zero if the offset is greater.  */
+	      wide_int wisize = wi::to_wide (size, sizprec);
+	      if (wi::ltu_p (wisize, offrng[0]))
+		return size_zero_node;
+	      return wide_int_to_tree (sizetype, wisize - offrng[0]);
+	    }
+	  wide_int dstoffrng[2];
+	  if (TREE_CODE (dstoff) == INTEGER_CST)
+	    dstoffrng[0] = dstoffrng[1] = wi::to_wide (dstoff);
+	  else if (TREE_CODE (dstoff) == SSA_NAME)
+	    {
+	      enum value_range_kind rng
+		= get_range_info (dstoff, dstoffrng, dstoffrng + 1);
+	      if (rng != VR_RANGE)
+		return NULL_TREE;
+	    }
+	  else
+	    return NULL_TREE;
+	  dstoffrng[0] = wide_int::from (dstoffrng[0], sizprec, SIGNED);
+	  dstoffrng[1] = wide_int::from (dstoffrng[1], sizprec, SIGNED);
+	  if (!wi::neg_p (dstoffrng[0]))
+	    wisize += dstoffrng[0];
+	  offrng[1] += dstoffrng[1];
+	  if (wi::neg_p (offrng[1]))
+	    return size_zero_node;
+	  return wide_int_to_tree (sizetype, wisize);
+	}
+return NULL_TREE;
+}
+/* Try simple DECLs not handled above.  */
+if (tree size = addr_decl_size (dest, pdecl, poff))
+return size;
 tree type = TREE_TYPE (dest);
 if (TREE_CODE (type) == POINTER_TYPE)
 type = TREE_TYPE (type);
 type = TYPE_MAIN_VARIANT (type);
+if (TREE_CODE (dest) == ADDR_EXPR)
+dest = TREE_OPERAND (dest, 0);
 if (TREE_CODE (type) == ARRAY_TYPE
-&& !array_at_struct_end_p (TREE_OPERAND (dest, 0)))
+&& !array_at_struct_end_p (dest))
 {
-/* Return the constant size unless it's zero (that's a zero-length
+if (tree size = TYPE_SIZE_UNIT (type))
-	 array likely at the end of a struct).  */
+	return TREE_CODE (size) == INTEGER_CST ? size : NULL_TREE;
-tree size = TYPE_SIZE_UNIT (type);
-if (size && TREE_CODE (size) == INTEGER_CST
-	  && !integer_zerop (size))
-	return size;
 }
 return NULL_TREE;
 }
 tree len = CALL_EXPR_ARG (exp, 2);
 check_memop_access (exp, dest, src, len);
 return expand_builtin_memory_copy_args (dest, src, len, target, exp,
-					  /*endp=*/ 0);
+					  /*retmode=*/ RETURN_BEGIN, false);
 }
 /* Check a call EXP to the memmove built-in for validity.
 Return NULL_RTX on both success and failure.  */
 static rtx
-expand_builtin_memmove (tree exp, rtx)
+expand_builtin_memmove (tree exp, rtx target)
 {
 if (!validate_arglist (exp,
 			 POINTER_TYPE, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
 return NULL_RTX;
 tree src = CALL_EXPR_ARG (exp, 1);
 tree len = CALL_EXPR_ARG (exp, 2);
 check_memop_access (exp, dest, src, len);
-return NULL_RTX;
+return expand_builtin_memory_copy_args (dest, src, len, target, exp,
+					  /*retmode=*/ RETURN_BEGIN, true);
 }
 /* Expand a call EXP to the mempcpy builtin.
 Return NULL_RTX if we failed; the caller should emit a normal call,
 otherwise try to get the result in TARGET, if convenient (and in
-mode MODE if that's convenient).  If ENDP is 0 return the
+mode MODE if that's convenient).  */
-destination pointer, if ENDP is 1 return the end pointer ala
-mempcpy, and if ENDP is 2 return the end pointer minus one ala
-stpcpy.  */
 static rtx
 expand_builtin_mempcpy (tree exp, rtx target)
 {
 if (!validate_arglist (exp,
 from being diagnosed again when expanding memcpy.  */
 if (!check_memop_access (exp, dest, src, len))
 return NULL_RTX;
 return expand_builtin_mempcpy_args (dest, src, len,
-				      target, exp, /*endp=*/ 1);
+				      target, exp, /*retmode=*/ RETURN_END);
 }
 /* Helper function to do the actual work for expand of memory copy family
 functions (memcpy, mempcpy, stpcpy).  Expansing should assign LEN bytes
-of memory from SRC to DEST and assign to TARGET if convenient.
+of memory from SRC to DEST and assign to TARGET if convenient.  Return
-If ENDP is 0 return the
+value is based on RETMODE argument.  */
-destination pointer, if ENDP is 1 return the end pointer ala
-mempcpy, and if ENDP is 2 return the end pointer minus one ala
-stpcpy.  */
 static rtx
 expand_builtin_memory_copy_args (tree dest, tree src, tree len,
-				 rtx target, tree exp, int endp)
+				 rtx target, tree exp, memop_ret retmode,
+				 bool might_overlap)
 {
 const char *src_str;
 unsigned int src_align = get_pointer_alignment (src);
 unsigned int dest_align = get_pointer_alignment (dest);
 rtx dest_mem, src_mem, dest_addr, len_rtx;
 unsigned int expected_align = 0;
 unsigned HOST_WIDE_INT min_size;
 unsigned HOST_WIDE_INT max_size;
 unsigned HOST_WIDE_INT probable_max_size;
+bool is_move_done;
 /* If DEST is not a pointer type, call the normal function.  */
 if (dest_align == 0)
 return NULL_RTX;
 /* If either SRC is not a pointer type, don't do this
 len_rtx = expand_normal (len);
 determine_block_size (len, len_rtx, &min_size, &max_size,
 			&probable_max_size);
 src_str = c_getstr (src);
-/* If SRC is a string constant and block move would be done
+/* If SRC is a string constant and block move would be done by
-by pieces, we can avoid loading the string from memory
+pieces, we can avoid loading the string from memory and only
-and only stored the computed constants.  */
+stored the computed constants.  This works in the overlap
+(memmove) case as well because store_by_pieces just generates a
+series of stores of constants from the string constant returned
+by c_getstr().  */
 if (src_str
 && CONST_INT_P (len_rtx)
 && (unsigned HOST_WIDE_INT) INTVAL (len_rtx) <= strlen (src_str) + 1
 && can_store_by_pieces (INTVAL (len_rtx), builtin_memcpy_read_str,
 			      CONST_CAST (char *, src_str),
 			      dest_align, false))
 {
 dest_mem = store_by_pieces (dest_mem, INTVAL (len_rtx),
 				  builtin_memcpy_read_str,
 				  CONST_CAST (char *, src_str),
-				  dest_align, false, endp);
+				  dest_align, false, retmode);
 dest_mem = force_operand (XEXP (dest_mem, 0), target);
 dest_mem = convert_memory_address (ptr_mode, dest_mem);
 return dest_mem;
 }
 src_mem = get_memory_rtx (src, len);
 set_mem_align (src_mem, src_align);
 /* Copy word part most expediently.  */
 enum block_op_methods method = BLOCK_OP_NORMAL;
-if (CALL_EXPR_TAILCALL (exp) && (endp == 0 || target == const0_rtx))
+if (CALL_EXPR_TAILCALL (exp)
+&& (retmode == RETURN_BEGIN || target == const0_rtx))
 method = BLOCK_OP_TAILCALL;
-if (endp == 1 && target != const0_rtx)
+bool use_mempcpy_call = (targetm.libc_has_fast_function (BUILT_IN_MEMPCPY)
+			   && retmode == RETURN_END
+			   && !might_overlap
+			   && target != const0_rtx);
+if (use_mempcpy_call)
 method = BLOCK_OP_NO_LIBCALL_RET;
 dest_addr = emit_block_move_hints (dest_mem, src_mem, len_rtx, method,
 				     expected_align, expected_size,
-				     min_size, max_size, probable_max_size);
+				     min_size, max_size, probable_max_size,
+				     use_mempcpy_call, &is_move_done, might_overlap);
+/* Bail out when a mempcpy call would be expanded as libcall and when
+we have a target that provides a fast implementation
+of mempcpy routine.  */
+if (!is_move_done)
+return NULL_RTX;
 if (dest_addr == pc_rtx)
 return NULL_RTX;
 if (dest_addr == 0)
 {
 dest_addr = force_operand (XEXP (dest_mem, 0), target);
 dest_addr = convert_memory_address (ptr_mode, dest_addr);
 }
-if (endp && target != const0_rtx)
+if (retmode != RETURN_BEGIN && target != const0_rtx)
 {
 dest_addr = gen_rtx_PLUS (ptr_mode, dest_addr, len_rtx);
 /* stpcpy pointer to last byte.  */
-if (endp == 2)
+if (retmode == RETURN_END_MINUS_ONE)
 	dest_addr = gen_rtx_MINUS (ptr_mode, dest_addr, const1_rtx);
 }
 return dest_addr;
 }
 static rtx
 expand_builtin_mempcpy_args (tree dest, tree src, tree len,
-			     rtx target, tree orig_exp, int endp)
+			     rtx target, tree orig_exp, memop_ret retmode)
 {
 return expand_builtin_memory_copy_args (dest, src, len, target, orig_exp,
-					  endp);
+					  retmode, false);
 }
 /* Expand into a movstr instruction, if one is available.  Return NULL_RTX if
 we failed, the caller should emit a normal call, otherwise try to
-get the result in TARGET, if convenient.  If ENDP is 0 return the
+get the result in TARGET, if convenient.
-destination pointer, if ENDP is 1 return the end pointer ala
+Return value is based on RETMODE argument.  */
-mempcpy, and if ENDP is 2 return the end pointer minus one ala
-stpcpy.  */
 static rtx
-expand_movstr (tree dest, tree src, rtx target, int endp)
+expand_movstr (tree dest, tree src, rtx target, memop_ret retmode)
 {
-struct expand_operand ops[3];
+class expand_operand ops[3];
 rtx dest_mem;
 rtx src_mem;
 if (!targetm.have_movstr ())
 return NULL_RTX;
 dest_mem = get_memory_rtx (dest, NULL);
 src_mem = get_memory_rtx (src, NULL);
-if (!endp)
+if (retmode == RETURN_BEGIN)
 {
 target = force_reg (Pmode, XEXP (dest_mem, 0));
 dest_mem = replace_equiv_address (dest_mem, target);
 }
-create_output_operand (&ops[0], endp ? target : NULL_RTX, Pmode);
+create_output_operand (&ops[0],
+			 retmode != RETURN_BEGIN ? target : NULL_RTX, Pmode);
 create_fixed_operand (&ops[1], dest_mem);
 create_fixed_operand (&ops[2], src_mem);
 if (!maybe_expand_insn (targetm.code_for_movstr, 3, ops))
 return NULL_RTX;
-if (endp && target != const0_rtx)
+if (retmode != RETURN_BEGIN && target != const0_rtx)
 {
 target = ops[0].value;
 /* movstr is supposed to set end to the address of the NUL
 	 terminator.  If the caller requested a mempcpy-like return value,
 	 adjust it.  */
-if (endp == 1)
+if (retmode == RETURN_END)
 	{
 	  rtx tem = plus_constant (GET_MODE (target),
 				   gen_lowpart (GET_MODE (target), target), 1);
 	  emit_move_insn (target, force_operand (tem, NULL_RTX));
 	}
 /* Do some very basic size validation of a call to the strcpy builtin
 given by EXP.  Return NULL_RTX to have the built-in expand to a call
 to the library function.  */
 static rtx
-expand_builtin_strcat (tree exp, rtx)
+expand_builtin_strcat (tree exp)
 {
 if (!validate_arglist (exp, POINTER_TYPE, POINTER_TYPE, VOID_TYPE)
 || !warn_stringop_overflow)
 return NULL_RTX;
 tree dest = CALL_EXPR_ARG (exp, 0);
 tree src = CALL_EXPR_ARG (exp, 1);
+/* Detect unterminated source (only).  */
+if (!check_nul_terminated_array (exp, src))
+return NULL_RTX;
 /* There is no way here to determine the length of the string in
 the destination to which the SRC string is being appended so
 just diagnose cases when the souce string is longer than
 the destination object.  */
 if (!TREE_NO_WARNING (exp))
 	warn_string_no_nul (EXPR_LOCATION (exp), "strcpy", src, nonstr);
 return NULL_RTX;
 }
-return expand_movstr (dest, src, target, /*endp=*/0);
+return expand_movstr (dest, src, target, /*retmode=*/ RETURN_BEGIN);
 }
 /* Expand a call EXP to the stpcpy builtin.
 Return NULL_RTX if we failed the caller should emit a normal call,
 otherwise try to get the result in TARGET, if convenient (and in
 /* Ensure we get an actual string whose length can be evaluated at
 	 compile-time, not an expression containing a string.  This is
 	 because the latter will potentially produce pessimized code
 	 when used to produce the return value.  */
-c_strlen_data data;
+c_strlen_data lendata = { };
-memset (&data, 0, sizeof (c_strlen_data));
 if (!c_getstr (src, NULL)
-	  || !(len = c_strlen (src, 0, &data, 1)))
+	  || !(len = c_strlen (src, 0, &lendata, 1)))
-	return expand_movstr (dst, src, target, /*endp=*/2);
+	return expand_movstr (dst, src, target,
+			      /*retmode=*/ RETURN_END_MINUS_ONE);
-if (data.decl && !TREE_NO_WARNING (exp))
-	warn_string_no_nul (EXPR_LOCATION (exp), "stpcpy", src, data.decl);
+if (lendata.decl && !TREE_NO_WARNING (exp))
+	warn_string_no_nul (EXPR_LOCATION (exp), "stpcpy", src, lendata.decl);
 lenp1 = size_binop_loc (loc, PLUS_EXPR, len, ssize_int (1));
 ret = expand_builtin_mempcpy_args (dst, src, lenp1,
-					 target, exp, /*endp=*/2);
+					 target, exp,
+					 /*retmode=*/ RETURN_END_MINUS_ONE);
 if (ret)
 	return ret;
 if (TREE_CODE (len) == INTEGER_CST)
 		  return target;
 		}
 	    }
 	}
-return expand_movstr (dst, src, target, /*endp=*/2);
+return expand_movstr (dst, src, target,
+			    /*retmode=*/ RETURN_END_MINUS_ONE);
 }
 }
 /* Expand a call EXP to the stpcpy builtin and diagnose uses of nonstring
 arguments while being careful to avoid duplicate warnings (which could
 tree dest = CALL_EXPR_ARG (exp, 0);
 tree src = CALL_EXPR_ARG (exp, 1);
 /* The exact number of bytes to write (not the maximum).  */
 tree len = CALL_EXPR_ARG (exp, 2);
+if (!check_nul_terminated_array (exp, src, len))
+return NULL_RTX;
 /* The size of the destination object.  */
 tree destsize = compute_objsize (dest, warn_stringop_overflow - 1);
 check_access (exp, dest, src, len, /*maxread=*/NULL_TREE, src, destsize);
 tree src = CALL_EXPR_ARG (exp, 1);
 tree maxread = CALL_EXPR_ARG (exp, 2);
 /* Try to determine the range of lengths that the source expression
 refers to.  */
-tree lenrange[2];
+c_strlen_data lendata = { };
-get_range_strlen (src, lenrange);
+get_range_strlen (src, &lendata, /* eltsize = */ 1);
 /* Try to verify that the destination is big enough for the shortest
 string.  */
 if (!objsize && warn_stringop_overflow)
 	 being copied.  */
 objsize = compute_objsize (dest, warn_stringop_overflow - 1);
 }
 /* Add one for the terminating nul.  */
-tree srclen = (lenrange[0]
+tree srclen = (lendata.minlen
-		 ? fold_build2 (PLUS_EXPR, size_type_node, lenrange[0],
+		 ? fold_build2 (PLUS_EXPR, size_type_node, lendata.minlen,
 				size_one_node)
 		 : NULL_TREE);
 /* The strncat function copies at most MAXREAD bytes and always appends
 the terminating nul so the specified upper bound should never be equal
 tree dest = CALL_EXPR_ARG (exp, 0);
 tree src = CALL_EXPR_ARG (exp, 1);
 /* The upper bound on the number of bytes to write.  */
 tree maxread = CALL_EXPR_ARG (exp, 2);
+/* Detect unterminated source (only).  */
+if (!check_nul_terminated_array (exp, src, maxread))
+return NULL_RTX;
 /* The length of the source sequence.  */
 tree slen = c_strlen (src, 1);
 /* Try to determine the range of lengths that the source expression
-refers to.  */
+refers to.  Since the lengths are only used for warning and not
-tree lenrange[2];
+for code generation disable strict mode below.  */
-if (slen)
+tree maxlen = slen;
-lenrange[0] = lenrange[1] = slen;
+if (!maxlen)
-else
+{
-get_range_strlen (src, lenrange);
+c_strlen_data lendata = { };
+get_range_strlen (src, &lendata, /* eltsize = */ 1);
+maxlen = lendata.maxbound;
+}
 /* Try to verify that the destination is big enough for the shortest
 string.  First try to determine the size of the destination object
 into which the source is being copied.  */
 tree destsize = compute_objsize (dest, warn_stringop_overflow - 1);
 /* Add one for the terminating nul.  */
-tree srclen = (lenrange[0]
+tree srclen = (maxlen
-		 ? fold_build2 (PLUS_EXPR, size_type_node, lenrange[0],
+		 ? fold_build2 (PLUS_EXPR, size_type_node, maxlen,
 				size_one_node)
 		 : NULL_TREE);
 /* The strncat function copies at most MAXREAD bytes and always appends
 the terminating nul so the specified upper bound should never be equal
 static rtx
 expand_builtin_strncpy (tree exp, rtx target)
 {
 location_t loc = EXPR_LOCATION (exp);
-if (validate_arglist (exp,
+if (!validate_arglist (exp,
-			POINTER_TYPE, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
+			 POINTER_TYPE, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
-{
+return NULL_RTX;
 tree dest = CALL_EXPR_ARG (exp, 0);
 tree src = CALL_EXPR_ARG (exp, 1);
 /* The number of bytes to write (not the maximum).  */
 tree len = CALL_EXPR_ARG (exp, 2);
-/* The length of the source sequence.  */
-tree slen = c_strlen (src, 1);
+if (!check_nul_terminated_array (exp, src, len))
+return NULL_RTX;
-if (warn_stringop_overflow)
-	{
+/* The length of the source sequence.  */
-	  tree destsize = compute_objsize (dest,
+tree slen = c_strlen (src, 1);
-					   warn_stringop_overflow - 1);
+if (warn_stringop_overflow)
-	  /* The number of bytes to write is LEN but check_access will also
+{
-	     check SLEN if LEN's value isn't known.  */
+tree destsize = compute_objsize (dest,
-	  check_access (exp, dest, src, len, /*maxread=*/NULL_TREE, src,
+				       warn_stringop_overflow - 1);
-			destsize);
-	}
+/* The number of bytes to write is LEN but check_access will also
+	 check SLEN if LEN's value isn't known.  */
-/* We must be passed a constant len and src parameter.  */
+check_access (exp, dest, src, len, /*maxread=*/NULL_TREE, src,
-if (!tree_fits_uhwi_p (len) || !slen || !tree_fits_uhwi_p (slen))
+		    destsize);
+}
+/* We must be passed a constant len and src parameter.  */
+if (!tree_fits_uhwi_p (len) || !slen || !tree_fits_uhwi_p (slen))
+return NULL_RTX;
+slen = size_binop_loc (loc, PLUS_EXPR, slen, ssize_int (1));
+/* We're required to pad with trailing zeros if the requested
+len is greater than strlen(s2)+1.  In that case try to
+use store_by_pieces, if it fails, punt.  */
+if (tree_int_cst_lt (slen, len))
+{
+unsigned int dest_align = get_pointer_alignment (dest);
+const char *p = c_getstr (src);
+rtx dest_mem;
+if (!p || dest_align == 0 || !tree_fits_uhwi_p (len)
+	  || !can_store_by_pieces (tree_to_uhwi (len),
+				   builtin_strncpy_read_str,
+				   CONST_CAST (char *, p),
+				   dest_align, false))
 	return NULL_RTX;
-slen = size_binop_loc (loc, PLUS_EXPR, slen, ssize_int (1));
+dest_mem = get_memory_rtx (dest, len);
+store_by_pieces (dest_mem, tree_to_uhwi (len),
-/* We're required to pad with trailing zeros if the requested
+		       builtin_strncpy_read_str,
-	 len is greater than strlen(s2)+1.  In that case try to
+		       CONST_CAST (char *, p), dest_align, false,
-	 use store_by_pieces, if it fails, punt.  */
+		       RETURN_BEGIN);
-if (tree_int_cst_lt (slen, len))
+dest_mem = force_operand (XEXP (dest_mem, 0), target);
-	{
+dest_mem = convert_memory_address (ptr_mode, dest_mem);
-	  unsigned int dest_align = get_pointer_alignment (dest);
+return dest_mem;
-	  const char *p = c_getstr (src);
+}
-	  rtx dest_mem;
-	  if (!p || dest_align == 0 || !tree_fits_uhwi_p (len)
-	      || !can_store_by_pieces (tree_to_uhwi (len),
-				       builtin_strncpy_read_str,
-				       CONST_CAST (char *, p),
-				       dest_align, false))
-	    return NULL_RTX;
-	  dest_mem = get_memory_rtx (dest, len);
-	  store_by_pieces (dest_mem, tree_to_uhwi (len),
-			   builtin_strncpy_read_str,
-			   CONST_CAST (char *, p), dest_align, false, 0);
-	  dest_mem = force_operand (XEXP (dest_mem, 0), target);
-	  dest_mem = convert_memory_address (ptr_mode, dest_mem);
-	  return dest_mem;
-	}
-}
 return NULL_RTX;
 }
 /* Callback routine for store_by_pieces.  Read GET_MODE_BITSIZE (MODE)
 bytes from constant string DATA + OFFSET and return it as target
 				  true))
 	{
 	  val_rtx = force_reg (val_mode, val_rtx);
 	  store_by_pieces (dest_mem, tree_to_uhwi (len),
 			   builtin_memset_gen_str, val_rtx, dest_align,
-			   true, 0);
+			   true, RETURN_BEGIN);
 	}
 else if (!set_storage_via_setmem (dest_mem, len_rtx, val_rtx,
 					dest_align, expected_align,
 					expected_size, min_size, max_size,
 					probable_max_size))
 if (tree_fits_uhwi_p (len)
 	  && can_store_by_pieces (tree_to_uhwi (len),
 				  builtin_memset_read_str, &c, dest_align,
 				  true))
 	store_by_pieces (dest_mem, tree_to_uhwi (len),
-			 builtin_memset_read_str, &c, dest_align, true, 0);
+			 builtin_memset_read_str, &c, dest_align, true,
+			 RETURN_BEGIN);
 else if (!set_storage_via_setmem (dest_mem, len_rtx,
 					gen_int_mode (c, val_mode),
 					dest_align, expected_align,
 					expected_size, min_size, max_size,
 					probable_max_size))
 machine_mode insn_mode = insn_data[icode].operand[0].mode;
 if (target && (!REG_P (target) || HARD_REGISTER_P (target)))
 target = NULL_RTX;
-struct expand_operand ops[4];
+class expand_operand ops[4];
 create_output_operand (&ops[0], target, insn_mode);
 create_fixed_operand (&ops[1], arg1_rtx);
 create_fixed_operand (&ops[2], arg2_rtx);
 create_integer_operand (&ops[3], align);
 if (maybe_expand_insn (icode, 4, ops))
 expand_builtin_strcmp (tree exp, ATTRIBUTE_UNUSED rtx target)
 {
 if (!validate_arglist (exp, POINTER_TYPE, POINTER_TYPE, VOID_TYPE))
 return NULL_RTX;
+tree arg1 = CALL_EXPR_ARG (exp, 0);
+tree arg2 = CALL_EXPR_ARG (exp, 1);
+if (!check_nul_terminated_array (exp, arg1)
+|| !check_nul_terminated_array (exp, arg2))
+return NULL_RTX;
 /* Due to the performance benefit, always inline the calls first.  */
 rtx result = NULL_RTX;
 result = inline_expand_builtin_string_cmp (exp, target);
 if (result)
 return result;
 insn_code cmpstr_icode = direct_optab_handler (cmpstr_optab, SImode);
 insn_code cmpstrn_icode = direct_optab_handler (cmpstrn_optab, SImode);
 if (cmpstr_icode == CODE_FOR_nothing && cmpstrn_icode == CODE_FOR_nothing)
 return NULL_RTX;
-tree arg1 = CALL_EXPR_ARG (exp, 0);
-tree arg2 = CALL_EXPR_ARG (exp, 1);
 unsigned int arg1_align = get_pointer_alignment (arg1) / BITS_PER_UNIT;
 unsigned int arg2_align = get_pointer_alignment (arg2) / BITS_PER_UNIT;
 /* If we don't have POINTER_TYPE, call the function.  */
 {
 if (!validate_arglist (exp,
 			 POINTER_TYPE, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
 return NULL_RTX;
+tree arg1 = CALL_EXPR_ARG (exp, 0);
+tree arg2 = CALL_EXPR_ARG (exp, 1);
+tree arg3 = CALL_EXPR_ARG (exp, 2);
+if (!check_nul_terminated_array (exp, arg1, arg3)
+|| !check_nul_terminated_array (exp, arg2, arg3))
+return NULL_RTX;
 /* Due to the performance benefit, always inline the calls first.  */
 rtx result = NULL_RTX;
 result = inline_expand_builtin_string_cmp (exp, target);
 if (result)
 return result;
 insn_code cmpstrn_icode = direct_optab_handler (cmpstrn_optab, SImode);
 if (cmpstrn_icode == CODE_FOR_nothing)
 return NULL_RTX;
 tree len;
-tree arg1 = CALL_EXPR_ARG (exp, 0);
-tree arg2 = CALL_EXPR_ARG (exp, 1);
-tree arg3 = CALL_EXPR_ARG (exp, 2);
 unsigned int arg1_align = get_pointer_alignment (arg1) / BITS_PER_UNIT;
 unsigned int arg2_align = get_pointer_alignment (arg2) / BITS_PER_UNIT;
 tree len1 = c_strlen (arg1, 1);
 of a variable-sized object, it cannot accumulate.  */
 result
 = allocate_dynamic_stack_space (op0, 0, align, max_size, alloca_for_var);
 result = convert_memory_address (ptr_mode, result);
+/* Dynamic allocations for variables are recorded during gimplification.  */
+if (!alloca_for_var && (flag_callgraph_info & CALLGRAPH_INFO_DYNAMIC_ALLOC))
+record_dynamic_alloc (exp);
 return result;
 }
 /* Emit a call to __asan_allocas_unpoison call in EXP.  Add to second argument
 of the call virtual_stack_dynamic_rtx - stack_pointer_rtx, which is the
 return const0_rtx;
 }
 if (targetm.have_clear_cache ())
 {
-struct expand_operand ops[2];
+class expand_operand ops[2];
 begin = CALL_EXPR_ARG (exp, 0);
 begin_rtx = expand_expr (begin, NULL_RTX, Pmode, EXPAND_NORMAL);
 end = CALL_EXPR_ARG (exp, 1);
 t_chain = CALL_EXPR_ARG (exp, 2);
 r_descr = expand_normal (t_descr);
 m_descr = gen_rtx_MEM (BLKmode, r_descr);
 MEM_NOTRAP_P (m_descr) = 1;
+set_mem_align (m_descr, GET_MODE_ALIGNMENT (ptr_mode));
 r_func = expand_normal (t_func);
 r_chain = expand_normal (t_chain);
 /* Generate insns to initialize the descriptor.  */
 static rtx
 expand_builtin_fork_or_exec (tree fn, tree exp, rtx target, int ignore)
 {
 tree id, decl;
 tree call;
+if (DECL_FUNCTION_CODE (fn) != BUILT_IN_FORK)
+{
+/* Detect unterminated path.  */
+if (!check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0)))
+	return NULL_RTX;
+/* Also detect unterminated first argument.  */
+switch (DECL_FUNCTION_CODE (fn))
+	{
+	case BUILT_IN_EXECL:
+	case BUILT_IN_EXECLE:
+	case BUILT_IN_EXECLP:
+	  if (!check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0)))
+	    return NULL_RTX;
+	default:
+	  break;
+	}
+}
 /* If we are not profiling, just call the function.  */
 if (!profile_arc_flag)
 return NULL_RTX;
 static enum memmodel
 get_memmodel (tree exp)
 {
 rtx op;
 unsigned HOST_WIDE_INT val;
-source_location loc
+location_t loc
 = expansion_point_location_if_in_system_header (input_location);
 /* If the parameter is not a constant, it's a run time value so we'll just
 convert it to MEMMODEL_SEQ_CST to avoid annoying runtime checking.  */
 if (TREE_CODE (exp) != INTEGER_CST)
 rtx expect, desired, mem, oldval;
 rtx_code_label *label;
 enum memmodel success, failure;
 tree weak;
 bool is_weak;
-source_location loc
+location_t loc
 = expansion_point_location_if_in_system_header (input_location);
 success = get_memmodel (CALL_EXPR_ARG (exp, 4));
 failure = get_memmodel (CALL_EXPR_ARG (exp, 5));
 machine_mode mode = int_mode_for_size (BITS_PER_UNIT * size, 0).require ();
 rtx expect, desired, mem, oldval, boolret;
 enum memmodel success, failure;
 tree lhs;
 bool is_weak;
-source_location loc
+location_t loc
 = expansion_point_location_if_in_system_header (gimple_location (call));
 success = get_memmodel (gimple_call_arg (call, 4));
 failure = get_memmodel (gimple_call_arg (call, 5));
 enum memmodel model;
 model = get_memmodel (CALL_EXPR_ARG (exp, 1));
 if (is_mm_release (model) || is_mm_acq_rel (model))
 {
-source_location loc
+location_t loc
 	= expansion_point_location_if_in_system_header (input_location);
 warning_at (loc, OPT_Winvalid_memory_model,
 		  "invalid memory model for %<__atomic_load%>");
 model = MEMMODEL_SEQ_CST;
 }
 model = get_memmodel (CALL_EXPR_ARG (exp, 2));
 if (!(is_mm_relaxed (model) || is_mm_seq_cst (model)
 	|| is_mm_release (model)))
 {
-source_location loc
+location_t loc
 	= expansion_point_location_if_in_system_header (input_location);
 warning_at (loc, OPT_Winvalid_memory_model,
 		  "invalid memory model for %<__atomic_store%>");
 model = MEMMODEL_SEQ_CST;
 }
 STRIP_NOPS (addr);
 gcc_assert (TREE_OPERAND (addr, 0) == fndecl);
 TREE_OPERAND (addr, 0) = builtin_decl_explicit (ext_call);
-/* If we will emit code after the call, the call can not be a tail call.
+/* If we will emit code after the call, the call cannot be a tail call.
 If it is emitted as a tail call, a barrier is emitted after it, and
 then all trailing code is removed.  */
 if (!ignore)
 CALL_EXPR_TAILCALL (exp) = 0;
 tree lhs = gimple_call_lhs (call);
 enum memmodel model = MEMMODEL_SYNC_SEQ_CST;
 machine_mode mode = TYPE_MODE (TREE_TYPE (flag));
 enum rtx_code code;
 optab optab;
-struct expand_operand ops[5];
+class expand_operand ops[5];
 gcc_assert (flag_inline_atomics);
 if (gimple_call_num_args (call) == 4)
 model = get_memmodel (gimple_call_arg (call, 3));
 mem = get_builtin_sync_mem (CALL_EXPR_ARG (exp, 0), mode);
 model = get_memmodel (CALL_EXPR_ARG (exp, 1));
 if (is_mm_consume (model) || is_mm_acquire (model) || is_mm_acq_rel (model))
 {
-source_location loc
+location_t loc
 	= expansion_point_location_if_in_system_header (input_location);
 warning_at (loc, OPT_Winvalid_memory_model,
 		  "invalid memory model for %<__atomic_store%>");
 model = MEMMODEL_SEQ_CST;
 }
 tree arg0 = CALL_EXPR_ARG (exp, 0);
 tree arg1 = CALL_EXPR_ARG (exp, 1);
 if (TREE_CODE (arg0) != INTEGER_CST)
 {
-error ("non-constant argument 1 to __atomic_always_lock_free");
+error ("non-constant argument 1 to %qs", "__atomic_always_lock_free");
 return const0_rtx;
 }
 size = fold_builtin_atomic_always_lock_free (arg0, arg1);
 if (size == boolean_true_node)
 tree arg0 = CALL_EXPR_ARG (exp, 0);
 tree arg1 = CALL_EXPR_ARG (exp, 1);
 if (!INTEGRAL_TYPE_P (TREE_TYPE (arg0)))
 {
-error ("non-integer argument 1 to __atomic_is_lock_free");
+error ("non-integer argument 1 to %qs", "__atomic_is_lock_free");
 return NULL_RTX;
 }
 if (!flag_inline_atomics)
 return NULL_RTX;
 if (!validate_arglist (exp, VOID_TYPE))
 return const0_rtx;
 icode = direct_optab_handler (get_thread_pointer_optab, Pmode);
 if (icode != CODE_FOR_nothing)
 {
-struct expand_operand op;
+class expand_operand op;
 /* If the target is not sutitable then create a new target. */
 if (target == NULL_RTX
 	  || !REG_P (target)
 	  || GET_MODE (target) != Pmode)
 	target = gen_reg_rtx (Pmode);
 create_output_operand (&op, target, Pmode);
 expand_insn (icode, 1, &op);
 return target;
 }
-error ("__builtin_thread_pointer is not supported on this target");
+error ("%<__builtin_thread_pointer%> is not supported on this target");
 return const0_rtx;
 }
 static void
 expand_builtin_set_thread_pointer (tree exp)
 if (!validate_arglist (exp, POINTER_TYPE, VOID_TYPE))
 return;
 icode = direct_optab_handler (set_thread_pointer_optab, Pmode);
 if (icode != CODE_FOR_nothing)
 {
-struct expand_operand op;
+class expand_operand op;
 rtx val = expand_expr (CALL_EXPR_ARG (exp, 0), NULL_RTX,
 			     Pmode, EXPAND_NORMAL);
 create_input_operand (&op, val, Pmode);
 expand_insn (icode, 1, &op);
 return;
 }
-error ("__builtin_set_thread_pointer is not supported on this target");
+error ("%<__builtin_set_thread_pointer%> is not supported on this target");
 }
 /* Emit code to restore the current value of stack.  */
 /* If neither strings is constant string, the call is not qualify.  */
 if (!src_str1 && !src_str2)
 return NULL_RTX;
 /* For strncmp, if the length is not a const, not qualify.  */
-if (is_ncmp && !tree_fits_uhwi_p (len3_tree))
+if (is_ncmp)
-return NULL_RTX;
+{
+if (!tree_fits_uhwi_p (len3_tree))
+	return NULL_RTX;
+else
+	len3 = tree_to_uhwi (len3_tree);
+}
+if (src_str1 != NULL)
+len1 = strnlen (src_str1, len1) + 1;
+if (src_str2 != NULL)
+len2 = strnlen (src_str2, len2) + 1;
 int const_str_n = 0;
 if (!len1)
 const_str_n = 2;
 else if (!len2)
 const_str_n = 2;
 gcc_checking_assert (const_str_n > 0);
 length = (const_str_n == 1) ? len1 : len2;
-if (is_ncmp && (len3 = tree_to_uhwi (len3_tree)) < length)
+if (is_ncmp && len3 < length)
 length = len3;
 /* If the length of the comparision is larger than the threshold,
 do nothing.  */
 if (length > (unsigned HOST_WIDE_INT)
-	       PARAM_VALUE (BUILTIN_STRING_CMP_INLINE_LENGTH))
+	       param_builtin_string_cmp_inline_length)
 return NULL_RTX;
 machine_mode mode = TYPE_MODE (TREE_TYPE (exp));
 /* Now, start inline expansion the call.  */
 rtx
 expand_builtin (tree exp, rtx target, rtx subtarget, machine_mode mode,
 		int ignore)
 {
 tree fndecl = get_callee_fndecl (exp);
-enum built_in_function fcode = DECL_FUNCTION_CODE (fndecl);
 machine_mode target_mode = TYPE_MODE (TREE_TYPE (exp));
 int flags;
 if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_MD)
 return targetm.expand_builtin (exp, target, subtarget, mode, ignore);
 /* When ASan is enabled, we don't want to expand some memory/string
 builtins and rely on libsanitizer's hooks.  This allows us to avoid
 redundant checks and be sure, that possible overflow will be detected
 by ASan.  */
+enum built_in_function fcode = DECL_FUNCTION_CODE (fndecl);
 if ((flag_sanitize & SANITIZE_ADDRESS) && asan_intercepted_p (fcode))
 return expand_call (exp, target, ignore);
 /* When not optimizing, generate calls to library functions for a certain
 set of builtins.  */
 if (target)
 	return target;
 break;
 case BUILT_IN_STRCAT:
-target = expand_builtin_strcat (exp, target);
+target = expand_builtin_strcat (exp);
 if (target)
 	return target;
+break;
+case BUILT_IN_GETTEXT:
+case BUILT_IN_PUTS:
+case BUILT_IN_PUTS_UNLOCKED:
+case BUILT_IN_STRDUP:
+if (validate_arglist (exp, POINTER_TYPE, VOID_TYPE))
+	check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0));
+break;
+case BUILT_IN_INDEX:
+case BUILT_IN_RINDEX:
+case BUILT_IN_STRCHR:
+case BUILT_IN_STRRCHR:
+if (validate_arglist (exp, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
+	check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0));
+break;
+case BUILT_IN_FPUTS:
+case BUILT_IN_FPUTS_UNLOCKED:
+if (validate_arglist (exp, POINTER_TYPE, POINTER_TYPE, VOID_TYPE))
+	check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0));
+break;
+case BUILT_IN_STRNDUP:
+if (validate_arglist (exp, POINTER_TYPE, INTEGER_TYPE, VOID_TYPE))
+	check_nul_terminated_array (exp,
+				    CALL_EXPR_ARG (exp, 0),
+				    CALL_EXPR_ARG (exp, 1));
+break;
+case BUILT_IN_STRCASECMP:
+case BUILT_IN_STRSTR:
+if (validate_arglist (exp, POINTER_TYPE, POINTER_TYPE, VOID_TYPE))
+	{
+	  check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 0));
+	  check_nul_terminated_array (exp, CALL_EXPR_ARG (exp, 1));
+	}
 break;
 case BUILT_IN_STRCPY:
 target = expand_builtin_strcpy (exp, target);
 if (target)
 {
 if (!validate_arg (arg, POINTER_TYPE))
 return NULL_TREE;
 else
 {
-c_strlen_data data;
+c_strlen_data lendata = { };
-memset (&data, 0, sizeof (c_strlen_data));
+tree len = c_strlen (arg, 0, &lendata);
-tree len = c_strlen (arg, 0, &data);
 if (len)
 	return fold_convert_loc (loc, type, len);
-if (!data.decl)
+if (!lendata.decl)
-	c_strlen (arg, 1, &data);
+	c_strlen (arg, 1, &lendata);
-if (data.decl)
+if (lendata.decl)
 	{
 	  if (EXPR_HAS_LOCATION (arg))
 	    loc = EXPR_LOCATION (arg);
 	  else if (loc == UNKNOWN_LOCATION)
 	    loc = input_location;
-	  warn_string_no_nul (loc, "strlen", arg, data.decl);
+	  warn_string_no_nul (loc, "strlen", arg, lendata.decl);
 	}
 return NULL_TREE;
 }
 }
 	       only.  The low-order value is not significant.  */
 	    type = double_type_node;
 	    mode = DFmode;
 	    arg = fold_build1_loc (loc, NOP_EXPR, type, arg);
 	  }
-	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf));
+	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf), false);
 	real_from_string (&r, buf);
 	result = build_call_expr (isgr_fn, 2,
 				  fold_build1_loc (loc, ABS_EXPR, type, arg),
 				  build_real (type, r));
 	return result;
 	       only.  The low-order value is not significant.  */
 	    type = double_type_node;
 	    mode = DFmode;
 	    arg = fold_build1_loc (loc, NOP_EXPR, type, arg);
 	  }
-	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf));
+	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf), false);
 	real_from_string (&r, buf);
 	result = build_call_expr (isle_fn, 2,
 				  fold_build1_loc (loc, ABS_EXPR, type, arg),
 				  build_real (type, r));
 	/*result = fold_build2_loc (loc, UNGT_EXPR,
 	    mode = DFmode;
 	    arg = fold_build1_loc (loc, NOP_EXPR, type, arg);
 	  }
 	arg = fold_build1_loc (loc, ABS_EXPR, type, arg);
-	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf));
+	get_max_float (REAL_MODE_FORMAT (mode), buf, sizeof (buf), false);
 	real_from_string (&rmax, buf);
 	sprintf (buf, "0x1p%d", REAL_MODE_FORMAT (orig_mode)->emin - 1);
 	real_from_string (&rmin, buf);
 	max_exp = build_real (type, rmax);
 	min_exp = build_real (type, rmin);
 static tree
 fold_builtin_arith_overflow (location_t loc, enum built_in_function fcode,
 			     tree arg0, tree arg1, tree arg2)
 {
 enum internal_fn ifn = IFN_LAST;
-/* The code of the expression corresponding to the type-generic
+/* The code of the expression corresponding to the built-in.  */
-built-in, or ERROR_MARK for the type-specific ones.  */
 enum tree_code opcode = ERROR_MARK;
 bool ovf_only = false;
 switch (fcode)
 {
 case BUILT_IN_ADD_OVERFLOW_P:
 ovf_only = true;
 /* FALLTHRU */
 case BUILT_IN_ADD_OVERFLOW:
-opcode = PLUS_EXPR;
-/* FALLTHRU */
 case BUILT_IN_SADD_OVERFLOW:
 case BUILT_IN_SADDL_OVERFLOW:
 case BUILT_IN_SADDLL_OVERFLOW:
 case BUILT_IN_UADD_OVERFLOW:
 case BUILT_IN_UADDL_OVERFLOW:
 case BUILT_IN_UADDLL_OVERFLOW:
+opcode = PLUS_EXPR;
 ifn = IFN_ADD_OVERFLOW;
 break;
 case BUILT_IN_SUB_OVERFLOW_P:
 ovf_only = true;
 /* FALLTHRU */
 case BUILT_IN_SUB_OVERFLOW:
-opcode = MINUS_EXPR;
-/* FALLTHRU */
 case BUILT_IN_SSUB_OVERFLOW:
 case BUILT_IN_SSUBL_OVERFLOW:
 case BUILT_IN_SSUBLL_OVERFLOW:
 case BUILT_IN_USUB_OVERFLOW:
 case BUILT_IN_USUBL_OVERFLOW:
 case BUILT_IN_USUBLL_OVERFLOW:
+opcode = MINUS_EXPR;
 ifn = IFN_SUB_OVERFLOW;
 break;
 case BUILT_IN_MUL_OVERFLOW_P:
 ovf_only = true;
 /* FALLTHRU */
 case BUILT_IN_MUL_OVERFLOW:
-opcode = MULT_EXPR;
-/* FALLTHRU */
 case BUILT_IN_SMUL_OVERFLOW:
 case BUILT_IN_SMULL_OVERFLOW:
 case BUILT_IN_SMULLL_OVERFLOW:
 case BUILT_IN_UMUL_OVERFLOW:
 case BUILT_IN_UMULL_OVERFLOW:
 case BUILT_IN_UMULLL_OVERFLOW:
+opcode = MULT_EXPR;
 ifn = IFN_MUL_OVERFLOW;
 break;
 default:
 gcc_unreachable ();
 }
 return omit_one_operand_loc (loc, boolean_type_node,
 				 arith_overflowed_p (opcode, type, arg0, arg1)
 				 ? boolean_true_node : boolean_false_node,
 				 arg2);
-tree ctype = build_complex_type (type);
+tree intres, ovfres;
-tree call = build_call_expr_internal_loc (loc, ifn, ctype,
+if (TREE_CODE (arg0) == INTEGER_CST && TREE_CODE (arg1) == INTEGER_CST)
-					    2, arg0, arg1);
+{
-tree tgt = save_expr (call);
+intres = fold_binary_loc (loc, opcode, type,
-tree intres = build1_loc (loc, REALPART_EXPR, type, tgt);
+				fold_convert_loc (loc, type, arg0),
-tree ovfres = build1_loc (loc, IMAGPART_EXPR, type, tgt);
+				fold_convert_loc (loc, type, arg1));
-ovfres = fold_convert_loc (loc, boolean_type_node, ovfres);
+if (TREE_OVERFLOW (intres))
+	intres = drop_tree_overflow (intres);
+ovfres = (arith_overflowed_p (opcode, type, arg0, arg1)
+		? boolean_true_node : boolean_false_node);
+}
+else
+{
+tree ctype = build_complex_type (type);
+tree call = build_call_expr_internal_loc (loc, ifn, ctype, 2,
+						arg0, arg1);
+tree tgt = save_expr (call);
+intres = build1_loc (loc, REALPART_EXPR, type, tgt);
+ovfres = build1_loc (loc, IMAGPART_EXPR, type, tgt);
+ovfres = fold_convert_loc (loc, boolean_type_node, ovfres);
+}
 if (ovf_only)
 return omit_one_operand_loc (loc, boolean_type_node, ovfres, arg2);
 tree mem_arg2 = build_fold_indirect_ref_loc (loc, arg2);
 return NULL_TREE;
 }
-/* Fold a call to built-in function FNDECL with 2 arguments, ARG0 and ARG1.
+/* Folds a call EXPR (which may be null) to built-in function FNDECL
-This function returns NULL_TREE if no simplification was possible.  */
+with 2 arguments, ARG0 and ARG1.  This function returns NULL_TREE
+if no simplification was possible.  */
 static tree
-fold_builtin_2 (location_t loc, tree fndecl, tree arg0, tree arg1)
+fold_builtin_2 (location_t loc, tree expr, tree fndecl, tree arg0, tree arg1)
 {
 tree type = TREE_TYPE (TREE_TYPE (fndecl));
 enum built_in_function fcode = DECL_FUNCTION_CODE (fndecl);
 if (TREE_CODE (arg0) == ERROR_MARK
 CASE_FLT_FN (BUILT_IN_MODF):
 return fold_builtin_modf (loc, arg0, arg1, type);
 case BUILT_IN_STRSPN:
-return fold_builtin_strspn (loc, arg0, arg1);
+return fold_builtin_strspn (loc, expr, arg0, arg1);
 case BUILT_IN_STRCSPN:
-return fold_builtin_strcspn (loc, arg0, arg1);
+return fold_builtin_strcspn (loc, expr, arg0, arg1);
 case BUILT_IN_STRPBRK:
-return fold_builtin_strpbrk (loc, arg0, arg1, type);
+return fold_builtin_strpbrk (loc, expr, arg0, arg1, type);
 case BUILT_IN_EXPECT:
 return fold_builtin_expect (loc, arg0, arg1, NULL_TREE, NULL_TREE);
 case BUILT_IN_ISGREATER:
 break;
 }
 return NULL_TREE;
 }
-/* Fold a call to built-in function FNDECL.  ARGS is an array of NARGS
+/* Folds a call EXPR (which may be null) to built-in function FNDECL.
-arguments.  IGNORE is true if the result of the
+ARGS is an array of NARGS arguments.  IGNORE is true if the result
-function call is ignored.  This function returns NULL_TREE if no
+of the function call is ignored.  This function returns NULL_TREE
-simplification was possible.  */
+if no simplification was possible.  */
-tree
+static tree
-fold_builtin_n (location_t loc, tree fndecl, tree *args, int nargs, bool)
+fold_builtin_n (location_t loc, tree expr, tree fndecl, tree *args,
+		int nargs, bool)
 {
 tree ret = NULL_TREE;
 switch (nargs)
 {
 break;
 case 1:
 ret = fold_builtin_1 (loc, fndecl, args[0]);
 break;
 case 2:
-ret = fold_builtin_2 (loc, fndecl, args[0], args[1]);
+ret = fold_builtin_2 (loc, expr, fndecl, args[0], args[1]);
 break;
 case 3:
 ret = fold_builtin_3 (loc, fndecl, args[0], args[1], args[2]);
 break;
 default:
 return targetm.fold_builtin (fndecl, call_expr_nargs (exp),
 				     CALL_EXPR_ARGP (exp), ignore);
 else
 	{
 	  tree *args = CALL_EXPR_ARGP (exp);
-	  ret = fold_builtin_n (loc, fndecl, args, nargs, ignore);
+	  ret = fold_builtin_n (loc, exp, fndecl, args, nargs, ignore);
 	  if (ret)
 	    return ret;
 	}
 }
 return NULL_TREE;
 if (avoid_folding_inline_builtin (fndecl))
 	return NULL_TREE;
 if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_MD)
 	return targetm.fold_builtin (fndecl, n, argarray, false);
 else
-	return fold_builtin_n (loc, fndecl, argarray, n, false);
+	return fold_builtin_n (loc, NULL_TREE, fndecl, argarray, n, false);
 }
 return NULL_TREE;
 }
 COMPOUND_EXPRs are chained through their RHS.  The RHS of the last
 COMPOUND_EXPR in the chain will contain the tree for the simplified
 form of the builtin function call.  */
 static tree
-fold_builtin_strpbrk (location_t loc, tree s1, tree s2, tree type)
+fold_builtin_strpbrk (location_t loc, tree expr, tree s1, tree s2, tree type)
 {
 if (!validate_arg (s1, POINTER_TYPE)
 || !validate_arg (s2, POINTER_TYPE))
 return NULL_TREE;
-else
-{
+if (!check_nul_terminated_array (expr, s1)
-tree fn;
+|| !check_nul_terminated_array (expr, s2))
-const char *p1, *p2;
+return NULL_TREE;
-p2 = c_getstr (s2);
+tree fn;
-if (p2 == NULL)
+const char *p1, *p2;
-	return NULL_TREE;
+p2 = c_getstr (s2);
-p1 = c_getstr (s1);
+if (p2 == NULL)
-if (p1 != NULL)
+return NULL_TREE;
-	{
-	  const char *r = strpbrk (p1, p2);
+p1 = c_getstr (s1);
-	  tree tem;
+if (p1 != NULL)
+{
-	  if (r == NULL)
+const char *r = strpbrk (p1, p2);
-	    return build_int_cst (TREE_TYPE (s1), 0);
+tree tem;
-	  /* Return an offset into the constant string argument.  */
+if (r == NULL)
-	  tem = fold_build_pointer_plus_hwi_loc (loc, s1, r - p1);
+	return build_int_cst (TREE_TYPE (s1), 0);
-	  return fold_convert_loc (loc, type, tem);
-	}
+/* Return an offset into the constant string argument.  */
+tem = fold_build_pointer_plus_hwi_loc (loc, s1, r - p1);
-if (p2[0] == '\0')
+return fold_convert_loc (loc, type, tem);
-	/* strpbrk(x, "") == NULL.
+}
-	   Evaluate and ignore s1 in case it had side-effects.  */
-	return omit_one_operand_loc (loc, type, integer_zero_node, s1);
+if (p2[0] == '\0')
+/* strpbrk(x, "") == NULL.
-if (p2[1] != '\0')
+Evaluate and ignore s1 in case it had side-effects.  */
-	return NULL_TREE;  /* Really call strpbrk.  */
+return omit_one_operand_loc (loc, type, integer_zero_node, s1);
-fn = builtin_decl_implicit (BUILT_IN_STRCHR);
+if (p2[1] != '\0')
-if (!fn)
+return NULL_TREE;  /* Really call strpbrk.  */
-	return NULL_TREE;
+fn = builtin_decl_implicit (BUILT_IN_STRCHR);
-/* New argument list transforming strpbrk(s1, s2) to
+if (!fn)
-	 strchr(s1, s2[0]).  */
+return NULL_TREE;
-return build_call_expr_loc (loc, fn, 2, s1,
-				  build_int_cst (integer_type_node, p2[0]));
+/* New argument list transforming strpbrk(s1, s2) to
-}
+strchr(s1, s2[0]).  */
+return build_call_expr_loc (loc, fn, 2, s1,
+			      build_int_cst (integer_type_node, p2[0]));
 }
 /* Simplify a call to the strspn builtin.  S1 and S2 are the arguments
 to the call.
 COMPOUND_EXPRs are chained through their RHS.  The RHS of the last
 COMPOUND_EXPR in the chain will contain the tree for the simplified
 form of the builtin function call.  */
 static tree
-fold_builtin_strspn (location_t loc, tree s1, tree s2)
+fold_builtin_strspn (location_t loc, tree expr, tree s1, tree s2)
 {
 if (!validate_arg (s1, POINTER_TYPE)
 || !validate_arg (s2, POINTER_TYPE))
 return NULL_TREE;
-else
-{
+if (!check_nul_terminated_array (expr, s1)
-const char *p1 = c_getstr (s1), *p2 = c_getstr (s2);
+|| !check_nul_terminated_array (expr, s2))
+return NULL_TREE;
-/* If either argument is "", return NULL_TREE.  */
-if ((p1 && *p1 == '\0') || (p2 && *p2 == '\0'))
+const char *p1 = c_getstr (s1), *p2 = c_getstr (s2);
-	/* Evaluate and ignore both arguments in case either one has
-	   side-effects.  */
+/* If either argument is "", return NULL_TREE.  */
-	return omit_two_operands_loc (loc, size_type_node, size_zero_node,
+if ((p1 && *p1 == '\0') || (p2 && *p2 == '\0'))
+/* Evaluate and ignore both arguments in case either one has
+side-effects.  */
+return omit_two_operands_loc (loc, size_type_node, size_zero_node,
 				  s1, s2);
 return NULL_TREE;
-}
 }
 /* Simplify a call to the strcspn builtin.  S1 and S2 are the arguments
 to the call.
 COMPOUND_EXPRs are chained through their RHS.  The RHS of the last
 COMPOUND_EXPR in the chain will contain the tree for the simplified
 form of the builtin function call.  */
 static tree
-fold_builtin_strcspn (location_t loc, tree s1, tree s2)
+fold_builtin_strcspn (location_t loc, tree expr, tree s1, tree s2)
 {
 if (!validate_arg (s1, POINTER_TYPE)
 || !validate_arg (s2, POINTER_TYPE))
 return NULL_TREE;
-else
-{
+if (!check_nul_terminated_array (expr, s1)
-/* If the first argument is "", return NULL_TREE.  */
+|| !check_nul_terminated_array (expr, s2))
-const char *p1 = c_getstr (s1);
+return NULL_TREE;
-if (p1 && *p1 == '\0')
-	{
+/* If the first argument is "", return NULL_TREE.  */
-	  /* Evaluate and ignore argument s2 in case it has
+const char *p1 = c_getstr (s1);
-	     side-effects.  */
+if (p1 && *p1 == '\0')
-	  return omit_one_operand_loc (loc, size_type_node,
+{
+/* Evaluate and ignore argument s2 in case it has
+	 side-effects.  */
+return omit_one_operand_loc (loc, size_type_node,
 				   size_zero_node, s2);
-	}
+}
 /* If the second argument is "", return __builtin_strlen(s1).  */
 const char *p2 = c_getstr (s2);
 if (p2 && *p2 == '\0')
-	{
+{
-	  tree fn = builtin_decl_implicit (BUILT_IN_STRLEN);
+tree fn = builtin_decl_implicit (BUILT_IN_STRLEN);
-	  /* If the replacement _DECL isn't initialized, don't do the
+/* If the replacement _DECL isn't initialized, don't do the
-	     transformation.  */
+	 transformation.  */
-	  if (!fn)
+if (!fn)
-	    return NULL_TREE;
+	return NULL_TREE;
-	  return build_call_expr_loc (loc, fn, 1, s1);
+return build_call_expr_loc (loc, fn, 1, s1);
-	}
+}
 return NULL_TREE;
-}
 }
 /* Fold the next_arg or va_start call EXP. Returns true if there was an error
 produced.  False otherwise.  This is done so that we don't output the error
 or warning twice or three times.  */
 tree arg;
 /* There is good chance the current input_location points inside the
 definition of the va_start macro (perhaps on the token for
 builtin) in a system header, so warnings will not be emitted.
 Use the location in real source code.  */
-source_location current_location =
+location_t current_location =
 linemap_unwind_to_first_non_reserved_loc (line_table, input_location,
 					      NULL);
 if (!stdarg_p (fntype))
 {
-error ("%<va_start%> used in function with fixed args");
+error ("%<va_start%> used in function with fixed arguments");
 return true;
 }
 if (va_start_p)
 {
 /* Emit warning if a free is called with address of a variable.  */
 static void
 maybe_emit_free_warning (tree exp)
 {
+if (call_expr_nargs (exp) != 1)
+return;
 tree arg = CALL_EXPR_ARG (exp, 0);
 STRIP_NOPS (arg);
 if (TREE_CODE (arg) != ADDR_EXPR)
 return;
 if (mpfr_number_p (m) && !mpfr_overflow_p () && !mpfr_underflow_p ()
 && (!flag_rounding_math || !inexact))
 {
 REAL_VALUE_TYPE rr;
-real_from_mpfr (&rr, m, type, GMP_RNDN);
+real_from_mpfr (&rr, m, type, MPFR_RNDN);
 /* Proceed iff GCC's REAL_VALUE_TYPE can hold the MPFR value,
 	 check for overflow/underflow.  If the REAL_VALUE_TYPE is zero
 	 but the mpft_t is not, then we underflowed in the
 	 conversion.  */
 if (real_isfinite (&rr)
 	  && !mpfr_overflow_p () && !mpfr_underflow_p ()
 	  && (!flag_rounding_math || !inexact)))
 {
 REAL_VALUE_TYPE re, im;
-real_from_mpfr (&re, mpc_realref (m), TREE_TYPE (type), GMP_RNDN);
+real_from_mpfr (&re, mpc_realref (m), TREE_TYPE (type), MPFR_RNDN);
-real_from_mpfr (&im, mpc_imagref (m), TREE_TYPE (type), GMP_RNDN);
+real_from_mpfr (&im, mpc_imagref (m), TREE_TYPE (type), MPFR_RNDN);
 /* Proceed iff GCC's REAL_VALUE_TYPE can hold the MPFR values,
 	 check for overflow/underflow.  If the REAL_VALUE_TYPE is zero
 	 but the mpft_t is not, then we underflowed in the
 	 conversion.  */
 if (force_convert
 if (real_isfinite (ra0) && real_isfinite (ra1))
 {
 	  const struct real_format *fmt = REAL_MODE_FORMAT (TYPE_MODE (type));
 	  const int prec = fmt->p;
-	  const mp_rnd_t rnd = fmt->round_towards_zero? GMP_RNDZ : GMP_RNDN;
+	  const mpfr_rnd_t rnd = fmt->round_towards_zero? MPFR_RNDZ : MPFR_RNDN;
 	  tree result_rem;
 	  long integer_quo;
 	  mpfr_t m0, m1;
 	  mpfr_inits2 (prec, m0, m1, NULL);
-	  mpfr_from_real (m0, ra0, GMP_RNDN);
+	  mpfr_from_real (m0, ra0, MPFR_RNDN);
-	  mpfr_from_real (m1, ra1, GMP_RNDN);
+	  mpfr_from_real (m1, ra1, MPFR_RNDN);
 	  mpfr_clear_flags ();
 	  mpfr_remquo (m0, &integer_quo, m0, m1, rnd);
 	  /* Remquo is independent of the rounding mode, so pass
 	     inexact=0 to do_mpfr_ckconv().  */
 	  result_rem = do_mpfr_ckconv (m0, type, /*inexact=*/ 0);
 	  && ra->cl != rvc_zero
 	  && !(real_isneg (ra) && real_isinteger (ra, TYPE_MODE (type))))
 {
 	  const struct real_format *fmt = REAL_MODE_FORMAT (TYPE_MODE (type));
 	  const int prec = fmt->p;
-	  const mp_rnd_t rnd = fmt->round_towards_zero? GMP_RNDZ : GMP_RNDN;
+	  const mpfr_rnd_t rnd = fmt->round_towards_zero? MPFR_RNDZ : MPFR_RNDN;
 	  int inexact, sg;
 	  mpfr_t m;
 	  tree result_lg;
 	  mpfr_init2 (m, prec);
-	  mpfr_from_real (m, ra, GMP_RNDN);
+	  mpfr_from_real (m, ra, MPFR_RNDN);
 	  mpfr_clear_flags ();
 	  inexact = mpfr_lgamma (m, &sg, m, rnd);
 	  result_lg = do_mpfr_ckconv (m, type, inexact);
 	  mpfr_clear (m);
 	  if (result_lg)
 	      && real_isfinite (re1) && real_isfinite (im1)))
 {
 	  const struct real_format *const fmt =
 	    REAL_MODE_FORMAT (TYPE_MODE (TREE_TYPE (type)));
 	  const int prec = fmt->p;
-	  const mp_rnd_t rnd = fmt->round_towards_zero ? GMP_RNDZ : GMP_RNDN;
+	  const mpfr_rnd_t rnd = fmt->round_towards_zero
+				 ? MPFR_RNDZ : MPFR_RNDN;
 	  const mpc_rnd_t crnd = fmt->round_towards_zero ? MPC_RNDZZ : MPC_RNDNN;
 	  int inexact;
 	  mpc_t m0, m1;
 	  mpc_init2 (m0, prec);
 {
 	  return targetm.fold_builtin (fndecl, nargs, args, ignore);
 }
 else
 	{
-	  ret = fold_builtin_n (loc, fndecl, args, nargs, ignore);
+	  ret = fold_builtin_n (loc, NULL_TREE, fndecl, args, nargs, ignore);
 	  if (ret)
 	    {
 	      /* Propagate location information from original call to
 		 expansion of builtin.  Otherwise things like
 		 maybe_emit_chk_warning, that operate on the expansion
 *p = (char)tree_to_uhwi (t);
 return true;
 }
-/* Return the maximum object size.  */
+/* Return true if the builtin DECL is implemented in a standard library.
+Otherwise returns false which doesn't guarantee it is not (thus the list of
-tree
+handled builtins below may be incomplete).  */
-max_object_size (void)
-{
+bool
-/* To do: Make this a configurable parameter.  */
+builtin_with_linkage_p (tree decl)
-return TYPE_MAX_VALUE (ptrdiff_type_node);
+{
-}
+if (DECL_BUILT_IN_CLASS (decl) == BUILT_IN_NORMAL)
+switch (DECL_FUNCTION_CODE (decl))
+{
+CASE_FLT_FN (BUILT_IN_ACOS):
+CASE_FLT_FN (BUILT_IN_ACOSH):
+CASE_FLT_FN (BUILT_IN_ASIN):
+CASE_FLT_FN (BUILT_IN_ASINH):
+CASE_FLT_FN (BUILT_IN_ATAN):
+CASE_FLT_FN (BUILT_IN_ATANH):
+CASE_FLT_FN (BUILT_IN_ATAN2):
+CASE_FLT_FN (BUILT_IN_CBRT):
+CASE_FLT_FN (BUILT_IN_CEIL):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_CEIL):
+CASE_FLT_FN (BUILT_IN_COPYSIGN):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_COPYSIGN):
+CASE_FLT_FN (BUILT_IN_COS):
+CASE_FLT_FN (BUILT_IN_COSH):
+CASE_FLT_FN (BUILT_IN_ERF):
+CASE_FLT_FN (BUILT_IN_ERFC):
+CASE_FLT_FN (BUILT_IN_EXP):
+CASE_FLT_FN (BUILT_IN_EXP2):
+CASE_FLT_FN (BUILT_IN_EXPM1):
+CASE_FLT_FN (BUILT_IN_FABS):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_FABS):
+CASE_FLT_FN (BUILT_IN_FDIM):
+CASE_FLT_FN (BUILT_IN_FLOOR):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_FLOOR):
+CASE_FLT_FN (BUILT_IN_FMA):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_FMA):
+CASE_FLT_FN (BUILT_IN_FMAX):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_FMAX):
+CASE_FLT_FN (BUILT_IN_FMIN):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_FMIN):
+CASE_FLT_FN (BUILT_IN_FMOD):
+CASE_FLT_FN (BUILT_IN_FREXP):
+CASE_FLT_FN (BUILT_IN_HYPOT):
+CASE_FLT_FN (BUILT_IN_ILOGB):
+CASE_FLT_FN (BUILT_IN_LDEXP):
+CASE_FLT_FN (BUILT_IN_LGAMMA):
+CASE_FLT_FN (BUILT_IN_LLRINT):
+CASE_FLT_FN (BUILT_IN_LLROUND):
+CASE_FLT_FN (BUILT_IN_LOG):
+CASE_FLT_FN (BUILT_IN_LOG10):
+CASE_FLT_FN (BUILT_IN_LOG1P):
+CASE_FLT_FN (BUILT_IN_LOG2):
+CASE_FLT_FN (BUILT_IN_LOGB):
+CASE_FLT_FN (BUILT_IN_LRINT):
+CASE_FLT_FN (BUILT_IN_LROUND):
+CASE_FLT_FN (BUILT_IN_MODF):
+CASE_FLT_FN (BUILT_IN_NAN):
+CASE_FLT_FN (BUILT_IN_NEARBYINT):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_NEARBYINT):
+CASE_FLT_FN (BUILT_IN_NEXTAFTER):
+CASE_FLT_FN (BUILT_IN_NEXTTOWARD):
+CASE_FLT_FN (BUILT_IN_POW):
+CASE_FLT_FN (BUILT_IN_REMAINDER):
+CASE_FLT_FN (BUILT_IN_REMQUO):
+CASE_FLT_FN (BUILT_IN_RINT):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_RINT):
+CASE_FLT_FN (BUILT_IN_ROUND):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_ROUND):
+CASE_FLT_FN (BUILT_IN_SCALBLN):
+CASE_FLT_FN (BUILT_IN_SCALBN):
+CASE_FLT_FN (BUILT_IN_SIN):
+CASE_FLT_FN (BUILT_IN_SINH):
+CASE_FLT_FN (BUILT_IN_SINCOS):
+CASE_FLT_FN (BUILT_IN_SQRT):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_SQRT):
+CASE_FLT_FN (BUILT_IN_TAN):
+CASE_FLT_FN (BUILT_IN_TANH):
+CASE_FLT_FN (BUILT_IN_TGAMMA):
+CASE_FLT_FN (BUILT_IN_TRUNC):
+CASE_FLT_FN_FLOATN_NX (BUILT_IN_TRUNC):
+	return true;
+default:
+	break;
+}
+return false;
+}

Mercurial > hg > CbC > CbC_gcc

comparison gcc/builtins.c @ 146:351920fa3827