tree-optimization/106131 - wrong code with FRE rewriting

The following makes sure to not use the original TBAA type for
looking up a value across an aggregate copy when we had to offset
the read.

2022-06-30  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/106131
	* tree-ssa-sccvn.cc (vn_reference_lookup_3): Force alias-set
	zero when offsetting the read looking through an aggregate
	copy.

	* g++.dg/torture/pr106131.C: New testcase.

(cherry picked from commit 9701432ff79926a5dd3303be3417e0bd0c24140b)

2 files changed, 46 insertions, 4 deletions

diff --git a/gcc/testsuite/g++.dg/torture/pr106131.C b/gcc/testsuite/g++.dg/torture/pr106131.C
new file mode 100644
index 00000000000..e110f4a8fe6
--- /dev/null
+++ b/gcc/testsuite/g++.dg/torture/pr106131.C
@@ -0,0 +1,34 @@
+// { dg-do run { target c++11 } }
+
+struct Pair {
+    int a, b;
+    Pair(const Pair &) = default;
+    Pair(int _a, int _b) : a(_a), b(_b) {}
+    Pair &operator=(const Pair &z) {
+	a = z.a;
+	b = z.b;
+	return *this;
+    }
+};
+
+const int &max(const int &a, const int &b)
+{
+  return a < b ? b : a;
+}
+
+int foo(Pair x, Pair y)
+{
+  return max(x.b, y.b);
+}
+
+int main()
+{
+  auto f = new Pair[3] {{0, -11}, {0, -8}, {0, 2}};
+  for (int i = 0; i < 1; i++) {
+      f[i] = f[0];
+      if(i == 0)
+	f[i] = f[2];
+      if (foo(f[i], f[1]) != 2)
+	__builtin_abort();
+  }
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index cd573798b8c..e22c7026556 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -3243,12 +3243,12 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
       poly_int64 extra_off = 0;
       if (j == 0 && i >= 0
 	  && lhs_ops[0].opcode == MEM_REF
-	  && maybe_ne (lhs_ops[0].off, -1))
+	  && known_ne (lhs_ops[0].off, -1))
 	{
 	  if (known_eq (lhs_ops[0].off, vr->operands[i].off))
 	    i--, j--;
 	  else if (vr->operands[i].opcode == MEM_REF
-		   && maybe_ne (vr->operands[i].off, -1))
+		   && known_ne (vr->operands[i].off, -1))
 	    {
 	      extra_off = vr->operands[i].off - lhs_ops[0].off;
 	      i--, j--;
@@ -3275,6 +3275,7 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
       copy_reference_ops_from_ref (rhs1, &rhs);
 
       /* Apply an extra offset to the inner MEM_REF of the RHS.  */
+      bool force_no_tbaa = false;
       if (maybe_ne (extra_off, 0))
 	{
 	  if (rhs.length () < 2)
@@ -3287,6 +3288,10 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
 	  rhs[ix].op0 = int_const_binop (PLUS_EXPR, rhs[ix].op0,
 					 build_int_cst (TREE_TYPE (rhs[ix].op0),
 							extra_off));
+	  /* When we have offsetted the RHS, reading only parts of it,
+	     we can no longer use the original TBAA type, force alias-set
+	     zero.  */
+	  force_no_tbaa = true;
 	}
 
       /* Save the operands since we need to use the original ones for
@@ -3339,8 +3344,11 @@ vn_reference_lookup_3 (ao_ref *ref, tree vuse, void *data_,
       /* Adjust *ref from the new operands.  */
       ao_ref rhs1_ref;
       ao_ref_init (&rhs1_ref, rhs1);
-      if (!ao_ref_init_from_vn_reference (&r, ao_ref_alias_set (&rhs1_ref),
-					  ao_ref_base_alias_set (&rhs1_ref),
+      if (!ao_ref_init_from_vn_reference (&r,
+					  force_no_tbaa ? 0
+					  : ao_ref_alias_set (&rhs1_ref),
+					  force_no_tbaa ? 0
+					  : ao_ref_base_alias_set (&rhs1_ref),
 					  vr->type, vr->operands))
 	return (void *)-1;
       /* This can happen with bitfields.  */