fold-const: Punt on MULT_EXPR in extract_muldiv MIN/MAX_EXPR case [PR111151]

As I've tried to explain in the comments, the extract_muldiv_1
MIN/MAX_EXPR optimization is wrong for code == MULT_EXPR.
If the multiplication is done in unsigned type or in signed
type with -fwrapv, it is fairly obvious that max (a, b) * c
in many cases isn't equivalent to max (a * c, b * c) (or min if c is
negative) due to overflows, but even for signed with undefined overflow,
the optimization could turn something without UB in it (where
say a * c invokes UB, but max (or min) picks the other operand where
b * c doesn't).
As for division/modulo, I think it is in most cases safe, except if
the problematic INT_MIN / -1 case could be triggered, but we can
just punt for MAX_EXPR because for MIN_EXPR if one operand is INT_MIN,
we'd pick that operand already.  It is just for completeness, match.pd
already has an optimization which turns x / -1 into -x, so the division
by zero is mostly theoretical.  That is also why in the testcase the
i case isn't actually miscompiled without the patch, while the c and f
cases are.

2024-03-26  Jakub Jelinek  <jakub@redhat.com>

	PR middle-end/111151
	* fold-const.cc (extract_muldiv_1) <case MAX_EXPR>: Punt for
	MULT_EXPR altogether, or for MAX_EXPR if c is -1.

	* gcc.c-torture/execute/pr111151.c: New test.

1 files changed, 21 insertions, 0 deletions

diff --git a/gcc/testsuite/gcc.c-torture/execute/pr111151.c b/gcc/testsuite/gcc.c-torture/execute/pr111151.c
new file mode 100644
index 0000000..89255d2
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/pr111151.c
@@ -0,0 +1,21 @@
+/* PR middle-end/111151 */
+
+int
+main ()
+{
+  unsigned a = (1U + __INT_MAX__) / 2U;
+  unsigned b = 1U;
+  unsigned c = (a * 2U > b * 2U ? a * 2U : b * 2U) * 2U;
+  if (c != 0U)
+    __builtin_abort ();
+  int d = (-__INT_MAX__ - 1) / 2;
+  int e = 10;
+  int f = (d * 2 > e * 5 ? d * 2 : e * 5) * 6;
+  if (f != 120)
+    __builtin_abort ();
+  int g = (-__INT_MAX__ - 1) / 2;
+  int h = 0;
+  int i = (g * 2 > h * 5 ? g * 2 : h * 5) / -1;
+  if (i != 0)
+    __builtin_abort ();
+}