https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80880

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
(gdb) p debug_generic_expr (exp)
__builtin_ia32_bndret (0B)

And sinking does:

Sinking __bound_tmp.0_3 = __builtin_ia32_bndret (_2);
 from bb 2 to bb 3

int* fn1.chkp() ()
{
  __bounds_type __bound_tmp.0;
  int * _2;

  <bb 2> [100.00%]:
  _2 = fn1.chkp ();
  if (_2 == 0B)
    goto <bb 3>; [33.47%]
  else
    goto <bb 4>; [66.53%]

  <bb 3> [33.47%]:
  __bound_tmp.0_3 = __builtin_ia32_bndret (_2);
  return 0B, __bound_tmp.0_3;

  <bb 4> [66.53%]:
  return;

nothing wrong with that.  Now we can do the conditional replacement of _2
with 0.

Thus expansion issue.  We absolutely need to deal with constant pointers here,
even if just in a conservative way.  chkp_get_rtl_bounds suggests that
returning NULL_RTX is ok thus

@@ -37584,8 +37601,10 @@ ix86_expand_builtin (tree exp, rtx targe

     case IX86_BUILTIN_BNDRET:
       arg0 = CALL_EXPR_ARG (exp, 0);
-      gcc_assert (TREE_CODE (arg0) == SSA_NAME);
-      target = chkp_get_rtl_bounds (arg0);
+      if (TREE_CODE (arg0) == SSA_NAME)
+       target = chkp_get_rtl_bounds (arg0);
+      else
+       target = NULL;

       /* If no bounds were specified for returned value,
         then use INIT bounds.  It usually happens when

or simply adjust chkp_get_rtl_bounds as there seems to be a single caller only.

Reply via email to