https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116953

            Bug ID: 116953
           Summary: [avr] error: operands to %T/%t must be reg + const_int
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gjl at gcc dot gnu.org
  Target Milestone: ---

unsigned foo (unsigned x, unsigned y)
{
  int i;
  for (i = 8; i--; x <<= 1)
    y ^= (x ^ y) & 0x80 ? 79U : 0U;
  return y;
}

$ avr-gcc -S -O2 -mmcu=atmega128 ...
bug.c: In function 'foo':
bug.c:7:1: error: operands to %T/%t must be reg + const_int:
    7 | }
      | ^
(const_int 79 [0x4f])
during RTL pass: final
bug.c:7:1: internal compiler error: in avr_print_operand, at
config/avr/avr.cc:2593
0xdec976 avr_print_operand
        ../../../source/gcc-master/gcc/config/avr/avr.cc:2593
0x6edc19 output_operand(rtx_def*, int)
        ../../../source/gcc-master/gcc/final.cc:3632
0x6ed73c output_asm_insn(char const*, rtx_def**)
        ../../../source/gcc-master/gcc/final.cc:3525
0xe058ad avr_out_sbxx_branch(rtx_insn*, rtx_def**)
        ../../../source/gcc-master/gcc/config/avr/avr.cc:13651
0x6ea2f6 get_insn_template(int, rtx_insn*)
        ../../../source/gcc-master/gcc/final.cc:2027
0x6ebea9 final_scan_insn_1

The bug works as follows:

avr.cc::avr_out_sbxx_branch() calls jump_over_one_insn_p() to determine whether
the current insn may skip the next instruction. jump_over_one_insn_p() uses
avr_2word_insn_p() on the NEXT insn, in particular it might compute insn
attributes to determine whether the next insn is a single instruction.
Computing insn attributes may run extract, which sets recog_data.operand
according to the next insn, but avr_out_sbxx_branch() assumes that operands
still holds operands for the current insn.

The probability for this bug increased with r15-3634, but it may also occur
without it.

Depending on the (operands of) the next insn, the ICE diagnostic may be
different, or wrong code may be generated, or a different ICE may trigger like
a segmentation fault.

Reply via email to