On Mon, 4 Aug 2025, Konstantinos Eleftheriou wrote:
> We were calling `is_store_forwarding` with a NULL value for `off_val`,
> which was causing a null pointer dereference in `is_constant`, leading
> to an ICE.
>
> This patch updates the call to `is_constant` in `is_store_forwarding`
> and adds a check for `off_val`, in order to update it with the right
> value.
OK.
Richard.
> Bootstrapped/regtested on AArch64 and x86_64.
>
> PR rtl-optimization/121303
>
> gcc/ChangeLog:
>
> * avoid-store-forwarding.cc (is_store_forwarding): Add check
> for `off_val` in `is_store_forwarding`.
>
> gcc/testsuite/ChangeLog:
>
> * gcc.target/i386/pr121303.c: New test.
> ---
> gcc/avoid-store-forwarding.cc | 9 +++++++-
> gcc/testsuite/gcc.target/i386/pr121303.c | 26 ++++++++++++++++++++++++
> 2 files changed, 34 insertions(+), 1 deletion(-)
> create mode 100644 gcc/testsuite/gcc.target/i386/pr121303.c
>
> diff --git a/gcc/avoid-store-forwarding.cc b/gcc/avoid-store-forwarding.cc
> index 1de6fd61d875..78ed736e0a3e 100644
> --- a/gcc/avoid-store-forwarding.cc
> +++ b/gcc/avoid-store-forwarding.cc
> @@ -145,11 +145,18 @@ is_store_forwarding (rtx store_mem, rtx load_mem,
> HOST_WIDE_INT *off_val)
> poly_int64 load_offset, store_offset;
> rtx load_base = strip_offset (XEXP (load_mem, 0), &load_offset);
> rtx store_base = strip_offset (XEXP (store_mem, 0), &store_offset);
> + poly_int64 off_diff = store_offset - load_offset;
> +
> + HOST_WIDE_INT off_val_tmp = 0;
> + bool is_off_diff_constant = off_diff.is_constant (&off_val_tmp);
> + if (off_val)
> + *off_val = off_val_tmp;
> +
> return (MEM_SIZE (load_mem).is_constant ()
> && rtx_equal_p (load_base, store_base)
> && known_subrange_p (store_offset, MEM_SIZE (store_mem),
> load_offset, MEM_SIZE (load_mem))
> - && (store_offset - load_offset).is_constant (off_val));
> + && is_off_diff_constant);
> }
>
> /* Given a list of small stores that are forwarded to LOAD_INSN, try to
> diff --git a/gcc/testsuite/gcc.target/i386/pr121303.c
> b/gcc/testsuite/gcc.target/i386/pr121303.c
> new file mode 100644
> index 000000000000..7900bce7e402
> --- /dev/null
> +++ b/gcc/testsuite/gcc.target/i386/pr121303.c
> @@ -0,0 +1,26 @@
> +/* { dg-do compile } */
> +/* { dg-options "-O1 -favoid-store-forwarding" } */
> +
> +typedef struct {
> + bool is_ssa;
> +} nir_src;
> +
> +nir_src nir_src_init;
> +
> +typedef struct {
> + nir_src src;
> + char swizzle[6];
> +} nir_alu_src;
> +
> +void nir_src_bit_size(nir_src);
> +
> +void nir_lower_fb_read_instr() {
> + {
> + nir_alu_src alu_src = {nir_src_init}, src = alu_src;
> + nir_src_bit_size(src.src);
> + }
> + {
> + nir_alu_src alu_src = {nir_src_init}, src = alu_src;
> + nir_src_bit_size(src.src);
> + }
> +}
>
--
Richard Biener <rguent...@suse.de>
SUSE Software Solutions Germany GmbH,
Frankenstrasse 146, 90461 Nuernberg, Germany;
GF: Ivo Totev, Andrew McDonald, Werner Knoblich; (HRB 36809, AG Nuernberg)
