re PR tree-optimization/87826 (ubsan: gimple-ssa-store-merging.c:281)
authorJakub Jelinek <jakub@redhat.com>
Thu, 1 Nov 2018 12:31:45 +0000 (13:31 +0100)
committerJakub Jelinek <jakub@gcc.gnu.org>
Thu, 1 Nov 2018 12:31:45 +0000 (13:31 +0100)
PR tree-optimization/87826
* gimple-ssa-store-merging.c (do_shift_rotate): Punt if count is
negative or larger or equal to type's precision.

* gcc.dg/pr87826.c: New test.

From-SVN: r265720

gcc/ChangeLog
gcc/gimple-ssa-store-merging.c
gcc/testsuite/ChangeLog
gcc/testsuite/gcc.dg/pr87826.c [new file with mode: 0644]

index f104208fae691620c0c529eb5e90cf6b3e93644c..7b0950c9db954694faf876bb4713ceb591603247 100644 (file)
@@ -1,3 +1,9 @@
+2018-11-01  Jakub Jelinek  <jakub@redhat.com>
+
+       PR tree-optimization/87826
+       * gimple-ssa-store-merging.c (do_shift_rotate): Punt if count is
+       negative or larger or equal to type's precision.
+
 2018-10-31  Alexandre Oliva <aoliva@redhat.com>
 
        * opts.c (default_options_table): Do not enable
index e1ddcb5e558d06883fd267261095e80aa4a39db5..5e5823c44a0343d67f323eee241d2416bfb8caf8 100644 (file)
@@ -262,7 +262,9 @@ do_shift_rotate (enum tree_code code,
   int i, size = TYPE_PRECISION (n->type) / BITS_PER_UNIT;
   unsigned head_marker;
 
-  if (count % BITS_PER_UNIT != 0)
+  if (count < 0
+      || count >= TYPE_PRECISION (n->type)
+      || count % BITS_PER_UNIT != 0)
     return false;
   count = (count / BITS_PER_UNIT) * BITS_PER_MARKER;
 
index 5cb637306de760b7c65317280d604a4fcdf6757f..2dbe48063a909c91d7718dc41cec3976370fe2c7 100644 (file)
@@ -1,3 +1,8 @@
+2018-11-01  Jakub Jelinek  <jakub@redhat.com>
+
+       PR tree-optimization/87826
+       * gcc.dg/pr87826.c: New test.
+
 2018-11-01  Thomas Koenig  <tkoenig@gcc.gnu.org>
 
        PR fortran/46020
diff --git a/gcc/testsuite/gcc.dg/pr87826.c b/gcc/testsuite/gcc.dg/pr87826.c
new file mode 100644 (file)
index 0000000..cc5f14a
--- /dev/null
@@ -0,0 +1,13 @@
+/* PR tree-optimization/87826 */
+/* { dg-do compile } */
+/* { dg-options "-O3 -w" } */
+
+int c;
+
+void
+foo (int *b)
+{
+  int e;
+  for (e = 0; e < 16; ++e)
+    b[e] = c >> e * 8;
+}