[Bug middle-end/79988] [7 Regression][CHKP] ICE in tree check: accessed operand 5 of call_expr with 4 operands in ix86_expand_builtin, at config/i386/i386.c:36851

["rguenth at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79988

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
             Target|                            |x86_64-*-*, i?86-*-*
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2017-03-10
   Target Milestone|---                         |7.0
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Well, the call to __builtin_ia32_bndcl is not compatible and thus not detected
as builtin here because the argument is pointing to a different address-space
than the prototype.

I'm unsure if MPX handles pointers to different address-spaces and how to
handle this case in general.  Simply stripping address-space qualifiers
for the gimple_builtin_call_types_compatible_p check is similarly bogus
I guess.

The specific check in chkp_gimple_call_builtin_p can of course be
reverted back to skip this checking via

Index: gcc/tree-chkp.c
===================================================================
--- gcc/tree-chkp.c     (revision 246023)
+++ gcc/tree-chkp.c     (working copy)
@@ -433,7 +433,9 @@ chkp_gimple_call_builtin_p (gimple *call
                            enum built_in_function code)
 {
   tree fndecl;
-  if (gimple_call_builtin_p (call, BUILT_IN_MD)
+  if (is_gimple_call (call)
+      && (fndecl = gimple_call_fndecl (call)) != NULL
+      && DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_MD
       && (fndecl = targetm.builtin_chkp_function (code))
       && (DECL_FUNCTION_CODE (gimple_call_fndecl (call))
          == DECL_FUNCTION_CODE (fndecl)))

but then if the resulting code makes any sense I don't know.  It does

.L3:
        movq    %rdx, %rax
        leaq    (%rsi,%rdx), %rcx
        bndcl   (%rdx), %bnd0
        bndcu   (%rdi,%rcx), %bnd0
        movq    $0, %gs:(%rdx)
        bndstx  %bnd1, (%rdx,%r8)
        addq    $8, %rdx

which looks like wrong-code to me (bndcl of (%rdx) rather than %gs:(%rdx)).

I'd say ICE is better than wrong-code but YMMV ;)