[Bug middle-end/126446] [13/14/15 Regression] X86-64: ICE at -O1 -mavx2 during RTL pass: vregs since r12-2085

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126446

--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-15 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:34932e9e078c180c4d552d910ff8c97be9ed8050

commit r15-11437-g34932e9e078c180c4d552d910ff8c97be9ed8050
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Jul 29 10:15:11 2026 +0200

    i386: Fix ICE on out of bounds vector elt access [PR126446]

    The following testcase ICEs on x86_64.
    The isel pass has a check for out of bounds constant index before
    optimizing into .VEC_SET, but it does it using
          // if index is a constant, then check the bounds
          poly_uint64 idx_poly;
          if (poly_int_tree_p (idx, &idx_poly))
            {
              poly_uint64 nelts = TYPE_VECTOR_SUBPARTS (TREE_TYPE (view_op0));
              if (known_gt (idx_poly, nelts))
                return false;
            }
    In the testcase below, idx is INTEGER_CST with long long type and
    negative value, that doesn't fit into poly_uint64, so we happily convert
    it into .VEC_SET.

    And another problem is that the x86 backend isn't trying to be careful
    and handle out of bounds elt gracefully (I think it could still in theory
    happen, if GIMPLE lets it through but e.g. something during expansion
    figures out the index is constant or whatever).

    The following patch fixes it in the backend to avoid triggering UB at
compile
    time by doing HOST_WIDE_INT_1U << elt etc. when elt is negative or too
    large.  In order to avoid ICE, we need to emit something, so I emit
    a no-op move, out of bounds vector set shouldn't change anything in
    the target.

    gimple-isel.cc will be changed incrementally.

    2026-07-29  Jakub Jelinek  <jakub@redhat.com>

            PR target/126446
            * config/i386/i386-expand.cc (ix86_expand_vector_set): If elt is
            out of bounds, emit a no-op move.

            * gcc.target/i386/avx2-pr126446.c: New test.

    Reviewed-by: Uros Bizjak <ubizjak@gmail.com>
    (cherry picked from commit 1bc2fdc4f4cbe1b68237f49f211473c56d8a44a3)