gnu/gcc/b7fbc9e1a4ebb2f7f52dff4b8a57309847aaa90d expmed: size 'op'/'log' for synth_mult's extend-then-discard [PR127031]
synth_mult accepts a sub-algorithm of up to MAX_BITS_PER_WORD
operations from its recursive call and appends the current operation
at index ops before the too-long check discards the result. That index
is one past both arrays. The write to op[MAX_BITS_PER_WORD] aliases
log[0..3] and overwrites the shift counts of the algorithm being
built, and the write to log[MAX_BITS_PER_WORD] falls outside the
struct. The cache update just above the check reads op[] at the same
index.
AVR reaches this at -O1/-O2, where MAX_BITS_PER_WORD is 8 and a SImode
multiply by a dense constant needs more operations than that:
uint32_t f (uint32_t x) { return x * 0xaaab; }
Size the arrays for the transient state.
PR middle-end/127031
gcc/ChangeLog:
* expmed.h (struct algorithm): Add one slot to the op and log
arrays for the operation synth_mult appends to a full
sub-algorithm before discarding it.
gcc/testsuite/ChangeLog:
* gcc.target/avr/pr127031.c: New test.
2 files changed