[Bug target/122673] New: [15/16 Regression] Segment fault by valid code on rv64 with -O2/-O3

[rvismith1115 at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122673

            Bug ID: 122673
           Summary: [15/16 Regression] Segment fault by valid code on rv64
                    with -O2/-O3
           Product: gcc
           Version: 16.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rvismith1115 at gmail dot com
  Target Milestone: ---

Created attachment 62786
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=62786&action=edit
reduced test case

Tested bug version: gcc-15-20251025, gcc-16-20251019
OK version: gcc-14-20251024

> riscv64-unknown-elf-g++ bug.cpp -O3 -march=rv64gcv_zvfh -mabi=lp64d -o a.out 
> && $QEMU a.out
Segmentation fault (core dumped)
> riscv64-unknown-elf-g++ bug.cpp -O0 -march=rv64gcv_zvfh -mabi=lp64d -o a.out 
> && $QEMU a.out && echo $?
0

Reproducer:
#include <riscv_vector.h>
long a = 6453, d = 30254205719575544, c;
bool b = 0;
short e[1][21];
int f[4][1][21][21][41];
int8_t g[1];
int16_t i[1];
int16_t j[1];
void l() {
  for (bool k = 0; k < b; k = 1)
    c = 108863;
  for (short q = 0; q < 021; q += 3)
    for (int m(a - 6453); m < 20; m = a)
      for (long p(d - 30254205719575544); p < 21; p += 2)
        for (char t(~e[m][8] - 72); t < 021; t += 4)
          for (char r = 0; r < (char)509755684; r = 46) {
            int s = 3;
            for (size_t ab; s; s -= ab) {
              ab = __riscv_vsetvl_e16m1(s);
              vint8mf2_t ac = __riscv_vle8_v_i8mf2(&g[0], b);
              vbool16_t ad = __riscv_vmseq_vx_i8mf2_b16(ac, 1, b);
              vint16m1_t ae = __riscv_vmv_v_x_i16m1(0,
__riscv_vsetvlmax_e16m1());
              vint16m1_t af = __riscv_vlse16_v_i16m1_tu(ae, &i[0], 2, b);
              vint16m1_t ag = __riscv_vssub_vv_i16m1_m(ad, af, af, ab);
              __riscv_vse16_v_i16m1(&j[0], ag, ab);
            }
            f[3][m][p][t][3] = 0;
          }
}
int main() {
  for (size_t n = 0; n < 1; ++n)
    for (size_t o = 0; o < 21; ++o)
      e[n][o] = 21174;
  l();
}