[gcc r16-2759] asf: Fix null pointer dereference in is_store_forwarding [PR121303]

[Philipp Tomsich via Gcc-cvs]

https://gcc.gnu.org/g:be377ef9ce3eb870ffd18ac02dabe32260dfcb6f

commit r16-2759-gbe377ef9ce3eb870ffd18ac02dabe32260dfcb6f
Author: Konstantinos Eleftheriou <konstantinos.elefther...@vrull.eu>
Date:   Wed Jul 30 17:06:33 2025 +0200

    asf: Fix null pointer dereference in is_store_forwarding [PR121303]
    
    We were calling `is_store_forwarding` with a NULL value for `off_val`,
    which was causing a null pointer dereference in `is_constant`, leading
    to an ICE.
    
    This patch updates the call to `is_constant` in `is_store_forwarding`
    and adds a check for `off_val`, in order to update it with the right
    value.
    
    Bootstrapped/regtested on AArch64 and x86_64.
    
            PR rtl-optimization/121303
    
    gcc/ChangeLog:
    
            * avoid-store-forwarding.cc (is_store_forwarding): Add check
            for `off_val` in `is_store_forwarding`.
    
    gcc/testsuite/ChangeLog:
    
            * gcc.target/i386/pr121303.c: New test.

Diff:
---
 gcc/avoid-store-forwarding.cc            |  9 ++++++++-
 gcc/testsuite/gcc.target/i386/pr121303.c | 26 ++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/gcc/avoid-store-forwarding.cc b/gcc/avoid-store-forwarding.cc
index 1de6fd61d875..78ed736e0a3e 100644
--- a/gcc/avoid-store-forwarding.cc
+++ b/gcc/avoid-store-forwarding.cc
@@ -145,11 +145,18 @@ is_store_forwarding (rtx store_mem, rtx load_mem, 
HOST_WIDE_INT *off_val)
   poly_int64 load_offset, store_offset;
   rtx load_base = strip_offset (XEXP (load_mem, 0), &load_offset);
   rtx store_base = strip_offset (XEXP (store_mem, 0), &store_offset);
+  poly_int64 off_diff = store_offset - load_offset;
+
+  HOST_WIDE_INT off_val_tmp = 0;
+  bool is_off_diff_constant = off_diff.is_constant (&off_val_tmp);
+  if (off_val)
+    *off_val = off_val_tmp;
+
   return (MEM_SIZE (load_mem).is_constant ()
          && rtx_equal_p (load_base, store_base)
          && known_subrange_p (store_offset, MEM_SIZE (store_mem),
                               load_offset, MEM_SIZE (load_mem))
-         && (store_offset - load_offset).is_constant (off_val));
+         && is_off_diff_constant);
 }
 
 /* Given a list of small stores that are forwarded to LOAD_INSN, try to
diff --git a/gcc/testsuite/gcc.target/i386/pr121303.c 
b/gcc/testsuite/gcc.target/i386/pr121303.c
new file mode 100644
index 000000000000..7900bce7e402
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr121303.c
@@ -0,0 +1,26 @@
+/* { dg-do compile } */
+/* { dg-options "-O1 -favoid-store-forwarding" } */
+
+typedef struct {
+  bool is_ssa;
+} nir_src;
+
+nir_src nir_src_init;
+
+typedef struct {
+  nir_src src;
+  char swizzle[6];
+} nir_alu_src;
+
+void nir_src_bit_size(nir_src);
+
+void nir_lower_fb_read_instr() {
+  {
+    nir_alu_src alu_src = {nir_src_init}, src = alu_src;
+    nir_src_bit_size(src.src);
+  }
+  {
+    nir_alu_src alu_src = {nir_src_init}, src = alu_src;
+    nir_src_bit_size(src.src);
+  }
+}