Re: [PATCH] isel, i386: Fix ICE on out of bounds vector elt access [PR126446]

[Jakub Jelinek]

On Wed, Jul 29, 2026 at 08:54:35AM +0200, Richard Biener wrote:
> > Now that I look at the patch, I think the if (known_gt (idx_poly, nelts))
> > above is wrong as well, I think it should be
> > if (known_ge (idx_poly, nelts))
> > because vector set is out of bounds even when accessing nelts index.
> > If you agree, I can post an incremental patch.
> 
> I agree to that.
> > @@ -114,6 +115,10 @@ gimple_expand_vec_set_extract_expr (stru
> >       if (known_gt (idx_poly, nelts))
> >         return false;
> >     }
> > +      else if (tree_fits_poly_int64_p (idx))
> > +   // if idx doesn't fit into poly_uint64, but fits into poly_int64,
> > +   // it must be negative
> > +   return false;
> 
> I'd say that iff poly_int_tree_p (idx, &idx_poly) checks it fits
> poly_uint64 then if it is poly-int (like large uint128), it's
> too large, so ...
> 
>    else if (poly_int_tree_p (idx))
>      // if idx doesn't fit into poly_uint64 but is constant, it must
>      //  be out of bounds
>      return false;
> 
> ?

Ok.  Because GCC 16.2 rc is near, I'll commit separately the i386.cc +
testcase right now (with IN_RANGE that Uros requested) and test
separately:

2026-07-29  Jakub Jelinek  <ja...@redhat.com>

        PR target/126446
        * gimple-isel.cc (gimple_expand_vec_set_extract_expr): Punt if
        idx doesn't fit into poly_uint64 but is poly_int_tree_p.  Use
        known_ge rather than known_gt for out of bounds check.  Formatting
        fixes.

--- gcc/gimple-isel.cc.jj       2026-07-28 21:02:44.114364489 +0200
+++ gcc/gimple-isel.cc  2026-07-29 09:47:34.226093210 +0200
@@ -96,10 +96,11 @@ gimple_expand_vec_set_extract_expr (stru
     return false;
 
   tree op0 = TREE_OPERAND (ref, 0);
-  if (TREE_CODE (op0) == VIEW_CONVERT_EXPR && DECL_P (TREE_OPERAND (op0, 0))
+  if (TREE_CODE (op0) == VIEW_CONVERT_EXPR
+      && DECL_P (TREE_OPERAND (op0, 0))
       && VECTOR_TYPE_P (TREE_TYPE (TREE_OPERAND (op0, 0)))
-      && TYPE_MODE (TREE_TYPE (ref))
-          == TYPE_MODE (TREE_TYPE (TREE_TYPE (TREE_OPERAND (op0, 0)))))
+      && (TYPE_MODE (TREE_TYPE (ref))
+         == TYPE_MODE (TREE_TYPE (TREE_TYPE (TREE_OPERAND (op0, 0))))))
     {
       tree pos = TREE_OPERAND (ref, 1);
 
@@ -111,9 +112,13 @@ gimple_expand_vec_set_extract_expr (stru
       if (poly_int_tree_p (idx, &idx_poly))
        {
          poly_uint64 nelts = TYPE_VECTOR_SUBPARTS (TREE_TYPE (view_op0));
-         if (known_gt (idx_poly, nelts))
+         if (known_ge (idx_poly, nelts))
            return false;
        }
+      else if (poly_int_tree_p (idx))
+       // if idx doesn't fit into poly_uint64, but is constant, it
+       // must be out of bounds
+       return false;
       machine_mode outermode = TYPE_MODE (TREE_TYPE (view_op0));
       machine_mode extract_mode = TYPE_MODE (TREE_TYPE (ref));
 

        Jakub