https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122569

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Philipp Tomsich <[email protected]>:

https://gcc.gnu.org/g:a66820ce3f5b298759042b6543a056b490370310

commit r17-286-ga66820ce3f5b298759042b6543a056b490370310
Author: Philipp Tomsich <[email protected]>
Date:   Thu Apr 9 10:58:23 2026 +0200

    tree-optimization/122569 - fix DeBruijn CLZ table validator shift-by-64 UB

    simplify_count_zeroes validates DeBruijn CLZ tables by computing
    (1 << (data + 1)) - 1 to simulate the value produced by the OR-cascade
    b |= b >> 1; ... b |= b >> 32.  For 64-bit input with data == 63 (the
    MSB bit), data + 1 equals HOST_BITS_PER_WIDE_INT, making the shift
    (HOST_WIDE_INT_1U << 64) undefined behavior.  Hosts typically produce
    0, so the check (0 * magic) >> 58 == 63 fails and check_table_array
    returns false.

    Every well-formed 64-bit DeBruijn CLZ table has an entry mapping the
    all-ones value to bit 63, so this UB rejected every such table --
    including the magic 0x03f79d71b4cb0a89 used in Stockfish's msb(),
    zstd's bits.h, and cpython's pycore_bitutils.h.

    Fix by special-casing data + 1 == HOST_BITS_PER_WIDE_INT to use
    HOST_WIDE_INT_M1U.  Only the 64-bit CLZ path is affected.

    gcc/ChangeLog:

            PR tree-optimization/122569
            * tree-ssa-forwprop.cc (simplify_count_zeroes): Avoid
            shift-by-HOST_BITS_PER_WIDE_INT UB when computing the all-ones
            value for the CLZ validator.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/122569
            * gcc.dg/tree-ssa/pr122569-1.c: New test.
            * gcc.dg/tree-ssa/pr122569-2.c: New test.
  • [Bug tree-optimization/122569] ... cvs-commit at gcc dot gnu.org via Gcc-bugs

Reply via email to