https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126084
--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The releases/gcc-16 branch has been updated by Jakub Jelinek <[email protected]>: https://gcc.gnu.org/g:cd0a5fdbaecb5dc05257d0aace12d7c4aea5eb1c commit r16-9287-gcd0a5fdbaecb5dc05257d0aace12d7c4aea5eb1c Author: Jakub Jelinek <[email protected]> Date: Tue Jul 14 10:39:55 2026 +0200 bitintlower: Handle .ASAN_POISON and .ASAN_POISON_USE with large/huge _BitInt [PR126084] If we have .ASAN_MARK (UNPOISON, &a, 24); .ASAN_MARK (UNPOISON, &b, 24); p_7 = &a; q_8 = &b; .ASAN_MARK (POISON, &a, 24); .ASAN_MARK (POISON, &b, 24); _1 = *p_7; _2 = *q_8; _3 = _1 + _2; <retval> = _3; return <retval>; or .ASAN_MARK (UNPOISON, &a, 24); .ASAN_MARK (UNPOISON, &b, 24); p_4 = &a; q_5 = &b; .ASAN_MARK (POISON, &a, 24); .ASAN_MARK (POISON, &b, 24); *p_4 = 1; *q_5 = 2; return; which represent load or store uses after scope and decide not to make the vars addressable anymore, we turn that into a_10 = .ASAN_POISON (); b_11 = .ASAN_POISON (); _1 = a_10 + b_11; <retval> = _1; return <retval>; or a_8 = .ASAN_POISON (); b_9 = .ASAN_POISON (); .ASAN_POISON_USE (a_8); .ASAN_POISON_USE (b_9); return; These 2 internal fns are something that is normally lowere during sanopt. Now, if the involved vars are large/huge _BitInt, the bitintlower pass doesn't handle them and we end up with invalid IL (we try to change the lhs of .ASAN_POISON from SSA_NAME to a var etc. which violates what sanopt expects and get an extra .ASAN_POISON_USE while doing that etc. I thought what would be the best way to deal with these, e.g. try to replace them with something tracking just one limb in those (although it is nicer to report the proper sizes in asan rather than just small part of it), but the .ASAN_POISON () uses can be also PHI args and some PHI args could be .ASAN_POISON () uses while others could be unrelated SSA_NAMEs, so we'd need to change those uses to be extensions from the .ASAN_POISONed limb into full size on all edges and what to do with abnormal edges etc. So, in the end I've decided instead to just perform what sanopt pass does for these 2 ifns if large/huge _BitInt is involved at the start of the bitintlower pass (similarly how we lower switches there). The asan.cc changes are needed so that we can properly report 24 bytes or 568 bytes etc. READs or WRITEs after scope. 2026-07-14 Jakub Jelinek <[email protected]> PR middle-end/126084 * gimple-lower-bitint.cc: Include "attribs.h" and "asan.h". (gimple_lower_bitint): Use asan_expand_poison_ifn to lower .ASAN_POISON calls with large/huge _BitInt lhs. * asan.cc (report_error_func): Set *nargs and use _n builtin even if size is not a power of two or larger than 16. (asan_expand_poison_ifn): Handle nargs == 2. * gcc.dg/asan/bitint-1.c: New test. * gcc.dg/asan/bitint-2.c: New test. Reviewed-by: Richard Biener <[email protected]> (cherry picked from commit 8837b1d542fb685da3b36176a0bd82a46f472b80)
