https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127031
--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Philipp Tomsich <[email protected]>: https://gcc.gnu.org/g:b7fbc9e1a4ebb2f7f52dff4b8a57309847aaa90d commit r17-3630-gb7fbc9e1a4ebb2f7f52dff4b8a57309847aaa90d Author: Philipp Tomsich <[email protected]> Date: Mon Aug 24 12:07:21 2026 +0200 expmed: size 'op'/'log' for synth_mult's extend-then-discard [PR127031] synth_mult accepts a sub-algorithm of up to MAX_BITS_PER_WORD operations from its recursive call and appends the current operation at index ops before the too-long check discards the result. That index is one past both arrays. The write to op[MAX_BITS_PER_WORD] aliases log[0..3] and overwrites the shift counts of the algorithm being built, and the write to log[MAX_BITS_PER_WORD] falls outside the struct. The cache update just above the check reads op[] at the same index. AVR reaches this at -O1/-O2, where MAX_BITS_PER_WORD is 8 and a SImode multiply by a dense constant needs more operations than that: uint32_t f (uint32_t x) { return x * 0xaaab; } Size the arrays for the transient state. PR middle-end/127031 gcc/ChangeLog: * expmed.h (struct algorithm): Add one slot to the op and log arrays for the operation synth_mult appends to a full sub-algorithm before discarding it. gcc/testsuite/ChangeLog: * gcc.target/avr/pr127031.c: New test.
