https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126952

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Roger Sayle <[email protected]>:

https://gcc.gnu.org/g:4abcb017f2c77cde470050c49d12effcd378845a

commit r17-6120-g4abcb017f2c77cde470050c49d12effcd378845a
Author: Roger Sayle <[email protected]>
Date:   Tue Nov 10 14:30:22 2026 +0000

    PR middle-end/126952: --enable-checking=rtl bootstrap regression

    This is the minimal fix to restore --enable-checking=rtl builds.
    Conceptually, wide-int has a simple invariant: if len is greater than
    zero, then the val field is well-defined, but if len is zero, val may
    be uninitialized.  Alas, wi::copy doesn't correctly defend against
    the case that len is zero, resulting in a "maybe used uninitialized"
    error during bootstrap.  Reducing a testcase is difficult, but the
    closest I can reduce looks something like:

    void foo(unsigned int len, int *ptr)
    {
      int *undef;
      int *val = len ? ptr : undef;
      int i = 0;
      do {
        val[i]++;
      } while (++i < len);
    }

    Notice that when len is zero, val's value is undefined and that this
    undefined pointer is unconditionally dereferenced.  This regression
    was exposed on mainline, by a change to thread backedges which peels
    the first iteration of the loop, revealing the path where val is
    always (obviously) undefined.  In reality, this analysis depends upon
    various inlining decisions, silencing the "maybe used uninitialized"
    when the logic is sufficiently complex.

    2026-11-10  Roger Sayle  <[email protected]>

    gcc/ChangeLog
            PR middle-end/126952
            * wide-int.h (wi::copy): Check that len is non-zero before
            copying the contents of wide-int.

Reply via email to