Hi! The following testcase ICEs on ppc64le. The problem is that copy_reg_eh_region_note_* functions accept either some instruction, or REG_EH_REGION note directly. To differentiate between those it uses INSN_P test (and returns early if the insn doesn't contain any REG_EH_REGION notes). If the function is called on a rtx_insn * that isn't INSN_P, like on the testcase on a NOTE, it assumes it must be REG_EH_REGION note, uses XEXP (note, 0) on it, which is actually PREV_INSN in this case and stores an instruction (JUMP_INSN in this case) into REG_EH_REGION notes it creates.
I believe we should treat rtx_insn * that aren't INSN_P like instructions that don't have any REG_EH_REGION notes. Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk? 2019-02-07 Jakub Jelinek <ja...@redhat.com> PR rtl-optimization/89234 * except.c (copy_reg_eh_region_note_forward): Return if note_or_insn is a NOTE, CODE_LABEL etc. - rtx_insn * other than INSN_P. (copy_reg_eh_region_note_backward): Likewise. * g++.dg/ubsan/pr89234.C: New test. --- gcc/except.c.jj 2019-01-10 11:43:14.387377695 +0100 +++ gcc/except.c 2019-02-07 15:11:27.756869475 +0100 @@ -1756,6 +1756,8 @@ copy_reg_eh_region_note_forward (rtx not if (note == NULL) return; } + else if (is_a <rtx_insn *> (note_or_insn)) + return; note = XEXP (note, 0); for (insn = first; insn != last ; insn = NEXT_INSN (insn)) @@ -1778,6 +1780,8 @@ copy_reg_eh_region_note_backward (rtx no if (note == NULL) return; } + else if (is_a <rtx_insn *> (note_or_insn)) + return; note = XEXP (note, 0); for (insn = last; insn != first; insn = PREV_INSN (insn)) --- gcc/testsuite/g++.dg/ubsan/pr89234.C.jj 2019-02-07 17:12:02.081024666 +0100 +++ gcc/testsuite/g++.dg/ubsan/pr89234.C 2019-02-07 17:08:55.026097949 +0100 @@ -0,0 +1,11 @@ +// PR rtl-optimization/89234 +// { dg-do compile { target dfp } } +// { dg-options "-O2 -fnon-call-exceptions -fsanitize=null" } + +typedef float __attribute__((mode (SD))) _Decimal32; + +void +foo (_Decimal32 *b, _Decimal32 c) +{ + *b = c + 1.5; +} Jakub