[gcc r14-5817] tree-optimization/112677 - stack corruption with .COND_* reduction

[gcc r14-5817] tree-optimization/112677 - stack corruption with .COND_* reduction

[Richard Biener]

https://gcc.gnu.org/g:9f63a8898154473f7b773c3e2ed71e4959719b71

commit r14-5817-g9f63a8898154473f7b773c3e2ed71e4959719b71
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 24 10:04:15 2023 +0100

    tree-optimization/112677 - stack corruption with .COND_* reduction
    
    The following makes sure to allocate enough space for vectype_op
    in vectorizable_reduction.
    
            PR tree-optimization/112677
            * tree-vect-loop.cc (vectorizable_reduction): Use alloca
            to allocate vectype_op.

Diff:
---
 gcc/tree-vect-loop.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gcc/tree-vect-loop.cc b/gcc/tree-vect-loop.cc
index caaed977c89..3df020d2228 100644
--- a/gcc/tree-vect-loop.cc
+++ b/gcc/tree-vect-loop.cc
@@ -7385,7 +7385,6 @@ vectorizable_reduction (loop_vec_info loop_vinfo,
 			stmt_vector_for_cost *cost_vec)
 {
   tree vectype_in = NULL_TREE;
-  tree vectype_op[3] = { NULL_TREE, NULL_TREE, NULL_TREE };
   class loop *loop = LOOP_VINFO_LOOP (loop_vinfo);
   enum vect_def_type cond_reduc_dt = vect_unknown_def_type;
   stmt_vec_info cond_stmt_vinfo = NULL;
@@ -7617,6 +7616,7 @@ vectorizable_reduction (loop_vec_info loop_vinfo,
      assumption is not true: we use reduc_index to record the index of the
      reduction variable.  */
   slp_tree *slp_op = XALLOCAVEC (slp_tree, op.num_ops);
+  tree *vectype_op = XALLOCAVEC (tree, op.num_ops);
   /* We need to skip an extra operand for COND_EXPRs with embedded
      comparison.  */
   unsigned opno_adjust = 0;