[PATCH] xtensa: Fix out-of-bounds array access

[Takayuki 'January June' Suwa <jjsuwa_sys3175@yahoo.co.jp>]

On 2022/10/26 5:09, Jan-Benedict Glaw wrote:
> I didn't yet actually check the warning, it may be bogus.

This "problem" can occur in the following two places calling xtensa_split_DI_reg_imm():

- (define_expand "movdi") @ line 943-945
- (define_split) @ line 989

and the former causes the "real" problem:

[from gcc/insn-emit.cc (generated by building)]

> /* ../../gcc/config/xtensa/xtensa.md:932 */
> rtx
> gen_movdi (rtx operand0,
> 	rtx operand1)
> {
>   rtx_insn *_val = 0;
>   start_sequence ();
>   {
>     rtx operands[2];					// only 2 elements
>     operands[0] = operand0;
>     operands[1] = operand1;
> #define FAIL return (end_sequence (), _val)
> #define DONE return (_val = get_insns (), end_sequence (), _val)
> #line 936 "../../gcc/config/xtensa/xtensa.md"
> {
>   if (CONSTANT_P (operands[1]))
>     {
>       /* Split in halves if 64-bit Const-to-Reg moves
> 	 because of offering further optimization opportunities.  */
>       if (register_operand (operands[0], DImode))
> 	{
> 	  xtensa_split_DI_reg_imm (operands);		// out-of-bounds!
> 	  emit_move_insn (operands[0], operands[1]);
> 	  emit_move_insn (operands[2], operands[3]);	// out-of-bounds!
> 	  DONE;
> 	}

The latter is not a problem as the array is large enough (up to MAX_RECOG_OPERANDS-1).

===

gcc/ChangeLog:

	* config/xtensa/xtensa.md (movdi):
	Copy operands[0...1] to ops[0...3] and then use the latter before
	calling xtensa_split_DI_reg_imm() and emitting insns.
---
 gcc/config/xtensa/xtensa.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/gcc/config/xtensa/xtensa.md b/gcc/config/xtensa/xtensa.md
index 2e7f76ada5c..de9bcbf24f7 100644
--- a/gcc/config/xtensa/xtensa.md
+++ b/gcc/config/xtensa/xtensa.md
@@ -940,9 +940,10 @@
 	 because of offering further optimization opportunities.  */
       if (register_operand (operands[0], DImode))
 	{
-	  xtensa_split_DI_reg_imm (operands);
-	  emit_move_insn (operands[0], operands[1]);
-	  emit_move_insn (operands[2], operands[3]);
+	  rtx ops[4] = { operands[0], operands[1] };
+	  xtensa_split_DI_reg_imm (ops);
+	  emit_move_insn (ops[0], ops[1]);
+	  emit_move_insn (ops[2], ops[3]);
 	  DONE;
 	}
 
-- 
2.30.2