https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77822
--- Comment #23 from Dominik Vogt <vogt at linux dot vnet.ibm.com> --- Regarding the ARM patch: + { + if (!IN_RANGE (INTVAL (operands[2]) + INTVAL (operands[3]), + 1, GET_MODE_BITSIZE (DImode) - 1)) + FAIL; + } Isn't this patch too simple? On s390x we get "pos" -N (operand 3) with "size" M, so the correct check should be: if (! IN_RANGE (INTVAL (operands[3]), 0, GET_MODE_BITSIZE (DImode) - 1) || IN_RANGE (INTVAL (operands[3]) + INTVAL (operands[2]), 1, GET_MODE_BITSIZE (DImode))) FAIL; It's just luck that the test program does not generate something like (zero_extract (...) (-1) (16)) Which can only be caught by testing "pos" individually. -- Also, I don't understand why the valid range is "1, GET_MODE_BITSIZE (DImode) - 1", shouldn't it be "1, GET_MODE_BITSIZE (DImode)" without the "- 1"?