repeating_sequence_p operates directly on the encoded pattern and does
not derive elements using the .elt() accessor. Passing in the length of
the unencoded vector can cause an out-of-bounds read of the encoded
pattern.
gcc/ChangeLog:
* config/riscv/riscv-v.cc
(rvv_builder::can_duplicate_repeating_sequence_p):
Use encoded_nelts when calling repeating_sequence_p.
(rvv_builder::is_repeating_sequence): Ditto.
(rvv_builder::repeating_sequence_use_merge_profitable_p): Ditto.
Signed-off-by: Patrick O'Neill <[email protected]>
---
gcc/config/riscv/riscv-v.cc | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/gcc/config/riscv/riscv-v.cc b/gcc/config/riscv/riscv-v.cc
index 0db5c7591ef..c89603669e3 100644
--- a/gcc/config/riscv/riscv-v.cc
+++ b/gcc/config/riscv/riscv-v.cc
@@ -502,9 +502,7 @@ rvv_builder::can_duplicate_repeating_sequence_p ()
|| GET_MODE_SIZE (m_new_inner_mode) > UNITS_PER_WORD
|| !get_vector_mode (m_new_inner_mode, new_size).exists (&m_new_mode))
return false;
- if (full_nelts ().is_constant ())
- return repeating_sequence_p (0, full_nelts ().to_constant (), npatterns
());
- return nelts_per_pattern () == 1;
+ return repeating_sequence_p (0, encoded_nelts (), npatterns ());
}
/* Return true if the vector is a simple sequence with one pattern and all
@@ -514,9 +512,7 @@ rvv_builder::is_repeating_sequence ()
{
if (npatterns () > 1)
return false;
- if (full_nelts ().is_constant ())
- return repeating_sequence_p (0, full_nelts ().to_constant (), 1);
- return nelts_per_pattern () == 1;
+ return repeating_sequence_p (0, encoded_nelts (), 1);
}
/* Return true if it is a repeating sequence that using
@@ -564,7 +560,7 @@ rvv_builder::repeating_sequence_use_merge_profitable_p ()
unsigned int nelts = full_nelts ().to_constant ();
- if (!repeating_sequence_p (0, nelts, npatterns ()))
+ if (!repeating_sequence_p (0, encoded_nelts (), npatterns ()))
return false;
unsigned int merge_cost = 1;
--
2.34.1