repeating_sequence_p operates directly on the encoded pattern and does not derive elements using the .elt() accessor. Passing in the length of the unencoded vector can cause an out-of-bounds read of the encoded pattern.
gcc/ChangeLog: * config/riscv/riscv-v.cc (rvv_builder::can_duplicate_repeating_sequence_p): Use encoded_nelts when calling repeating_sequence_p. (rvv_builder::is_repeating_sequence): Ditto. (rvv_builder::repeating_sequence_use_merge_profitable_p): Ditto. Signed-off-by: Patrick O'Neill <patr...@rivosinc.com> --- gcc/config/riscv/riscv-v.cc | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/gcc/config/riscv/riscv-v.cc b/gcc/config/riscv/riscv-v.cc index 0db5c7591ef..c89603669e3 100644 --- a/gcc/config/riscv/riscv-v.cc +++ b/gcc/config/riscv/riscv-v.cc @@ -502,9 +502,7 @@ rvv_builder::can_duplicate_repeating_sequence_p () || GET_MODE_SIZE (m_new_inner_mode) > UNITS_PER_WORD || !get_vector_mode (m_new_inner_mode, new_size).exists (&m_new_mode)) return false; - if (full_nelts ().is_constant ()) - return repeating_sequence_p (0, full_nelts ().to_constant (), npatterns ()); - return nelts_per_pattern () == 1; + return repeating_sequence_p (0, encoded_nelts (), npatterns ()); } /* Return true if the vector is a simple sequence with one pattern and all @@ -514,9 +512,7 @@ rvv_builder::is_repeating_sequence () { if (npatterns () > 1) return false; - if (full_nelts ().is_constant ()) - return repeating_sequence_p (0, full_nelts ().to_constant (), 1); - return nelts_per_pattern () == 1; + return repeating_sequence_p (0, encoded_nelts (), 1); } /* Return true if it is a repeating sequence that using @@ -564,7 +560,7 @@ rvv_builder::repeating_sequence_use_merge_profitable_p () unsigned int nelts = full_nelts ().to_constant (); - if (!repeating_sequence_p (0, nelts, npatterns ())) + if (!repeating_sequence_p (0, encoded_nelts (), npatterns ())) return false; unsigned int merge_cost = 1; -- 2.34.1