[Bug middle-end/126447] [17 Regression] ICE SSA corruption, bitint + signed overflow sanitizer, since r17-2439

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126447

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-16 branch has been updated by Jakub Jelinek
<[email protected]>:

https://gcc.gnu.org/g:d6a1fe04e7cec6b378ecbf6c5b8ee36dd918d5d2

commit r16-9428-gd6a1fe04e7cec6b378ecbf6c5b8ee36dd918d5d2
Author: Jakub Jelinek <[email protected]>
Date:   Wed Jul 29 10:04:30 2026 +0200

    bitintlower: Fix _BitInt SSA_NAME coalescing ICE [PR126447]

    The following testcases ICE, because the build_bitint_stmt_ssa_conflicts
    function sets for those ifns muldiv_p to true (similarly to the MULT_EXPR
    and division/modulo ones) to prevent the lhs from being mapped into
    the same underlying variable as the input operand(s).
    Now, if the lhs and at least one of the operands
    SSA_NAME_OCCURS_IN_ABNORMAL_PHI, we can trigger ICE because we fail to
    coalesce something that has to be coalesced.
    For MULT_EXPR etc. we handle this in gimple_lower_bitint, by
                        /* For multiplication and division with (ab)
                           lhs and one or both operands force the operands
                           into new SSA_NAMEs to avoid coalescing failures.  */
                        if (TREE_CODE (rhs1) == SSA_NAME
                            && SSA_NAME_OCCURS_IN_ABNORMAL_PHI (rhs1))
                          {
                            first_large_huge = 0;
                            tree t = make_ssa_name (TREE_TYPE (rhs1));
                            g = gimple_build_assign (t, SSA_NAME, rhs1);
                            gsi_insert_before (&gsi, g, GSI_SAME_STMT);
                            gimple_set_location (g, loc);
                            gimple_assign_set_rhs1 (stmt, t);
                            if (rhs1 == rhs2)
                              {
                                gimple_assign_set_rhs2 (stmt, t);
                                rhs2 = t;
                              }
                            update_stmt (stmt);
                          }
    etc. a few lines above the hunk below.
    This patch just adds the same thing for the problematic internal
    fn calls (not handling that way the .MUL_OVERFLOW etc. ifns,
    because those do return COMPLEX_EXPR of BITINT_TYPE and so the
    problematic case shouldn't exist there).

    2026-07-29  Jakub Jelinek  <[email protected]>

            PR middle-end/126447
            * gimple-lower-bitint.cc (gimple_lower_bitint): For
            ifn calls with large/huge _BitInt (ab) SSA_NAME lhs if they
            have such (ab) argument too, force it into temporary SSA_NAME
            for IFN_UBSAN_CHECK_MUL and, if bitint_big_endian, also for
            IFN_UBSAN_CHECK_{ADD,SUB}.

            * gcc.dg/ubsan/bitint-5.c: New test.

    Reviewed-by: Andrea Pinski <[email protected]>
    (cherry picked from commit cd9428362b6585e77ea2a171ec030894fcfa4d1c)