[gcc r16-9427] cfgexpand: Verify that partitions do not share a MEM_EXPR [PR126405]

https://gcc.gnu.org/g:7f1cdcfbf7a837b2ad14ebe2df04b01a178119f6

commit r16-9427-g7f1cdcfbf7a837b2ad14ebe2df04b01a178119f6
Author: Kyrylo Tkachov <[email protected]>
Date:   Sun Jul 26 03:18:46 2026 -0700

    cfgexpand: Verify that partitions do not share a MEM_EXPR [PR126405]
    
    Two stack slots carrying one MEM_EXPR read as a single object to
    MEM_EXPR-based disambiguation.  That is how PR121957, PR123625 and PR126405
    each became wrong code: the load/store pair-fusion pass identifies a location
    by a MEM_EXPR base and an offset from it, so it fused accesses that belong to
    different slots and redirected a store.
    
    out-of-SSA maintains the invariant, but a break in it stays silent until some
    consumer acts on it, and only for the subset of functions that consumer happens
    to look at.
    Check it directly once per function under flag_checking, after every partition
    has been given its RTL, so that a regression here is an ICE rather than a
    miscompile.
    
    Bootstrapped and tested on aarch64-none-linux-gnu and x86_64-linux-gnu.
    
    gcc/ChangeLog:
    
            PR middle-end/126405
            * cfgexpand.cc (verify_partition_mem_exprs): New function.
            (pass_expand::execute): Call it.
    
    Signed-off-by: Kyrylo Tkachov <[email protected]>
    (cherry picked from commit 95ee9c9e74eb93414bbcd76b02e1fcbec383f2ce)

Diff:
---
 gcc/cfgexpand.cc | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/gcc/cfgexpand.cc b/gcc/cfgexpand.cc
index 777bff0f82b2..39a7f541d50a 100644
--- a/gcc/cfgexpand.cc
+++ b/gcc/cfgexpand.cc
@@ -2462,6 +2462,31 @@ stack_protect_return_slot_p ()
   return false;
 }
 
+/* Verify that partitions which claim to be the same object really are at the
+   same address.  MEM_EXPR-based disambiguation identifies a location by a
+   MEM_EXPR base and an offset from it, so two stack slots carrying one
+   MEM_EXPR read as a single object, which lets an access to one be redirected
+   to the other.  out-of-SSA keeps them apart, see the comment above
+   split_overlapping_partition_decls.  */
+
+static void
+verify_partition_mem_exprs (void)
+{
+  hash_map<tree, rtx> slots;
+  for (unsigned i = 0; i < num_var_partitions (SA.map); i++)
+    {
+      rtx x = SA.partition_to_pseudo[i];
+      if (!x || !MEM_P (x) || !MEM_EXPR (x))
+	continue;
+      bool existed;
+      rtx &known = slots.get_or_insert (MEM_EXPR (x), &existed);
+      if (!existed)
+	known = x;
+      else
+	gcc_assert (rtx_equal_p (XEXP (known, 0), XEXP (x, 0)));
+    }
+}
+
 /* Expand all variables used in the function.  */
 
 static rtx_insn *
@@ -7172,6 +7197,9 @@ pass_expand::execute (function *fun)
       adjust_one_expanded_partition_var (name);
     }
 
+  if (flag_checking)
+    verify_partition_mem_exprs ();
+
   /* Clean up RTL of variables that straddle across multiple
      partitions, and check that the rtl of any PARM_DECLs that are not
      cleaned up is that of their default defs.  */