From 8a8a6d60c670c5153c5109df5fe68deb6fcf466d Mon Sep 17 00:00:00 2001
From: Jakub Jelinek <jakub@redhat.com>
Date: Tue, 21 Nov 2023 09:32:37 +0100
Subject: [PATCH] builtins: Fix fold_builtin_query clzg/ctzg side-effects
 handling [PR112639]

As the testcase shows, I've missed one spot where initially the code thinks
it could use 2 argument IFN_CLZ/IFN_CTZ form, but then verifies it can't
because it doesn't have the right target value and turns it into the
arg0 ? arg1 : .C[LT]Z (arg0)
form.  That form evaluates the argument twice though and so needs save_expr,
which I've missed to call in that case.  In other cases where it is known
from the beginning that it will be needed (e.g. the __builtin_clzg case
on types smaller than unsigned int where we'll need to add an addend
to the clz value) or the unsigned __int128 expansion called save_expr
before.

2023-11-21  Jakub Jelinek  <jakub@redhat.com>

	PR middle-end/112639
	* builtins.cc (fold_builtin_bit_query): If arg0 has side-effects, arg1
	is specified but cleared, call save_expr on arg0.

	* gcc.dg/torture/pr112639.c: New test.
---
 gcc/builtins.cc                         |  2 ++
 gcc/testsuite/gcc.dg/torture/pr112639.c | 34 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 gcc/testsuite/gcc.dg/torture/pr112639.c

diff --git a/gcc/builtins.cc b/gcc/builtins.cc
index a489ef1c564..6af2a0b07aa 100644
--- a/gcc/builtins.cc
+++ b/gcc/builtins.cc
@@ -9819,6 +9819,8 @@ fold_builtin_bit_query (location_t loc, enum built_in_function fcode,
 	  if (!direct_internal_fn_supported_p (ifn, arg0_type,
 					       OPTIMIZE_FOR_BOTH))
 	    arg2 = NULL_TREE;
+	  if (arg2 == NULL_TREE)
+	    arg0 = save_expr (arg0);
 	}
       if (fcodei == END_BUILTINS || arg2)
 	call = build_call_expr_internal_loc (loc, ifn, integer_type_node,
diff --git a/gcc/testsuite/gcc.dg/torture/pr112639.c b/gcc/testsuite/gcc.dg/torture/pr112639.c
new file mode 100644
index 00000000000..9450d88baea
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr112639.c
@@ -0,0 +1,34 @@
+/* PR middle-end/112639 */
+/* { dg-do run } */
+
+unsigned long long b = 0;
+
+int
+foo (void)
+{
+  return __builtin_clzg (b++, __SIZEOF_LONG_LONG__ * __CHAR_BIT__);
+}
+
+int
+bar (void)
+{
+  return __builtin_ctzg (b++, __SIZEOF_LONG_LONG__ * __CHAR_BIT__);
+}
+
+int
+main ()
+{
+  if (foo () != __SIZEOF_LONG_LONG__ * __CHAR_BIT__ || b != 1)
+    __builtin_abort ();
+  if (foo () != __SIZEOF_LONG_LONG__ * __CHAR_BIT__ - 1 || b != 2)
+    __builtin_abort ();
+  if (foo () != __SIZEOF_LONG_LONG__ * __CHAR_BIT__ - 2 || b != 3)
+    __builtin_abort ();
+  b = 0;
+  if (bar () != __SIZEOF_LONG_LONG__ * __CHAR_BIT__ || b != 1)
+    __builtin_abort ();
+  if (bar () != 0 || b != 2)
+    __builtin_abort ();
+  if (bar () != 1 || b != 3)
+    __builtin_abort ();
+}