asf: Fix null pointer dereference in is_store_forwarding [PR121303]

We were calling `is_store_forwarding` with a NULL value for `off_val`,
which was causing a null pointer dereference in `is_constant`, leading
to an ICE.

This patch updates the call to `is_constant` in `is_store_forwarding`
and adds a check for `off_val`, in order to update it with the right
value.

Bootstrapped/regtested on AArch64 and x86_64.

	PR rtl-optimization/121303

gcc/ChangeLog:

	* avoid-store-forwarding.cc (is_store_forwarding): Add check
	for `off_val` in `is_store_forwarding`.

gcc/testsuite/ChangeLog:

	* gcc.target/i386/pr121303.c: New test.

2 files changed, 34 insertions, 1 deletions

diff --git a/gcc/avoid-store-forwarding.cc b/gcc/avoid-store-forwarding.cc
index 1de6fd6..78ed736 100644
--- a/gcc/avoid-store-forwarding.cc
+++ b/gcc/avoid-store-forwarding.cc
@@ -145,11 +145,18 @@ is_store_forwarding (rtx store_mem, rtx load_mem, HOST_WIDE_INT *off_val)
   poly_int64 load_offset, store_offset;
   rtx load_base = strip_offset (XEXP (load_mem, 0), &load_offset);
   rtx store_base = strip_offset (XEXP (store_mem, 0), &store_offset);
+  poly_int64 off_diff = store_offset - load_offset;
+
+  HOST_WIDE_INT off_val_tmp = 0;
+  bool is_off_diff_constant = off_diff.is_constant (&off_val_tmp);
+  if (off_val)
+    *off_val = off_val_tmp;
+
   return (MEM_SIZE (load_mem).is_constant ()
 	  && rtx_equal_p (load_base, store_base)
 	  && known_subrange_p (store_offset, MEM_SIZE (store_mem),
 			       load_offset, MEM_SIZE (load_mem))
-	  && (store_offset - load_offset).is_constant (off_val));
+	  && is_off_diff_constant);
 }
 
 /* Given a list of small stores that are forwarded to LOAD_INSN, try to
diff --git a/gcc/testsuite/gcc.target/i386/pr121303.c b/gcc/testsuite/gcc.target/i386/pr121303.c
new file mode 100644
index 0000000..7900bce
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr121303.c
@@ -0,0 +1,26 @@
+/* { dg-do compile } */
+/* { dg-options "-O1 -favoid-store-forwarding" } */
+
+typedef struct {
+  bool is_ssa;
+} nir_src;
+
+nir_src nir_src_init;
+
+typedef struct {
+  nir_src src;
+  char swizzle[6];
+} nir_alu_src;
+
+void nir_src_bit_size(nir_src);
+
+void nir_lower_fb_read_instr() {
+  {
+    nir_alu_src alu_src = {nir_src_init}, src = alu_src;
+    nir_src_bit_size(src.src);
+  }
+  {
+    nir_alu_src alu_src = {nir_src_init}, src = alu_src;
+    nir_src_bit_size(src.src);
+  }
+}