[Bug sanitizer/80536] [6/7/8 Regression] UBSAN: compile time segfault

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80536

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Marek Polacek from comment #11)
> (In reply to Jakub Jelinek from comment #5)
> > To expand on that, I think we want to drop that call from there and instead
> > be able to simplify somehow a SAVE_EXPR if after c_fully_fold or cp_fold it
> > becomes simple enough not to require any saving.
> 
> Hmm, I'm not sure what you mean.  save_expr has
> 
> 3351   if (tree_invariant_p_1 (inner))
> 3352     return expr;

Sure, it has and also has skip_simple_arithmetic.  But without the fold there
is a chance (though small, as fold isn't recursive) that it previously would
turn something non-invariant/simple arithmetics into invariant/simple arith and
we wouldn't create the SAVE_EXPR, but now do.  Besides increased memory
footprint that wouldn't be bad, the problem is that I don't see any of the
recursive folders being able to undo that, so we end up with them until
gimplification.

Thus, it would be nice if e.g. cp_fold, or fold, or c_fully_fold_internal was
able to fold a SAVE_EXPR where:
  inner = skip_simple_arithmetic (TREE_OPERAND (save_expr, 0));
  if (TREE_CODE (inner) == ERROR_MARK)
    return inner;

  if (tree_invariant_p_1 (inner))
    return TREE_OPERAND (save_expr, 0);

The problem on the C FE side (that would be nice to fix) is that it has its own
c_save_expr that wants the operand to be c_fully_folded already when creating
the SAVE_EXPR, it would be better if we could post-pone that and perhaps use
some flag on the SAVE_EXPR to indicate whether we've c_fully_folded the operand
already or not and only fully fold it once (C++ FE does that through its hash
maps) the first time something calls c_fully_fold on the SAVE_EXPR.
So maybe you should start just with the C++ FE for now, or do it in fold too.