[Bug sanitizer/105093] [9/10 Regression] ICE in expand_expr_addr_expr_1, at expr.c:7607 since r6-3529-gf11a7b6d57f6fcba

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105093

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:bee22b8bc1974773ec2d0e8bf64ad4fbba738fe4

commit r9-10143-gbee22b8bc1974773ec2d0e8bf64ad4fbba738fe4
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Mar 30 10:49:47 2022 +0200

    ubsan: Fix ICE due to -fsanitize=object-size [PR105093]

    The following testcase ICEs, because for a volatile X & RESULT_DECL
    ubsan wants to take address of that reference.  instrument_object_size
    is called with x, so the base is equal to the access and the var
    is automatic, so there is no risk of an out of bounds access for it.
    Normally we wouldn't instrument those because we fold address of the
    t - address of inner to 0, add constant size of the decl and it is
    equal to what __builtin_object_size computes.  But the volatile
    results in the subtraction not being folded.

    The first hunk fixes it by punting if we access the whole automatic
    decl, so that even volatile won't cause a problem.
    The second hunk (not strictly needed for this testcase) is similar
    to what has been added to asan.cc recently, if we actually take
    address of a decl and keep it in the IL, we better mark it addressable.

    2022-03-30  Jakub Jelinek  <jakub@redhat.com>

            PR sanitizer/105093
            * ubsan.c (instrument_object_size): If t is equal to inner and
            is a decl other than global var, punt.  When emitting call to
            UBSAN_OBJECT_SIZE ifn, make sure base is addressable.

            * g++.dg/ubsan/pr105093.C: New test.

    (cherry picked from commit e3e68fa59ead502c24950298b53c637bbe535a74)