[PATCH] -fsanitize=vptr instrumentation (take 2)

[Jason Merrill]

On 10/28/2014 08:44 AM, Jakub Jelinek wrote:
> +cp_ubsan_check_member_access_r (tree *stmt_p, int *walk_subtrees, void *data)

This function needs a longer comment about exactly what forms it's 
trying to instrument.

> +  /* T t; t.foo (); doesn't need instrumentation, if the type is known.  */
> +  if (is_addr
> +      && TREE_CODE (op) == ADDR_EXPR
> +      && DECL_P (TREE_OPERAND (op, 0))
> +      && same_type_p (type,
> +		      TYPE_MAIN_VARIANT (TREE_TYPE (TREE_OPERAND (op, 0)))))
> +    return NULL_TREE;

How do we know the decl's vptr hasn't been clobbered?  This seems like 
one of the optimizations we decided to drop.

> +  if (TREE_CODE (base) == COMPONENT_REF
> +      && DECL_ARTIFICIAL (TREE_OPERAND (base, 1)))
> +    {
> +      tree base2 = TREE_OPERAND (base, 0);
> +      while (TREE_CODE (base2) == COMPONENT_REF
> +	     || TREE_CODE (base2) == ARRAY_REF
> +	     || TREE_CODE (base2) == ARRAY_RANGE_REF)
> +	base2 = TREE_OPERAND (base2, 0);
> +      if (TREE_CODE (base2) != INDIRECT_REF
> +	  && TREE_CODE (base2) != MEM_REF)
> +	return;
> +    }
> +  else if (TREE_CODE (base) != INDIRECT_REF
> +	   && TREE_CODE (base) != MEM_REF)
> +    return;

Why do you look through ARRAY_REF here?  An element of an array is its 
own complete object.

Jason