https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105736
--- Comment #2 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> --- OK, so the fix is pretty straightforward; error_mark_node escapes through as a return in ADDR_EXPR object size computations. I want to get a reproducer independent of ubsan though so that it's verifiable in the general case: diff --git a/gcc/tree-object-size.cc b/gcc/tree-object-size.cc index fc062b94d76..f1a699a94db 100644 --- a/gcc/tree-object-size.cc +++ b/gcc/tree-object-size.cc @@ -695,19 +695,24 @@ addr_object_size (struct object_size_info *osi, const_tree ptr, var_size = pt_var_size; bytes = compute_object_offset (TREE_OPERAND (ptr, 0), var); if (bytes != error_mark_node) - bytes = size_for_offset (var_size, bytes); - if (var != pt_var - && pt_var_size - && TREE_CODE (pt_var) == MEM_REF - && bytes != error_mark_node) { - tree bytes2 = compute_object_offset (TREE_OPERAND (ptr, 0), pt_var); - if (bytes2 != error_mark_node) + bytes = size_for_offset (var_size, bytes); + if (var != pt_var + && pt_var_size + && TREE_CODE (pt_var) == MEM_REF + && bytes != error_mark_node) { - bytes2 = size_for_offset (pt_var_size, bytes2); - bytes = size_binop (MIN_EXPR, bytes, bytes2); + tree bytes2 = compute_object_offset (TREE_OPERAND (ptr, 0), + pt_var); + if (bytes2 != error_mark_node) + { + bytes2 = size_for_offset (pt_var_size, bytes2); + bytes = size_binop (MIN_EXPR, bytes, bytes2); + } } } + else + bytes = size_unknown (object_size_type); wholebytes = object_size_type & OST_SUBOBJECT ? var_size : pt_var_wholesize;