[PATCH] Fix -fsanitize=undefined ubsan_encode_value ICE (PR sanitizer/81111)

[Jakub Jelinek]

Hi!

Martin's recent patch that introduced sanitize_flags_p causes us to
instrument operations even when current_function_decl is NULL.  If it
is valid constant expression it will be folded away soon, otherwise
usually we emit a runtime initializer in the static ctors function for
it.  In any case, neither gimple_add_tmp_var that create_tmp_var calls
normark_addressable actually work in that case, fixed thusly,
bootstrapped/regtested on x86_64-linux and i686-linux plus
bootstrapped/regtested with bootstrap-ubsan, ok for trunk?

2017-06-19  Jakub Jelinek  <ja...@redhat.com>

        PR sanitizer/81111
        * ubsan.c (ubsan_encode_value): If current_function_decl is NULL,
        use create_tmp_var_raw instead of create_tmp_var, mark it addressable
        just by setting TREE_ADDRESSABLE on the result and use a TARGET_EXPR.

        * g++.dg/ubsan/pr81111.C: New test.

--- gcc/ubsan.c.jj      2017-06-16 13:27:48.000000000 +0200
+++ gcc/ubsan.c 2017-06-16 16:28:29.099155949 +0200
@@ -145,9 +145,17 @@ ubsan_encode_value (tree t, bool in_expa
        {
          /* The reason for this is that we don't want to pessimize
             code by making vars unnecessarily addressable.  */
-         tree var = create_tmp_var (type);
-         tree tem = build2 (MODIFY_EXPR, void_type_node, var, t);
-         mark_addressable (var);
+         tree var;
+         if (current_function_decl)
+           {
+             var = create_tmp_var (type);
+             mark_addressable (var);
+           }
+         else
+           {
+             var = create_tmp_var_raw (type);
+             TREE_ADDRESSABLE (var) = 1;
+           }
          if (in_expand_p)
            {
              rtx mem
@@ -158,8 +166,17 @@ ubsan_encode_value (tree t, bool in_expa
              expand_assignment (var, t, false);
              return build_fold_addr_expr (var);
            }
-         t = build_fold_addr_expr (var);
-         return build2 (COMPOUND_EXPR, TREE_TYPE (t), tem, t);
+         if (current_function_decl)
+           {
+             tree tem = build2 (MODIFY_EXPR, void_type_node, var, t);
+             t = build_fold_addr_expr (var);
+             return build2 (COMPOUND_EXPR, TREE_TYPE (t), tem, t);
+           }
+         else
+           {
+             var = build4 (TARGET_EXPR, type, var, t, NULL_TREE, NULL_TREE);
+             return build_fold_addr_expr (var);
+           }
        }
       else
        return build_fold_addr_expr (t);
--- gcc/testsuite/g++.dg/ubsan/pr81111.C.jj     2017-06-16 15:39:57.752886010 
+0200
+++ gcc/testsuite/g++.dg/ubsan/pr81111.C        2017-06-16 15:39:37.000000000 
+0200
@@ -0,0 +1,45 @@
+// PR sanitizer/81111
+// { dg-do compile }
+// { dg-options "-fsanitize=shift" }
+
+template <typename V>
+struct N
+{
+  static const V m = (((V)(-1) < 0)
+                     ? (V)1 << (sizeof(V) * __CHAR_BIT__ - ((V)(-1) < 0))
+                     : (V) 0);
+};
+
+template<typename V>
+const V N<V>::m;
+
+template <typename V>
+struct O
+{
+  static const V m = (V)1 << sizeof(V) * __CHAR_BIT__;
+};
+
+template<typename V>
+const V O<V>::m;
+
+void
+foo ()
+{
+  N<long long>::m;
+  N<unsigned long long>::m;
+#ifdef __SIZEOF_INT128__
+  N<__int128>::m;
+  N<unsigned __int128>::m;
+#endif
+}
+
+void
+bar ()
+{
+  O<long long>::m;
+  O<unsigned long long>::m;
+#ifdef __SIZEOF_INT128__
+  O<__int128>::m;
+  O<unsigned __int128>::m;
+#endif
+}

        Jakub