This fixes __builtin_object_size folding on static storage accessed via a type with a trailing array element.
Bootstrapped and tested on x86_64-unknown-linux-gnu, will apply after testing on the 4.6 branch. Thanks, Richard. 2011-10-12 Richard Guenther <rguent...@suse.de> PR tree-optimization/50700 * tree-object-size.c (addr_object_size): Simplify and treat MEM_REF bases consistently. * gcc.dg/builtin-object-size-12.c: New testcase. Index: gcc/tree-object-size.c =================================================================== *** gcc/tree-object-size.c (revision 179757) --- gcc/tree-object-size.c (working copy) *************** addr_object_size (struct object_size_inf *** 166,189 **** gcc_assert (TREE_CODE (ptr) == ADDR_EXPR); pt_var = TREE_OPERAND (ptr, 0); ! if (REFERENCE_CLASS_P (pt_var)) ! pt_var = get_base_address (pt_var); if (pt_var ! && TREE_CODE (pt_var) == MEM_REF ! && TREE_CODE (TREE_OPERAND (pt_var, 0)) == SSA_NAME ! && POINTER_TYPE_P (TREE_TYPE (TREE_OPERAND (pt_var, 0)))) { unsigned HOST_WIDE_INT sz; ! if (!osi || (object_size_type & 1) != 0) { sz = compute_builtin_object_size (TREE_OPERAND (pt_var, 0), object_size_type & ~1); - if (host_integerp (TREE_OPERAND (pt_var, 1), 0)) - sz -= TREE_INT_CST_LOW (TREE_OPERAND (pt_var, 1)); - else - sz = offset_limit; } else { --- 166,184 ---- gcc_assert (TREE_CODE (ptr) == ADDR_EXPR); pt_var = TREE_OPERAND (ptr, 0); ! while (handled_component_p (pt_var)) ! pt_var = TREE_OPERAND (pt_var, 0); if (pt_var ! && TREE_CODE (pt_var) == MEM_REF) { unsigned HOST_WIDE_INT sz; ! if (!osi || (object_size_type & 1) != 0 ! || TREE_CODE (pt_var) != SSA_NAME) { sz = compute_builtin_object_size (TREE_OPERAND (pt_var, 0), object_size_type & ~1); } else { *************** addr_object_size (struct object_size_inf *** 195,204 **** sz = object_sizes[object_size_type][SSA_NAME_VERSION (var)]; else sz = unknown[object_size_type]; ! if (host_integerp (TREE_OPERAND (pt_var, 1), 0)) ! sz -= TREE_INT_CST_LOW (TREE_OPERAND (pt_var, 1)); else ! sz = offset_limit; } if (sz != unknown[object_size_type] && sz < offset_limit) --- 190,206 ---- sz = object_sizes[object_size_type][SSA_NAME_VERSION (var)]; else sz = unknown[object_size_type]; ! } ! if (sz != unknown[object_size_type]) ! { ! double_int dsz = double_int_sub (uhwi_to_double_int (sz), ! mem_ref_offset (pt_var)); ! if (double_int_negative_p (dsz)) ! sz = 0; ! else if (double_int_fits_in_uhwi_p (dsz)) ! sz = double_int_to_uhwi (dsz); else ! sz = unknown[object_size_type]; } if (sz != unknown[object_size_type] && sz < offset_limit) *************** addr_object_size (struct object_size_inf *** 211,217 **** tree_low_cst (DECL_SIZE_UNIT (pt_var), 1) < offset_limit) pt_var_size = DECL_SIZE_UNIT (pt_var); else if (pt_var ! && (SSA_VAR_P (pt_var) || TREE_CODE (pt_var) == STRING_CST) && TYPE_SIZE_UNIT (TREE_TYPE (pt_var)) && host_integerp (TYPE_SIZE_UNIT (TREE_TYPE (pt_var)), 1) && (unsigned HOST_WIDE_INT) --- 213,219 ---- tree_low_cst (DECL_SIZE_UNIT (pt_var), 1) < offset_limit) pt_var_size = DECL_SIZE_UNIT (pt_var); else if (pt_var ! && TREE_CODE (pt_var) == STRING_CST && TYPE_SIZE_UNIT (TREE_TYPE (pt_var)) && host_integerp (TYPE_SIZE_UNIT (TREE_TYPE (pt_var)), 1) && (unsigned HOST_WIDE_INT) Index: gcc/testsuite/gcc.dg/builtin-object-size-12.c =================================================================== *** gcc/testsuite/gcc.dg/builtin-object-size-12.c (revision 0) --- gcc/testsuite/gcc.dg/builtin-object-size-12.c (revision 0) *************** *** 0 **** --- 1,19 ---- + /* { dg-do run } */ + /* { dg-options "-O2" } */ + + extern void abort (void); + struct S { + int len; + char s[0]; + }; + int main() + { + char buf[sizeof (struct S) + 32]; + if (__builtin_object_size (((struct S *)&buf[0])->s, 1) != 32) + abort (); + if (__builtin_object_size (((struct S *)&buf[1])->s, 1) != 31) + abort (); + if (__builtin_object_size (((struct S *)&buf[64])->s, 0) != 0) + abort (); + return 0; + }