Hi! As the testcase shows, we can hit the assertion here (with code that is rejected only later on during expansion). Instead of the assertion, this patch just doesn't try to optimize those, maybe_optimize_ubsan_ptr_ifn is a pure optimization.
Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk? 2018-03-22 Jakub Jelinek <ja...@redhat.com> PR sanitizer/85029 * sanopt.c (maybe_optimize_ubsan_ptr_ifn): If DECL_REGISTER (base), just don't try to optimize it rather than assert it never happens. * g++.dg/ubsan/pr85029.C: New test. --- gcc/sanopt.c.jj 2018-03-14 09:49:45.462028237 +0100 +++ gcc/sanopt.c 2018-03-22 08:20:30.639183003 +0100 @@ -488,9 +488,9 @@ maybe_optimize_ubsan_ptr_ifn (sanopt_ctx &unsignedp, &reversep, &volatilep); if ((offset == NULL_TREE || TREE_CODE (offset) == INTEGER_CST) && DECL_P (base) + && !DECL_REGISTER (base) && pbitpos.is_constant (&bitpos)) { - gcc_assert (!DECL_REGISTER (base)); offset_int expr_offset; if (offset) expr_offset = wi::to_offset (offset) + bitpos / BITS_PER_UNIT; --- gcc/testsuite/g++.dg/ubsan/pr85029.C.jj 2018-03-22 08:22:34.952174863 +0100 +++ gcc/testsuite/g++.dg/ubsan/pr85029.C 2018-03-22 08:31:49.554138533 +0100 @@ -0,0 +1,15 @@ +// PR sanitizer/85029 +// { dg-do compile } +// { dg-skip-if "" { *-*-* } { "-flto -fno-fat-lto-objects" } } +// { dg-options "-fsanitize=undefined" } + +struct B { + virtual B bar (); + int e; +} register a; // { dg-error "register name not specified for 'a'" } + +int +foo (...) +{ + return foo (a); +} Jakub