[gcc r10-10628] match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in GENERIC when sanitizing [PR10

[gcc r10-10628] match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in GENERIC when sanitizing [PR10

[Jakub Jelinek]

https://gcc.gnu.org/g:208ad9a001f192c763e2c9682a4c296b4696a10c

commit r10-10628-g208ad9a001f192c763e2c9682a4c296b4696a10c
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 29 11:24:38 2021 +0200

    match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in GENERIC when sanitizing [PR101210]
    
    When we have (intptr_t) x == cst where x has REFERENCE_TYPE, this
    optimization creates x == cst out of it where cst has REFERENCE_TYPE.
    If it is done in GENERIC folding, it can results in ubsan failures
    where the INTEGER_CST with REFERENCE_TYPE is instrumented.
    
    Fixed by deferring it to GIMPLE folding in this case.
    
    2021-06-29  Jakub Jelinek  <jakub@redhat.com>
    
            PR c++/101210
            * match.pd ((intptr_t)x eq/ne CST to x eq/ne (typeof x) CST): Don't
            perform the optimization in GENERIC when sanitizing and x has a
            reference type.
    
            * g++.dg/ubsan/pr101210.C: New test.
    
    (cherry picked from commit 53fd7544aff6d0a18869017cb9bb921a7f5dcd04)

Diff:
---
 gcc/match.pd                          |  7 ++++++-
 gcc/testsuite/g++.dg/ubsan/pr101210.C | 13 +++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/gcc/match.pd b/gcc/match.pd
index 660d5c26840..827fba81206 100644
--- a/gcc/match.pd
+++ b/gcc/match.pd
@@ -4548,7 +4548,12 @@ DEFINE_INT_AND_FLOAT_ROUND_FN (RINT)
   (cmp (convert @0) INTEGER_CST@1)
   (if (((POINTER_TYPE_P (TREE_TYPE (@0))
 	 && !FUNC_OR_METHOD_TYPE_P (TREE_TYPE (TREE_TYPE (@0)))
-	 && INTEGRAL_TYPE_P (TREE_TYPE (@1)))
+	 && INTEGRAL_TYPE_P (TREE_TYPE (@1))
+	 /* Don't perform this optimization in GENERIC if @0 has reference
+	    type when sanitizing.  See PR101210.  */
+	 && !(GENERIC
+	      && TREE_CODE (TREE_TYPE (@0)) == REFERENCE_TYPE
+	      && (flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT))))
 	|| (INTEGRAL_TYPE_P (TREE_TYPE (@0))
 	    && POINTER_TYPE_P (TREE_TYPE (@1))
 	    && !FUNC_OR_METHOD_TYPE_P (TREE_TYPE (TREE_TYPE (@1)))))
diff --git a/gcc/testsuite/g++.dg/ubsan/pr101210.C b/gcc/testsuite/g++.dg/ubsan/pr101210.C
new file mode 100644
index 00000000000..955b8203f44
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ubsan/pr101210.C
@@ -0,0 +1,13 @@
+// PR c++/101210
+// { dg-do run }
+// { dg-options "-fsanitize=null,alignment -fno-sanitize-recover=null,alignment" }
+
+int v[2];
+int
+main ()
+{
+  int x;
+  int &y = x;
+  v[0] = reinterpret_cast<__INTPTR_TYPE__>(&y) == 0;
+  v[1] = reinterpret_cast<__INTPTR_TYPE__>(&y) == 1;
+}