[gcc r10-10855] fold-const: Fix up -fsanitize=null in C++ [PR105729]

[gcc r10-10855] fold-const: Fix up -fsanitize=null in C++ [PR105729]

[Jakub Jelinek]

https://gcc.gnu.org/g:76562138659d6a3e6f11e467dd1ffd6d19f3df75

commit r10-10855-g76562138659d6a3e6f11e467dd1ffd6d19f3df75
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri May 27 11:40:42 2022 +0200

    fold-const: Fix up -fsanitize=null in C++ [PR105729]
    
    The following testcase triggers a false positive UBSan binding a reference
    to null diagnostics.
    In the FE we instrument conversions from pointer to reference type
    to diagnose at runtime if the operand of such a conversion is 0.
    The problem is that a GENERIC folding folds
    ((const struct Bar *) ((const struct Foo *) this)->data) + (sizetype) range_check (x)
    conversion to const struct Bar & by converting to that the first
    operand of the POINTER_PLUS_EXPR.  But that changes when the -fsanitize=null
    binding to reference runtime check occurs.  Without the optimization,
    it is invoked on the result of the POINTER_PLUS_EXPR, and as range_check
    call throws, that means it never triggers in the testcase.
    With the optimization, it checks whether this->data is NULL and it is.
    
    The following patch avoids that optimization during GENERIC folding when
    -fsanitize=null is enabled and it is a cast from non-REFERENCE_TYPE to
    REFERENCE_TYPE.
    
    2022-05-27  Jakub Jelinek  <jakub@redhat.com>
    
            PR sanitizer/105729
            * fold-const.c (fold_unary_loc): Don't optimize (X &) ((Y *) z + w)
            to (X &) z + w if -fsanitize=null during GENERIC folding.
    
            * g++.dg/ubsan/pr105729.C: New test.
    
    (cherry picked from commit e2f014fcefcd2ad56b31995329820bbd99072eae)

Diff:
---
 gcc/fold-const.c                      | 14 ++++++++++++--
 gcc/testsuite/g++.dg/ubsan/pr105729.C | 29 +++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/gcc/fold-const.c b/gcc/fold-const.c
index 2dccd10748a..9b65819463e 100644
--- a/gcc/fold-const.c
+++ b/gcc/fold-const.c
@@ -8889,8 +8889,18 @@ fold_unary_loc (location_t loc, enum tree_code code, tree type, tree op0)
 	  tree arg00 = TREE_OPERAND (arg0, 0);
 	  tree arg01 = TREE_OPERAND (arg0, 1);
 
-	  return fold_build_pointer_plus_loc
-		   (loc, fold_convert_loc (loc, type, arg00), arg01);
+	  /* Avoid this optimization in GENERIC for -fsanitize=null
+	     when type is a reference type and arg00's type is not,
+	     because arg00 could be validly nullptr and if arg01 doesn't return,
+	     we don't want false positive binding of reference to nullptr.  */
+	  if (TREE_CODE (type) == REFERENCE_TYPE
+	      && !in_gimple_form
+	      && (flag_sanitize & SANITIZE_NULL) != 0
+	      && TREE_CODE (TREE_TYPE (arg00)) != REFERENCE_TYPE)
+	    return NULL_TREE;
+
+	  arg00 = fold_convert_loc (loc, type, arg00);
+	  return fold_build_pointer_plus_loc (loc, arg00, arg01);
 	}
 
       /* Convert (T1)(~(T2)X) into ~(T1)X if T1 and T2 are integral types
diff --git a/gcc/testsuite/g++.dg/ubsan/pr105729.C b/gcc/testsuite/g++.dg/ubsan/pr105729.C
new file mode 100644
index 00000000000..fb676630994
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ubsan/pr105729.C
@@ -0,0 +1,29 @@
+// PR sanitizer/105729
+// { dg-do run }
+// { dg-options "-fsanitize=null -fno-sanitize-recover=null" }
+
+int
+foo (int x)
+{
+  throw 0;
+}
+
+struct S {};
+struct T {
+  S *data;
+  T () : data (0) {}
+  const S &bar (int x) const { return data[foo (x)]; }
+};
+
+int
+main ()
+{
+  T t;
+  try
+    {
+      t.bar (-1);
+    }
+  catch (...)
+    {
+    }
+}