[gcc(refs/users/aoliva/heads/testme)] hardcfr docs: add checking at exceptions and noreturn calls

[Alexandre Oliva <aoliva@gcc.gnu.org>]

https://gcc.gnu.org/g:66687c95a0658c74e4ad1ae015cc8baa37a91e10

commit 66687c95a0658c74e4ad1ae015cc8baa37a91e10
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Aug 24 13:37:00 2022 -0300

    hardcfr docs: add checking at exceptions and noreturn calls

Diff:
---
 gcc/ada/doc/gnat_rm/security_hardening_features.rst | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/gcc/ada/doc/gnat_rm/security_hardening_features.rst b/gcc/ada/doc/gnat_rm/security_hardening_features.rst
index f5fdc8e46b4..b7803cde588 100644
--- a/gcc/ada/doc/gnat_rm/security_hardening_features.rst
+++ b/gcc/ada/doc/gnat_rm/security_hardening_features.rst
@@ -263,11 +263,16 @@ For each block that is marked as visited, the mechanism checks that at
 least one of its predecessors, and at least one of its successors, are
 also marked as visited.
 
-Verification is performed just before returning.  Subprogram
-executions that complete by raising or propagating an exception bypass
-verification-and-return points.  A subprogram that can only complete
-by raising or propagating an exception may have instrumentation
-disabled altogether.
+Verification is performed just before returns, tail- and noreturn
+calls.  Furthermore, any subprogram from which an exception may
+escape, i.e., that may raise or propagate an exception that isn't
+handled internally, is automatically enclosed by a cleanup handler
+that performs verification.  When a noreturn call returns control to
+its caller through an exception, verification will have already been
+performed before the call, but it will take place again when the
+caller reaches the next verification point, whether it is the end of
+the enclosing cleanup handler, a return or reraise statement after the
+exception is otherwise handled, or even another noreturn call.
 
 The instrumentation for hardening with control flow redundancy can be
 observed in dump files generated by the command-line option