[gcc r14-457] do not tailcall __sanitizer_cov_trace_pc [PR90746]

[gcc r14-457] do not tailcall __sanitizer_cov_trace_pc [PR90746]

[Alexander Monakov]

https://gcc.gnu.org/g:cef0c0bb13e2953b41caca0506ab1d41c56f29de

commit r14-457-gcef0c0bb13e2953b41caca0506ab1d41c56f29de
Author: Alexander Monakov <amonakov@ispras.ru>
Date:   Thu Jan 19 19:25:04 2023 +0300

    do not tailcall __sanitizer_cov_trace_pc [PR90746]
    
    When instrumentation is requested via -fsanitize-coverage=trace-pc, GCC
    emits calls of __sanitizer_cov_trace_pc callback in each basic block.
    This callback is supposed to be implemented by the user, and should be
    able to identify the containing basic block by inspecting its return
    address. Tailcalling the callback prevents that, so disallow it.
    
    gcc/ChangeLog:
    
            PR sanitizer/90746
            * calls.cc (can_implement_as_sibling_call_p): Reject calls
            to __sanitizer_cov_trace_pc.
    
    gcc/testsuite/ChangeLog:
    
            PR sanitizer/90746
            * gcc.dg/sancov/basic0.c: Verify absence of tailcall.

Diff:
---
 gcc/calls.cc                         | 10 ++++++++++
 gcc/testsuite/gcc.dg/sancov/basic0.c |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/gcc/calls.cc b/gcc/calls.cc
index 4d7f6c3d291..1c9abccef68 100644
--- a/gcc/calls.cc
+++ b/gcc/calls.cc
@@ -2541,6 +2541,16 @@ can_implement_as_sibling_call_p (tree exp,
       return false;
     }
 
+  /* __sanitizer_cov_trace_pc is supposed to inspect its return address
+     to identify the caller, and therefore should not be tailcalled.  */
+  if (fndecl && DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL
+      && DECL_FUNCTION_CODE (fndecl) == BUILT_IN_SANITIZER_COV_TRACE_PC)
+    {
+      /* No need for maybe_complain_about_tail_call here:
+	 the call is synthesized by the compiler.  */
+      return false;
+    }
+
   /* If the called function is nested in the current one, it might access
      some of the caller's arguments, but could clobber them beforehand if
      the argument areas are shared.  */
diff --git a/gcc/testsuite/gcc.dg/sancov/basic0.c b/gcc/testsuite/gcc.dg/sancov/basic0.c
index af69b2d12ed..dfdaea84802 100644
--- a/gcc/testsuite/gcc.dg/sancov/basic0.c
+++ b/gcc/testsuite/gcc.dg/sancov/basic0.c
@@ -1,9 +1,11 @@
 /* Basic test on number of inserted callbacks.  */
 /* { dg-do compile } */
-/* { dg-options "-fsanitize-coverage=trace-pc -fdump-tree-optimized" } */
+/* { dg-options "-fsanitize-coverage=trace-pc -fdump-tree-optimized -fdump-rtl-expand" } */
 
 void foo(void)
 {
 }
 
 /* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_pc \\(\\)" 1 "optimized" } } */
+/* The built-in should not be tail-called: */
+/* { dg-final { scan-rtl-dump-not "call_insn/j" "expand" } } */