[PATCH] Fix -fsanitize=null ICE (PR sanitizer/81223)

[PATCH] Fix -fsanitize=null ICE (PR sanitizer/81223)

[Marek Polacek]

We were crashing because a WITH_SIZE_EXPR had gotten to instrument_null,
for which get_base_address returns NULL, but we weren't prepared for
that.

Bootstrapped/regtested on x86_64-linux, applying to trunk.

2017-06-27  Marek Polacek  <polacek@redhat.com>

	PR sanitizer/81223
	* ubsan.c (instrument_null): Check get_base_address's result for null.

	* gcc.dg/ubsan/pr81223.c: New test.

diff --git gcc/testsuite/gcc.dg/ubsan/pr81223.c gcc/testsuite/gcc.dg/ubsan/pr81223.c
index e69de29..e7aff52 100644
--- gcc/testsuite/gcc.dg/ubsan/pr81223.c
+++ gcc/testsuite/gcc.dg/ubsan/pr81223.c
@@ -0,0 +1,12 @@
+/* PR sanitizer/81223 */
+/* { dg-do compile } */
+/* { dg-options "-fsanitize=undefined" } */
+
+void bar ();
+
+void
+foo (int x)
+{
+  struct S { char a[x]; } v;
+  bar (v);
+}
diff --git gcc/ubsan.c gcc/ubsan.c
index c7a06ef..bd0588b 100644
--- gcc/ubsan.c
+++ gcc/ubsan.c
@@ -1228,7 +1228,8 @@ instrument_null (gimple_stmt_iterator gsi, tree t, bool is_lhs)
   if (TREE_CODE (t) == ADDR_EXPR)
     t = TREE_OPERAND (t, 0);
   tree base = get_base_address (t);
-  if (TREE_CODE (base) == MEM_REF
+  if (base != NULL_TREE
+      && TREE_CODE (base) == MEM_REF
       && TREE_CODE (TREE_OPERAND (base, 0)) == SSA_NAME)
     instrument_mem_ref (t, base, &gsi, is_lhs);
 }

	Marek