tree-optimization/104825 - guard modref query

The following makes sure to guard the modref query in VN on a
pointer typed argument.

2022-03-08  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/104825
	* tree-ssa-sccvn.cc (visit_reference_op_call): Properly
	guard modref get_ao_ref on a pointer typed argument.

	* gcc.dg/torture/pr104825.c: New testcase.

diff --git a/gcc/testsuite/gcc.dg/torture/pr104825.c b/gcc/testsuite/gcc.dg/torture/pr104825.c
new file mode 100644 (file)
index 0000000..7affacc
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr104825.c
@@ -0,0 +1,14 @@
+/* { dg-do compile } */
+/* { dg-additional-options "-Wno-stringop-overread" } */
+
+int foo (fmt)
+char* fmt;
+{
+  return (__builtin_strchr (fmt, '*') != 0
+          || __builtin_strchr (fmt, 'n') != 0);
+}
+void bar ()
+{
+  if (foo (1))
+    __builtin_abort ();
+}

diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index d4d0aba..66b4fc2 100644 (file)
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -5140,11 +5140,12 @@ visit_reference_op_call (tree lhs, gcall *stmt)
                {
                  accesses.quick_grow (accesses.length () + 1);
                  ao_ref *r = &accesses.last ();
-                 if (!access_node.get_ao_ref (stmt, r))
+                 tree arg = access_node.get_call_arg (stmt);
+                 if (!POINTER_TYPE_P (TREE_TYPE (arg))
+                     || !access_node.get_ao_ref (stmt, r))
                    {
                      /* Initialize a ref based on the argument and
                         unknown offset if possible.  */
-                     tree arg = access_node.get_call_arg (stmt);
                      if (arg && TREE_CODE (arg) == SSA_NAME)
                        arg = SSA_VAL (arg);
                      if (arg