gcc/c-family/c-ubsan.cc

   1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
   2    Copyright (C) 2013-2022 Free Software Foundation, Inc.
   3    Contributed by Marek Polacek <polacek@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "tm.h"
  25 #include "c-family/c-common.h"
  26 #include "ubsan.h"
  27 #include "c-family/c-ubsan.h"
  28 #include "stor-layout.h"
  29 #include "builtins.h"
  30 #include "gimplify.h"
  31 #include "stringpool.h"
  32 #include "attribs.h"
  33 #include "asan.h"
  34 #include "langhooks.h"
  35
  36 /* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
  37    return NULL_TREE.  */
  38
  39 tree
  40 ubsan_instrument_division (location_t loc, tree op0, tree op1)
  41 {
  42   tree t, tt, x = NULL_TREE;
  43   tree type = TREE_TYPE (op0);
  44   enum sanitize_code flag = SANITIZE_DIVIDE;
  45
  46   /* At this point both operands should have the same type,
  47      because they are already converted to RESULT_TYPE.
  48      Use TYPE_MAIN_VARIANT since typedefs can confuse us.  */
  49   tree top0 = TYPE_MAIN_VARIANT (type);
  50   tree top1 = TYPE_MAIN_VARIANT (TREE_TYPE (op1));
  51   gcc_checking_assert (lang_hooks.types_compatible_p (top0, top1));
  52
  53   op0 = unshare_expr (op0);
  54   op1 = unshare_expr (op1);
  55
  56   if (TREE_CODE (type) == INTEGER_TYPE
  57       && sanitize_flags_p (SANITIZE_DIVIDE))
  58     t = fold_build2 (EQ_EXPR, boolean_type_node,
  59                      op1, build_int_cst (type, 0));
  60   else if (TREE_CODE (type) == REAL_TYPE
  61            && sanitize_flags_p (SANITIZE_FLOAT_DIVIDE))
  62     {
  63       t = fold_build2 (EQ_EXPR, boolean_type_node,
  64                        op1, build_real (type, dconst0));
  65       flag = SANITIZE_FLOAT_DIVIDE;
  66     }
  67   else
  68     t = NULL_TREE;
  69
  70   /* We check INT_MIN / -1 only for signed types.  */
  71   if (TREE_CODE (type) == INTEGER_TYPE
  72       && sanitize_flags_p (SANITIZE_SI_OVERFLOW)
  73       && !TYPE_UNSIGNED (type))
  74     {
  75       tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
  76                         build_int_cst (type, -1));
  77       x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
  78                        TYPE_MIN_VALUE (type));
  79       x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
  80       if (t == NULL_TREE || integer_zerop (t))
  81         {
  82           t = x;
  83           x = NULL_TREE;
  84           flag = SANITIZE_SI_OVERFLOW;
  85         }
  86       else if ((((flag_sanitize_trap & SANITIZE_DIVIDE) == 0)
  87                 == ((flag_sanitize_trap & SANITIZE_SI_OVERFLOW) == 0))
  88                && (((flag_sanitize_recover & SANITIZE_DIVIDE) == 0)
  89                    == ((flag_sanitize_recover & SANITIZE_SI_OVERFLOW) == 0)))
  90         {
  91           t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
  92           x = NULL_TREE;
  93         }
  94       else if (integer_zerop (x))
  95         x = NULL_TREE;
  96     }
  97   else if (t == NULL_TREE)
  98     return NULL_TREE;
  99
 100   /* If the condition was folded to 0, no need to instrument
 101      this expression.  */
 102   if (integer_zerop (t))
 103     return NULL_TREE;
 104
 105   /* In case we have a SAVE_EXPR in a conditional context, we need to
 106      make sure it gets evaluated before the condition.  */
 107   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
 108   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
 109   if ((flag_sanitize_trap & flag) && x == NULL_TREE)
 110     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 111   else
 112     {
 113       tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
 114                                      ubsan_type_descriptor (type), NULL_TREE,
 115                                      NULL_TREE);
 116       data = build_fold_addr_expr_loc (loc, data);
 117       if (flag_sanitize_trap & flag)
 118         tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP),
 119                                   0);
 120       else
 121         {
 122           enum built_in_function bcode
 123             = (flag_sanitize_recover & flag)
 124               ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
 125               : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
 126           tt = builtin_decl_explicit (bcode);
 127           op0 = unshare_expr (op0);
 128           op1 = unshare_expr (op1);
 129           tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 130                                     ubsan_encode_value (op1));
 131         }
 132       if (x)
 133         {
 134           tree xt;
 135           if (flag_sanitize_trap & SANITIZE_SI_OVERFLOW)
 136             xt = build_call_expr_loc (loc,
 137                                       builtin_decl_explicit (BUILT_IN_TRAP),
 138                                       0);
 139           else
 140             {
 141               enum built_in_function bcode
 142                 = (flag_sanitize_recover & SANITIZE_SI_OVERFLOW)
 143                    ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
 144                    : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
 145               xt = builtin_decl_explicit (bcode);
 146               op0 = unshare_expr (op0);
 147               op1 = unshare_expr (op1);
 148               xt = build_call_expr_loc (loc, xt, 3, data,
 149                                         ubsan_encode_value (op0),
 150                                         ubsan_encode_value (op1));
 151             }
 152           x = fold_build3 (COND_EXPR, void_type_node, x, xt, void_node);
 153         }
 154     }
 155   t = fold_build3 (COND_EXPR, void_type_node, t, tt, x ? x : void_node);
 156
 157   return t;
 158 }
 159
 160 /* Instrument left and right shifts.  */
 161
 162 tree
 163 ubsan_instrument_shift (location_t loc, enum tree_code code,
 164                         tree op0, tree op1)
 165 {
 166   tree t, tt = NULL_TREE;
 167   tree type0 = TREE_TYPE (op0);
 168   tree type1 = TREE_TYPE (op1);
 169   if (!INTEGRAL_TYPE_P (type0))
 170     return NULL_TREE;
 171
 172   tree op1_utype = unsigned_type_for (type1);
 173   HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
 174   tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
 175
 176   op0 = unshare_expr (op0);
 177   op1 = unshare_expr (op1);
 178
 179   t = fold_convert_loc (loc, op1_utype, op1);
 180   t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
 181
 182   /* If this is not a signed operation, don't perform overflow checks.
 183      Also punt on bit-fields.  */
 184   if (TYPE_OVERFLOW_WRAPS (type0)
 185       || maybe_ne (GET_MODE_BITSIZE (TYPE_MODE (type0)),
 186                    TYPE_PRECISION (type0))
 187       || !sanitize_flags_p (SANITIZE_SHIFT_BASE)
 188       /* In C++20 and later, shifts are well defined except when
 189          the second operand is not within bounds.  */
 190       || cxx_dialect >= cxx20)
 191     ;
 192
 193   /* For signed x << y, in C99 and later, the following:
 194      (unsigned) x >> (uprecm1 - y)
 195      if non-zero, is undefined.  */
 196   else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
 197     {
 198       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 199                             fold_convert (op1_utype, unshare_expr (op1)));
 200       tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
 201       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 202       tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
 203                         build_int_cst (TREE_TYPE (tt), 0));
 204     }
 205
 206   /* For signed x << y, in C++11 to C++17, the following:
 207      x < 0 || ((unsigned) x >> (uprecm1 - y))
 208      if > 1, is undefined.  */
 209   else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
 210     {
 211       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 212                             fold_convert (op1_utype, unshare_expr (op1)));
 213       tt = fold_convert_loc (loc, unsigned_type_for (type0),
 214                              unshare_expr (op0));
 215       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 216       tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
 217                         build_int_cst (TREE_TYPE (tt), 1));
 218       x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
 219                        build_int_cst (type0, 0));
 220       tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
 221     }
 222
 223   /* If the condition was folded to 0, no need to instrument
 224      this expression.  */
 225   if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
 226     return NULL_TREE;
 227
 228   /* In case we have a SAVE_EXPR in a conditional context, we need to
 229      make sure it gets evaluated before the condition.  */
 230   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
 231   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
 232
 233   enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
 234   tree else_t = void_node;
 235   if (tt)
 236     {
 237       if (!sanitize_flags_p (SANITIZE_SHIFT_EXPONENT))
 238         {
 239           t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
 240           t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
 241           recover_kind = SANITIZE_SHIFT_BASE;
 242         }
 243       else
 244         {
 245           if (((!(flag_sanitize_trap & SANITIZE_SHIFT_EXPONENT))
 246                == (!(flag_sanitize_trap & SANITIZE_SHIFT_BASE)))
 247               && ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
 248                   == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
 249             t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
 250           else
 251             else_t = tt;
 252         }
 253     }
 254
 255   if ((flag_sanitize_trap & recover_kind) && else_t == void_node)
 256     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 257   else
 258     {
 259       tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
 260                                      ubsan_type_descriptor (type0),
 261                                      ubsan_type_descriptor (type1), NULL_TREE,
 262                                      NULL_TREE);
 263       data = build_fold_addr_expr_loc (loc, data);
 264
 265       if (flag_sanitize_trap & recover_kind)
 266         tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 267       else
 268         {
 269           enum built_in_function bcode
 270             = (flag_sanitize_recover & recover_kind)
 271               ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 272               : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 273           tt = builtin_decl_explicit (bcode);
 274           op0 = unshare_expr (op0);
 275           op1 = unshare_expr (op1);
 276           tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 277                                     ubsan_encode_value (op1));
 278         }
 279       if (else_t != void_node)
 280         {
 281           tree else_tt;
 282           if (flag_sanitize_trap & SANITIZE_SHIFT_BASE)
 283             else_tt
 284               = build_call_expr_loc (loc,
 285                                      builtin_decl_explicit (BUILT_IN_TRAP), 0);
 286           else
 287             {
 288               enum built_in_function bcode
 289                 = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
 290                   ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 291                   : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 292               else_tt = builtin_decl_explicit (bcode);
 293               op0 = unshare_expr (op0);
 294               op1 = unshare_expr (op1);
 295               else_tt = build_call_expr_loc (loc, else_tt, 3, data,
 296                                              ubsan_encode_value (op0),
 297                                              ubsan_encode_value (op1));
 298             }
 299           else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
 300                                 else_tt, void_node);
 301         }
 302     }
 303   t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);
 304
 305   return t;
 306 }
 307
 308 /* Instrument variable length array bound.  */
 309
 310 tree
 311 ubsan_instrument_vla (location_t loc, tree size)
 312 {
 313   tree type = TREE_TYPE (size);
 314   tree t, tt;
 315
 316   t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
 317   if (flag_sanitize_trap & SANITIZE_VLA)
 318     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 319   else
 320     {
 321       tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
 322                                      ubsan_type_descriptor (type), NULL_TREE,
 323                                      NULL_TREE);
 324       data = build_fold_addr_expr_loc (loc, data);
 325       enum built_in_function bcode
 326         = (flag_sanitize_recover & SANITIZE_VLA)
 327           ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
 328           : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
 329       tt = builtin_decl_explicit (bcode);
 330       tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
 331     }
 332   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 333
 334   return t;
 335 }
 336
 337 /* Instrument missing return in C++ functions returning non-void.  */
 338
 339 tree
 340 ubsan_instrument_return (location_t loc)
 341 {
 342   if (flag_sanitize_trap & SANITIZE_RETURN)
 343     /* pass_warn_function_return checks for BUILTINS_LOCATION.  */
 344     return build_call_expr_loc (BUILTINS_LOCATION,
 345                                 builtin_decl_explicit (BUILT_IN_TRAP), 0);
 346
 347   tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
 348                                  NULL_TREE, NULL_TREE);
 349   tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
 350   return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
 351 }
 352
 353 /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
 354    that gets expanded in the sanopt pass, and make an array dimension
 355    of it.  ARRAY is the array, *INDEX is an index to the array.
 356    Return NULL_TREE if no instrumentation is emitted.
 357    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 358
 359 tree
 360 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
 361                          bool ignore_off_by_one)
 362 {
 363   tree type = TREE_TYPE (array);
 364   tree domain = TYPE_DOMAIN (type);
 365
 366   if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
 367     return NULL_TREE;
 368
 369   tree bound = TYPE_MAX_VALUE (domain);
 370   if (ignore_off_by_one)
 371     bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
 372                          build_int_cst (TREE_TYPE (bound), 1));
 373
 374   /* Detect flexible array members and suchlike, unless
 375      -fsanitize=bounds-strict.  */
 376   tree base = get_base_address (array);
 377   if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
 378       && TREE_CODE (array) == COMPONENT_REF
 379       && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
 380     {
 381       tree next = NULL_TREE;
 382       tree cref = array;
 383
 384       /* Walk all structs/unions.  */
 385       while (TREE_CODE (cref) == COMPONENT_REF)
 386         {
 387           if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
 388             for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
 389                  next && TREE_CODE (next) != FIELD_DECL;
 390                  next = DECL_CHAIN (next))
 391               ;
 392           if (next)
 393             /* Not a last element.  Instrument it.  */
 394             break;
 395           /* Ok, this is the last field of the structure/union.  But the
 396              aggregate containing the field must be the last field too,
 397              recursively.  */
 398           cref = TREE_OPERAND (cref, 0);
 399         }
 400       if (!next)
 401         /* Don't instrument this flexible array member-like array in non-strict
 402            -fsanitize=bounds mode.  */
 403         return NULL_TREE;
 404     }
 405
 406   /* Don't emit instrumentation in the most common cases.  */
 407   tree idx = NULL_TREE;
 408   if (TREE_CODE (*index) == INTEGER_CST)
 409     idx = *index;
 410   else if (TREE_CODE (*index) == BIT_AND_EXPR
 411            && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
 412     idx = TREE_OPERAND (*index, 1);
 413   if (idx
 414       && TREE_CODE (bound) == INTEGER_CST
 415       && tree_int_cst_sgn (idx) >= 0
 416       && tree_int_cst_le (idx, bound))
 417     return NULL_TREE;
 418
 419   *index = save_expr (*index);
 420   /* Create a "(T *) 0" tree node to describe the array type.  */
 421   tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
 422   return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
 423                                        void_type_node, 3, zero_with_type,
 424                                        *index, bound);
 425 }
 426
 427 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS.  */
 428
 429 bool
 430 ubsan_array_ref_instrumented_p (const_tree t)
 431 {
 432   if (TREE_CODE (t) != ARRAY_REF)
 433     return false;
 434
 435   tree op1 = TREE_OPERAND (t, 1);
 436   return TREE_CODE (op1) == COMPOUND_EXPR
 437          && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
 438          && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
 439          && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
 440 }
 441
 442 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
 443    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 444
 445 void
 446 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
 447 {
 448   if (!ubsan_array_ref_instrumented_p (*expr_p)
 449       && sanitize_flags_p (SANITIZE_BOUNDS | SANITIZE_BOUNDS_STRICT)
 450       && current_function_decl != NULL_TREE)
 451     {
 452       tree op0 = TREE_OPERAND (*expr_p, 0);
 453       tree op1 = TREE_OPERAND (*expr_p, 1);
 454       tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
 455                                         ignore_off_by_one);
 456       if (e != NULL_TREE)
 457         {
 458           tree t = copy_node (*expr_p);
 459           TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
 460                                         e, op1);
 461           *expr_p = t;
 462         }
 463     }
 464 }
 465
 466 static tree
 467 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
 468                                           enum ubsan_null_ckind ckind)
 469 {
 470   if (!sanitize_flags_p (SANITIZE_ALIGNMENT | SANITIZE_NULL)
 471       || current_function_decl == NULL_TREE)
 472     return NULL_TREE;
 473
 474   tree type = TREE_TYPE (ptype);
 475   tree orig_op = op;
 476   bool instrument = false;
 477   unsigned int mina = 0;
 478
 479   if (sanitize_flags_p (SANITIZE_ALIGNMENT))
 480     {
 481       mina = min_align_of_type (type);
 482       if (mina <= 1)
 483         mina = 0;
 484     }
 485   while ((TREE_CODE (op) == NOP_EXPR
 486           || TREE_CODE (op) == NON_LVALUE_EXPR)
 487          && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
 488     op = TREE_OPERAND (op, 0);
 489   if (TREE_CODE (op) == NOP_EXPR
 490       && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
 491     {
 492       if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
 493         instrument = true;
 494     }
 495   else
 496     {
 497       if (sanitize_flags_p (SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
 498         {
 499           bool strict_overflow_p = false;
 500           /* tree_single_nonzero_warnv_p will not return true for non-weak
 501              non-automatic decls with -fno-delete-null-pointer-checks,
 502              which is disabled during -fsanitize=null.  We don't want to
 503              instrument those, just weak vars though.  */
 504           int save_flag_delete_null_pointer_checks
 505             = flag_delete_null_pointer_checks;
 506           flag_delete_null_pointer_checks = 1;
 507           if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
 508               || strict_overflow_p)
 509             instrument = true;
 510           flag_delete_null_pointer_checks
 511             = save_flag_delete_null_pointer_checks;
 512         }
 513       else if (sanitize_flags_p (SANITIZE_NULL))
 514         instrument = true;
 515       if (mina && mina > 1)
 516         {
 517           if (!POINTER_TYPE_P (TREE_TYPE (op))
 518               || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
 519             instrument = true;
 520         }
 521     }
 522   if (!instrument)
 523     return NULL_TREE;
 524   op = save_expr (orig_op);
 525   gcc_assert (POINTER_TYPE_P (ptype));
 526   if (TREE_CODE (ptype) == REFERENCE_TYPE)
 527     ptype = build_pointer_type (TREE_TYPE (ptype));
 528   tree kind = build_int_cst (ptype, ckind);
 529   tree align = build_int_cst (pointer_sized_int_node, mina);
 530   tree call
 531     = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
 532                                     3, op, kind, align);
 533   TREE_SIDE_EFFECTS (call) = 1;
 534   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
 535 }
 536
 537 /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
 538    type if needed.  */
 539
 540 void
 541 ubsan_maybe_instrument_reference (tree *stmt_p)
 542 {
 543   tree stmt = *stmt_p;
 544   tree op = stmt;
 545   if (TREE_CODE (stmt) == NOP_EXPR)
 546     op = TREE_OPERAND (stmt, 0);
 547   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 548                                                  TREE_TYPE (stmt),
 549                                                  UBSAN_REF_BINDING);
 550   if (op)
 551     {
 552       if (TREE_CODE (stmt) == NOP_EXPR)
 553         TREE_OPERAND (stmt, 0) = op;
 554       else
 555         *stmt_p = op;
 556     }
 557 }
 558
 559 /* Instrument a CALL_EXPR to a method if needed.  */
 560
 561 void
 562 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
 563 {
 564   if (call_expr_nargs (stmt) == 0)
 565     return;
 566   tree op = CALL_EXPR_ARG (stmt, 0);
 567   if (op == error_mark_node
 568       || !POINTER_TYPE_P (TREE_TYPE (op)))
 569     return;
 570   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 571                                                  TREE_TYPE (op),
 572                                                  is_ctor ? UBSAN_CTOR_CALL
 573                                                  : UBSAN_MEMBER_CALL);
 574   if (op)
 575     CALL_EXPR_ARG (stmt, 0) = op;
 576 }