gcc/sanopt.c

   1 /* Optimize and expand sanitizer functions.
   2    Copyright (C) 2014-2015 Free Software Foundation, Inc.
   3    Contributed by Marek Polacek <polacek@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "input.h"
  25 #include "alias.h"
  26 #include "symtab.h"
  27 #include "options.h"
  28 #include "tree.h"
  29 #include "fold-const.h"
  30 #include "predict.h"
  31 #include "tm.h"
  32 #include "hard-reg-set.h"
  33 #include "function.h"
  34 #include "dominance.h"
  35 #include "cfg.h"
  36 #include "basic-block.h"
  37 #include "tree-ssa-alias.h"
  38 #include "internal-fn.h"
  39 #include "gimple-expr.h"
  40 #include "is-a.h"
  41 #include "gimple.h"
  42 #include "gimplify.h"
  43 #include "gimple-iterator.h"
  44 #include "plugin-api.h"
  45 #include "tree-pass.h"
  46 #include "asan.h"
  47 #include "gimple-pretty-print.h"
  48 #include "tm_p.h"
  49 #include "langhooks.h"
  50 #include "ubsan.h"
  51 #include "params.h"
  52 #include "tree-ssa-operands.h"
  53
  54
  55 /* This is used to carry information about basic blocks.  It is
  56    attached to the AUX field of the standard CFG block.  */
  57
  58 struct sanopt_info
  59 {
  60   /* True if this BB might call (directly or indirectly) free/munmap
  61      or similar operation.  */
  62   bool has_freeing_call_p;
  63
  64   /* True if HAS_FREEING_CALL_P flag has been computed.  */
  65   bool has_freeing_call_computed_p;
  66
  67   /* True if there is a block with HAS_FREEING_CALL_P flag set
  68      on any path between an immediate dominator of BB, denoted
  69      imm(BB), and BB.  */
  70   bool imm_dom_path_with_freeing_call_p;
  71
  72   /* True if IMM_DOM_PATH_WITH_FREEING_CALL_P has been computed.  */
  73   bool imm_dom_path_with_freeing_call_computed_p;
  74
  75   /* Number of possibly freeing calls encountered in this bb
  76      (so far).  */
  77   uint64_t freeing_call_events;
  78
  79   /* True if BB is currently being visited during computation
  80      of IMM_DOM_PATH_WITH_FREEING_CALL_P flag.  */
  81   bool being_visited_p;
  82
  83   /* True if this BB has been visited in the dominator walk.  */
  84   bool visited_p;
  85 };
  86
  87 /* If T has a single definition of form T = T2, return T2.  */
  88
  89 static tree
  90 maybe_get_single_definition (tree t)
  91 {
  92   if (TREE_CODE (t) == SSA_NAME)
  93     {
  94       gimple g = SSA_NAME_DEF_STMT (t);
  95       if (gimple_assign_single_p (g))
  96         return gimple_assign_rhs1 (g);
  97     }
  98   return NULL_TREE;
  99 }
 100
 101 /* Traits class for tree hash maps below.  */
 102
 103 struct sanopt_tree_map_traits : default_hashmap_traits
 104 {
 105   static inline hashval_t hash (const_tree ref)
 106   {
 107     return iterative_hash_expr (ref, 0);
 108   }
 109
 110   static inline bool equal_keys (const_tree ref1, const_tree ref2)
 111   {
 112     return operand_equal_p (ref1, ref2, 0);
 113   }
 114 };
 115
 116 /* Tree triplet for vptr_check_map.  */
 117 struct sanopt_tree_triplet
 118 {
 119   tree t1, t2, t3;
 120 };
 121
 122 /* Traits class for tree triplet hash maps below.  */
 123
 124 struct sanopt_tree_triplet_map_traits : default_hashmap_traits
 125 {
 126   static inline hashval_t
 127   hash (const sanopt_tree_triplet &ref)
 128   {
 129     inchash::hash hstate (0);
 130     inchash::add_expr (ref.t1, hstate);
 131     inchash::add_expr (ref.t2, hstate);
 132     inchash::add_expr (ref.t3, hstate);
 133     return hstate.end ();
 134   }
 135
 136   static inline bool
 137   equal_keys (const sanopt_tree_triplet &ref1, const sanopt_tree_triplet &ref2)
 138   {
 139     return operand_equal_p (ref1.t1, ref2.t1, 0)
 140            && operand_equal_p (ref1.t2, ref2.t2, 0)
 141            && operand_equal_p (ref1.t3, ref2.t3, 0);
 142   }
 143
 144   template<typename T>
 145   static inline void
 146   mark_deleted (T &e)
 147   {
 148     e.m_key.t1 = reinterpret_cast<T *> (1);
 149   }
 150
 151   template<typename T>
 152   static inline void
 153   mark_empty (T &e)
 154   {
 155     e.m_key.t1 = NULL;
 156   }
 157
 158   template<typename T>
 159   static inline bool
 160   is_deleted (T &e)
 161   {
 162     return e.m_key.t1 == (void *) 1;
 163   }
 164
 165   template<typename T>
 166   static inline bool
 167   is_empty (T &e)
 168   {
 169     return e.m_key.t1 == NULL;
 170   }
 171 };
 172
 173 /* This is used to carry various hash maps and variables used
 174    in sanopt_optimize_walker.  */
 175
 176 struct sanopt_ctx
 177 {
 178   /* This map maps a pointer (the first argument of UBSAN_NULL) to
 179      a vector of UBSAN_NULL call statements that check this pointer.  */
 180   hash_map<tree, auto_vec<gimple> > null_check_map;
 181
 182   /* This map maps a pointer (the second argument of ASAN_CHECK) to
 183      a vector of ASAN_CHECK call statements that check the access.  */
 184   hash_map<tree, auto_vec<gimple>, sanopt_tree_map_traits> asan_check_map;
 185
 186   /* This map maps a tree triplet (the first, second and fourth argument
 187      of UBSAN_VPTR) to a vector of UBSAN_VPTR call statements that check
 188      that virtual table pointer.  */
 189   hash_map<sanopt_tree_triplet, auto_vec<gimple>,
 190            sanopt_tree_triplet_map_traits> vptr_check_map;
 191
 192   /* Number of IFN_ASAN_CHECK statements.  */
 193   int asan_num_accesses;
 194 };
 195
 196
 197 /* Return true if there might be any call to free/munmap operation
 198    on any path in between DOM (which should be imm(BB)) and BB.  */
 199
 200 static bool
 201 imm_dom_path_with_freeing_call (basic_block bb, basic_block dom)
 202 {
 203   sanopt_info *info = (sanopt_info *) bb->aux;
 204   edge e;
 205   edge_iterator ei;
 206
 207   if (info->imm_dom_path_with_freeing_call_computed_p)
 208     return info->imm_dom_path_with_freeing_call_p;
 209
 210   info->being_visited_p = true;
 211
 212   FOR_EACH_EDGE (e, ei, bb->preds)
 213     {
 214       sanopt_info *pred_info = (sanopt_info *) e->src->aux;
 215
 216       if (e->src == dom)
 217         continue;
 218
 219       if ((pred_info->imm_dom_path_with_freeing_call_computed_p
 220           && pred_info->imm_dom_path_with_freeing_call_p)
 221           || (pred_info->has_freeing_call_computed_p
 222               && pred_info->has_freeing_call_p))
 223         {
 224           info->imm_dom_path_with_freeing_call_computed_p = true;
 225           info->imm_dom_path_with_freeing_call_p = true;
 226           info->being_visited_p = false;
 227           return true;
 228         }
 229     }
 230
 231   FOR_EACH_EDGE (e, ei, bb->preds)
 232     {
 233       sanopt_info *pred_info = (sanopt_info *) e->src->aux;
 234
 235       if (e->src == dom)
 236         continue;
 237
 238       if (pred_info->has_freeing_call_computed_p)
 239         continue;
 240
 241       gimple_stmt_iterator gsi;
 242       for (gsi = gsi_start_bb (e->src); !gsi_end_p (gsi); gsi_next (&gsi))
 243         {
 244           gimple stmt = gsi_stmt (gsi);
 245
 246           if (is_gimple_call (stmt) && !nonfreeing_call_p (stmt))
 247             {
 248               pred_info->has_freeing_call_p = true;
 249               break;
 250             }
 251         }
 252
 253       pred_info->has_freeing_call_computed_p = true;
 254       if (pred_info->has_freeing_call_p)
 255         {
 256           info->imm_dom_path_with_freeing_call_computed_p = true;
 257           info->imm_dom_path_with_freeing_call_p = true;
 258           info->being_visited_p = false;
 259           return true;
 260         }
 261     }
 262
 263   FOR_EACH_EDGE (e, ei, bb->preds)
 264     {
 265       if (e->src == dom)
 266         continue;
 267
 268       basic_block src;
 269       for (src = e->src; src != dom; )
 270         {
 271           sanopt_info *pred_info = (sanopt_info *) src->aux;
 272           if (pred_info->being_visited_p)
 273             break;
 274           basic_block imm = get_immediate_dominator (CDI_DOMINATORS, src);
 275           if (imm_dom_path_with_freeing_call (src, imm))
 276             {
 277               info->imm_dom_path_with_freeing_call_computed_p = true;
 278               info->imm_dom_path_with_freeing_call_p = true;
 279               info->being_visited_p = false;
 280               return true;
 281             }
 282           src = imm;
 283         }
 284     }
 285
 286   info->imm_dom_path_with_freeing_call_computed_p = true;
 287   info->imm_dom_path_with_freeing_call_p = false;
 288   info->being_visited_p = false;
 289   return false;
 290 }
 291
 292 /* Get the first dominating check from the list of stored checks.
 293    Non-dominating checks are silently dropped.  */
 294
 295 static gimple
 296 maybe_get_dominating_check (auto_vec<gimple> &v)
 297 {
 298   for (; !v.is_empty (); v.pop ())
 299     {
 300       gimple g = v.last ();
 301       sanopt_info *si = (sanopt_info *) gimple_bb (g)->aux;
 302       if (!si->visited_p)
 303         /* At this point we shouldn't have any statements
 304            that aren't dominating the current BB.  */
 305         return g;
 306     }
 307   return NULL;
 308 }
 309
 310 /* Optimize away redundant UBSAN_NULL calls.  */
 311
 312 static bool
 313 maybe_optimize_ubsan_null_ifn (struct sanopt_ctx *ctx, gimple stmt)
 314 {
 315   gcc_assert (gimple_call_num_args (stmt) == 3);
 316   tree ptr = gimple_call_arg (stmt, 0);
 317   tree cur_align = gimple_call_arg (stmt, 2);
 318   gcc_assert (TREE_CODE (cur_align) == INTEGER_CST);
 319   bool remove = false;
 320
 321   auto_vec<gimple> &v = ctx->null_check_map.get_or_insert (ptr);
 322   gimple g = maybe_get_dominating_check (v);
 323   if (!g)
 324     {
 325       /* For this PTR we don't have any UBSAN_NULL stmts recorded, so there's
 326          nothing to optimize yet.  */
 327       v.safe_push (stmt);
 328       return false;
 329     }
 330
 331   /* We already have recorded a UBSAN_NULL check for this pointer. Perhaps we
 332      can drop this one.  But only if this check doesn't specify stricter
 333      alignment.  */
 334
 335   tree align = gimple_call_arg (g, 2);
 336   int kind = tree_to_shwi (gimple_call_arg (g, 1));
 337   /* If this is a NULL pointer check where we had segv anyway, we can
 338      remove it.  */
 339   if (integer_zerop (align)
 340       && (kind == UBSAN_LOAD_OF
 341           || kind == UBSAN_STORE_OF
 342           || kind == UBSAN_MEMBER_ACCESS))
 343     remove = true;
 344   /* Otherwise remove the check in non-recovering mode, or if the
 345      stmts have same location.  */
 346   else if (integer_zerop (align))
 347     remove = (flag_sanitize_recover & SANITIZE_NULL) == 0
 348               || flag_sanitize_undefined_trap_on_error
 349               || gimple_location (g) == gimple_location (stmt);
 350   else if (tree_int_cst_le (cur_align, align))
 351     remove = (flag_sanitize_recover & SANITIZE_ALIGNMENT) == 0
 352               || flag_sanitize_undefined_trap_on_error
 353               || gimple_location (g) == gimple_location (stmt);
 354
 355   if (!remove && gimple_bb (g) == gimple_bb (stmt)
 356       && tree_int_cst_compare (cur_align, align) == 0)
 357     v.pop ();
 358
 359   if (!remove)
 360     v.safe_push (stmt);
 361   return remove;
 362 }
 363
 364 /* Optimize away redundant UBSAN_VPTR calls.  The second argument
 365    is the value loaded from the virtual table, so rely on FRE to find out
 366    when we can actually optimize.  */
 367
 368 static bool
 369 maybe_optimize_ubsan_vptr_ifn (struct sanopt_ctx *ctx, gimple stmt)
 370 {
 371   gcc_assert (gimple_call_num_args (stmt) == 5);
 372   sanopt_tree_triplet triplet;
 373   triplet.t1 = gimple_call_arg (stmt, 0);
 374   triplet.t2 = gimple_call_arg (stmt, 1);
 375   triplet.t3 = gimple_call_arg (stmt, 3);
 376
 377   auto_vec<gimple> &v = ctx->vptr_check_map.get_or_insert (triplet);
 378   gimple g = maybe_get_dominating_check (v);
 379   if (!g)
 380     {
 381       /* For this PTR we don't have any UBSAN_VPTR stmts recorded, so there's
 382          nothing to optimize yet.  */
 383       v.safe_push (stmt);
 384       return false;
 385     }
 386
 387   return true;
 388 }
 389
 390 /* Returns TRUE if ASan check of length LEN in block BB can be removed
 391    if preceded by checks in V.  */
 392
 393 static bool
 394 can_remove_asan_check (auto_vec<gimple> &v, tree len, basic_block bb)
 395 {
 396   unsigned int i;
 397   gimple g;
 398   gimple to_pop = NULL;
 399   bool remove = false;
 400   basic_block last_bb = bb;
 401   bool cleanup = false;
 402
 403   FOR_EACH_VEC_ELT_REVERSE (v, i, g)
 404     {
 405       basic_block gbb = gimple_bb (g);
 406       sanopt_info *si = (sanopt_info *) gbb->aux;
 407       if (gimple_uid (g) < si->freeing_call_events)
 408         {
 409           /* If there is a potentially freeing call after g in gbb, we should
 410              remove it from the vector, can't use in optimization.  */
 411           cleanup = true;
 412           continue;
 413         }
 414
 415       tree glen = gimple_call_arg (g, 2);
 416       gcc_assert (TREE_CODE (glen) == INTEGER_CST);
 417
 418       /* If we've checked only smaller length than we want to check now,
 419          we can't remove the current stmt.  If g is in the same basic block,
 420          we want to remove it though, as the current stmt is better.  */
 421       if (tree_int_cst_lt (glen, len))
 422         {
 423           if (gbb == bb)
 424             {
 425               to_pop = g;
 426               cleanup = true;
 427             }
 428           continue;
 429         }
 430
 431       while (last_bb != gbb)
 432         {
 433           /* Paths from last_bb to bb have been checked before.
 434              gbb is necessarily a dominator of last_bb, but not necessarily
 435              immediate dominator.  */
 436           if (((sanopt_info *) last_bb->aux)->freeing_call_events)
 437             break;
 438
 439           basic_block imm = get_immediate_dominator (CDI_DOMINATORS, last_bb);
 440           gcc_assert (imm);
 441           if (imm_dom_path_with_freeing_call (last_bb, imm))
 442             break;
 443
 444           last_bb = imm;
 445         }
 446       if (last_bb == gbb)
 447         remove = true;
 448       break;
 449     }
 450
 451   if (cleanup)
 452     {
 453       unsigned int j = 0, l = v.length ();
 454       for (i = 0; i < l; i++)
 455         if (v[i] != to_pop
 456             && (gimple_uid (v[i])
 457                 == ((sanopt_info *)
 458                     gimple_bb (v[i])->aux)->freeing_call_events))
 459           {
 460             if (i != j)
 461               v[j] = v[i];
 462             j++;
 463           }
 464       v.truncate (j);
 465     }
 466
 467   return remove;
 468 }
 469
 470 /* Optimize away redundant ASAN_CHECK calls.  */
 471
 472 static bool
 473 maybe_optimize_asan_check_ifn (struct sanopt_ctx *ctx, gimple stmt)
 474 {
 475   gcc_assert (gimple_call_num_args (stmt) == 4);
 476   tree ptr = gimple_call_arg (stmt, 1);
 477   tree len = gimple_call_arg (stmt, 2);
 478   basic_block bb = gimple_bb (stmt);
 479   sanopt_info *info = (sanopt_info *) bb->aux;
 480
 481   if (TREE_CODE (len) != INTEGER_CST)
 482     return false;
 483   if (integer_zerop (len))
 484     return false;
 485
 486   gimple_set_uid (stmt, info->freeing_call_events);
 487
 488   auto_vec<gimple> *ptr_checks = &ctx->asan_check_map.get_or_insert (ptr);
 489
 490   tree base_addr = maybe_get_single_definition (ptr);
 491   auto_vec<gimple> *base_checks = NULL;
 492   if (base_addr)
 493     {
 494       base_checks = &ctx->asan_check_map.get_or_insert (base_addr);
 495       /* Original pointer might have been invalidated.  */
 496       ptr_checks = ctx->asan_check_map.get (ptr);
 497     }
 498
 499   gimple g = maybe_get_dominating_check (*ptr_checks);
 500   gimple g2 = NULL;
 501
 502   if (base_checks)
 503     /* Try with base address as well.  */
 504     g2 = maybe_get_dominating_check (*base_checks);
 505
 506   if (g == NULL && g2 == NULL)
 507     {
 508       /* For this PTR we don't have any ASAN_CHECK stmts recorded, so there's
 509          nothing to optimize yet.  */
 510       ptr_checks->safe_push (stmt);
 511       if (base_checks)
 512         base_checks->safe_push (stmt);
 513       return false;
 514     }
 515
 516   bool remove = false;
 517
 518   if (ptr_checks)
 519     remove = can_remove_asan_check (*ptr_checks, len, bb);
 520
 521   if (!remove && base_checks)
 522     /* Try with base address as well.  */
 523     remove = can_remove_asan_check (*base_checks, len, bb);
 524
 525   if (!remove)
 526     {
 527       ptr_checks->safe_push (stmt);
 528       if (base_checks)
 529         base_checks->safe_push (stmt);
 530     }
 531
 532   return remove;
 533 }
 534
 535 /* Try to optimize away redundant UBSAN_NULL and ASAN_CHECK calls.
 536
 537    We walk blocks in the CFG via a depth first search of the dominator
 538    tree; we push unique UBSAN_NULL or ASAN_CHECK statements into a vector
 539    in the NULL_CHECK_MAP or ASAN_CHECK_MAP hash maps as we enter the
 540    blocks.  When leaving a block, we mark the block as visited; then
 541    when checking the statements in the vector, we ignore statements that
 542    are coming from already visited blocks, because these cannot dominate
 543    anything anymore.  CTX is a sanopt context.  */
 544
 545 static void
 546 sanopt_optimize_walker (basic_block bb, struct sanopt_ctx *ctx)
 547 {
 548   basic_block son;
 549   gimple_stmt_iterator gsi;
 550   sanopt_info *info = (sanopt_info *) bb->aux;
 551   bool asan_check_optimize = (flag_sanitize & SANITIZE_ADDRESS) != 0;
 552
 553   for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi);)
 554     {
 555       gimple stmt = gsi_stmt (gsi);
 556       bool remove = false;
 557
 558       if (!is_gimple_call (stmt))
 559         {
 560           /* Handle asm volatile or asm with "memory" clobber
 561              the same as potentionally freeing call.  */
 562           gasm *asm_stmt = dyn_cast <gasm *> (stmt);
 563           if (asm_stmt
 564               && asan_check_optimize
 565               && (gimple_asm_clobbers_memory_p (asm_stmt)
 566                   || gimple_asm_volatile_p (asm_stmt)))
 567             info->freeing_call_events++;
 568           gsi_next (&gsi);
 569           continue;
 570         }
 571
 572       if (asan_check_optimize && !nonfreeing_call_p (stmt))
 573         info->freeing_call_events++;
 574
 575       if (gimple_call_internal_p (stmt))
 576         switch (gimple_call_internal_fn (stmt))
 577           {
 578           case IFN_UBSAN_NULL:
 579             remove = maybe_optimize_ubsan_null_ifn (ctx, stmt);
 580             break;
 581           case IFN_UBSAN_VPTR:
 582             remove = maybe_optimize_ubsan_vptr_ifn (ctx, stmt);
 583             break;
 584           case IFN_ASAN_CHECK:
 585             if (asan_check_optimize)
 586               remove = maybe_optimize_asan_check_ifn (ctx, stmt);
 587             if (!remove)
 588               ctx->asan_num_accesses++;
 589             break;
 590           default:
 591             break;
 592           }
 593
 594       if (remove)
 595         {
 596           /* Drop this check.  */
 597           if (dump_file && (dump_flags & TDF_DETAILS))
 598             {
 599               fprintf (dump_file, "Optimizing out\n  ");
 600               print_gimple_stmt (dump_file, stmt, 0, dump_flags);
 601               fprintf (dump_file, "\n");
 602             }
 603           unlink_stmt_vdef (stmt);
 604           gsi_remove (&gsi, true);
 605         }
 606       else
 607         gsi_next (&gsi);
 608     }
 609
 610   if (asan_check_optimize)
 611     {
 612       info->has_freeing_call_p = info->freeing_call_events != 0;
 613       info->has_freeing_call_computed_p = true;
 614     }
 615
 616   for (son = first_dom_son (CDI_DOMINATORS, bb);
 617        son;
 618        son = next_dom_son (CDI_DOMINATORS, son))
 619     sanopt_optimize_walker (son, ctx);
 620
 621   /* We're leaving this BB, so mark it to that effect.  */
 622   info->visited_p = true;
 623 }
 624
 625 /* Try to remove redundant sanitizer checks in function FUN.  */
 626
 627 static int
 628 sanopt_optimize (function *fun)
 629 {
 630   struct sanopt_ctx ctx;
 631   ctx.asan_num_accesses = 0;
 632
 633   /* Set up block info for each basic block.  */
 634   alloc_aux_for_blocks (sizeof (sanopt_info));
 635
 636   /* We're going to do a dominator walk, so ensure that we have
 637      dominance information.  */
 638   calculate_dominance_info (CDI_DOMINATORS);
 639
 640   /* Recursively walk the dominator tree optimizing away
 641      redundant checks.  */
 642   sanopt_optimize_walker (ENTRY_BLOCK_PTR_FOR_FN (fun), &ctx);
 643
 644   free_aux_for_blocks ();
 645
 646   return ctx.asan_num_accesses;
 647 }
 648
 649 /* Perform optimization of sanitize functions.  */
 650
 651 namespace {
 652
 653 const pass_data pass_data_sanopt =
 654 {
 655   GIMPLE_PASS, /* type */
 656   "sanopt", /* name */
 657   OPTGROUP_NONE, /* optinfo_flags */
 658   TV_NONE, /* tv_id */
 659   ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
 660   0, /* properties_provided */
 661   0, /* properties_destroyed */
 662   0, /* todo_flags_start */
 663   TODO_update_ssa, /* todo_flags_finish */
 664 };
 665
 666 class pass_sanopt : public gimple_opt_pass
 667 {
 668 public:
 669   pass_sanopt (gcc::context *ctxt)
 670     : gimple_opt_pass (pass_data_sanopt, ctxt)
 671   {}
 672
 673   /* opt_pass methods: */
 674   virtual bool gate (function *) { return flag_sanitize; }
 675   virtual unsigned int execute (function *);
 676
 677 }; // class pass_sanopt
 678
 679 unsigned int
 680 pass_sanopt::execute (function *fun)
 681 {
 682   basic_block bb;
 683   int asan_num_accesses = 0;
 684
 685   /* Try to remove redundant checks.  */
 686   if (optimize
 687       && (flag_sanitize
 688           & (SANITIZE_NULL | SANITIZE_ALIGNMENT
 689              | SANITIZE_ADDRESS | SANITIZE_VPTR)))
 690     asan_num_accesses = sanopt_optimize (fun);
 691   else if (flag_sanitize & SANITIZE_ADDRESS)
 692     {
 693       gimple_stmt_iterator gsi;
 694       FOR_EACH_BB_FN (bb, fun)
 695         for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
 696           {
 697             gimple stmt = gsi_stmt (gsi);
 698             if (is_gimple_call (stmt) && gimple_call_internal_p (stmt)
 699                 && gimple_call_internal_fn (stmt) == IFN_ASAN_CHECK)
 700               ++asan_num_accesses;
 701           }
 702     }
 703
 704   bool use_calls = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD < INT_MAX
 705     && asan_num_accesses >= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
 706
 707   FOR_EACH_BB_FN (bb, fun)
 708     {
 709       gimple_stmt_iterator gsi;
 710       for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); )
 711         {
 712           gimple stmt = gsi_stmt (gsi);
 713           bool no_next = false;
 714
 715           if (!is_gimple_call (stmt))
 716             {
 717               gsi_next (&gsi);
 718               continue;
 719             }
 720
 721           if (gimple_call_internal_p (stmt))
 722             {
 723               enum internal_fn ifn = gimple_call_internal_fn (stmt);
 724               switch (ifn)
 725                 {
 726                 case IFN_UBSAN_NULL:
 727                   no_next = ubsan_expand_null_ifn (&gsi);
 728                   break;
 729                 case IFN_UBSAN_BOUNDS:
 730                   no_next = ubsan_expand_bounds_ifn (&gsi);
 731                   break;
 732                 case IFN_UBSAN_OBJECT_SIZE:
 733                   no_next = ubsan_expand_objsize_ifn (&gsi);
 734                   break;
 735                 case IFN_UBSAN_VPTR:
 736                   no_next = ubsan_expand_vptr_ifn (&gsi);
 737                   break;
 738                 case IFN_ASAN_CHECK:
 739                   no_next = asan_expand_check_ifn (&gsi, use_calls);
 740                   break;
 741                 default:
 742                   break;
 743                 }
 744             }
 745           else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
 746             {
 747               tree callee = gimple_call_fndecl (stmt);
 748               switch (DECL_FUNCTION_CODE (callee))
 749                 {
 750                 case BUILT_IN_UNREACHABLE:
 751                   if (flag_sanitize & SANITIZE_UNREACHABLE
 752                       && !lookup_attribute ("no_sanitize_undefined",
 753                                             DECL_ATTRIBUTES (fun->decl)))
 754                     no_next = ubsan_instrument_unreachable (&gsi);
 755                   break;
 756                 default:
 757                   break;
 758                 }
 759             }
 760
 761           if (dump_file && (dump_flags & TDF_DETAILS))
 762             {
 763               fprintf (dump_file, "Expanded\n  ");
 764               print_gimple_stmt (dump_file, stmt, 0, dump_flags);
 765               fprintf (dump_file, "\n");
 766             }
 767
 768           if (!no_next)
 769             gsi_next (&gsi);
 770         }
 771     }
 772   return 0;
 773 }
 774
 775 } // anon namespace
 776
 777 gimple_opt_pass *
 778 make_pass_sanopt (gcc::context *ctxt)
 779 {
 780   return new pass_sanopt (ctxt);
 781 }