https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80797
--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
We don't instrument such expressions because
v_3 = &s_2->i;
is not gimple_assign_load_p:
1997 if (flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT))
1998 {
1999 if (gimple_store_p (stmt))
2000 instrument_null (gsi, true);
2001 if (gimple_assign_load_p (stmt))
2002 instrument_null (gsi, false);
2003 }
So I think we could use gimple_assign_single_p instead of gimple_assign_load_p
and then strip the ADDR_EXPR in instrument_null before getting its base
address. Untested.