The following makes sure to guard the modref query in VN on a
pointer typed argument.
Bootstrapped and tested on x86_64-unknown-linux-gnu, pushed.
2022-03-08 Richard Biener <rguent...@suse.de>
PR tree-optimization/104825
* tree-ssa-sccvn.c (visit_reference_op_call): Properly
guard modref get_ao_ref on a pointer typed argument.
* gcc.dg/torture/pr104825.c: New testcase.
---
gcc/testsuite/gcc.dg/torture/pr104825.c | 14 ++++++++++++++
gcc/tree-ssa-sccvn.cc | 5 +++--
2 files changed, 17 insertions(+), 2 deletions(-)
create mode 100644 gcc/testsuite/gcc.dg/torture/pr104825.c
diff --git a/gcc/testsuite/gcc.dg/torture/pr104825.c
b/gcc/testsuite/gcc.dg/torture/pr104825.c
new file mode 100644
index 00000000000..7affacc2094
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr104825.c
@@ -0,0 +1,14 @@
+/* { dg-do compile } */
+/* { dg-additional-options "-Wno-stringop-overread" } */
+
+int foo (fmt)
+char* fmt;
+{
+ return (__builtin_strchr (fmt, '*') != 0
+ || __builtin_strchr (fmt, 'n') != 0);
+}
+void bar ()
+{
+ if (foo (1))
+ __builtin_abort ();
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index d4d0aba880c..66b4fc21f5b 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -5140,11 +5140,12 @@ visit_reference_op_call (tree lhs, gcall *stmt)
{
accesses.quick_grow (accesses.length () + 1);
ao_ref *r = &accesses.last ();
- if (!access_node.get_ao_ref (stmt, r))
+ tree arg = access_node.get_call_arg (stmt);
+ if (!POINTER_TYPE_P (TREE_TYPE (arg))
+ || !access_node.get_ao_ref (stmt, r))
{
/* Initialize a ref based on the argument and
unknown offset if possible. */
- tree arg = access_node.get_call_arg (stmt);
if (arg && TREE_CODE (arg) == SSA_NAME)
arg = SSA_VAL (arg);
if (arg
--
2.34.1
