From dc46350d44c2949ec38deb028960f8040f8e8e5d Mon Sep 17 00:00:00 2001
From: Richard Biener <rguenther@suse.de>
Date: Tue, 8 Mar 2022 08:42:58 +0100
Subject: [PATCH] tree-optimization/104825 - guard modref query

The following makes sure to guard the modref query in VN on a
pointer typed argument.

2022-03-08  Richard Biener  <rguenther@suse.de>

	PR tree-optimization/104825
	* tree-ssa-sccvn.cc (visit_reference_op_call): Properly
	guard modref get_ao_ref on a pointer typed argument.

	* gcc.dg/torture/pr104825.c: New testcase.
---
 gcc/testsuite/gcc.dg/torture/pr104825.c | 14 ++++++++++++++
 gcc/tree-ssa-sccvn.cc                   |  5 +++--
 2 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/torture/pr104825.c

diff --git a/gcc/testsuite/gcc.dg/torture/pr104825.c b/gcc/testsuite/gcc.dg/torture/pr104825.c
new file mode 100644
index 000000000000..7affacc20942
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr104825.c
@@ -0,0 +1,14 @@
+/* { dg-do compile } */
+/* { dg-additional-options "-Wno-stringop-overread" } */
+
+int foo (fmt)
+char* fmt;
+{
+  return (__builtin_strchr (fmt, '*') != 0
+          || __builtin_strchr (fmt, 'n') != 0);
+}
+void bar ()
+{
+  if (foo (1))
+    __builtin_abort ();
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index d4d0aba880cd..66b4fc21f5b3 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -5140,11 +5140,12 @@ visit_reference_op_call (tree lhs, gcall *stmt)
 		{
 		  accesses.quick_grow (accesses.length () + 1);
 		  ao_ref *r = &accesses.last ();
-		  if (!access_node.get_ao_ref (stmt, r))
+		  tree arg = access_node.get_call_arg (stmt);
+		  if (!POINTER_TYPE_P (TREE_TYPE (arg))
+		      || !access_node.get_ao_ref (stmt, r))
 		    {
 		      /* Initialize a ref based on the argument and
 			 unknown offset if possible.  */
-		      tree arg = access_node.get_call_arg (stmt);
 		      if (arg && TREE_CODE (arg) == SSA_NAME)
 			arg = SSA_VAL (arg);
 		      if (arg
-- 
GitLab