/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/vec.h

Bug Summary

File:	build/gcc/vec.h
Warning:	line 815, column 10 Called C++ object pointer is null

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name asan.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model static -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/11.0.0 -D IN_GCC -D HAVE_CONFIG_H -I . -I . -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/. -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../include -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libcpp/include -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libcody -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libdecnumber -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libdecnumber/bid -I ../libdecnumber -I /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/../libbacktrace -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/10/../../../../include/c++/10 -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/10/../../../../include/c++/10/x86_64-suse-linux -internal-isystem /usr/bin/../lib64/gcc/x86_64-suse-linux/10/../../../../include/c++/10/backward -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/11.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-narrowing -Wwrite-strings -Wno-error=format-diag -Wno-long-long -Wno-variadic-macros -Wno-overlength-strings -fdeprecated-macro -fdebug-compilation-dir /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/objdir/gcc -ferror-limit 19 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=plist-html -analyzer-config silence-checkers=core.NullDereference -faddrsig -o /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/objdir/clang-static-analyzer/2021-01-16-135054-17580-1/report-nQiCs7.plist -x c++ /home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c

/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c

→

1/* AddressSanitizer, a fast memory error detector.
 Copyright (C) 2012-2021 Free Software Foundation, Inc.
 Contributed by Kostya Serebryany <kcc@google.com>

5This file is part of GCC.

7GCC is free software; you can redistribute it and/or modify it under
8the terms of the GNU General Public License as published by the Free
9Software Foundation; either version 3, or (at your option) any later
10version.

12GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13WARRANTY; without even the implied warranty of MERCHANTABILITY or
14FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
15for more details.

17You should have received a copy of the GNU General Public License
18along with GCC; see the file COPYING3.  If not see
19<http://www.gnu.org/licenses/>.  */


22#include "config.h"
23#include "system.h"
24#include "coretypes.h"
25#include "backend.h"
26#include "target.h"
27#include "rtl.h"
28#include "tree.h"
29#include "gimple.h"
30#include "cfghooks.h"
31#include "alloc-pool.h"
32#include "tree-pass.h"
33#include "memmodel.h"
34#include "tm_p.h"
35#include "ssa.h"
36#include "stringpool.h"
37#include "tree-ssanames.h"
38#include "optabs.h"
39#include "emit-rtl.h"
40#include "cgraph.h"
41#include "gimple-pretty-print.h"
42#include "alias.h"
43#include "fold-const.h"
44#include "cfganal.h"
45#include "gimplify.h"
46#include "gimple-iterator.h"
47#include "varasm.h"
48#include "stor-layout.h"
49#include "tree-iterator.h"
50#include "stringpool.h"
51#include "attribs.h"
52#include "asan.h"
53#include "dojump.h"
54#include "explow.h"
55#include "expr.h"
56#include "output.h"
57#include "langhooks.h"
58#include "cfgloop.h"
59#include "gimple-builder.h"
60#include "gimple-fold.h"
61#include "ubsan.h"
62#include "builtins.h"
63#include "fnmatch.h"
64#include "tree-inline.h"
65#include "tree-ssa.h"

67/* AddressSanitizer finds out-of-bounds and use-after-free bugs
 with <2x slowdown on average.

 The tool consists of two parts:
 instrumentation module (this file) and a run-time library.
 The instrumentation module adds a run-time check before every memory insn.
   For a 8- or 16- byte load accessing address X:
     ShadowAddr = (X >> 3) + Offset
     ShadowValue = *(char*)ShadowAddr;  // *(short*) for 16-byte access.
     if (ShadowValue)
__asan_report_load8(X);
   For a load of N bytes (N=1, 2 or 4) from address X:
     ShadowAddr = (X >> 3) + Offset
     ShadowValue = *(char*)ShadowAddr;
     if (ShadowValue)
if ((X & 7) + N - 1 > ShadowValue)
  __asan_report_loadN(X);
 Stores are instrumented similarly, but using __asan_report_storeN functions.
 A call too __asan_init_vN() is inserted to the list of module CTORs.
 N is the version number of the AddressSanitizer API. The changes between the
 API versions are listed in libsanitizer/asan/asan_interface_internal.h.

 The run-time library redefines malloc (so that redzone are inserted around
 the allocated memory) and free (so that reuse of free-ed memory is delayed),
 provides __asan_report* and __asan_init_vN functions.

 Read more:
 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm

 The current implementation supports detection of out-of-bounds and
 use-after-free in the heap, on the stack and for global variables.

 [Protection of stack variables]

 To understand how detection of out-of-bounds and use-after-free works
 for stack variables, lets look at this example on x86_64 where the
 stack grows downward:

   int
   foo ()
   {
     char a[23] = {0};
     int b[2] = {0};

     a[5] = 1;
     b[1] = 2;

     return a[5] + b[1];
   }

 For this function, the stack protected by asan will be organized as
 follows, from the top of the stack to the bottom:

 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']

 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
  the next slot be 32 bytes aligned; this one is called Partial
  Redzone; this 32 bytes alignment is an asan constraint]

 Slot 3/ [24 bytes for variable 'a']

 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']

 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]

 Slot 6/ [8 bytes for variable 'b']

 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
   'LEFT RedZone']

 The 32 bytes of LEFT red zone at the bottom of the stack can be
 decomposed as such:

   1/ The first 8 bytes contain a magical asan number that is always
   0x41B58AB3.

   2/ The following 8 bytes contains a pointer to a string (to be
   parsed at runtime by the runtime asan library), which format is
   the following:

    "<function-name> <space> <num-of-variables-on-the-stack>
    (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
    <length-of-var-in-bytes> ){n} "

where '(...){n}' means the content inside the parenthesis occurs 'n'
times, with 'n' being the number of variables on the stack.

   3/ The following 8 bytes contain the PC of the current function which
   will be used by the run-time library to print an error message.

   4/ The following 8 bytes are reserved for internal use by the run-time.

 The shadow memory for that stack layout is going to look like this:

   - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
     The F1 byte pattern is a magic number called
     ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
     the memory for that shadow byte is part of a the LEFT red zone
     intended to seat at the bottom of the variables on the stack.

   - content of shadow memory 8 bytes for slots 6 and 5:
     0xF4F4F400.  The F4 byte pattern is a magic number
     called ASAN_STACK_MAGIC_PARTIAL.  It flags the fact that the
     memory region for this shadow byte is a PARTIAL red zone
     intended to pad a variable A, so that the slot following
     {A,padding} is 32 bytes aligned.

     Note that the fact that the least significant byte of this
     shadow memory content is 00 means that 8 bytes of its
     corresponding memory (which corresponds to the memory of
     variable 'b') is addressable.

   - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
     The F2 byte pattern is a magic number called
     ASAN_STACK_MAGIC_MIDDLE.  It flags the fact that the memory
     region for this shadow byte is a MIDDLE red zone intended to
     seat between two 32 aligned slots of {variable,padding}.

   - content of shadow memory 8 bytes for slot 3 and 2:
     0xF4000000.  This represents is the concatenation of
     variable 'a' and the partial red zone following it, like what we
     had for variable 'b'.  The least significant 3 bytes being 00
     means that the 3 bytes of variable 'a' are addressable.

   - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
     The F3 byte pattern is a magic number called
     ASAN_STACK_MAGIC_RIGHT.  It flags the fact that the memory
     region for this shadow byte is a RIGHT red zone intended to seat
     at the top of the variables of the stack.

 Note that the real variable layout is done in expand_used_vars in
 cfgexpand.c.  As far as Address Sanitizer is concerned, it lays out
 stack variables as well as the different red zones, emits some
 prologue code to populate the shadow memory as to poison (mark as
 non-accessible) the regions of the red zones and mark the regions of
 stack variables as accessible, and emit some epilogue code to
 un-poison (mark as accessible) the regions of red zones right before
 the function exits.

 [Protection of global variables]

 The basic idea is to insert a red zone between two global variables
 and install a constructor function that calls the asan runtime to do
 the populating of the relevant shadow memory regions at load time.

 So the global variables are laid out as to insert a red zone between
 them. The size of the red zones is so that each variable starts on a
 32 bytes boundary.

 Then a constructor function is installed so that, for each global
 variable, it calls the runtime asan library function
 __asan_register_globals_with an instance of this type:

   struct __asan_global
   {
     // Address of the beginning of the global variable.
     const void *__beg;

     // Initial size of the global variable.
     uptr __size;

     // Size of the global variable + size of the red zone.  This
     //   size is 32 bytes aligned.
     uptr __size_with_redzone;

     // Name of the global variable.
     const void *__name;

     // Name of the module where the global variable is declared.
     const void *__module_name;

     // 1 if it has dynamic initialization, 0 otherwise.
     uptr __has_dynamic_init;

     // A pointer to struct that contains source location, could be NULL.
     __asan_global_source_location *__location;
   }

 A destructor function that calls the runtime asan library function
 _asan_unregister_globals is also installed.  */

248static unsigned HOST_WIDE_INTlong asan_shadow_offset_value;
249static bool asan_shadow_offset_computed;
250static vec<char *> sanitized_sections;
251static tree last_alloca_addr;

253/* Set of variable declarations that are going to be guarded by
 use-after-scope sanitizer.  */

256hash_set<tree> *asan_handled_variables = NULLnullptr;

258hash_set <tree> *asan_used_labels = NULLnullptr;

260/* Global variables for HWASAN stack tagging.  */
261/* hwasan_frame_tag_offset records the offset from the frame base tag that the
 next object should have.  */
263static uint8_t hwasan_frame_tag_offset = 0;
264/* hwasan_frame_base_ptr is a pointer with the same address as
 `virtual_stack_vars_rtx` for the current frame, and with the frame base tag
 stored in it.  N.b. this global RTX does not need to be marked GTY, but is
 done so anyway.  The need is not there since all uses are in just one pass
 (cfgexpand) and there are no calls to ggc_collect between the uses.  We mark
 it GTY(()) anyway to allow the use of the variable later on if needed by
 future features.  */
271static GTY(()) rtx hwasan_frame_base_ptr = NULL_RTX(rtx) 0;
272/* hwasan_frame_base_init_seq is the sequence of RTL insns that will initialize
 the hwasan_frame_base_ptr.  When the hwasan_frame_base_ptr is requested, we
 generate this sequence but do not emit it.  If the sequence was created it
 is emitted once the function body has been expanded.

 This delay is because the frame base pointer may be needed anywhere in the
 function body, or needed by the expand_used_vars function.  Emitting once in
 a known place is simpler than requiring the emission of the instructions to
 be know where it should go depending on the first place the hwasan frame
 base is needed.  */
282static GTY(()) rtx_insn *hwasan_frame_base_init_seq = NULLnullptr;

284/* Structure defining the extent of one object on the stack that HWASAN needs
 to tag in the corresponding shadow stack space.

 The range this object spans on the stack is between `untagged_base +
 nearest_offset` and `untagged_base + farthest_offset`.
 `tagged_base` is an rtx containing the same value as `untagged_base` but
 with a random tag stored in the top byte.  We record both `untagged_base`
 and `tagged_base` so that `hwasan_emit_prologue` can use both without having
 to emit RTL into the instruction stream to re-calculate one from the other.
 (`hwasan_emit_prologue` needs to use both bases since the
 __hwasan_tag_memory call it emits uses an untagged value, and it calculates
 the tag to store in shadow memory based on the tag_offset plus the tag in
 tagged_base).  */
297struct hwasan_stack_var
298{
rtx untagged_base;
rtx tagged_base;
poly_int64 nearest_offset;
poly_int64 farthest_offset;
uint8_t tag_offset;
304};

306/* Variable recording all stack variables that HWASAN needs to tag.
 Does not need to be marked as GTY(()) since every use is in the cfgexpand
 pass and gcc_collect is not called in the middle of that pass.  */
309static vec<hwasan_stack_var> hwasan_tagged_stack_vars;


312/* Sets shadow offset to value in string VAL.  */

314bool
315set_asan_shadow_offset (const char *val)
316{
char *endp;

errno(*__errno_location ()) = 0;
320#ifdef HAVE_LONG_LONG1
asan_shadow_offset_value = strtoull (val, &endp, 0);
322#else
asan_shadow_offset_value = strtoul (val, &endp, 0);
324#endif
if (!(*val != '\0' && *endp == '\0' && errno(*__errno_location ()) == 0))
  return false;

asan_shadow_offset_computed = true;

return true;
331}

333/* Set list of user-defined sections that need to be sanitized.  */

335void
336set_sanitized_sections (const char *sections)
337{
char *pat;
unsigned i;
FOR_EACH_VEC_ELT (sanitized_sections, i, pat)for (i = 0; (sanitized_sections).iterate ((i), &(pat)); ++
(i))
  free (pat);
sanitized_sections.truncate (0);

for (const char *s = sections; *s; )
  {
    const char *end;
    for (end = s; *end && *end != ','; ++end);
    size_t len = end - s;
    sanitized_sections.safe_push (xstrndup (s, len));
    s = *end ? end + 1 : end;
  }
352}

354bool
355asan_mark_p (gimple *stmt, enum asan_mark_flags flag)
356{
return (gimple_call_internal_p (stmt, IFN_ASAN_MARK)
 && tree_to_uhwi (gimple_call_arg (stmt, 0)) == flag);
359}

361bool
362asan_sanitize_stack_p (void)
363{
return (sanitize_flags_p (SANITIZE_ADDRESS) && param_asan_stackglobal_options.x_param_asan_stack);
365}

367bool
368asan_sanitize_allocas_p (void)
369{
return (asan_sanitize_stack_p () && param_asan_protect_allocasglobal_options.x_param_asan_protect_allocas);
371}

373bool
374asan_instrument_reads (void)
375{
return (sanitize_flags_p (SANITIZE_ADDRESS) && param_asan_instrument_readsglobal_options.x_param_asan_instrument_reads);
377}

379bool
380asan_instrument_writes (void)
381{
return (sanitize_flags_p (SANITIZE_ADDRESS) && param_asan_instrument_writesglobal_options.x_param_asan_instrument_writes);
383}

385bool
386asan_memintrin (void)
387{
return (sanitize_flags_p (SANITIZE_ADDRESS) && param_asan_memintringlobal_options.x_param_asan_memintrin);
389}


392/* Checks whether section SEC should be sanitized.  */

394static bool
395section_sanitized_p (const char *sec)
396{
char *pat;
unsigned i;
FOR_EACH_VEC_ELT (sanitized_sections, i, pat)for (i = 0; (sanitized_sections).iterate ((i), &(pat)); ++
(i))
  if (fnmatch (pat, sec, FNM_PERIOD(1 << 2)) == 0)
    return true;
return false;
403}

405/* Returns Asan shadow offset.  */

407static unsigned HOST_WIDE_INTlong
408asan_shadow_offset ()
409{
if (!asan_shadow_offset_computed)
  {
    asan_shadow_offset_computed = true;
    asan_shadow_offset_value = targetm.asan_shadow_offset ();
  }
return asan_shadow_offset_value;
416}

418/* Returns Asan shadow offset has been set.  */
419bool
420asan_shadow_offset_set_p ()
421{
return asan_shadow_offset_computed;
423}

425alias_set_type asan_shadow_set = -1;

427/* Pointer types to 1, 2 or 4 byte integers in shadow memory.  A separate
 alias set is used for all shadow memory accesses.  */
429static GTY(()) tree shadow_ptr_types[3];

431/* Decl for __asan_option_detect_stack_use_after_return.  */
432static GTY(()) tree asan_detect_stack_use_after_return;

434/* Hashtable support for memory references used by gimple
 statements.  */

437/* This type represents a reference to a memory region.  */
438struct asan_mem_ref
439{
/* The expression of the beginning of the memory region.  */
tree start;

/* The size of the access.  */
HOST_WIDE_INTlong access_size;
445};

447object_allocator <asan_mem_ref> asan_mem_ref_pool ("asan_mem_ref");

449/* Initializes an instance of asan_mem_ref.  */

451static void
452asan_mem_ref_init (asan_mem_ref *ref, tree start, HOST_WIDE_INTlong access_size)
453{
ref->start = start;
ref->access_size = access_size;
456}

458/* Allocates memory for an instance of asan_mem_ref into the memory
 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
 START is the address of (or the expression pointing to) the
 beginning of memory reference.  ACCESS_SIZE is the size of the
 access to the referenced memory.  */

464static asan_mem_ref*
465asan_mem_ref_new (tree start, HOST_WIDE_INTlong access_size)
466{
asan_mem_ref *ref = asan_mem_ref_pool.allocate ();

asan_mem_ref_init (ref, start, access_size);
return ref;
471}

473/* This builds and returns a pointer to the end of the memory region
 that starts at START and of length LEN.  */

476tree
477asan_mem_ref_get_end (tree start, tree len)
478{
if (len == NULL_TREE(tree) nullptr || integer_zerop (len))
  return start;

if (!ptrofftype_p (len))
  len = convert_to_ptrofftype (len)convert_to_ptrofftype_loc (((location_t) 0), len);

return fold_build2 (POINTER_PLUS_EXPR, TREE_TYPE (start), start, len)fold_build2_loc (((location_t) 0), POINTER_PLUS_EXPR, ((contains_struct_check
 ((start), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 485, __FUNCTION__))->typed.type), start, len );
486}

488/*  Return a tree expression that represents the end of the referenced
  memory region.  Beware that this function can actually build a new
  tree expression.  */

492tree
493asan_mem_ref_get_end (const asan_mem_ref *ref, tree len)
494{
return asan_mem_ref_get_end (ref->start, len);
496}

498struct asan_mem_ref_hasher : nofree_ptr_hash <asan_mem_ref>
499{
static inline hashval_t hash (const asan_mem_ref *);
static inline bool equal (const asan_mem_ref *, const asan_mem_ref *);
502};

504/* Hash a memory reference.  */

506inline hashval_t
507asan_mem_ref_hasher::hash (const asan_mem_ref *mem_ref)
508{
return iterative_hash_expr (mem_ref->start, 0);
510}

512/* Compare two memory references.  We accept the length of either
 memory references to be NULL_TREE.  */

515inline bool
516asan_mem_ref_hasher::equal (const asan_mem_ref *m1,
	    const asan_mem_ref *m2)
518{
return operand_equal_p (m1->start, m2->start, 0);
520}

522static hash_table<asan_mem_ref_hasher> *asan_mem_ref_ht;

524/* Returns a reference to the hash table containing memory references.
 This function ensures that the hash table is created.  Note that
 this hash table is updated by the function
 update_mem_ref_hash_table.  */

529static hash_table<asan_mem_ref_hasher> *
530get_mem_ref_hash_table ()
531{
if (!asan_mem_ref_ht)
  asan_mem_ref_ht = new hash_table<asan_mem_ref_hasher> (10);

return asan_mem_ref_ht;
536}

538/* Clear all entries from the memory references hash table.  */

540static void
541empty_mem_ref_hash_table ()
542{
if (asan_mem_ref_ht)
  asan_mem_ref_ht->empty ();
545}

547/* Free the memory references hash table.  */

549static void
550free_mem_ref_resources ()
551{
delete asan_mem_ref_ht;
asan_mem_ref_ht = NULLnullptr;

asan_mem_ref_pool.release ();
556}

558/* Return true iff the memory reference REF has been instrumented.  */

560static bool
561has_mem_ref_been_instrumented (tree ref, HOST_WIDE_INTlong access_size)
562{
asan_mem_ref r;
asan_mem_ref_init (&r, ref, access_size);

asan_mem_ref *saved_ref = get_mem_ref_hash_table ()->find (&r);
return saved_ref && saved_ref->access_size >= access_size;
568}

570/* Return true iff the memory reference REF has been instrumented.  */

572static bool
573has_mem_ref_been_instrumented (const asan_mem_ref *ref)
574{
return has_mem_ref_been_instrumented (ref->start, ref->access_size);
576}

578/* Return true iff access to memory region starting at REF and of
 length LEN has been instrumented.  */

581static bool
582has_mem_ref_been_instrumented (const asan_mem_ref *ref, tree len)
583{
HOST_WIDE_INTlong size_in_bytes
  = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;

return size_in_bytes != -1
  && has_mem_ref_been_instrumented (ref->start, size_in_bytes);
589}

591/* Set REF to the memory reference present in a gimple assignment
 ASSIGNMENT.  Return true upon successful completion, false
 otherwise.  */

595static bool
596get_mem_ref_of_assignment (const gassign *assignment,
	   asan_mem_ref *ref,
	   bool *ref_is_store)
599{
gcc_assert (gimple_assign_single_p (assignment))((void)(!(gimple_assign_single_p (assignment)) ? fancy_abort (
"/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 600, __FUNCTION__), 0 : 0));

if (gimple_store_p (assignment)
    && !gimple_clobber_p (assignment))
  {
    ref->start = gimple_assign_lhs (assignment);
    *ref_is_store = true;
  }
else if (gimple_assign_load_p (assignment))
  {
    ref->start = gimple_assign_rhs1 (assignment);
    *ref_is_store = false;
  }
else
  return false;

ref->access_size = int_size_in_bytes (TREE_TYPE (ref->start)((contains_struct_check ((ref->start), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 616, __FUNCTION__))->typed.type));
return true;
618}

620/* Return address of last allocated dynamic alloca.  */

622static tree
623get_last_alloca_addr ()
624{
if (last_alloca_addr)
  return last_alloca_addr;

last_alloca_addr = create_tmp_reg (ptr_type_nodeglobal_trees[TI_PTR_TYPE], "last_alloca_addr");
gassign *g = gimple_build_assign (last_alloca_addr, null_pointer_nodeglobal_trees[TI_NULL_POINTER]);
edge e = single_succ_edge (ENTRY_BLOCK_PTR_FOR_FN (cfun)(((cfun + 0))->cfg->x_entry_block_ptr));
gsi_insert_on_edge_immediate (e, g);
return last_alloca_addr;
633}

635/* Insert __asan_allocas_unpoison (top, bottom) call before
 __builtin_stack_restore (new_sp) call.
 The pseudocode of this routine should look like this:
   top = last_alloca_addr;
   bot = new_sp;
   __asan_allocas_unpoison (top, bot);
   last_alloca_addr = new_sp;
   __builtin_stack_restore (new_sp);
 In general, we can't use new_sp as bot parameter because on some
 architectures SP has non zero offset from dynamic stack area.  Moreover, on
 some architectures this offset (STACK_DYNAMIC_OFFSET) becomes known for each
 particular function only after all callees were expanded to rtl.
 The most noticeable example is PowerPC{,64}, see
 http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html#DYNAM-STACK.
 To overcome the issue we use following trick: pass new_sp as a second
 parameter to __asan_allocas_unpoison and rewrite it during expansion with
 new_sp + (virtual_dynamic_stack_rtx - sp) later in
 expand_asan_emit_allocas_unpoison function.

 HWASAN needs to do very similar, the eventual pseudocode should be:
    __hwasan_tag_memory (virtual_stack_dynamic_rtx,
	   0,
	   new_sp - sp);
    __builtin_stack_restore (new_sp)

 Need to use the same trick to handle STACK_DYNAMIC_OFFSET as described
 above.  */

663static void
664handle_builtin_stack_restore (gcall *call, gimple_stmt_iterator *iter)
665{
if (!iter
    || !(asan_sanitize_allocas_p () || hwasan_sanitize_allocas_p ()))
  return;

tree restored_stack = gimple_call_arg (call, 0);

gimple *g;

if (hwasan_sanitize_allocas_p ())
  {
    enum internal_fn fn = IFN_HWASAN_ALLOCA_UNPOISON;
    /* There is only one piece of information `expand_HWASAN_ALLOCA_UNPOISON`
needs to work.  This is the length of the area that we're
deallocating.  Since the stack pointer is known at expand time, the
position of the new stack pointer after deallocation is enough
information to calculate this length.  */
    g = gimple_build_call_internal (fn, 1, restored_stack);
  }
else
  {
    tree last_alloca = get_last_alloca_addr ();
    tree fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCAS_UNPOISON);
    g = gimple_build_call (fn, 2, last_alloca, restored_stack);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    g = gimple_build_assign (last_alloca, restored_stack);
  }

gsi_insert_before (iter, g, GSI_SAME_STMT);
694}

696/* Deploy and poison redzones around __builtin_alloca call.  To do this, we
 should replace this call with another one with changed parameters and
 replace all its uses with new address, so
     addr = __builtin_alloca (old_size, align);
 is replaced by
     left_redzone_size = max (align, ASAN_RED_ZONE_SIZE);
 Following two statements are optimized out if we know that
 old_size & (ASAN_RED_ZONE_SIZE - 1) == 0, i.e. alloca doesn't need partial
 redzone.
     misalign = old_size & (ASAN_RED_ZONE_SIZE - 1);
     partial_redzone_size = ASAN_RED_ZONE_SIZE - misalign;
     right_redzone_size = ASAN_RED_ZONE_SIZE;
     additional_size = left_redzone_size + partial_redzone_size +
                       right_redzone_size;
     new_size = old_size + additional_size;
     new_alloca = __builtin_alloca (new_size, max (align, 32))
     __asan_alloca_poison (new_alloca, old_size)
     addr = new_alloca + max (align, ASAN_RED_ZONE_SIZE);
     last_alloca_addr = new_alloca;
 ADDITIONAL_SIZE is added to make new memory allocation contain not only
 requested memory, but also left, partial and right redzones as well as some
 additional space, required by alignment.  */

719static void
720handle_builtin_alloca (gcall *call, gimple_stmt_iterator *iter)
721{
if (!iter
    || !(asan_sanitize_allocas_p () || hwasan_sanitize_allocas_p ()))
  return;

gassign *g;
gcall *gg;
tree callee = gimple_call_fndecl (call);
tree old_size = gimple_call_arg (call, 0);
tree ptr_type = gimple_call_lhs (call) ? TREE_TYPE (gimple_call_lhs (call))((contains_struct_check ((gimple_call_lhs (call)), (TS_TYPED)
, "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 730, __FUNCTION__))->typed.type)
			 : ptr_type_nodeglobal_trees[TI_PTR_TYPE];
tree partial_size = NULL_TREE(tree) nullptr;
unsigned int align
  = DECL_FUNCTION_CODE (callee) == BUILT_IN_ALLOCA
    ? 0 : tree_to_uhwi (gimple_call_arg (call, 1));

if (hwasan_sanitize_allocas_p ())
  {
    gimple_seq stmts = NULLnullptr;
    location_t loc = gimple_location (gsi_stmt (*iter));
    /*
HWASAN needs a different expansion.

addr = __builtin_alloca (size, align);

should be replaced by

new_size = size rounded up to HWASAN_TAG_GRANULE_SIZE byte alignment;
untagged_addr = __builtin_alloca (new_size, align);
tag = __hwasan_choose_alloca_tag ();
addr = ifn_HWASAN_SET_TAG (untagged_addr, tag);
__hwasan_tag_memory (untagged_addr, tag, new_size);
*/
    /* Ensure alignment at least HWASAN_TAG_GRANULE_SIZE bytes so we start on
a tag granule.  */
    align = align > HWASAN_TAG_GRANULE_SIZEtargetm.memtag.granule_size () ? align : HWASAN_TAG_GRANULE_SIZEtargetm.memtag.granule_size ();

    tree old_size = gimple_call_arg (call, 0);
    tree new_size = gimple_build_round_up (&stmts, loc, size_type_nodeglobal_trees[TI_SIZE_TYPE],
			     old_size,
			     HWASAN_TAG_GRANULE_SIZEtargetm.memtag.granule_size ());

    /* Make the alloca call */
    tree untagged_addr
= gimple_build (&stmts, loc,
	as_combined_fn (BUILT_IN_ALLOCA_WITH_ALIGN), ptr_type,
	new_size, build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE], align));

    /* Choose the tag.
Here we use an internal function so we can choose the tag at expand
time.  We need the decision to be made after stack variables have been
assigned their tag (i.e. once the hwasan_frame_tag_offset variable has
been set to one after the last stack variables tag).  */
    tree tag = gimple_build (&stmts, loc, CFN_HWASAN_CHOOSE_TAG,
	       unsigned_char_type_nodeinteger_types[itk_unsigned_char]);

    /* Add tag to pointer.  */
    tree addr
= gimple_build (&stmts, loc, CFN_HWASAN_SET_TAG, ptr_type,
	untagged_addr, tag);

    /* Tag shadow memory.
NOTE: require using `untagged_addr` here for libhwasan API.  */
    gimple_build (&stmts, loc, as_combined_fn (BUILT_IN_HWASAN_TAG_MEM),
    void_type_nodeglobal_trees[TI_VOID_TYPE], untagged_addr, tag, new_size);

    /* Insert the built up code sequence into the original instruction stream
the iterator points to.  */
    gsi_insert_seq_before (iter, stmts, GSI_SAME_STMT);

    /* Finally, replace old alloca ptr with NEW_ALLOCA.  */
    replace_call_with_value (iter, addr);
    return;
  }

tree last_alloca = get_last_alloca_addr ();
const HOST_WIDE_INTlong redzone_mask = ASAN_RED_ZONE_SIZE32 - 1;

/* If ALIGN > ASAN_RED_ZONE_SIZE, we embed left redzone into first ALIGN
   bytes of allocated space.  Otherwise, align alloca to ASAN_RED_ZONE_SIZE
   manually.  */
align = MAX (align, ASAN_RED_ZONE_SIZE * BITS_PER_UNIT)((align) > (32 * (8)) ? (align) : (32 * (8)));

tree alloca_rz_mask = build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE], redzone_mask);
tree redzone_size = build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE], ASAN_RED_ZONE_SIZE32);

/* Extract lower bits from old_size.  */
wide_int size_nonzero_bits = get_nonzero_bits (old_size);
wide_int rz_mask
  = wi::uhwi (redzone_mask, wi::get_precision (size_nonzero_bits));
wide_int old_size_lower_bits = wi::bit_and (size_nonzero_bits, rz_mask);

/* If alloca size is aligned to ASAN_RED_ZONE_SIZE, we don't need partial
   redzone.  Otherwise, compute its size here.  */
if (wi::ne_p (old_size_lower_bits, 0))
  {
    /* misalign = size & (ASAN_RED_ZONE_SIZE - 1)
       partial_size = ASAN_RED_ZONE_SIZE - misalign.  */
    g = gimple_build_assign (make_ssa_name (size_type_nodeglobal_trees[TI_SIZE_TYPE], NULLnullptr),
	       BIT_AND_EXPR, old_size, alloca_rz_mask);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    tree misalign = gimple_assign_lhs (g);
    g = gimple_build_assign (make_ssa_name (size_type_nodeglobal_trees[TI_SIZE_TYPE], NULLnullptr), MINUS_EXPR,
	       redzone_size, misalign);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    partial_size = gimple_assign_lhs (g);
  }

/* additional_size = align + ASAN_RED_ZONE_SIZE.  */
tree additional_size = build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE], align / BITS_PER_UNIT(8)
					+ ASAN_RED_ZONE_SIZE32);
/* If alloca has partial redzone, include it to additional_size too.  */
if (partial_size)
  {
    /* additional_size += partial_size.  */
    g = gimple_build_assign (make_ssa_name (size_type_nodeglobal_trees[TI_SIZE_TYPE]), PLUS_EXPR,
	       partial_size, additional_size);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    additional_size = gimple_assign_lhs (g);
  }

/* new_size = old_size + additional_size.  */
g = gimple_build_assign (make_ssa_name (size_type_nodeglobal_trees[TI_SIZE_TYPE]), PLUS_EXPR, old_size,
	   additional_size);
gsi_insert_before (iter, g, GSI_SAME_STMT);
tree new_size = gimple_assign_lhs (g);

/* Build new __builtin_alloca call:
     new_alloca_with_rz = __builtin_alloca (new_size, align).  */
tree fn = builtin_decl_implicit (BUILT_IN_ALLOCA_WITH_ALIGN);
gg = gimple_build_call (fn, 2, new_size,
	  build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE], align));
tree new_alloca_with_rz = make_ssa_name (ptr_type, gg);
gimple_call_set_lhs (gg, new_alloca_with_rz);
gsi_insert_before (iter, gg, GSI_SAME_STMT);

/* new_alloca = new_alloca_with_rz + align.  */
g = gimple_build_assign (make_ssa_name (ptr_type), POINTER_PLUS_EXPR,
	   new_alloca_with_rz,
	   build_int_cst (size_type_nodeglobal_trees[TI_SIZE_TYPE],
			  align / BITS_PER_UNIT(8)));
gsi_insert_before (iter, g, GSI_SAME_STMT);
tree new_alloca = gimple_assign_lhs (g);

/* Poison newly created alloca redzones:
    __asan_alloca_poison (new_alloca, old_size).  */
fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCA_POISON);
gg = gimple_build_call (fn, 2, new_alloca, old_size);
gsi_insert_before (iter, gg, GSI_SAME_STMT);

/* Save new_alloca_with_rz value into last_alloca to use it during
   allocas unpoisoning.  */
g = gimple_build_assign (last_alloca, new_alloca_with_rz);
gsi_insert_before (iter, g, GSI_SAME_STMT);

/* Finally, replace old alloca ptr with NEW_ALLOCA.  */
replace_call_with_value (iter, new_alloca);
878}

880/* Return the memory references contained in a gimple statement
 representing a builtin call that has to do with memory access.  */

883static bool
884get_mem_refs_of_builtin_call (gcall *call,
	      asan_mem_ref *src0,
	      tree *src0_len,
	      bool *src0_is_store,
	      asan_mem_ref *src1,
	      tree *src1_len,
	      bool *src1_is_store,
	      asan_mem_ref *dst,
	      tree *dst_len,
	      bool *dst_is_store,
	      bool *dest_is_deref,
	      bool *intercepted_p,
	      gimple_stmt_iterator *iter = NULLnullptr)
897{
gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL))((void)(!(gimple_call_builtin_p (call, BUILT_IN_NORMAL)) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 898, __FUNCTION__), 0 : 0));

tree callee = gimple_call_fndecl (call);
tree source0 = NULL_TREE(tree) nullptr, source1 = NULL_TREE(tree) nullptr,
  dest = NULL_TREE(tree) nullptr, len = NULL_TREE(tree) nullptr;
bool is_store = true, got_reference_p = false;
HOST_WIDE_INTlong access_size = 1;

*intercepted_p = asan_intercepted_p ((DECL_FUNCTION_CODE (callee)));

switch (DECL_FUNCTION_CODE (callee))
  {
    /* (s, s, n) style memops.  */
  case BUILT_IN_BCMP:
  case BUILT_IN_MEMCMP:
    source0 = gimple_call_arg (call, 0);
    source1 = gimple_call_arg (call, 1);
    len = gimple_call_arg (call, 2);
    break;

    /* (src, dest, n) style memops.  */
  case BUILT_IN_BCOPY:
    source0 = gimple_call_arg (call, 0);
    dest = gimple_call_arg (call, 1);
    len = gimple_call_arg (call, 2);
    break;

    /* (dest, src, n) style memops.  */
  case BUILT_IN_MEMCPY:
  case BUILT_IN_MEMCPY_CHK:
  case BUILT_IN_MEMMOVE:
  case BUILT_IN_MEMMOVE_CHK:
  case BUILT_IN_MEMPCPY:
  case BUILT_IN_MEMPCPY_CHK:
    dest = gimple_call_arg (call, 0);
    source0 = gimple_call_arg (call, 1);
    len = gimple_call_arg (call, 2);
    break;

    /* (dest, n) style memops.  */
  case BUILT_IN_BZERO:
    dest = gimple_call_arg (call, 0);
    len = gimple_call_arg (call, 1);
    break;

    /* (dest, x, n) style memops*/
  case BUILT_IN_MEMSET:
  case BUILT_IN_MEMSET_CHK:
    dest = gimple_call_arg (call, 0);
    len = gimple_call_arg (call, 2);
    break;

  case BUILT_IN_STRLEN:
    /* Special case strlen here since its length is taken from its return
value.

The approach taken by the sanitizers is to check a memory access
before it's taken.  For ASAN strlen is intercepted by libasan, so no
check is inserted by the compiler.

This function still returns `true` and provides a length to the rest
of the ASAN pass in order to record what areas have been checked,
avoiding superfluous checks later on.

HWASAN does not intercept any of these internal functions.
This means that checks for memory accesses must be inserted by the
compiler.
strlen is a special case, because we can tell the length from the
return of the function, but that is not known until after the function
has returned.

Hence we can't check the memory access before it happens.
We could check the memory access after it has already happened, but
for now we choose to just ignore `strlen` calls.
This decision was simply made because that means the special case is
limited to this one case of this one function.  */
    if (hwasan_sanitize_p ())
return false;
    source0 = gimple_call_arg (call, 0);
    len = gimple_call_lhs (call);
    break;

  case BUILT_IN_STACK_RESTORE:
    handle_builtin_stack_restore (call, iter);
    break;

  CASE_BUILT_IN_ALLOCAcase BUILT_IN_ALLOCA: case BUILT_IN_ALLOCA_WITH_ALIGN: case BUILT_IN_ALLOCA_WITH_ALIGN_AND_MAX:
    handle_builtin_alloca (call, iter);
    break;
  /* And now the __atomic* and __sync builtins.
     These are handled differently from the classical memory
     access builtins above.  */

  case BUILT_IN_ATOMIC_LOAD_1:
    is_store = false;
    /* FALLTHRU */
  case BUILT_IN_SYNC_FETCH_AND_ADD_1:
  case BUILT_IN_SYNC_FETCH_AND_SUB_1:
  case BUILT_IN_SYNC_FETCH_AND_OR_1:
  case BUILT_IN_SYNC_FETCH_AND_AND_1:
  case BUILT_IN_SYNC_FETCH_AND_XOR_1:
  case BUILT_IN_SYNC_FETCH_AND_NAND_1:
  case BUILT_IN_SYNC_ADD_AND_FETCH_1:
  case BUILT_IN_SYNC_SUB_AND_FETCH_1:
  case BUILT_IN_SYNC_OR_AND_FETCH_1:
  case BUILT_IN_SYNC_AND_AND_FETCH_1:
  case BUILT_IN_SYNC_XOR_AND_FETCH_1:
  case BUILT_IN_SYNC_NAND_AND_FETCH_1:
  case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1:
  case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1:
  case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1:
  case BUILT_IN_SYNC_LOCK_RELEASE_1:
  case BUILT_IN_ATOMIC_EXCHANGE_1:
  case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1:
  case BUILT_IN_ATOMIC_STORE_1:
  case BUILT_IN_ATOMIC_ADD_FETCH_1:
  case BUILT_IN_ATOMIC_SUB_FETCH_1:
  case BUILT_IN_ATOMIC_AND_FETCH_1:
  case BUILT_IN_ATOMIC_NAND_FETCH_1:
  case BUILT_IN_ATOMIC_XOR_FETCH_1:
  case BUILT_IN_ATOMIC_OR_FETCH_1:
  case BUILT_IN_ATOMIC_FETCH_ADD_1:
  case BUILT_IN_ATOMIC_FETCH_SUB_1:
  case BUILT_IN_ATOMIC_FETCH_AND_1:
  case BUILT_IN_ATOMIC_FETCH_NAND_1:
  case BUILT_IN_ATOMIC_FETCH_XOR_1:
  case BUILT_IN_ATOMIC_FETCH_OR_1:
    access_size = 1;
    goto do_atomic;

  case BUILT_IN_ATOMIC_LOAD_2:
    is_store = false;
    /* FALLTHRU */
  case BUILT_IN_SYNC_FETCH_AND_ADD_2:
  case BUILT_IN_SYNC_FETCH_AND_SUB_2:
  case BUILT_IN_SYNC_FETCH_AND_OR_2:
  case BUILT_IN_SYNC_FETCH_AND_AND_2:
  case BUILT_IN_SYNC_FETCH_AND_XOR_2:
  case BUILT_IN_SYNC_FETCH_AND_NAND_2:
  case BUILT_IN_SYNC_ADD_AND_FETCH_2:
  case BUILT_IN_SYNC_SUB_AND_FETCH_2:
  case BUILT_IN_SYNC_OR_AND_FETCH_2:
  case BUILT_IN_SYNC_AND_AND_FETCH_2:
  case BUILT_IN_SYNC_XOR_AND_FETCH_2:
  case BUILT_IN_SYNC_NAND_AND_FETCH_2:
  case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2:
  case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2:
  case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2:
  case BUILT_IN_SYNC_LOCK_RELEASE_2:
  case BUILT_IN_ATOMIC_EXCHANGE_2:
  case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2:
  case BUILT_IN_ATOMIC_STORE_2:
  case BUILT_IN_ATOMIC_ADD_FETCH_2:
  case BUILT_IN_ATOMIC_SUB_FETCH_2:
  case BUILT_IN_ATOMIC_AND_FETCH_2:
  case BUILT_IN_ATOMIC_NAND_FETCH_2:
  case BUILT_IN_ATOMIC_XOR_FETCH_2:
  case BUILT_IN_ATOMIC_OR_FETCH_2:
  case BUILT_IN_ATOMIC_FETCH_ADD_2:
  case BUILT_IN_ATOMIC_FETCH_SUB_2:
  case BUILT_IN_ATOMIC_FETCH_AND_2:
  case BUILT_IN_ATOMIC_FETCH_NAND_2:
  case BUILT_IN_ATOMIC_FETCH_XOR_2:
  case BUILT_IN_ATOMIC_FETCH_OR_2:
    access_size = 2;
    goto do_atomic;

  case BUILT_IN_ATOMIC_LOAD_4:
    is_store = false;
    /* FALLTHRU */
  case BUILT_IN_SYNC_FETCH_AND_ADD_4:
  case BUILT_IN_SYNC_FETCH_AND_SUB_4:
  case BUILT_IN_SYNC_FETCH_AND_OR_4:
  case BUILT_IN_SYNC_FETCH_AND_AND_4:
  case BUILT_IN_SYNC_FETCH_AND_XOR_4:
  case BUILT_IN_SYNC_FETCH_AND_NAND_4:
  case BUILT_IN_SYNC_ADD_AND_FETCH_4:
  case BUILT_IN_SYNC_SUB_AND_FETCH_4:
  case BUILT_IN_SYNC_OR_AND_FETCH_4:
  case BUILT_IN_SYNC_AND_AND_FETCH_4:
  case BUILT_IN_SYNC_XOR_AND_FETCH_4:
  case BUILT_IN_SYNC_NAND_AND_FETCH_4:
  case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4:
  case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4:
  case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4:
  case BUILT_IN_SYNC_LOCK_RELEASE_4:
  case BUILT_IN_ATOMIC_EXCHANGE_4:
  case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4:
  case BUILT_IN_ATOMIC_STORE_4:
  case BUILT_IN_ATOMIC_ADD_FETCH_4:
  case BUILT_IN_ATOMIC_SUB_FETCH_4:
  case BUILT_IN_ATOMIC_AND_FETCH_4:
  case BUILT_IN_ATOMIC_NAND_FETCH_4:
  case BUILT_IN_ATOMIC_XOR_FETCH_4:
  case BUILT_IN_ATOMIC_OR_FETCH_4:
  case BUILT_IN_ATOMIC_FETCH_ADD_4:
  case BUILT_IN_ATOMIC_FETCH_SUB_4:
  case BUILT_IN_ATOMIC_FETCH_AND_4:
  case BUILT_IN_ATOMIC_FETCH_NAND_4:
  case BUILT_IN_ATOMIC_FETCH_XOR_4:
  case BUILT_IN_ATOMIC_FETCH_OR_4:
    access_size = 4;
    goto do_atomic;

  case BUILT_IN_ATOMIC_LOAD_8:
    is_store = false;
    /* FALLTHRU */
  case BUILT_IN_SYNC_FETCH_AND_ADD_8:
  case BUILT_IN_SYNC_FETCH_AND_SUB_8:
  case BUILT_IN_SYNC_FETCH_AND_OR_8:
  case BUILT_IN_SYNC_FETCH_AND_AND_8:
  case BUILT_IN_SYNC_FETCH_AND_XOR_8:
  case BUILT_IN_SYNC_FETCH_AND_NAND_8:
  case BUILT_IN_SYNC_ADD_AND_FETCH_8:
  case BUILT_IN_SYNC_SUB_AND_FETCH_8:
  case BUILT_IN_SYNC_OR_AND_FETCH_8:
  case BUILT_IN_SYNC_AND_AND_FETCH_8:
  case BUILT_IN_SYNC_XOR_AND_FETCH_8:
  case BUILT_IN_SYNC_NAND_AND_FETCH_8:
  case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8:
  case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8:
  case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8:
  case BUILT_IN_SYNC_LOCK_RELEASE_8:
  case BUILT_IN_ATOMIC_EXCHANGE_8:
  case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8:
  case BUILT_IN_ATOMIC_STORE_8:
  case BUILT_IN_ATOMIC_ADD_FETCH_8:
  case BUILT_IN_ATOMIC_SUB_FETCH_8:
  case BUILT_IN_ATOMIC_AND_FETCH_8:
  case BUILT_IN_ATOMIC_NAND_FETCH_8:
  case BUILT_IN_ATOMIC_XOR_FETCH_8:
  case BUILT_IN_ATOMIC_OR_FETCH_8:
  case BUILT_IN_ATOMIC_FETCH_ADD_8:
  case BUILT_IN_ATOMIC_FETCH_SUB_8:
  case BUILT_IN_ATOMIC_FETCH_AND_8:
  case BUILT_IN_ATOMIC_FETCH_NAND_8:
  case BUILT_IN_ATOMIC_FETCH_XOR_8:
  case BUILT_IN_ATOMIC_FETCH_OR_8:
    access_size = 8;
    goto do_atomic;

  case BUILT_IN_ATOMIC_LOAD_16:
    is_store = false;
    /* FALLTHRU */
  case BUILT_IN_SYNC_FETCH_AND_ADD_16:
  case BUILT_IN_SYNC_FETCH_AND_SUB_16:
  case BUILT_IN_SYNC_FETCH_AND_OR_16:
  case BUILT_IN_SYNC_FETCH_AND_AND_16:
  case BUILT_IN_SYNC_FETCH_AND_XOR_16:
  case BUILT_IN_SYNC_FETCH_AND_NAND_16:
  case BUILT_IN_SYNC_ADD_AND_FETCH_16:
  case BUILT_IN_SYNC_SUB_AND_FETCH_16:
  case BUILT_IN_SYNC_OR_AND_FETCH_16:
  case BUILT_IN_SYNC_AND_AND_FETCH_16:
  case BUILT_IN_SYNC_XOR_AND_FETCH_16:
  case BUILT_IN_SYNC_NAND_AND_FETCH_16:
  case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16:
  case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16:
  case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16:
  case BUILT_IN_SYNC_LOCK_RELEASE_16:
  case BUILT_IN_ATOMIC_EXCHANGE_16:
  case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16:
  case BUILT_IN_ATOMIC_STORE_16:
  case BUILT_IN_ATOMIC_ADD_FETCH_16:
  case BUILT_IN_ATOMIC_SUB_FETCH_16:
  case BUILT_IN_ATOMIC_AND_FETCH_16:
  case BUILT_IN_ATOMIC_NAND_FETCH_16:
  case BUILT_IN_ATOMIC_XOR_FETCH_16:
  case BUILT_IN_ATOMIC_OR_FETCH_16:
  case BUILT_IN_ATOMIC_FETCH_ADD_16:
  case BUILT_IN_ATOMIC_FETCH_SUB_16:
  case BUILT_IN_ATOMIC_FETCH_AND_16:
  case BUILT_IN_ATOMIC_FETCH_NAND_16:
  case BUILT_IN_ATOMIC_FETCH_XOR_16:
  case BUILT_IN_ATOMIC_FETCH_OR_16:
    access_size = 16;
    /* FALLTHRU */
  do_atomic:
    {
dest = gimple_call_arg (call, 0);
/* DEST represents the address of a memory location.
  instrument_derefs wants the memory location, so lets
  dereference the address DEST before handing it to
  instrument_derefs.  */
tree type = build_nonstandard_integer_type (access_size
				    * BITS_PER_UNIT(8), 1);
dest = build2 (MEM_REF, type, dest,
       build_int_cst (build_pointer_type (char_type_nodeinteger_types[itk_char]), 0));
break;
    }

  default:
    /* The other builtins memory access are not instrumented in this
function because they either don't have any length parameter,
or their length parameter is just a limit.  */
    break;
  }

if (len != NULL_TREE(tree) nullptr)
  {
    if (source0 != NULL_TREE(tree) nullptr)
{
 src0->start = source0;
 src0->access_size = access_size;
 *src0_len = len;
 *src0_is_store = false;
}

    if (source1 != NULL_TREE(tree) nullptr)
{
 src1->start = source1;
 src1->access_size = access_size;
 *src1_len = len;
 *src1_is_store = false;
}

    if (dest != NULL_TREE(tree) nullptr)
{
 dst->start = dest;
 dst->access_size = access_size;
 *dst_len = len;
 *dst_is_store = true;
}

    got_reference_p = true;
  }
else if (dest)
  {
    dst->start = dest;
    dst->access_size = access_size;
    *dst_len = NULL_TREE(tree) nullptr;
    *dst_is_store = is_store;
    *dest_is_deref = true;
    got_reference_p = true;
  }

return got_reference_p;
1235}

1237/* Return true iff a given gimple statement has been instrumented.
 Note that the statement is "defined" by the memory references it
 contains.  */

1241static bool
1242has_stmt_been_instrumented_p (gimple *stmt)
1243{
if (gimple_assign_single_p (stmt))
  {
    bool r_is_store;
    asan_mem_ref r;
    asan_mem_ref_init (&r, NULLnullptr, 1);

    if (get_mem_ref_of_assignment (as_a <gassign *> (stmt), &r,
		     &r_is_store))
return has_mem_ref_been_instrumented (&r);
  }
else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
  {
    asan_mem_ref src0, src1, dest;
    asan_mem_ref_init (&src0, NULLnullptr, 1);
    asan_mem_ref_init (&src1, NULLnullptr, 1);
    asan_mem_ref_init (&dest, NULLnullptr, 1);

    tree src0_len = NULL_TREE(tree) nullptr, src1_len = NULL_TREE(tree) nullptr, dest_len = NULL_TREE(tree) nullptr;
    bool src0_is_store = false, src1_is_store = false,
dest_is_store = false, dest_is_deref = false, intercepted_p = true;
    if (get_mem_refs_of_builtin_call (as_a <gcall *> (stmt),
			&src0, &src0_len, &src0_is_store,
			&src1, &src1_len, &src1_is_store,
			&dest, &dest_len, &dest_is_store,
			&dest_is_deref, &intercepted_p))
{
 if (src0.start != NULL_TREE(tree) nullptr
     && !has_mem_ref_been_instrumented (&src0, src0_len))
   return false;

 if (src1.start != NULL_TREE(tree) nullptr
     && !has_mem_ref_been_instrumented (&src1, src1_len))
   return false;

 if (dest.start != NULL_TREE(tree) nullptr
     && !has_mem_ref_been_instrumented (&dest, dest_len))
   return false;

 return true;
}
  }
else if (is_gimple_call (stmt) && gimple_store_p (stmt))
  {
    asan_mem_ref r;
    asan_mem_ref_init (&r, NULLnullptr, 1);

    r.start = gimple_call_lhs (stmt);
    r.access_size = int_size_in_bytes (TREE_TYPE (r.start)((contains_struct_check ((r.start), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1291, __FUNCTION__))->typed.type));
    return has_mem_ref_been_instrumented (&r);
  }

return false;
1296}

1298/*  Insert a memory reference into the hash table.  */

1300static void
1301update_mem_ref_hash_table (tree ref, HOST_WIDE_INTlong access_size)
1302{
hash_table<asan_mem_ref_hasher> *ht = get_mem_ref_hash_table ();

asan_mem_ref r;
asan_mem_ref_init (&r, ref, access_size);

asan_mem_ref **slot = ht->find_slot (&r, INSERT);
if (*slot == NULLnullptr || (*slot)->access_size < access_size)
  *slot = asan_mem_ref_new (ref, access_size);
1311}

1313/* Initialize shadow_ptr_types array.  */

1315static void
1316asan_init_shadow_ptr_types (void)
1317{
asan_shadow_set = new_alias_set ();
tree types[3] = { signed_char_type_nodeinteger_types[itk_signed_char], short_integer_type_nodeinteger_types[itk_short],
    integer_type_nodeinteger_types[itk_int] };

for (unsigned i = 0; i < 3; i++)
  {
    shadow_ptr_types[i] = build_distinct_type_copy (types[i]);
    TYPE_ALIAS_SET (shadow_ptr_types[i])((tree_class_check ((shadow_ptr_types[i]), (tcc_type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1325, __FUNCTION__))->type_common.alias_set) = asan_shadow_set;
    shadow_ptr_types[i] = build_pointer_type (shadow_ptr_types[i]);
  }

initialize_sanitizer_builtins ();
1330}

1332/* Create ADDR_EXPR of STRING_CST with the PP pretty printer text.  */

1334static tree
1335asan_pp_string (pretty_printer *pp)
1336{
const char *buf = pp_formatted_text (pp);
size_t len = strlen (buf);
tree ret = build_string (len + 1, buf);
TREE_TYPE (ret)((contains_struct_check ((ret), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1340, __FUNCTION__))->typed.type)
  = build_array_type (TREE_TYPE (shadow_ptr_types[0])((contains_struct_check ((shadow_ptr_types[0]), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1341, __FUNCTION__))->typed.type),
	build_index_type (size_int (len)size_int_kind (len, stk_sizetype)));
TREE_READONLY (ret)((non_type_check ((ret), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1343, __FUNCTION__))->base.readonly_flag) = 1;
TREE_STATIC (ret)((ret)->base.static_flag) = 1;
return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
1346}

1348/* Clear shadow memory at SHADOW_MEM, LEN bytes.  Can't call a library call here
 though.  */

1351static void
1352asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INTlong len)
1353{
rtx_insn *insn, *insns, *jump;
rtx_code_label *top_label;
rtx end, addr, tmp;

gcc_assert ((len & 3) == 0)((void)(!((len & 3) == 0) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1358, __FUNCTION__), 0 : 0));
start_sequence ();
clear_storage (shadow_mem, GEN_INT (len)gen_rtx_CONST_INT (((void) 0, E_VOIDmode), (len)), BLOCK_OP_NORMAL);
insns = get_insns ();
end_sequence ();
for (insn = insns; insn; insn = NEXT_INSN (insn))
  if (CALL_P (insn)(((enum rtx_code) (insn)->code) == CALL_INSN))
    break;
if (insn == NULL_RTX(rtx) 0)
  {
    emit_insn (insns);
    return;
  }

top_label = gen_label_rtx ();
addr = copy_to_mode_reg (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), XEXP (shadow_mem, 0)(((shadow_mem)->u.fld[0]).rt_rtx));
shadow_mem = adjust_automodify_address (shadow_mem, SImode, addr, 0)adjust_automodify_address_1 (shadow_mem, (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)), addr, 0, 1);
end = force_reg (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), plus_constant (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), addr, len));
emit_label (top_label);

emit_move_insn (shadow_mem, const0_rtx(const_int_rtx[64]));
tmp = expand_simple_binop (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), PLUS, addr, gen_int_mode (4, Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)))), addr,
	     true, OPTAB_LIB_WIDEN);
if (tmp != addr)
  emit_move_insn (addr, tmp);
emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX(rtx) 0, Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), true, top_label);
jump = get_last_insn ();
gcc_assert (JUMP_P (jump))((void)(!((((enum rtx_code) (jump)->code) == JUMP_INSN)) ?
 fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1385, __FUNCTION__), 0 : 0));
add_reg_br_prob_note (jump,
	profile_probability::guessed_always ()
	   .apply_scale (80, 100));
1389}

1391void
1392asan_function_start (void)
1393{
section *fnsec = function_section (current_function_decl);
switch_to_section (fnsec);
ASM_OUTPUT_DEBUG_LABEL (asm_out_file, "LASANPC",(*targetm.asm_out.internal_label) (asm_out_file, "LASANPC", (
(cfun + 0)->funcdef_no))
	 current_function_funcdef_no)(*targetm.asm_out.internal_label) (asm_out_file, "LASANPC", (
(cfun + 0)->funcdef_no));
1398}

1400/* Return number of shadow bytes that are occupied by a local variable
 of SIZE bytes.  */

1403static unsigned HOST_WIDE_INTlong
1404shadow_mem_size (unsigned HOST_WIDE_INTlong size)
1405{
/* It must be possible to align stack variables to granularity
   of shadow memory.  */
gcc_assert (BITS_PER_UNIT((void)(!((8) * (1UL << 3) <= (((unsigned int) 1 <<
 28) * 8)) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1409, __FUNCTION__), 0 : 0))
     * ASAN_SHADOW_GRANULARITY <= MAX_SUPPORTED_STACK_ALIGNMENT)((void)(!((8) * (1UL << 3) <= (((unsigned int) 1 <<
 28) * 8)) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1409, __FUNCTION__), 0 : 0));

return ROUND_UP (size, ASAN_SHADOW_GRANULARITY)(((size) + ((1UL << 3)) - 1) & ~(((1UL << 3))
 - 1)) / ASAN_SHADOW_GRANULARITY(1UL << 3);
1412}

1414/* Always emit 4 bytes at a time.  */
1415#define RZ_BUFFER_SIZE4 4

1417/* ASAN redzone buffer container that handles emission of shadow bytes.  */
1418class asan_redzone_buffer
1419{
1420public:
/* Constructor.  */
asan_redzone_buffer (rtx shadow_mem, HOST_WIDE_INTlong prev_offset):
  m_shadow_mem (shadow_mem), m_prev_offset (prev_offset),
  m_original_offset (prev_offset), m_shadow_bytes (RZ_BUFFER_SIZE4)
{}

/* Emit VALUE shadow byte at a given OFFSET.  */
void emit_redzone_byte (HOST_WIDE_INTlong offset, unsigned char value);

/* Emit RTX emission of the content of the buffer.  */
void flush_redzone_payload (void);

1433private:
/* Flush if the content of the buffer is full
   (equal to RZ_BUFFER_SIZE).  */
void flush_if_full (void);

/* Memory where we last emitted a redzone payload.  */
rtx m_shadow_mem;

/* Relative offset where we last emitted a redzone payload.  */
HOST_WIDE_INTlong m_prev_offset;

/* Relative original offset.  Used for checking only.  */
HOST_WIDE_INTlong m_original_offset;

1447public:
/* Buffer with redzone payload.  */
auto_vec<unsigned char> m_shadow_bytes;
1450};

1452/* Emit VALUE shadow byte at a given OFFSET.  */

1454void
1455asan_redzone_buffer::emit_redzone_byte (HOST_WIDE_INTlong offset,
			unsigned char value)
1457{
gcc_assert ((offset & (ASAN_SHADOW_GRANULARITY - 1)) == 0)((void)(!((offset & ((1UL << 3) - 1)) == 0) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1458, __FUNCTION__), 0 : 0));
gcc_assert (offset >= m_prev_offset)((void)(!(offset >= m_prev_offset) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1459, __FUNCTION__), 0 : 0));

HOST_WIDE_INTlong off
  = m_prev_offset + ASAN_SHADOW_GRANULARITY(1UL << 3) * m_shadow_bytes.length ();
if (off == offset)
  {
    /* Consecutive shadow memory byte.  */
    m_shadow_bytes.safe_push (value);
    flush_if_full ();
  }
else
  {
    if (!m_shadow_bytes.is_empty ())
flush_redzone_payload ();

    /* Maybe start earlier in order to use aligned store.  */
    HOST_WIDE_INTlong align = (offset - m_prev_offset) % ASAN_RED_ZONE_SIZE32;
    if (align)
{
 offset -= align;
 for (unsigned i = 0; i < align / BITS_PER_UNIT(8); i++)
   m_shadow_bytes.safe_push (0);
}

    /* Adjust m_prev_offset and m_shadow_mem.  */
    HOST_WIDE_INTlong diff = offset - m_prev_offset;
    m_shadow_mem = adjust_address (m_shadow_mem, VOIDmode,adjust_address_1 (m_shadow_mem, ((void) 0, E_VOIDmode), diff >>
 3, 1, 1, 0, 0)
		     diff >> ASAN_SHADOW_SHIFT)adjust_address_1 (m_shadow_mem, ((void) 0, E_VOIDmode), diff >>
 3, 1, 1, 0, 0);
    m_prev_offset = offset;
    m_shadow_bytes.safe_push (value);
    flush_if_full ();
  }
1491}

1493/* Emit RTX emission of the content of the buffer.  */

1495void
1496asan_redzone_buffer::flush_redzone_payload (void)
1497{
gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN)((void)(!(0 == 0) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1498, __FUNCTION__), 0 : 0));

if (m_shadow_bytes.is_empty ())
  return;

/* Be sure we always emit to an aligned address.  */
gcc_assert (((m_prev_offset - m_original_offset)((void)(!(((m_prev_offset - m_original_offset) & (32 - 1)
) == 0) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1505, __FUNCTION__), 0 : 0))
     & (ASAN_RED_ZONE_SIZE - 1)) == 0)((void)(!(((m_prev_offset - m_original_offset) & (32 - 1)
) == 0) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1505, __FUNCTION__), 0 : 0));

/* Fill it to RZ_BUFFER_SIZE bytes with zeros if needed.  */
unsigned l = m_shadow_bytes.length ();
for (unsigned i = 0; i <= RZ_BUFFER_SIZE4 - l; i++)
  m_shadow_bytes.safe_push (0);

if (dump_file && (dump_flags & TDF_DETAILS))
  fprintf (dump_file,
    "Flushing rzbuffer at offset %" PRId64"l" "d" " with: ", m_prev_offset);

unsigned HOST_WIDE_INTlong val = 0;
for (unsigned i = 0; i < RZ_BUFFER_SIZE4; i++)
  {
    unsigned char v
= m_shadow_bytes[BYTES_BIG_ENDIAN0 ? RZ_BUFFER_SIZE4 - i - 1 : i];
    val |= (unsigned HOST_WIDE_INTlong)v << (BITS_PER_UNIT(8) * i);
    if (dump_file && (dump_flags & TDF_DETAILS))
fprintf (dump_file, "%02x ", v);
  }

if (dump_file && (dump_flags & TDF_DETAILS))
  fprintf (dump_file, "\n");

rtx c = gen_int_mode (val, SImode(scalar_int_mode ((scalar_int_mode::from_int) E_SImode)));
m_shadow_mem = adjust_address (m_shadow_mem, SImode, 0)adjust_address_1 (m_shadow_mem, (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)), 0, 1, 1, 0, 0);
emit_move_insn (m_shadow_mem, c);
m_shadow_bytes.truncate (0);
1533}

1535/* Flush if the content of the buffer is full
 (equal to RZ_BUFFER_SIZE).  */

1538void
1539asan_redzone_buffer::flush_if_full (void)
1540{
if (m_shadow_bytes.length () == RZ_BUFFER_SIZE4)
  flush_redzone_payload ();
1543}


1546/* HWAddressSanitizer (hwasan) is a probabilistic method for detecting
 out-of-bounds and use-after-free bugs.
 Read more:
 http://code.google.com/p/address-sanitizer/

 Similar to AddressSanitizer (asan) it consists of two parts: the
 instrumentation module in this file, and a run-time library.

 The instrumentation module adds a run-time check before every memory insn in
 the same manner as asan (see the block comment for AddressSanitizer above).
 Currently, hwasan only adds out-of-line instrumentation, where each check is
 implemented as a function call to the run-time library.  Hence a check for a
 load of N bytes from address X would be implemented with a function call to
 __hwasan_loadN(X), and checking a store of N bytes from address X would be
 implemented with a function call to __hwasan_storeN(X).

 The main difference between hwasan and asan is in the information stored to
 help this checking.  Both sanitizers use a shadow memory area which stores
 data recording the state of main memory at a corresponding address.

 For hwasan, each 16 byte granule in main memory has a corresponding 1 byte
 in shadow memory.  This shadow address can be calculated with equation:
   (addr >> log_2(HWASAN_TAG_GRANULE_SIZE))
 + __hwasan_shadow_memory_dynamic_address;
 The conversion between real and shadow memory for asan is given in the block
 comment at the top of this file.
 The description of how this shadow memory is laid out for asan is in the
 block comment at the top of this file, here we describe how this shadow
 memory is used for hwasan.

 For hwasan, each variable is assigned a byte-sized 'tag'.  The extent of
 the shadow memory for that variable is filled with the assigned tag, and
 every pointer referencing that variable has its top byte set to the same
 tag.  The run-time library redefines malloc so that every allocation returns
 a tagged pointer and tags the corresponding shadow memory with the same tag.

 On each pointer dereference the tag found in the pointer is compared to the
 tag found in the shadow memory corresponding to the accessed memory address.
 If these tags are found to differ then this memory access is judged to be
 invalid and a report is generated.

 This method of bug detection is not perfect -- it can not catch every bad
 access -- but catches them probabilistically instead.  There is always the
 possibility that an invalid memory access will happen to access memory
 tagged with the same tag as the pointer that this access used.
 The chances of this are approx. 0.4% for any two uncorrelated objects.

 Random tag generation can mitigate this problem by decreasing the
 probability that an invalid access will be missed in the same manner over
 multiple runs.  i.e. if two objects are tagged the same in one run of the
 binary they are unlikely to be tagged the same in the next run.
 Both heap and stack allocated objects have random tags by default.

 [16 byte granule implications]
  Since the shadow memory only has a resolution on real memory of 16 bytes,
  invalid accesses that are within the same 16 byte granule as a valid
  address will not be caught.

  There is a "short-granule" feature in the runtime library which does catch
  such accesses, but this feature is not implemented for stack objects (since
  stack objects are allocated and tagged by compiler instrumentation, and
  this feature has not yet been implemented in GCC instrumentation).

  Another outcome of this 16 byte resolution is that each tagged object must
  be 16 byte aligned.  If two objects were to share any 16 byte granule in
  memory, then they both would have to be given the same tag, and invalid
  accesses to one using a pointer to the other would be undetectable.

 [Compiler instrumentation]
  Compiler instrumentation ensures that two adjacent buffers on the stack are
  given different tags, this means an access to one buffer using a pointer
  generated from the other (e.g. through buffer overrun) will have mismatched
  tags and be caught by hwasan.

  We don't randomly tag every object on the stack, since that would require
  keeping many registers to record each tag.  Instead we randomly generate a
  tag for each function frame, and each new stack object uses a tag offset
  from that frame tag.
  i.e. each object is tagged as RFT + offset, where RFT is the "random frame
  tag" generated for this frame.
  This means that randomisation does not peturb the difference between tags
  on tagged stack objects within a frame, but this is mitigated by the fact
  that objects with the same tag within a frame are very far apart
  (approx. 2^HWASAN_TAG_SIZE objects apart).

  As a demonstration, using the same example program as in the asan block
  comment above:

   int
   foo ()
   {
     char a[23] = {0};
     int b[2] = {0};

     a[5] = 1;
     b[1] = 2;

     return a[5] + b[1];
   }

  On AArch64 the stack will be ordered as follows for the above function:

  Slot 1/ [24 bytes for variable 'a']
  Slot 2/ [8 bytes padding for alignment]
  Slot 3/ [8 bytes for variable 'b']
  Slot 4/ [8 bytes padding for alignment]

  (The padding is there to ensure 16 byte alignment as described in the 16
   byte granule implications).

  While the shadow memory will be ordered as follows:

  - 2 bytes (representing 32 bytes in real memory) tagged with RFT + 1.
  - 1 byte (representing 16 bytes in real memory) tagged with RFT + 2.

  And any pointer to "a" will have the tag RFT + 1, and any pointer to "b"
  will have the tag RFT + 2.

 [Top Byte Ignore requirements]
  Hwasan requires the ability to store an 8 bit tag in every pointer.  There
  is no instrumentation done to remove this tag from pointers before
  dereferencing, which means the hardware must ignore this tag during memory
  accesses.

  Architectures where this feature is available should indicate this using
  the TARGET_MEMTAG_CAN_TAG_ADDRESSES hook.

 [Stack requires cleanup on unwinding]
  During normal operation of a hwasan sanitized program more space in the
  shadow memory becomes tagged as the stack grows.  As the stack shrinks this
  shadow memory space must become untagged.  If it is not untagged then when
  the stack grows again (during other function calls later on in the program)
  objects on the stack that are usually not tagged (e.g. parameters passed on
  the stack) can be placed in memory whose shadow space is tagged with
  something else, and accesses can cause false positive reports.

  Hence we place untagging code on every epilogue of functions which tag some
  stack objects.

  Moreover, the run-time library intercepts longjmp & setjmp to untag when
  the stack is unwound this way.

  C++ exceptions are not yet handled, which means this sanitizer can not
  handle C++ code that throws exceptions -- it will give false positives
  after an exception has been thrown.  The implementation that the hwasan
  library has for handling these relies on the frame pointer being after any
  local variables.  This is not generally the case for GCC.  */


1695/* Returns whether we are tagging pointers and checking those tags on memory
 access.  */
1697bool
1698hwasan_sanitize_p ()
1699{
return sanitize_flags_p (SANITIZE_HWADDRESS);
1701}

1703/* Are we tagging the stack?  */
1704bool
1705hwasan_sanitize_stack_p ()
1706{
return (hwasan_sanitize_p () && param_hwasan_instrument_stackglobal_options.x_param_hwasan_instrument_stack);
1708}

1710/* Are we tagging alloca objects?  */
1711bool
1712hwasan_sanitize_allocas_p (void)
1713{
return (hwasan_sanitize_stack_p () && param_hwasan_instrument_allocasglobal_options.x_param_hwasan_instrument_allocas);
1715}

1717/* Should we instrument reads?  */
1718bool
1719hwasan_instrument_reads (void)
1720{
return (hwasan_sanitize_p () && param_hwasan_instrument_readsglobal_options.x_param_hwasan_instrument_reads);
1722}

1724/* Should we instrument writes?  */
1725bool
1726hwasan_instrument_writes (void)
1727{
return (hwasan_sanitize_p () && param_hwasan_instrument_writesglobal_options.x_param_hwasan_instrument_writes);
1729}

1731/* Should we instrument builtin calls?  */
1732bool
1733hwasan_memintrin (void)
1734{
return (hwasan_sanitize_p () && param_hwasan_instrument_mem_intrinsicsglobal_options.x_param_hwasan_instrument_mem_intrinsics);
1736}

1738/* Insert code to protect stack vars.  The prologue sequence should be emitted
 directly, epilogue sequence returned.  BASE is the register holding the
 stack base, against which OFFSETS array offsets are relative to, OFFSETS
 array contains pairs of offsets in reverse order, always the end offset
 of some gap that needs protection followed by starting offset,
 and DECLS is an array of representative decls for each var partition.
 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
 elements long (OFFSETS include gap before the first variable as well
 as gaps after each stack variable).  PBASE is, if non-NULL, some pseudo
 register which stack vars DECL_RTLs are based on.  Either BASE should be
 assigned to PBASE, when not doing use after return protection, or
 corresponding address based on __asan_stack_malloc* return value.  */

1751rtx_insn *
1752asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
	    HOST_WIDE_INTlong *offsets, tree *decls, int length)
1754{
rtx shadow_base, shadow_mem, ret, mem, orig_base;
rtx_code_label *lab;
rtx_insn *insns;
char buf[32];
HOST_WIDE_INTlong base_offset = offsets[length - 1];
HOST_WIDE_INTlong base_align_bias = 0, offset, prev_offset;
HOST_WIDE_INTlong asan_frame_size = offsets[0] - base_offset;
HOST_WIDE_INTlong last_offset, last_size, last_size_aligned;
int l;
unsigned char cur_shadow_byte = ASAN_STACK_MAGIC_LEFT0xf1;
tree str_cst, decl, id;
int use_after_return_class = -1;

if (shadow_ptr_types[0] == NULL_TREE(tree) nullptr)
  asan_init_shadow_ptr_types ();

expanded_location cfun_xloc
  = expand_location (DECL_SOURCE_LOCATION (current_function_decl)((contains_struct_check ((current_function_decl), (TS_DECL_MINIMAL
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1772, __FUNCTION__))->decl_minimal.locus));

/* First of all, prepare the description string.  */
pretty_printer asan_pp;

pp_decimal_int (&asan_pp, length / 2 - 1)do { sprintf ((&asan_pp)->buffer->digit_buffer, "%d"
, length / 2 - 1); pp_string (&asan_pp, (&asan_pp)->
buffer->digit_buffer); } while (0);
pp_space (&asan_pp)pp_character (&asan_pp, ' ');
for (l = length - 2; l; l -= 2)
  {
    tree decl = decls[l / 2 - 1];
    pp_wide_integer (&asan_pp, offsets[l] - base_offset);
    pp_space (&asan_pp)pp_character (&asan_pp, ' ');
    pp_wide_integer (&asan_pp, offsets[l - 1] - offsets[l]);
    pp_space (&asan_pp)pp_character (&asan_pp, ' ');

    expanded_location xloc
= expand_location (DECL_SOURCE_LOCATION (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1788, __FUNCTION__))->decl_minimal.locus));
    char location[32];

    if (xloc.file == cfun_xloc.file)
sprintf (location, ":%d", xloc.line);
    else
location[0] = '\0';

    if (DECL_P (decl)(tree_code_type[(int) (((enum tree_code) (decl)->base.code
))] == tcc_declaration) && DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1796, __FUNCTION__))->decl_minimal.name))
{
 unsigned idlen
   = IDENTIFIER_LENGTH (DECL_NAME (decl))((tree_check ((((contains_struct_check ((decl), (TS_DECL_MINIMAL
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1799, __FUNCTION__))->decl_minimal.name)), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1799, __FUNCTION__, (IDENTIFIER_NODE)))->identifier.id.len
) + strlen (location);
 pp_decimal_int (&asan_pp, idlen)do { sprintf ((&asan_pp)->buffer->digit_buffer, "%d"
, idlen); pp_string (&asan_pp, (&asan_pp)->buffer->
digit_buffer); } while (0);
 pp_space (&asan_pp)pp_character (&asan_pp, ' ');
 pp_tree_identifier (&asan_pp, DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1802, __FUNCTION__))->decl_minimal.name));
 pp_string (&asan_pp, location);
}
    else
pp_string (&asan_pp, "9 <unknown>");

    if (l > 2)
pp_space (&asan_pp)pp_character (&asan_pp, ' ');
  }
str_cst = asan_pp_string (&asan_pp);

/* Emit the prologue sequence.  */
if (asan_frame_size > 32 && asan_frame_size <= 65536 && pbase
    && param_asan_use_after_returnglobal_options.x_param_asan_use_after_return)
  {
    use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
    /* __asan_stack_malloc_N guarantees alignment
N < 6 ? (64 << N) : 4096 bytes.  */
    if (alignb > (use_after_return_class < 6
    ? (64U << use_after_return_class) : 4096U))
use_after_return_class = -1;
    else if (alignb > ASAN_RED_ZONE_SIZE32 && (asan_frame_size & (alignb - 1)))
base_align_bias = ((asan_frame_size + alignb - 1)
	   & ~(alignb - HOST_WIDE_INT_11L)) - asan_frame_size;
  }

/* Align base if target is STRICT_ALIGNMENT.  */
if (STRICT_ALIGNMENT0)
  {
    const HOST_WIDE_INTlong align
= (GET_MODE_ALIGNMENT (SImode)get_mode_alignment ((scalar_int_mode ((scalar_int_mode::from_int
) E_SImode))) / BITS_PER_UNIT(8)) << ASAN_SHADOW_SHIFT3;
    base = expand_binop (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), and_optab, base, gen_int_mode (-align, Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)))),
	   NULL_RTX(rtx) 0, 1, OPTAB_DIRECT);
  }

if (use_after_return_class == -1 && pbase)
  emit_move_insn (pbase, base);

base = expand_binop (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), add_optab, base,
       gen_int_mode (base_offset - base_align_bias, Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)))),
       NULL_RTX(rtx) 0, 1, OPTAB_DIRECT);
orig_base = NULL_RTX(rtx) 0;
if (use_after_return_class != -1)
  {
    if (asan_detect_stack_use_after_return == NULL_TREE(tree) nullptr)
{
 id = get_identifier ("__asan_option_detect_stack_use_after_return")(__builtin_constant_p ("__asan_option_detect_stack_use_after_return"
) ? get_identifier_with_length (("__asan_option_detect_stack_use_after_return"
), strlen ("__asan_option_detect_stack_use_after_return")) : get_identifier
 ("__asan_option_detect_stack_use_after_return"));
 decl = build_decl (BUILTINS_LOCATION((location_t) 1), VAR_DECL, id,
	     integer_type_nodeinteger_types[itk_int]);
 SET_DECL_ASSEMBLER_NAME (decl, id)overwrite_decl_assembler_name (decl, id);
 TREE_ADDRESSABLE (decl)((decl)->base.addressable_flag) = 1;
 DECL_ARTIFICIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1853, __FUNCTION__))->decl_common.artificial_flag) = 1;
 DECL_IGNORED_P (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1854, __FUNCTION__))->decl_common.ignored_flag) = 1;
 DECL_EXTERNAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1855, __FUNCTION__))->decl_common.decl_flag_1) = 1;
 TREE_STATIC (decl)((decl)->base.static_flag) = 1;
 TREE_PUBLIC (decl)((decl)->base.public_flag) = 1;
 TREE_USED (decl)((decl)->base.used_flag) = 1;
 asan_detect_stack_use_after_return = decl;
}
    orig_base = gen_reg_rtx (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))));
    emit_move_insn (orig_base, base);
    ret = expand_normal (asan_detect_stack_use_after_return);
    lab = gen_label_rtx ();
    emit_cmp_and_jump_insns (ret, const0_rtx(const_int_rtx[64]), EQ, NULL_RTX(rtx) 0,
	       VOIDmode((void) 0, E_VOIDmode), 0, lab,
	       profile_probability::very_likely ());
    snprintf (buf, sizeof buf, "__asan_stack_malloc_%d",
use_after_return_class);
    ret = init_one_libfunc (buf);
    ret = emit_library_call_value (ret, NULL_RTX(rtx) 0, LCT_NORMAL, ptr_mode,
		     GEN_INT (asan_frame_sizegen_rtx_CONST_INT (((void) 0, E_VOIDmode), (asan_frame_size +
 base_align_bias))
			      + base_align_bias)gen_rtx_CONST_INT (((void) 0, E_VOIDmode), (asan_frame_size +
 base_align_bias)),
		     TYPE_MODE (pointer_sized_int_node)((((enum tree_code) ((tree_class_check ((global_trees[TI_POINTER_SIZED_TYPE
]), (tcc_type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1874, __FUNCTION__)))->base.code) == VECTOR_TYPE) ? vector_type_mode
 (global_trees[TI_POINTER_SIZED_TYPE]) : (global_trees[TI_POINTER_SIZED_TYPE
])->type_common.mode));
    /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
and NULL otherwise.  Check RET value is NULL here and jump over the
BASE reassignment in this case.  Otherwise, reassign BASE to RET.  */
    emit_cmp_and_jump_insns (ret, const0_rtx(const_int_rtx[64]), EQ, NULL_RTX(rtx) 0,
	       VOIDmode((void) 0, E_VOIDmode), 0, lab,
	       profile_probability:: very_unlikely ());
    ret = convert_memory_address (Pmode, ret)convert_memory_address_addr_space (((global_options.x_ix86_pmode
 == PMODE_DI ? (scalar_int_mode ((scalar_int_mode::from_int) E_DImode
)) : (scalar_int_mode ((scalar_int_mode::from_int) E_SImode))
)), (ret), 0);
    emit_move_insn (base, ret);
    emit_label (lab);
    emit_move_insn (pbase, expand_binop (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), add_optab, base,
			   gen_int_mode (base_align_bias
					 - base_offset, Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode)))),
			   NULL_RTX(rtx) 0, 1, OPTAB_DIRECT));
  }
mem = gen_rtx_MEM (ptr_mode, base);
mem = adjust_address (mem, VOIDmode, base_align_bias)adjust_address_1 (mem, ((void) 0, E_VOIDmode), base_align_bias
, 1, 1, 0, 0);
emit_move_insn (mem, gen_int_mode (ASAN_STACK_FRAME_MAGIC0x41b58ab3, ptr_mode));
mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode))adjust_address_1 (mem, ((void) 0, E_VOIDmode), GET_MODE_SIZE (
ptr_mode), 1, 1, 0, 0);
emit_move_insn (mem, expand_normal (str_cst));
mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode))adjust_address_1 (mem, ((void) 0, E_VOIDmode), GET_MODE_SIZE (
ptr_mode), 1, 1, 0, 0);
ASM_GENERATE_INTERNAL_LABEL (buf, "LASANPC", current_function_funcdef_no)do { char *__p; (buf)[0] = '*'; (buf)[1] = '.'; __p = stpcpy (
&(buf)[2], "LASANPC"); sprint_ul (__p, (unsigned long) ((
(cfun + 0)->funcdef_no))); } while (0);
id = get_identifier (buf)(__builtin_constant_p (buf) ? get_identifier_with_length ((buf
), strlen (buf)) : get_identifier (buf));
decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl)((contains_struct_check ((current_function_decl), (TS_DECL_MINIMAL
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1897, __FUNCTION__))->decl_minimal.locus),
    VAR_DECL, id, char_type_nodeinteger_types[itk_char]);
SET_DECL_ASSEMBLER_NAME (decl, id)overwrite_decl_assembler_name (decl, id);
TREE_ADDRESSABLE (decl)((decl)->base.addressable_flag) = 1;
TREE_READONLY (decl)((non_type_check ((decl), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1901, __FUNCTION__))->base.readonly_flag) = 1;
DECL_ARTIFICIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1902, __FUNCTION__))->decl_common.artificial_flag) = 1;
DECL_IGNORED_P (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1903, __FUNCTION__))->decl_common.ignored_flag) = 1;
TREE_STATIC (decl)((decl)->base.static_flag) = 1;
TREE_PUBLIC (decl)((decl)->base.public_flag) = 0;
TREE_USED (decl)((decl)->base.used_flag) = 1;
DECL_INITIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1907, __FUNCTION__))->decl_common.initial) = decl;
TREE_ASM_WRITTEN (decl)((decl)->base.asm_written_flag) = 1;
TREE_ASM_WRITTEN (id)((id)->base.asm_written_flag) = 1;
emit_move_insn (mem, expand_normal (build_fold_addr_expr (decl)build_fold_addr_expr_loc (((location_t) 0), (decl))));
shadow_base = expand_binop (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), lshr_optab, base,
	      gen_int_shift_amount (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), ASAN_SHADOW_SHIFT3),
	      NULL_RTX(rtx) 0, 1, OPTAB_DIRECT);
shadow_base
  = plus_constant (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), shadow_base,
     asan_shadow_offset ()
     + (base_align_bias >> ASAN_SHADOW_SHIFT3));
gcc_assert (asan_shadow_set != -1((void)(!(asan_shadow_set != -1 && (32 >> 3) ==
 4) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1919, __FUNCTION__), 0 : 0))
     && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4)((void)(!(asan_shadow_set != -1 && (32 >> 3) ==
 4) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1919, __FUNCTION__), 0 : 0));
shadow_mem = gen_rtx_MEM (SImode(scalar_int_mode ((scalar_int_mode::from_int) E_SImode)), shadow_base);
set_mem_alias_set (shadow_mem, asan_shadow_set);
if (STRICT_ALIGNMENT0)
  set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)get_mode_alignment ((scalar_int_mode ((scalar_int_mode::from_int
) E_SImode)))));
prev_offset = base_offset;

asan_redzone_buffer rz_buffer (shadow_mem, prev_offset);
for (l = length; l; l -= 2)
  {
    if (l == 2)
cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT0xf3;
    offset = offsets[l - 1];

    bool extra_byte = (offset - base_offset) & (ASAN_SHADOW_GRANULARITY(1UL << 3) - 1);
    /* If a red-zone is not aligned to ASAN_SHADOW_GRANULARITY then
the previous stack variable has size % ASAN_SHADOW_GRANULARITY != 0.
In that case we have to emit one extra byte that will describe
how many bytes (our of ASAN_SHADOW_GRANULARITY) can be accessed.  */
    if (extra_byte)
{
 HOST_WIDE_INTlong aoff
   = base_offset + ((offset - base_offset)
	     & ~(ASAN_SHADOW_GRANULARITY(1UL << 3) - HOST_WIDE_INT_11L));
 rz_buffer.emit_redzone_byte (aoff, offset - aoff);
 offset = aoff + ASAN_SHADOW_GRANULARITY(1UL << 3);
}

    /* Calculate size of red zone payload.  */
    while (offset < offsets[l - 2])
{
 rz_buffer.emit_redzone_byte (offset, cur_shadow_byte);
 offset += ASAN_SHADOW_GRANULARITY(1UL << 3);
}

    cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE0xf2;
  }

/* As the automatic variables are aligned to
   ASAN_RED_ZONE_SIZE / ASAN_SHADOW_GRANULARITY, the buffer should be
   flushed here.  */
gcc_assert (rz_buffer.m_shadow_bytes.is_empty ())((void)(!(rz_buffer.m_shadow_bytes.is_empty ()) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 1960, __FUNCTION__), 0 : 0));

do_pending_stack_adjust ();

/* Construct epilogue sequence.  */
start_sequence ();

lab = NULLnullptr;
if (use_after_return_class != -1)
  {
    rtx_code_label *lab2 = gen_label_rtx ();
    char c = (char) ASAN_STACK_MAGIC_USE_AFTER_RET0xf5;
    emit_cmp_and_jump_insns (orig_base, base, EQ, NULL_RTX(rtx) 0,
	       VOIDmode((void) 0, E_VOIDmode), 0, lab2,
	       profile_probability::very_likely ());
    shadow_mem = gen_rtx_MEM (BLKmode((void) 0, E_BLKmode), shadow_base);
    set_mem_alias_set (shadow_mem, asan_shadow_set);
    mem = gen_rtx_MEM (ptr_mode, base);
    mem = adjust_address (mem, VOIDmode, base_align_bias)adjust_address_1 (mem, ((void) 0, E_VOIDmode), base_align_bias
, 1, 1, 0, 0);
    emit_move_insn (mem, gen_int_mode (ASAN_STACK_RETIRED_MAGIC0x45e0360e, ptr_mode));
    unsigned HOST_WIDE_INTlong sz = asan_frame_size >> ASAN_SHADOW_SHIFT3;
    if (use_after_return_class < 5
 && can_store_by_pieces (sz, builtin_memset_read_str, &c,
		  BITS_PER_UNIT(8), true))
{
 /* Emit:
      memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize);
      **SavedFlagPtr(FakeStack, class_id) = 0
 */
 store_by_pieces (shadow_mem, sz, builtin_memset_read_str, &c,
	   BITS_PER_UNIT(8), true, RETURN_BEGIN);

 unsigned HOST_WIDE_INTlong offset
   = (1 << (use_after_return_class + 6));
 offset -= GET_MODE_SIZE (ptr_mode);
 mem = gen_rtx_MEM (ptr_mode, base);
 mem = adjust_address (mem, ptr_mode, offset)adjust_address_1 (mem, ptr_mode, offset, 1, 1, 0, 0);
 rtx addr = gen_reg_rtx (ptr_mode);
 emit_move_insn (addr, mem);
 addr = convert_memory_address (Pmode, addr)convert_memory_address_addr_space (((global_options.x_ix86_pmode
 == PMODE_DI ? (scalar_int_mode ((scalar_int_mode::from_int) E_DImode
)) : (scalar_int_mode ((scalar_int_mode::from_int) E_SImode))
)), (addr), 0);
 mem = gen_rtx_MEM (QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)), addr);
 emit_move_insn (mem, const0_rtx(const_int_rtx[64]));
}
    else if (use_after_return_class >= 5
      || !set_storage_via_setmem (shadow_mem,
			   GEN_INT (sz)gen_rtx_CONST_INT (((void) 0, E_VOIDmode), (sz)),
			   gen_int_mode (c, QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode))),
			   BITS_PER_UNIT(8), BITS_PER_UNIT(8),
			   -1, sz, sz, sz))
{
 snprintf (buf, sizeof buf, "__asan_stack_free_%d",
    use_after_return_class);
 ret = init_one_libfunc (buf);
 rtx addr = convert_memory_address (ptr_mode, base)convert_memory_address_addr_space ((ptr_mode), (base), 0);
 rtx orig_addr = convert_memory_address (ptr_mode, orig_base)convert_memory_address_addr_space ((ptr_mode), (orig_base), 0
);
 emit_library_call (ret, LCT_NORMAL, ptr_mode, addr, ptr_mode,
	     GEN_INT (asan_frame_size + base_align_bias)gen_rtx_CONST_INT (((void) 0, E_VOIDmode), (asan_frame_size +
 base_align_bias)),
	     TYPE_MODE (pointer_sized_int_node)((((enum tree_code) ((tree_class_check ((global_trees[TI_POINTER_SIZED_TYPE
]), (tcc_type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2017, __FUNCTION__)))->base.code) == VECTOR_TYPE) ? vector_type_mode
 (global_trees[TI_POINTER_SIZED_TYPE]) : (global_trees[TI_POINTER_SIZED_TYPE
])->type_common.mode),
	     orig_addr, ptr_mode);
}
    lab = gen_label_rtx ();
    emit_jump (lab);
    emit_label (lab2);
  }

shadow_mem = gen_rtx_MEM (BLKmode((void) 0, E_BLKmode), shadow_base);
set_mem_alias_set (shadow_mem, asan_shadow_set);

if (STRICT_ALIGNMENT0)
  set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)get_mode_alignment ((scalar_int_mode ((scalar_int_mode::from_int
) E_SImode)))));

prev_offset = base_offset;
last_offset = base_offset;
last_size = 0;
last_size_aligned = 0;
for (l = length; l; l -= 2)
  {
    offset = base_offset + ((offsets[l - 1] - base_offset)
	      & ~(ASAN_RED_ZONE_SIZE32 - HOST_WIDE_INT_11L));
    if (last_offset + last_size_aligned < offset)
{
 shadow_mem = adjust_address (shadow_mem, VOIDmode,adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0)
		       (last_offset - prev_offset)adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0)
		       >> ASAN_SHADOW_SHIFT)adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0);
 prev_offset = last_offset;
 asan_clear_shadow (shadow_mem, last_size_aligned >> ASAN_SHADOW_SHIFT3);
 last_offset = offset;
 last_size = 0;
}
    else
last_size = offset - last_offset;
    last_size += base_offset + ((offsets[l - 2] - base_offset)
		  & ~(ASAN_MIN_RED_ZONE_SIZE16 - HOST_WIDE_INT_11L))
   - offset;

    /* Unpoison shadow memory that corresponds to a variable that is 
is subject of use-after-return sanitization.  */
    if (l > 2)
{
 decl = decls[l / 2 - 2];
 if (asan_handled_variables != NULLnullptr
     && asan_handled_variables->contains (decl))
   {
     HOST_WIDE_INTlong size = offsets[l - 3] - offsets[l - 2];
     if (dump_file && (dump_flags & TDF_DETAILS))
{
  const char *n = (DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2066, __FUNCTION__))->decl_minimal.name)
		   ? IDENTIFIER_POINTER (DECL_NAME (decl))((const char *) (tree_check ((((contains_struct_check ((decl)
, (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2067, __FUNCTION__))->decl_minimal.name)), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2067, __FUNCTION__, (IDENTIFIER_NODE)))->identifier.id.str
)
		   : "<unknown>");
  fprintf (dump_file, "Unpoisoning shadow stack for variable: "
	   "%s (%" PRId64"l" "d" " B)\n", n, size);
}

last_size += size & ~(ASAN_MIN_RED_ZONE_SIZE16 - HOST_WIDE_INT_11L);
   }
}
    last_size_aligned
= ((last_size + (ASAN_RED_ZONE_SIZE32 - HOST_WIDE_INT_11L))
  & ~(ASAN_RED_ZONE_SIZE32 - HOST_WIDE_INT_11L));
  }
if (last_size_aligned)
  {
    shadow_mem = adjust_address (shadow_mem, VOIDmode,adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0)
		   (last_offset - prev_offset)adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0)
		   >> ASAN_SHADOW_SHIFT)adjust_address_1 (shadow_mem, ((void) 0, E_VOIDmode), (last_offset
 - prev_offset) >> 3, 1, 1, 0, 0);
    asan_clear_shadow (shadow_mem, last_size_aligned >> ASAN_SHADOW_SHIFT3);
  }

/* Clean-up set with instrumented stack variables.  */
delete asan_handled_variables;
asan_handled_variables = NULLnullptr;
delete asan_used_labels;
asan_used_labels = NULLnullptr;

do_pending_stack_adjust ();
if (lab)
  emit_label (lab);

insns = get_insns ();
end_sequence ();
return insns;
2101}

2103/* Emit __asan_allocas_unpoison (top, bot) call.  The BASE parameter corresponds
 to BOT argument, for TOP virtual_stack_dynamic_rtx is used.  NEW_SEQUENCE
 indicates whether we're emitting new instructions sequence or not.  */

2107rtx_insn *
2108asan_emit_allocas_unpoison (rtx top, rtx bot, rtx_insn *before)
2109{
if (before)
  push_to_sequence (before);
else
  start_sequence ();
rtx ret = init_one_libfunc ("__asan_allocas_unpoison");
top = convert_memory_address (ptr_mode, top)convert_memory_address_addr_space ((ptr_mode), (top), 0);
bot = convert_memory_address (ptr_mode, bot)convert_memory_address_addr_space ((ptr_mode), (bot), 0);
emit_library_call (ret, LCT_NORMAL, ptr_mode,
     top, ptr_mode, bot, ptr_mode);

do_pending_stack_adjust ();
rtx_insn *insns = get_insns ();
end_sequence ();
return insns;
2124}

2126/* Return true if DECL, a global var, might be overridden and needs
 therefore a local alias.  */

2129static bool
2130asan_needs_local_alias (tree decl)
2131{
return DECL_WEAK (decl)((contains_struct_check ((decl), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2132, __FUNCTION__))->decl_with_vis.weak_flag) || !targetm.binds_local_p (decl);
2133}

2135/* Return true if DECL, a global var, is an artificial ODR indicator symbol
 therefore doesn't need protection.  */

2138static bool
2139is_odr_indicator (tree decl)
2140{
return (DECL_ARTIFICIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2141, __FUNCTION__))->decl_common.artificial_flag)
 && lookup_attribute ("asan odr indicator", DECL_ATTRIBUTES (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2142, __FUNCTION__))->decl_common.attributes)));
2143}

2145/* Return true if DECL is a VAR_DECL that should be protected
 by Address Sanitizer, by appending a red zone with protected
 shadow memory after it and aligning it to at least
 ASAN_RED_ZONE_SIZE bytes.  */

2150bool
2151asan_protect_global (tree decl, bool ignore_decl_rtl_set_p)
2152{
if (!param_asan_globalsglobal_options.x_param_asan_globals)
  return false;

rtx rtl, symbol;

if (TREE_CODE (decl)((enum tree_code) (decl)->base.code) == STRING_CST)
  {
    /* Instrument all STRING_CSTs except those created
by asan_pp_string here.  */
    if (shadow_ptr_types[0] != NULL_TREE(tree) nullptr
 && TREE_CODE (TREE_TYPE (decl))((enum tree_code) (((contains_struct_check ((decl), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2163, __FUNCTION__))->typed.type))->base.code) == ARRAY_TYPE
 && TREE_TYPE (TREE_TYPE (decl))((contains_struct_check ((((contains_struct_check ((decl), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2164, __FUNCTION__))->typed.type)), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2164, __FUNCTION__))->typed.type) == TREE_TYPE (shadow_ptr_types[0])((contains_struct_check ((shadow_ptr_types[0]), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2164, __FUNCTION__))->typed.type))
return false;
    return true;
  }
if (!VAR_P (decl)(((enum tree_code) (decl)->base.code) == VAR_DECL)
    /* TLS vars aren't statically protectable.  */
    || DECL_THREAD_LOCAL_P (decl)((((decl)->base.static_flag) || ((contains_struct_check ((
decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2170, __FUNCTION__))->decl_common.decl_flag_1)) &&
 decl_tls_model (decl) >= TLS_MODEL_REAL)
    /* Externs will be protected elsewhere.  */
    || DECL_EXTERNAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2172, __FUNCTION__))->decl_common.decl_flag_1)
    /* PR sanitizer/81697: For architectures that use section anchors first
call to asan_protect_global may occur before DECL_RTL (decl) is set.
We should ignore DECL_RTL_SET_P then, because otherwise the first call
to asan_protect_global will return FALSE and the following calls on the
same decl after setting DECL_RTL (decl) will return TRUE and we'll end
up with inconsistency at runtime.  */
    || (!DECL_RTL_SET_P (decl)(((tree_contains_struct[(((enum tree_code) (decl)->base.code
))][(TS_DECL_WRTL)])) && (contains_struct_check ((decl
), (TS_DECL_WRTL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2179, __FUNCTION__))->decl_with_rtl.rtl != nullptr) && !ignore_decl_rtl_set_p)
    /* Comdat vars pose an ABI problem, we can't know if
the var that is selected by the linker will have
padding or not.  */
    || DECL_ONE_ONLY (decl)(decl_comdat_group (decl) != (tree) nullptr && (((decl
)->base.public_flag) || ((contains_struct_check ((decl), (
TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2183, __FUNCTION__))->decl_common.decl_flag_1)))
    /* Similarly for common vars.  People can use -fno-common.
Note: Linux kernel is built with -fno-common, so we do instrument
globals there even if it is C.  */
    || (DECL_COMMON (decl)((contains_struct_check ((decl), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2187, __FUNCTION__))->decl_with_vis.common_flag) && TREE_PUBLIC (decl)((decl)->base.public_flag))
    /* Don't protect if using user section, often vars placed
into user section from multiple TUs are then assumed
to be an array of such vars, putting padding in there
breaks this assumption.  */
    || (DECL_SECTION_NAME (decl)decl_section_name (decl) != NULLnullptr
 && !symtab_node::get (decl)->implicit_section
 && !section_sanitized_p (DECL_SECTION_NAME (decl)decl_section_name (decl)))
    || DECL_SIZE (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2195, __FUNCTION__))->decl_common.size) == 0
    || ASAN_RED_ZONE_SIZE32 * BITS_PER_UNIT(8) > MAX_OFILE_ALIGNMENT(((unsigned int) 1 << 28) * 8)
    || TREE_CODE (DECL_SIZE_UNIT (decl))((enum tree_code) (((contains_struct_check ((decl), (TS_DECL_COMMON
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2197, __FUNCTION__))->decl_common.size_unit))->base.code
) != INTEGER_CST
    || !valid_constant_size_p (DECL_SIZE_UNIT (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2198, __FUNCTION__))->decl_common.size_unit))
    || DECL_ALIGN_UNIT (decl)((((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2199, __FUNCTION__))->decl_common.align) ? ((unsigned)1)
 << (((contains_struct_check ((decl), (TS_DECL_COMMON),
 "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2199, __FUNCTION__))->decl_common.align) - 1) : 0) / (8)
) > 2 * ASAN_RED_ZONE_SIZE32
    || TREE_TYPE (decl)((contains_struct_check ((decl), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2200, __FUNCTION__))->typed.type) == ubsan_get_source_location_type ()
    || is_odr_indicator (decl))
  return false;

if (!ignore_decl_rtl_set_p || DECL_RTL_SET_P (decl)(((tree_contains_struct[(((enum tree_code) (decl)->base.code
))][(TS_DECL_WRTL)])) && (contains_struct_check ((decl
), (TS_DECL_WRTL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2204, __FUNCTION__))->decl_with_rtl.rtl != nullptr))
  {

    rtl = DECL_RTL (decl)((contains_struct_check ((decl), (TS_DECL_WRTL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2207, __FUNCTION__))->decl_with_rtl.rtl ? (decl)->decl_with_rtl
.rtl : (make_decl_rtl (decl), (decl)->decl_with_rtl.rtl));
    if (!MEM_P (rtl)(((enum rtx_code) (rtl)->code) == MEM) || GET_CODE (XEXP (rtl, 0))((enum rtx_code) ((((rtl)->u.fld[0]).rt_rtx))->code) != SYMBOL_REF)
return false;
    symbol = XEXP (rtl, 0)(((rtl)->u.fld[0]).rt_rtx);

    if (CONSTANT_POOL_ADDRESS_P (symbol)(__extension__ ({ __typeof ((symbol)) const _rtx = ((symbol))
; if (((enum rtx_code) (_rtx)->code) != SYMBOL_REF) rtl_check_failed_flag
 ("CONSTANT_POOL_ADDRESS_P", _rtx, "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2212, __FUNCTION__); _rtx; })->unchanging)
 || TREE_CONSTANT_POOL_ADDRESS_P (symbol)(__extension__ ({ __typeof ((symbol)) const _rtx = ((symbol))
; if (((enum rtx_code) (_rtx)->code) != SYMBOL_REF) rtl_check_failed_flag
 ("TREE_CONSTANT_POOL_ADDRESS_P", _rtx, "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2213, __FUNCTION__); _rtx; })->frame_related))
return false;
  }

if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2217, __FUNCTION__))->decl_common.attributes)))
  return false;

if (!TARGET_SUPPORTS_ALIASES1 && asan_needs_local_alias (decl))
  return false;

return true;
2224}

2226/* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
 IS_STORE is either 1 (for a store) or 0 (for a load).  */

2229static tree
2230report_error_func (bool is_store, bool recover_p, HOST_WIDE_INTlong size_in_bytes,
   int *nargs)
2232{
gcc_assert (!hwasan_sanitize_p ())((void)(!(!hwasan_sanitize_p ()) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2233, __FUNCTION__), 0 : 0));

static enum built_in_function report[2][2][6]
  = { { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
   BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
   BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
 { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
   BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
   BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } },
{ { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT,
   BUILT_IN_ASAN_REPORT_LOAD2_NOABORT,
   BUILT_IN_ASAN_REPORT_LOAD4_NOABORT,
   BUILT_IN_ASAN_REPORT_LOAD8_NOABORT,
   BUILT_IN_ASAN_REPORT_LOAD16_NOABORT,
   BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT },
 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT,
   BUILT_IN_ASAN_REPORT_STORE2_NOABORT,
   BUILT_IN_ASAN_REPORT_STORE4_NOABORT,
   BUILT_IN_ASAN_REPORT_STORE8_NOABORT,
   BUILT_IN_ASAN_REPORT_STORE16_NOABORT,
   BUILT_IN_ASAN_REPORT_STORE_N_NOABORT } } };
if (size_in_bytes == -1)
  {
    *nargs = 2;
    return builtin_decl_implicit (report[recover_p][is_store][5]);
  }
*nargs = 1;
int size_log2 = exact_log2 (size_in_bytes);
return builtin_decl_implicit (report[recover_p][is_store][size_log2]);
2262}

2264/* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
 IS_STORE is either 1 (for a store) or 0 (for a load).  */

2267static tree
2268check_func (bool is_store, bool recover_p, HOST_WIDE_INTlong size_in_bytes,
   int *nargs)
2270{
static enum built_in_function check[2][2][6]
  = { { { BUILT_IN_ASAN_LOAD1, BUILT_IN_ASAN_LOAD2,
   BUILT_IN_ASAN_LOAD4, BUILT_IN_ASAN_LOAD8,
   BUILT_IN_ASAN_LOAD16, BUILT_IN_ASAN_LOADN },
 { BUILT_IN_ASAN_STORE1, BUILT_IN_ASAN_STORE2,
   BUILT_IN_ASAN_STORE4, BUILT_IN_ASAN_STORE8,
   BUILT_IN_ASAN_STORE16, BUILT_IN_ASAN_STOREN } },
{ { BUILT_IN_ASAN_LOAD1_NOABORT,
   BUILT_IN_ASAN_LOAD2_NOABORT,
   BUILT_IN_ASAN_LOAD4_NOABORT,
   BUILT_IN_ASAN_LOAD8_NOABORT,
   BUILT_IN_ASAN_LOAD16_NOABORT,
   BUILT_IN_ASAN_LOADN_NOABORT },
 { BUILT_IN_ASAN_STORE1_NOABORT,
   BUILT_IN_ASAN_STORE2_NOABORT,
   BUILT_IN_ASAN_STORE4_NOABORT,
   BUILT_IN_ASAN_STORE8_NOABORT,
   BUILT_IN_ASAN_STORE16_NOABORT,
   BUILT_IN_ASAN_STOREN_NOABORT } } };
if (size_in_bytes == -1)
  {
    *nargs = 2;
    return builtin_decl_implicit (check[recover_p][is_store][5]);
  }
*nargs = 1;
int size_log2 = exact_log2 (size_in_bytes);
return builtin_decl_implicit (check[recover_p][is_store][size_log2]);
2298}

2300/* Split the current basic block and create a condition statement
 insertion point right before or after the statement pointed to by
 ITER.  Return an iterator to the point at which the caller might
 safely insert the condition statement.

 THEN_BLOCK must be set to the address of an uninitialized instance
 of basic_block.  The function will then set *THEN_BLOCK to the
 'then block' of the condition statement to be inserted by the
 caller.

 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
 *THEN_BLOCK to *FALLTHROUGH_BLOCK.

 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
 block' of the condition statement to be inserted by the caller.

 Note that *FALLTHROUGH_BLOCK is a new block that contains the
 statements starting from *ITER, and *THEN_BLOCK is a new empty
 block.

 *ITER is adjusted to point to always point to the first statement
  of the basic block * FALLTHROUGH_BLOCK.  That statement is the
  same as what ITER was pointing to prior to calling this function,
  if BEFORE_P is true; otherwise, it is its following statement.  */

2325gimple_stmt_iterator
2326create_cond_insert_point (gimple_stmt_iterator *iter,
	  bool before_p,
	  bool then_more_likely_p,
	  bool create_then_fallthru_edge,
	  basic_block *then_block,
	  basic_block *fallthrough_block)
2332{
gimple_stmt_iterator gsi = *iter;

if (!gsi_end_p (gsi) && before_p)
  gsi_prev (&gsi);

basic_block cur_bb = gsi_bb (*iter);

edge e = split_block (cur_bb, gsi_stmt (gsi));

/* Get a hold on the 'condition block', the 'then block' and the
   'else block'.  */
basic_block cond_bb = e->src;
basic_block fallthru_bb = e->dest;
basic_block then_bb = create_empty_bb (cond_bb);
if (current_loops((cfun + 0)->x_current_loops))
  {
    add_bb_to_loop (then_bb, cond_bb->loop_father);
    loops_state_set (LOOPS_NEED_FIXUP);
  }

/* Set up the newly created 'then block'.  */
e = make_edge (cond_bb, then_bb, EDGE_TRUE_VALUE);
profile_probability fallthrough_probability
  = then_more_likely_p
  ? profile_probability::very_unlikely ()
  : profile_probability::very_likely ();
e->probability = fallthrough_probability.invert ();
then_bb->count = e->count ();
if (create_then_fallthru_edge)
  make_single_succ_edge (then_bb, fallthru_bb, EDGE_FALLTHRU);

/* Set up the fallthrough basic block.  */
e = find_edge (cond_bb, fallthru_bb);
e->flags = EDGE_FALSE_VALUE;
e->probability = fallthrough_probability;

/* Update dominance info for the newly created then_bb; note that
   fallthru_bb's dominance info has already been updated by
   split_bock.  */
if (dom_info_available_p (CDI_DOMINATORS))
  set_immediate_dominator (CDI_DOMINATORS, then_bb, cond_bb);

*then_block = then_bb;
*fallthrough_block = fallthru_bb;
*iter = gsi_start_bb (fallthru_bb);

return gsi_last_bb (cond_bb);
2380}

2382/* Insert an if condition followed by a 'then block' right before the
 statement pointed to by ITER.  The fallthrough block -- which is the
 else block of the condition as well as the destination of the
 outcoming edge of the 'then block' -- starts with the statement
 pointed to by ITER.

 COND is the condition of the if.

 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
 'then block' is higher than the probability of the edge to the
 fallthrough block.

 Upon completion of the function, *THEN_BB is set to the newly
 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
 fallthrough block.

 *ITER is adjusted to still point to the same statement it was
 pointing to initially.  */

2401static void
2402insert_if_then_before_iter (gcond *cond,
	    gimple_stmt_iterator *iter,
	    bool then_more_likely_p,
	    basic_block *then_bb,
	    basic_block *fallthrough_bb)
2407{
gimple_stmt_iterator cond_insert_point =
  create_cond_insert_point (iter,
	      /*before_p=*/true,
	      then_more_likely_p,
	      /*create_then_fallthru_edge=*/true,
	      then_bb,
	      fallthrough_bb);
gsi_insert_after (&cond_insert_point, cond, GSI_NEW_STMT);
2416}

2418/* Build (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset ().
 If RETURN_ADDRESS is set to true, return memory location instread
 of a value in the shadow memory.  */

2422static tree
2423build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
	 tree base_addr, tree shadow_ptr_type,
	 bool return_address = false)
2426{
tree t, uintptr_type = TREE_TYPE (base_addr)((contains_struct_check ((base_addr), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2427, __FUNCTION__))->typed.type);
tree shadow_type = TREE_TYPE (shadow_ptr_type)((contains_struct_check ((shadow_ptr_type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2428, __FUNCTION__))->typed.type);
gimple *g;

t = build_int_cst (uintptr_type, ASAN_SHADOW_SHIFT3);
g = gimple_build_assign (make_ssa_name (uintptr_type), RSHIFT_EXPR,
	   base_addr, t);
gimple_set_location (g, location);
gsi_insert_after (gsi, g, GSI_NEW_STMT);

t = build_int_cst (uintptr_type, asan_shadow_offset ());
g = gimple_build_assign (make_ssa_name (uintptr_type), PLUS_EXPR,
	   gimple_assign_lhs (g), t);
gimple_set_location (g, location);
gsi_insert_after (gsi, g, GSI_NEW_STMT);

g = gimple_build_assign (make_ssa_name (shadow_ptr_type), NOP_EXPR,
	   gimple_assign_lhs (g));
gimple_set_location (g, location);
gsi_insert_after (gsi, g, GSI_NEW_STMT);

if (!return_address)
  {
    t = build2 (MEM_REF, shadow_type, gimple_assign_lhs (g),
  build_int_cst (shadow_ptr_type, 0));
    g = gimple_build_assign (make_ssa_name (shadow_type), MEM_REF, t);
    gimple_set_location (g, location);
    gsi_insert_after (gsi, g, GSI_NEW_STMT);
  }

return gimple_assign_lhs (g);
2458}

2460/* BASE can already be an SSA_NAME; in that case, do not create a
 new SSA_NAME for it.  */

2463static tree
2464maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
       bool before_p)
2466{
STRIP_USELESS_TYPE_CONVERSION (base)(base) = tree_ssa_strip_useless_type_conversions (base);
if (TREE_CODE (base)((enum tree_code) (base)->base.code) == SSA_NAME)
  return base;
gimple *g = gimple_build_assign (make_ssa_name (TREE_TYPE (base)((contains_struct_check ((base), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2470, __FUNCTION__))->typed.type)), base);
gimple_set_location (g, loc);
if (before_p)
  gsi_insert_before (iter, g, GSI_SAME_STMT);
else
  gsi_insert_after (iter, g, GSI_NEW_STMT);
return gimple_assign_lhs (g);
2477}

2479/* LEN can already have necessary size and precision;
 in that case, do not create a new variable.  */

2482tree
2483maybe_cast_to_ptrmode (location_t loc, tree len, gimple_stmt_iterator *iter,
       bool before_p)
2485{
if (ptrofftype_p (len))
  return len;
gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
		  NOP_EXPR, len);
gimple_set_location (g, loc);
if (before_p)
  gsi_insert_before (iter, g, GSI_SAME_STMT);
else
  gsi_insert_after (iter, g, GSI_NEW_STMT);
return gimple_assign_lhs (g);
2496}

2498/* Instrument the memory access instruction BASE.  Insert new
 statements before or after ITER.

 Note that the memory access represented by BASE can be either an
 SSA_NAME, or a non-SSA expression.  LOCATION is the source code
 location.  IS_STORE is TRUE for a store, FALSE for a load.
 BEFORE_P is TRUE for inserting the instrumentation code before
 ITER, FALSE for inserting it after ITER.  IS_SCALAR_ACCESS is TRUE
 for a scalar memory access and FALSE for memory region access.
 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
 length.  ALIGN tells alignment of accessed memory object.

 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
 memory region have already been instrumented.

 If BEFORE_P is TRUE, *ITER is arranged to still point to the
 statement it was pointing to prior to calling this function,
 otherwise, it points to the statement logically following it.  */

2517static void
2518build_check_stmt (location_t loc, tree base, tree len,
  HOST_WIDE_INTlong size_in_bytes, gimple_stmt_iterator *iter,
  bool is_non_zero_len, bool before_p, bool is_store,
  bool is_scalar_access, unsigned int align = 0)
2522{
gimple_stmt_iterator gsi = *iter;
gimple *g;

gcc_assert (!(size_in_bytes > 0 && !is_non_zero_len))((void)(!(!(size_in_bytes > 0 && !is_non_zero_len)
) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2526, __FUNCTION__), 0 : 0));
gcc_assert (size_in_bytes == -1 || size_in_bytes >= 1)((void)(!(size_in_bytes == -1 || size_in_bytes >= 1) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2527, __FUNCTION__), 0 : 0));

gsi = *iter;

base = unshare_expr (base);
base = maybe_create_ssa_name (loc, base, &gsi, before_p);

if (len)
  {
    len = unshare_expr (len);
    len = maybe_cast_to_ptrmode (loc, len, iter, before_p);
  }
else
  {
    gcc_assert (size_in_bytes != -1)((void)(!(size_in_bytes != -1) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2541, __FUNCTION__), 0 : 0));
    len = build_int_cst (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], size_in_bytes);
  }

if (size_in_bytes > 1)
  {
    if ((size_in_bytes & (size_in_bytes - 1)) != 0
 || size_in_bytes > 16)
is_scalar_access = false;
    else if (align && align < size_in_bytes * BITS_PER_UNIT(8))
{
 /* On non-strict alignment targets, if
    16-byte access is just 8-byte aligned,
    this will result in misaligned shadow
    memory 2 byte load, but otherwise can
    be handled using one read.  */
 if (size_in_bytes != 16
     || STRICT_ALIGNMENT0
     || align < 8 * BITS_PER_UNIT(8))
   is_scalar_access = false;
}
  }

HOST_WIDE_INTlong flags = 0;
if (is_store)
  flags |= ASAN_CHECK_STORE;
if (is_non_zero_len)
  flags |= ASAN_CHECK_NON_ZERO_LEN;
if (is_scalar_access)
  flags |= ASAN_CHECK_SCALAR_ACCESS;

enum internal_fn fn = hwasan_sanitize_p ()
  ? IFN_HWASAN_CHECK
  : IFN_ASAN_CHECK;

g = gimple_build_call_internal (fn, 4,
		  build_int_cst (integer_type_nodeinteger_types[itk_int], flags),
		  base, len,
		  build_int_cst (integer_type_nodeinteger_types[itk_int],
				 align / BITS_PER_UNIT(8)));
gimple_set_location (g, loc);
if (before_p)
  gsi_insert_before (&gsi, g, GSI_SAME_STMT);
else
  {
    gsi_insert_after (&gsi, g, GSI_NEW_STMT);
    gsi_next (&gsi);
    *iter = gsi;
  }
2590}

2592/* If T represents a memory access, add instrumentation code before ITER.
 LOCATION is source code location.
 IS_STORE is either TRUE (for a store) or FALSE (for a load).  */

2596static void
2597instrument_derefs (gimple_stmt_iterator *iter, tree t,
   location_t location, bool is_store)
2599{
if (is_store && !(asan_instrument_writes () || hwasan_instrument_writes ()))
  return;
if (!is_store && !(asan_instrument_reads () || hwasan_instrument_reads ()))
  return;

tree type, base;
HOST_WIDE_INTlong size_in_bytes;
if (location == UNKNOWN_LOCATION((location_t) 0))
  location = EXPR_LOCATION (t)((((t)) && ((tree_code_type[(int) (((enum tree_code) (
(t))->base.code))]) >= tcc_reference && (tree_code_type
[(int) (((enum tree_code) ((t))->base.code))]) <= tcc_expression
)) ? (t)->exp.locus : ((location_t) 0));

type = TREE_TYPE (t)((contains_struct_check ((t), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2610, __FUNCTION__))->typed.type);
switch (TREE_CODE (t)((enum tree_code) (t)->base.code))
  {
  case ARRAY_REF:
  case COMPONENT_REF:
  case INDIRECT_REF:
  case MEM_REF:
  case VAR_DECL:
  case BIT_FIELD_REF:
    break;
    /* FALLTHRU */
  default:
    return;
  }

size_in_bytes = int_size_in_bytes (type);
if (size_in_bytes <= 0)
  return;

poly_int64 bitsize, bitpos;
tree offset;
machine_mode mode;
int unsignedp, reversep, volatilep = 0;
tree inner = get_inner_reference (t, &bitsize, &bitpos, &offset, &mode,
		    &unsignedp, &reversep, &volatilep);

if (TREE_CODE (t)((enum tree_code) (t)->base.code) == COMPONENT_REF
    && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1))((tree_check (((*((const_cast<tree*> (tree_operand_check
 ((t), (1), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2637, __FUNCTION__)))))), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2637, __FUNCTION__, (FIELD_DECL)))->field_decl.qualifier
) != NULL_TREE(tree) nullptr)
  {
    tree repr = DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1))((tree_check (((*((const_cast<tree*> (tree_operand_check
 ((t), (1), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2639, __FUNCTION__)))))), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2639, __FUNCTION__, (FIELD_DECL)))->field_decl.qualifier
);
    instrument_derefs (iter, build3 (COMPONENT_REF, TREE_TYPE (repr)((contains_struct_check ((repr), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2640, __FUNCTION__))->typed.type),
		       TREE_OPERAND (t, 0)(*((const_cast<tree*> (tree_operand_check ((t), (0), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2641, __FUNCTION__))))), repr,
		       TREE_OPERAND (t, 2)(*((const_cast<tree*> (tree_operand_check ((t), (2), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2642, __FUNCTION__)))))),
	 location, is_store);
    return;
  }

if (!multiple_p (bitpos, BITS_PER_UNIT(8))
    || maybe_ne (bitsize, size_in_bytes * BITS_PER_UNIT(8)))
  return;

if (VAR_P (inner)(((enum tree_code) (inner)->base.code) == VAR_DECL) && DECL_HARD_REGISTER (inner)((tree_check ((inner), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2651, __FUNCTION__, (VAR_DECL)))->decl_with_vis.hard_register
))
  return;

poly_int64 decl_size;
if (VAR_P (inner)(((enum tree_code) (inner)->base.code) == VAR_DECL)
    && offset == NULL_TREE(tree) nullptr
    && DECL_SIZE (inner)((contains_struct_check ((inner), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2657, __FUNCTION__))->decl_common.size)
    && poly_int_tree_p (DECL_SIZE (inner)((contains_struct_check ((inner), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2658, __FUNCTION__))->decl_common.size), &decl_size)
    && known_subrange_p (bitpos, bitsize, 0, decl_size))
  {
    if (DECL_THREAD_LOCAL_P (inner)((((inner)->base.static_flag) || ((contains_struct_check (
(inner), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2661, __FUNCTION__))->decl_common.decl_flag_1)) &&
 decl_tls_model (inner) >= TLS_MODEL_REAL))
return;
    /* If we're not sanitizing globals and we can tell statically that this
access is inside a global variable, then there's no point adding
instrumentation to check the access.  N.b. hwasan currently never
sanitizes globals.  */
    if ((hwasan_sanitize_p () || !param_asan_globalsglobal_options.x_param_asan_globals)
 && is_global_var (inner))
      return;
    if (!TREE_STATIC (inner)((inner)->base.static_flag))
{
 /* Automatic vars in the current function will be always
    accessible.  */
 if (decl_function_context (inner) == current_function_decl
     && (!asan_sanitize_use_after_scope ()
  || !TREE_ADDRESSABLE (inner)((inner)->base.addressable_flag)))
   return;
}
    /* Always instrument external vars, they might be dynamically
initialized.  */
    else if (!DECL_EXTERNAL (inner)((contains_struct_check ((inner), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2681, __FUNCTION__))->decl_common.decl_flag_1))
{
 /* For static vars if they are known not to be dynamically
    initialized, they will be always accessible.  */
 varpool_node *vnode = varpool_node::get (inner);
 if (vnode && !vnode->dynamically_initialized)
   return;
}
  }

base = build_fold_addr_expr (t)build_fold_addr_expr_loc (((location_t) 0), (t));
if (!has_mem_ref_been_instrumented (base, size_in_bytes))
  {
    unsigned int align = get_object_alignment (t);
    build_check_stmt (location, base, NULL_TREE(tree) nullptr, size_in_bytes, iter,
	/*is_non_zero_len*/size_in_bytes > 0, /*before_p=*/true,
	is_store, /*is_scalar_access*/true, align);
    update_mem_ref_hash_table (base, size_in_bytes);
    update_mem_ref_hash_table (t, size_in_bytes);
  }

2702}

2704/*  Insert a memory reference into the hash table if access length
  can be determined in compile time.  */

2707static void
2708maybe_update_mem_ref_hash_table (tree base, tree len)
2709{
if (!POINTER_TYPE_P (TREE_TYPE (base))(((enum tree_code) (((contains_struct_check ((base), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2710, __FUNCTION__))->typed.type))->base.code) == POINTER_TYPE
 || ((enum tree_code) (((contains_struct_check ((base), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2710, __FUNCTION__))->typed.type))->base.code) == REFERENCE_TYPE
)
    || !INTEGRAL_TYPE_P (TREE_TYPE (len))(((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2711, __FUNCTION__))->typed.type))->base.code) == ENUMERAL_TYPE
 || ((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2711, __FUNCTION__))->typed.type))->base.code) == BOOLEAN_TYPE
 || ((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2711, __FUNCTION__))->typed.type))->base.code) == INTEGER_TYPE
))
  return;

HOST_WIDE_INTlong size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;

if (size_in_bytes != -1)
  update_mem_ref_hash_table (base, size_in_bytes);
2718}

2720/* Instrument an access to a contiguous memory region that starts at
 the address pointed to by BASE, over a length of LEN (expressed in
 the sizeof (*BASE) bytes).  ITER points to the instruction before
 which the instrumentation instructions must be inserted.  LOCATION
 is the source location that the instrumentation instructions must
 have.  If IS_STORE is true, then the memory access is a store;
 otherwise, it's a load.  */

2728static void
2729instrument_mem_region_access (tree base, tree len,
	      gimple_stmt_iterator *iter,
	      location_t location, bool is_store)
2732{
if (!POINTER_TYPE_P (TREE_TYPE (base))(((enum tree_code) (((contains_struct_check ((base), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2733, __FUNCTION__))->typed.type))->base.code) == POINTER_TYPE
 || ((enum tree_code) (((contains_struct_check ((base), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2733, __FUNCTION__))->typed.type))->base.code) == REFERENCE_TYPE
)
    || !INTEGRAL_TYPE_P (TREE_TYPE (len))(((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2734, __FUNCTION__))->typed.type))->base.code) == ENUMERAL_TYPE
 || ((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2734, __FUNCTION__))->typed.type))->base.code) == BOOLEAN_TYPE
 || ((enum tree_code) (((contains_struct_check ((len), (TS_TYPED
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2734, __FUNCTION__))->typed.type))->base.code) == INTEGER_TYPE
)
    || integer_zerop (len))
  return;

HOST_WIDE_INTlong size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;

if ((size_in_bytes == -1)
    || !has_mem_ref_been_instrumented (base, size_in_bytes))
  {
    build_check_stmt (location, base, len, size_in_bytes, iter,
	/*is_non_zero_len*/size_in_bytes > 0, /*before_p*/true,
	is_store, /*is_scalar_access*/false, /*align*/0);
  }

maybe_update_mem_ref_hash_table (base, len);
*iter = gsi_for_stmt (gsi_stmt (*iter));
2750}

2752/* Instrument the call to a built-in memory access function that is
 pointed to by the iterator ITER.

 Upon completion, return TRUE iff *ITER has been advanced to the
 statement following the one it was originally pointing to.  */

2758static bool
2759instrument_builtin_call (gimple_stmt_iterator *iter)
2760{
if (!(asan_memintrin () || hwasan_memintrin ()))
  return false;

bool iter_advanced_p = false;
gcall *call = as_a <gcall *> (gsi_stmt (*iter));

gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL))((void)(!(gimple_call_builtin_p (call, BUILT_IN_NORMAL)) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2767, __FUNCTION__), 0 : 0));

location_t loc = gimple_location (call);

asan_mem_ref src0, src1, dest;
asan_mem_ref_init (&src0, NULLnullptr, 1);
asan_mem_ref_init (&src1, NULLnullptr, 1);
asan_mem_ref_init (&dest, NULLnullptr, 1);

tree src0_len = NULL_TREE(tree) nullptr, src1_len = NULL_TREE(tree) nullptr, dest_len = NULL_TREE(tree) nullptr;
bool src0_is_store = false, src1_is_store = false, dest_is_store = false,
  dest_is_deref = false, intercepted_p = true;

if (get_mem_refs_of_builtin_call (call,
		    &src0, &src0_len, &src0_is_store,
		    &src1, &src1_len, &src1_is_store,
		    &dest, &dest_len, &dest_is_store,
		    &dest_is_deref, &intercepted_p, iter))
  {
    if (dest_is_deref)
{
 instrument_derefs (iter, dest.start, loc, dest_is_store);
 gsi_next (iter);
 iter_advanced_p = true;
}
    else if (!intercepted_p
      && (src0_len || src1_len || dest_len))
{
 if (src0.start != NULL_TREE(tree) nullptr)
   instrument_mem_region_access (src0.start, src0_len,
			  iter, loc, /*is_store=*/false);
 if (src1.start != NULL_TREE(tree) nullptr)
   instrument_mem_region_access (src1.start, src1_len,
			  iter, loc, /*is_store=*/false);
 if (dest.start != NULL_TREE(tree) nullptr)
   instrument_mem_region_access (dest.start, dest_len,
			  iter, loc, /*is_store=*/true);

 *iter = gsi_for_stmt (call);
 gsi_next (iter);
 iter_advanced_p = true;
}
    else
{
 if (src0.start != NULL_TREE(tree) nullptr)
   maybe_update_mem_ref_hash_table (src0.start, src0_len);
 if (src1.start != NULL_TREE(tree) nullptr)
   maybe_update_mem_ref_hash_table (src1.start, src1_len);
 if (dest.start != NULL_TREE(tree) nullptr)
   maybe_update_mem_ref_hash_table (dest.start, dest_len);
}
  }
return iter_advanced_p;
2820}

2822/*  Instrument the assignment statement ITER if it is subject to
  instrumentation.  Return TRUE iff instrumentation actually
  happened.  In that case, the iterator ITER is advanced to the next
  logical expression following the one initially pointed to by ITER,
  and the relevant memory reference that which access has been
  instrumented is added to the memory references hash table.  */

2829static bool
2830maybe_instrument_assignment (gimple_stmt_iterator *iter)
2831{
gimple *s = gsi_stmt (*iter);

gcc_assert (gimple_assign_single_p (s))((void)(!(gimple_assign_single_p (s)) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 2834, __FUNCTION__), 0 : 0));

tree ref_expr = NULL_TREE(tree) nullptr;
bool is_store, is_instrumented = false;

if (gimple_store_p (s))
  {
    ref_expr = gimple_assign_lhs (s);
    is_store = true;
    instrument_derefs (iter, ref_expr,
	 gimple_location (s),
	 is_store);
    is_instrumented = true;
  }

if (gimple_assign_load_p (s))
  {
    ref_expr = gimple_assign_rhs1 (s);
    is_store = false;
    instrument_derefs (iter, ref_expr,
	 gimple_location (s),
	 is_store);
    is_instrumented = true;
  }

if (is_instrumented)
  gsi_next (iter);

return is_instrumented;
2863}

2865/* Instrument the function call pointed to by the iterator ITER, if it
 is subject to instrumentation.  At the moment, the only function
 calls that are instrumented are some built-in functions that access
 memory.  Look at instrument_builtin_call to learn more.

 Upon completion return TRUE iff *ITER was advanced to the statement
 following the one it was originally pointing to.  */

2873static bool
2874maybe_instrument_call (gimple_stmt_iterator *iter)
2875{
gimple *stmt = gsi_stmt (*iter);
bool is_builtin = gimple_call_builtin_p (stmt, BUILT_IN_NORMAL);

if (is_builtin && instrument_builtin_call (iter))
  return true;

if (gimple_call_noreturn_p (stmt))
  {
    if (is_builtin)
{
 tree callee = gimple_call_fndecl (stmt);
 switch (DECL_FUNCTION_CODE (callee))
   {
   case BUILT_IN_UNREACHABLE:
   case BUILT_IN_TRAP:
     /* Don't instrument these.  */
     return false;
   default:
     break;
   }
}
    /* If a function does not return, then we must handle clearing up the
shadow stack accordingly.  For ASAN we can simply set the entire stack
to "valid" for accesses by setting the shadow space to 0 and all
accesses will pass checks.  That means that some bad accesses may be
missed, but we will not report any false positives.

This is not possible for HWASAN.  Since there is no "always valid" tag
we can not set any space to "always valid".  If we were to clear the
entire shadow stack then code resuming from `longjmp` or a caught
exception would trigger false positives when correctly accessing
variables on the stack.  Hence we need to handle things like
`longjmp`, thread exit, and exceptions in a different way.  These
problems must be handled externally to the compiler, e.g. in the
language runtime.  */
    if (! hwasan_sanitize_p ())
{
 tree decl = builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN);
 gimple *g = gimple_build_call (decl, 0);
 gimple_set_location (g, gimple_location (stmt));
 gsi_insert_before (iter, g, GSI_SAME_STMT);
}
  }

bool instrumented = false;
if (gimple_store_p (stmt))
  {
    tree ref_expr = gimple_call_lhs (stmt);
    instrument_derefs (iter, ref_expr,
	 gimple_location (stmt),
	 /*is_store=*/true);

    instrumented = true;
  }

/* Walk through gimple_call arguments and check them id needed.  */
unsigned args_num = gimple_call_num_args (stmt);
for (unsigned i = 0; i < args_num; ++i)
  {
    tree arg = gimple_call_arg (stmt, i);
    /* If ARG is not a non-aggregate register variable, compiler in general
creates temporary for it and pass it as argument to gimple call.
But in some cases, e.g. when we pass by value a small structure that
fits to register, compiler can avoid extra overhead by pulling out
these temporaries.  In this case, we should check the argument.  */
    if (!is_gimple_reg (arg) && !is_gimple_min_invariant (arg))
{
 instrument_derefs (iter, arg,
	     gimple_location (stmt),
	     /*is_store=*/false);
 instrumented = true;
}
  }
if (instrumented)
  gsi_next (iter);
return instrumented;
2952}

2954/* Walk each instruction of all basic block and instrument those that
 represent memory references: loads, stores, or function calls.
 In a given basic block, this function avoids instrumenting memory
 references that have already been instrumented.  */

2959static void
2960transform_statements (void)
2961{
basic_block bb, last_bb = NULLnullptr;
gimple_stmt_iterator i;
int saved_last_basic_block = last_basic_block_for_fn (cfun)(((cfun + 0))->cfg->x_last_basic_block);

FOR_EACH_BB_FN (bb, cfun)for (bb = ((cfun + 0))->cfg->x_entry_block_ptr->next_bb
; bb != ((cfun + 0))->cfg->x_exit_block_ptr; bb = bb->
next_bb)
  {
    basic_block prev_bb = bb;

    if (bb->index >= saved_last_basic_block) continue;

    /* Flush the mem ref hash table, if current bb doesn't have
exactly one predecessor, or if that predecessor (skipping
over asan created basic blocks) isn't the last processed
basic block.  Thus we effectively flush on extended basic
block boundaries.  */
    while (single_pred_p (prev_bb))
{
 prev_bb = single_pred (prev_bb);
 if (prev_bb->index < saved_last_basic_block)
   break;
}
    if (prev_bb != last_bb)
empty_mem_ref_hash_table ();
    last_bb = bb;

    for (i = gsi_start_bb (bb); !gsi_end_p (i);)
{
 gimple *s = gsi_stmt (i);

 if (has_stmt_been_instrumented_p (s))
   gsi_next (&i);
 else if (gimple_assign_single_p (s)
   && !gimple_clobber_p (s)
   && maybe_instrument_assignment (&i))
   /*  Nothing to do as maybe_instrument_assignment advanced
the iterator I.  */;
 else if (is_gimple_call (s) && maybe_instrument_call (&i))
   /*  Nothing to do as maybe_instrument_call
advanced the iterator I.  */;
 else
   {
     /* No instrumentation happened.

 If the current instruction is a function call that
 might free something, let's forget about the memory
 references that got instrumented.  Otherwise we might
 miss some instrumentation opportunities.  Do the same
 for a ASAN_MARK poisoning internal function.  */
     if (is_gimple_call (s)
  && (!nonfreeing_call_p (s)
      || asan_mark_p (s, ASAN_MARK_POISON)))
empty_mem_ref_hash_table ();

     gsi_next (&i);
   }
}
  }
free_mem_ref_resources ();
3020}

3022/* Build
 __asan_before_dynamic_init (module_name)
 or
 __asan_after_dynamic_init ()
 call.  */

3028tree
3029asan_dynamic_init_call (bool after_p)
3030{
if (shadow_ptr_types[0] == NULL_TREE(tree) nullptr)
  asan_init_shadow_ptr_types ();

tree fn = builtin_decl_implicit (after_p
		   ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
		   : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT);
tree module_name_cst = NULL_TREE(tree) nullptr;
if (!after_p)
  {
    pretty_printer module_name_pp;
    pp_string (&module_name_pp, main_input_filenameglobal_options.x_main_input_filename);

    module_name_cst = asan_pp_string (&module_name_pp);
    module_name_cst = fold_convert (const_ptr_type_node,fold_convert_loc (((location_t) 0), global_trees[TI_CONST_PTR_TYPE
], module_name_cst)
		      module_name_cst)fold_convert_loc (((location_t) 0), global_trees[TI_CONST_PTR_TYPE
], module_name_cst);
  }

return build_call_expr (fn, after_p ? 0 : 1, module_name_cst);
3049}

3051/* Build
 struct __asan_global
 {
   const void *__beg;
   uptr __size;
   uptr __size_with_redzone;
   const void *__name;
   const void *__module_name;
   uptr __has_dynamic_init;
   __asan_global_source_location *__location;
   char *__odr_indicator;
 } type.  */

3064static tree
3065asan_global_struct (void)
3066{
static const char *field_names[]
  = { "__beg", "__size", "__size_with_redzone",
"__name", "__module_name", "__has_dynamic_init", "__location",
"__odr_indicator" };
tree fields[ARRAY_SIZE (field_names)(sizeof (field_names) / sizeof ((field_names)[0]))], ret;
unsigned i;

ret = make_node (RECORD_TYPE);
for (i = 0; i < ARRAY_SIZE (field_names)(sizeof (field_names) / sizeof ((field_names)[0])); i++)
  {
    fields[i]
= build_decl (UNKNOWN_LOCATION((location_t) 0), FIELD_DECL,
      get_identifier (field_names[i])(__builtin_constant_p (field_names[i]) ? get_identifier_with_length
 ((field_names[i]), strlen (field_names[i])) : get_identifier
 (field_names[i])),
      (i == 0 || i == 3) ? const_ptr_type_nodeglobal_trees[TI_CONST_PTR_TYPE]
      : pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]);
    DECL_CONTEXT (fields[i])((contains_struct_check ((fields[i]), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3082, __FUNCTION__))->decl_minimal.context) = ret;
    if (i)
DECL_CHAIN (fields[i - 1])(((contains_struct_check (((contains_struct_check ((fields[i -
 1]), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3084, __FUNCTION__))), (TS_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3084, __FUNCTION__))->common.chain)) = fields[i];
  }
tree type_decl = build_decl (input_location, TYPE_DECL,
	       get_identifier ("__asan_global")(__builtin_constant_p ("__asan_global") ? get_identifier_with_length
 (("__asan_global"), strlen ("__asan_global")) : get_identifier
 ("__asan_global")), ret);
DECL_IGNORED_P (type_decl)((contains_struct_check ((type_decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3088, __FUNCTION__))->decl_common.ignored_flag) = 1;
DECL_ARTIFICIAL (type_decl)((contains_struct_check ((type_decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3089, __FUNCTION__))->decl_common.artificial_flag) = 1;
TYPE_FIELDS (ret)((tree_check3 ((ret), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3090, __FUNCTION__, (RECORD_TYPE), (UNION_TYPE), (QUAL_UNION_TYPE
)))->type_non_common.values) = fields[0];
TYPE_NAME (ret)((tree_class_check ((ret), (tcc_type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3091, __FUNCTION__))->type_common.name) = type_decl;
TYPE_STUB_DECL (ret)(((contains_struct_check (((tree_class_check ((ret), (tcc_type
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3092, __FUNCTION__))), (TS_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3092, __FUNCTION__))->common.chain)) = type_decl;
TYPE_ARTIFICIAL (ret)((tree_class_check ((ret), (tcc_type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3093, __FUNCTION__))->base.nowarning_flag) = 1;
layout_type (ret);
return ret;
3096}

3098/* Create and return odr indicator symbol for DECL.
 TYPE is __asan_global struct type as returned by asan_global_struct.  */

3101static tree
3102create_odr_indicator (tree decl, tree type)
3103{
char *name;
tree uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)))((contains_struct_check (((((contains_struct_check (((contains_struct_check
 ((((tree_check3 ((type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3105, __FUNCTION__, (RECORD_TYPE), (UNION_TYPE), (QUAL_UNION_TYPE
)))->type_non_common.values)), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3105, __FUNCTION__))), (TS_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3105, __FUNCTION__))->common.chain))), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3105, __FUNCTION__))->typed.type);
tree decl_name
  = (HAS_DECL_ASSEMBLER_NAME_P (decl)((tree_contains_struct[(((enum tree_code) (decl)->base.code
))][(TS_DECL_WITH_VIS)])) ? DECL_ASSEMBLER_NAME (decl)decl_assembler_name (decl)
			: DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3108, __FUNCTION__))->decl_minimal.name));
/* DECL_NAME theoretically might be NULL.  Bail out with 0 in this case.  */
if (decl_name == NULL_TREE(tree) nullptr)
  return build_int_cst (uptr, 0);
const char *dname = IDENTIFIER_POINTER (decl_name)((const char *) (tree_check ((decl_name), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3112, __FUNCTION__, (IDENTIFIER_NODE)))->identifier.id.str
);
if (HAS_DECL_ASSEMBLER_NAME_P (decl)((tree_contains_struct[(((enum tree_code) (decl)->base.code
))][(TS_DECL_WITH_VIS)])))
  dname = targetm.strip_name_encoding (dname);
size_t len = strlen (dname) + sizeof ("__odr_asan_");
name = XALLOCAVEC (char, len)((char *) __builtin_alloca(sizeof (char) * (len)));
snprintf (name, len, "__odr_asan_%s", dname);
3118#ifndef NO_DOT_IN_LABEL
name[sizeof ("__odr_asan") - 1] = '.';
3120#elif !defined(NO_DOLLAR_IN_LABEL)
name[sizeof ("__odr_asan") - 1] = '$';
3122#endif
tree var = build_decl (UNKNOWN_LOCATION((location_t) 0), VAR_DECL, get_identifier (name)(__builtin_constant_p (name) ? get_identifier_with_length ((name
), strlen (name)) : get_identifier (name)),
	 char_type_nodeinteger_types[itk_char]);
TREE_ADDRESSABLE (var)((var)->base.addressable_flag) = 1;
TREE_READONLY (var)((non_type_check ((var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3126, __FUNCTION__))->base.readonly_flag) = 0;
TREE_THIS_VOLATILE (var)((var)->base.volatile_flag) = 1;
DECL_ARTIFICIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3128, __FUNCTION__))->decl_common.artificial_flag) = 1;
DECL_IGNORED_P (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3129, __FUNCTION__))->decl_common.ignored_flag) = 1;
TREE_STATIC (var)((var)->base.static_flag) = 1;
TREE_PUBLIC (var)((var)->base.public_flag) = 1;
DECL_VISIBILITY (var)((contains_struct_check ((var), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3132, __FUNCTION__))->decl_with_vis.visibility) = DECL_VISIBILITY (decl)((contains_struct_check ((decl), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3132, __FUNCTION__))->decl_with_vis.visibility);
DECL_VISIBILITY_SPECIFIED (var)((contains_struct_check ((var), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3133, __FUNCTION__))->decl_with_vis.visibility_specified
) = DECL_VISIBILITY_SPECIFIED (decl)((contains_struct_check ((decl), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3133, __FUNCTION__))->decl_with_vis.visibility_specified
);

TREE_USED (var)((var)->base.used_flag) = 1;
tree ctor = build_constructor_va (TREE_TYPE (var)((contains_struct_check ((var), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3136, __FUNCTION__))->typed.type), 1, NULL_TREE(tree) nullptr,
		    build_int_cst (unsigned_type_nodeinteger_types[itk_unsigned_int], 0));
TREE_CONSTANT (ctor)((non_type_check ((ctor), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3138, __FUNCTION__))->base.constant_flag) = 1;
TREE_STATIC (ctor)((ctor)->base.static_flag) = 1;
DECL_INITIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3140, __FUNCTION__))->decl_common.initial) = ctor;
DECL_ATTRIBUTES (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3141, __FUNCTION__))->decl_common.attributes) = tree_cons (get_identifier ("asan odr indicator")(__builtin_constant_p ("asan odr indicator") ? get_identifier_with_length
 (("asan odr indicator"), strlen ("asan odr indicator")) : get_identifier
 ("asan odr indicator")),
		     NULLnullptr, DECL_ATTRIBUTES (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3142, __FUNCTION__))->decl_common.attributes));
make_decl_rtl (var);
varpool_node::finalize_decl (var);
return fold_convert (uptr, build_fold_addr_expr (var))fold_convert_loc (((location_t) 0), uptr, build_fold_addr_expr_loc
 (((location_t) 0), (var)));
3146}

3148/* Return true if DECL, a global var, might be overridden and needs
 an additional odr indicator symbol.  */

3151static bool
3152asan_needs_odr_indicator_p (tree decl)
3153{
/* Don't emit ODR indicators for kernel because:
   a) Kernel is written in C thus doesn't need ODR indicators.
   b) Some kernel code may have assumptions about symbols containing specific
      patterns in their names.  Since ODR indicators contain original names
      of symbols they are emitted for, these assumptions would be broken for
      ODR indicator symbols.  */
return (!(flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_KERNEL_ADDRESS)
 && !DECL_ARTIFICIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3161, __FUNCTION__))->decl_common.artificial_flag)
 && !DECL_WEAK (decl)((contains_struct_check ((decl), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3162, __FUNCTION__))->decl_with_vis.weak_flag)
 && TREE_PUBLIC (decl)((decl)->base.public_flag));
3164}

3166/* Append description of a single global DECL into vector V.
 TYPE is __asan_global struct type as returned by asan_global_struct.  */

3169static void
3170asan_add_global (tree decl, tree type, vec<constructor_elt, va_gc> *v)
3171{
tree init, uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)))((contains_struct_check (((((contains_struct_check (((contains_struct_check
 ((((tree_check3 ((type), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3172, __FUNCTION__, (RECORD_TYPE), (UNION_TYPE), (QUAL_UNION_TYPE
)))->type_non_common.values)), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3172, __FUNCTION__))), (TS_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3172, __FUNCTION__))->common.chain))), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3172, __FUNCTION__))->typed.type);
unsigned HOST_WIDE_INTlong size;
tree str_cst, module_name_cst, refdecl = decl;
vec<constructor_elt, va_gc> *vinner = NULLnullptr;

pretty_printer asan_pp, module_name_pp;

if (DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3179, __FUNCTION__))->decl_minimal.name))
9
←
Assuming field 'name' is null→
10
←
Taking false branch→
  pp_tree_identifier (&asan_pp, DECL_NAME (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3180, __FUNCTION__))->decl_minimal.name));
else
  pp_string (&asan_pp, "<unknown>");
str_cst = asan_pp_string (&asan_pp);

pp_string (&module_name_pp, main_input_filenameglobal_options.x_main_input_filename);
module_name_cst = asan_pp_string (&module_name_pp);

if (asan_needs_local_alias (decl))
11
←
Taking false branch→
  {
    char buf[20];
    ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", vec_safe_length (v) + 1)do { char *__p; (buf)[0] = '*'; (buf)[1] = '.'; __p = stpcpy (
&(buf)[2], "LASAN"); sprint_ul (__p, (unsigned long) (vec_safe_length
 (v) + 1)); } while (0);
    refdecl = build_decl (DECL_SOURCE_LOCATION (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3192, __FUNCTION__))->decl_minimal.locus),
	    VAR_DECL, get_identifier (buf)(__builtin_constant_p (buf) ? get_identifier_with_length ((buf
), strlen (buf)) : get_identifier (buf)), TREE_TYPE (decl)((contains_struct_check ((decl), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3193, __FUNCTION__))->typed.type));
    TREE_ADDRESSABLE (refdecl)((refdecl)->base.addressable_flag) = TREE_ADDRESSABLE (decl)((decl)->base.addressable_flag);
    TREE_READONLY (refdecl)((non_type_check ((refdecl), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3195, __FUNCTION__))->base.readonly_flag) = TREE_READONLY (decl)((non_type_check ((decl), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3195, __FUNCTION__))->base.readonly_flag);
    TREE_THIS_VOLATILE (refdecl)((refdecl)->base.volatile_flag) = TREE_THIS_VOLATILE (decl)((decl)->base.volatile_flag);
    DECL_NOT_GIMPLE_REG_P (refdecl)(contains_struct_check ((refdecl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3197, __FUNCTION__))->decl_common.not_gimple_reg_flag = DECL_NOT_GIMPLE_REG_P (decl)(contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3197, __FUNCTION__))->decl_common.not_gimple_reg_flag;
    DECL_ARTIFICIAL (refdecl)((contains_struct_check ((refdecl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3198, __FUNCTION__))->decl_common.artificial_flag) = DECL_ARTIFICIAL (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3198, __FUNCTION__))->decl_common.artificial_flag);
    DECL_IGNORED_P (refdecl)((contains_struct_check ((refdecl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3199, __FUNCTION__))->decl_common.ignored_flag) = DECL_IGNORED_P (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3199, __FUNCTION__))->decl_common.ignored_flag);
    TREE_STATIC (refdecl)((refdecl)->base.static_flag) = 1;
    TREE_PUBLIC (refdecl)((refdecl)->base.public_flag) = 0;
    TREE_USED (refdecl)((refdecl)->base.used_flag) = 1;
    assemble_alias (refdecl, DECL_ASSEMBLER_NAME (decl)decl_assembler_name (decl));
  }

tree odr_indicator_ptr
  = (asan_needs_odr_indicator_p (decl) ? create_odr_indicator (decl, type)
12
←
'?' condition is false→
			 : build_int_cst (uptr, 0));
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], build_fold_addr_expr_loc
 (((location_t) 0), (refdecl)))}; vec_safe_push ((vinner), _ce___
); } while (0)
13
←
Calling 'vec_safe_push<constructor_elt, va_gc>'→
34
←
Returning from 'vec_safe_push<constructor_elt, va_gc>'→
35
←
Loop condition is false.  Exiting loop→
	  fold_convert (const_ptr_type_node,do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], build_fold_addr_expr_loc
 (((location_t) 0), (refdecl)))}; vec_safe_push ((vinner), _ce___
); } while (0)
			build_fold_addr_expr (refdecl)))do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], build_fold_addr_expr_loc
 (((location_t) 0), (refdecl)))}; vec_safe_push ((vinner), _ce___
); } while (0);
size = tree_to_uhwi (DECL_SIZE_UNIT (decl)((contains_struct_check ((decl), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3212, __FUNCTION__))->decl_common.size_unit));
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size))do { constructor_elt _ce___ = {(tree) nullptr, build_int_cst (
uptr, size)}; vec_safe_push ((vinner), _ce___); } while (0);
36
←
Passing value via 1st parameter 'v'→
37
←
Calling 'vec_safe_push<constructor_elt, va_gc>'→
size += asan_red_zone_size (size);
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size))do { constructor_elt _ce___ = {(tree) nullptr, build_int_cst (
uptr, size)}; vec_safe_push ((vinner), _ce___); } while (0);
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], str_cst)
}; vec_safe_push ((vinner), _ce___); } while (0)
	  fold_convert (const_ptr_type_node, str_cst))do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], str_cst)
}; vec_safe_push ((vinner), _ce___); } while (0);
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], module_name_cst
)}; vec_safe_push ((vinner), _ce___); } while (0)
	  fold_convert (const_ptr_type_node, module_name_cst))do { constructor_elt _ce___ = {(tree) nullptr, fold_convert_loc
 (((location_t) 0), global_trees[TI_CONST_PTR_TYPE], module_name_cst
)}; vec_safe_push ((vinner), _ce___); } while (0);
varpool_node *vnode = varpool_node::get (decl);
int has_dynamic_init = 0;
/* FIXME: Enable initialization order fiasco detection in LTO mode once
   proper fix for PR 79061 will be applied.  */
if (!in_lto_pglobal_options.x_in_lto_p)
  has_dynamic_init = vnode ? vnode->dynamically_initialized : 0;
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,do { constructor_elt _ce___ = {(tree) nullptr, build_int_cst (
uptr, has_dynamic_init)}; vec_safe_push ((vinner), _ce___); }
 while (0)
	  build_int_cst (uptr, has_dynamic_init))do { constructor_elt _ce___ = {(tree) nullptr, build_int_cst (
uptr, has_dynamic_init)}; vec_safe_push ((vinner), _ce___); }
 while (0);
tree locptr = NULL_TREE(tree) nullptr;
location_t loc = DECL_SOURCE_LOCATION (decl)((contains_struct_check ((decl), (TS_DECL_MINIMAL), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3229, __FUNCTION__))->decl_minimal.locus);
expanded_location xloc = expand_location (loc);
if (xloc.file != NULLnullptr)
  {
    static int lasanloccnt = 0;
    char buf[25];
    ASM_GENERATE_INTERNAL_LABEL (buf, "LASANLOC", ++lasanloccnt)do { char *__p; (buf)[0] = '*'; (buf)[1] = '.'; __p = stpcpy (
&(buf)[2], "LASANLOC"); sprint_ul (__p, (unsigned long) (
++lasanloccnt)); } while (0);
    tree var = build_decl (UNKNOWN_LOCATION((location_t) 0), VAR_DECL, get_identifier (buf)(__builtin_constant_p (buf) ? get_identifier_with_length ((buf
), strlen (buf)) : get_identifier (buf)),
	     ubsan_get_source_location_type ());
    TREE_STATIC (var)((var)->base.static_flag) = 1;
    TREE_PUBLIC (var)((var)->base.public_flag) = 0;
    DECL_ARTIFICIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3240, __FUNCTION__))->decl_common.artificial_flag) = 1;
    DECL_IGNORED_P (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3241, __FUNCTION__))->decl_common.ignored_flag) = 1;
    pretty_printer filename_pp;
    pp_string (&filename_pp, xloc.file);
    tree str = asan_pp_string (&filename_pp);
    tree ctor = build_constructor_va (TREE_TYPE (var)((contains_struct_check ((var), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3245, __FUNCTION__))->typed.type), 3,
			NULL_TREE(tree) nullptr, str, NULL_TREE(tree) nullptr,
			build_int_cst (unsigned_type_nodeinteger_types[itk_unsigned_int],
				       xloc.line), NULL_TREE(tree) nullptr,
			build_int_cst (unsigned_type_nodeinteger_types[itk_unsigned_int],
				       xloc.column));
    TREE_CONSTANT (ctor)((non_type_check ((ctor), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3251, __FUNCTION__))->base.constant_flag) = 1;
    TREE_STATIC (ctor)((ctor)->base.static_flag) = 1;
    DECL_INITIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3253, __FUNCTION__))->decl_common.initial) = ctor;
    varpool_node::finalize_decl (var);
    locptr = fold_convert (uptr, build_fold_addr_expr (var))fold_convert_loc (((location_t) 0), uptr, build_fold_addr_expr_loc
 (((location_t) 0), (var)));
  }
else
  locptr = build_int_cst (uptr, 0);
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, locptr)do { constructor_elt _ce___ = {(tree) nullptr, locptr}; vec_safe_push
 ((vinner), _ce___); } while (0);
CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, odr_indicator_ptr)do { constructor_elt _ce___ = {(tree) nullptr, odr_indicator_ptr
}; vec_safe_push ((vinner), _ce___); } while (0);
init = build_constructor (type, vinner);
CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, init)do { constructor_elt _ce___ = {(tree) nullptr, init}; vec_safe_push
 ((v), _ce___); } while (0);
3263}

3265/* Initialize sanitizer.def builtins if the FE hasn't initialized them.  */
3266void
3267initialize_sanitizer_builtins (void)
3268{
tree decl;

if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT))
  return;

tree BT_FN_VOID = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_PTR
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_CONST_PTR
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], const_ptr_type_nodeglobal_trees[TI_CONST_PTR_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_PTR_PTR
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE],
		ptr_type_nodeglobal_trees[TI_PTR_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_PTR_PTR_PTR
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE],
		ptr_type_nodeglobal_trees[TI_PTR_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_PTR_PTRMODE
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE],
		pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_INT
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], integer_type_nodeinteger_types[itk_int], NULL_TREE(tree) nullptr);
tree BT_FN_SIZE_CONST_PTR_INT
  = build_function_type_list (size_type_nodeglobal_trees[TI_SIZE_TYPE], const_ptr_type_nodeglobal_trees[TI_CONST_PTR_TYPE],
		integer_type_nodeinteger_types[itk_int], NULL_TREE(tree) nullptr);

tree BT_FN_VOID_UINT8_UINT8
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], unsigned_char_type_nodeinteger_types[itk_unsigned_char],
		unsigned_char_type_nodeinteger_types[itk_unsigned_char], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_UINT16_UINT16
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], uint16_type_nodeglobal_trees[TI_UINT16_TYPE],
		uint16_type_nodeglobal_trees[TI_UINT16_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_UINT32_UINT32
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], uint32_type_nodeglobal_trees[TI_UINT32_TYPE],
		uint32_type_nodeglobal_trees[TI_UINT32_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_UINT64_UINT64
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], uint64_type_nodeglobal_trees[TI_UINT64_TYPE],
		uint64_type_nodeglobal_trees[TI_UINT64_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_FLOAT_FLOAT
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], float_type_nodeglobal_trees[TI_FLOAT_TYPE],
		float_type_nodeglobal_trees[TI_FLOAT_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_DOUBLE_DOUBLE
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], double_type_nodeglobal_trees[TI_DOUBLE_TYPE],
		double_type_nodeglobal_trees[TI_DOUBLE_TYPE], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_UINT64_PTR
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], uint64_type_nodeglobal_trees[TI_UINT64_TYPE],
		ptr_type_nodeglobal_trees[TI_PTR_TYPE], NULL_TREE(tree) nullptr);

tree BT_FN_PTR_CONST_PTR_UINT8
  = build_function_type_list (ptr_type_nodeglobal_trees[TI_PTR_TYPE], const_ptr_type_nodeglobal_trees[TI_CONST_PTR_TYPE],
		unsigned_char_type_nodeinteger_types[itk_unsigned_char], NULL_TREE(tree) nullptr);
tree BT_FN_VOID_PTR_UINT8_PTRMODE
  = build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], ptr_type_nodeglobal_trees[TI_PTR_TYPE],
		unsigned_char_type_nodeinteger_types[itk_unsigned_char],
		pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], NULL_TREE(tree) nullptr);

tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5];
tree BT_FN_IX_CONST_VPTR_INT[5];
tree BT_FN_IX_VPTR_IX_INT[5];
tree BT_FN_VOID_VPTR_IX_INT[5];
tree vptr
  = build_pointer_type (build_qualified_type (void_type_nodeglobal_trees[TI_VOID_TYPE],
				TYPE_QUAL_VOLATILE));
tree cvptr
  = build_pointer_type (build_qualified_type (void_type_nodeglobal_trees[TI_VOID_TYPE],
				TYPE_QUAL_VOLATILE
				|TYPE_QUAL_CONST));
tree boolt
  = lang_hooks.types.type_for_size (BOOL_TYPE_SIZE(8), 1);
int i;
for (i = 0; i < 5; i++)
  {
    tree ix = build_nonstandard_integer_type (BITS_PER_UNIT(8) * (1 << i), 1);
    BT_FN_BOOL_VPTR_PTR_IX_INT_INT[i]
= build_function_type_list (boolt, vptr, ptr_type_nodeglobal_trees[TI_PTR_TYPE], ix,
		    integer_type_nodeinteger_types[itk_int], integer_type_nodeinteger_types[itk_int],
		    NULL_TREE(tree) nullptr);
    BT_FN_IX_CONST_VPTR_INT[i]
= build_function_type_list (ix, cvptr, integer_type_nodeinteger_types[itk_int], NULL_TREE(tree) nullptr);
    BT_FN_IX_VPTR_IX_INT[i]
= build_function_type_list (ix, vptr, ix, integer_type_nodeinteger_types[itk_int],
		    NULL_TREE(tree) nullptr);
    BT_FN_VOID_VPTR_IX_INT[i]
= build_function_type_list (void_type_nodeglobal_trees[TI_VOID_TYPE], vptr, ix,
		    integer_type_nodeinteger_types[itk_int], NULL_TREE(tree) nullptr);
  }
3354#define BT_FN_BOOL_VPTR_PTR_I1_INT_INTBT_FN_BOOL_VPTR_PTR_IX_INT_INT[0] BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
3355#define BT_FN_I1_CONST_VPTR_INTBT_FN_IX_CONST_VPTR_INT[0] BT_FN_IX_CONST_VPTR_INT[0]
3356#define BT_FN_I1_VPTR_I1_INTBT_FN_IX_VPTR_IX_INT[0] BT_FN_IX_VPTR_IX_INT[0]
3357#define BT_FN_VOID_VPTR_I1_INTBT_FN_VOID_VPTR_IX_INT[0] BT_FN_VOID_VPTR_IX_INT[0]
3358#define BT_FN_BOOL_VPTR_PTR_I2_INT_INTBT_FN_BOOL_VPTR_PTR_IX_INT_INT[1] BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
3359#define BT_FN_I2_CONST_VPTR_INTBT_FN_IX_CONST_VPTR_INT[1] BT_FN_IX_CONST_VPTR_INT[1]
3360#define BT_FN_I2_VPTR_I2_INTBT_FN_IX_VPTR_IX_INT[1] BT_FN_IX_VPTR_IX_INT[1]
3361#define BT_FN_VOID_VPTR_I2_INTBT_FN_VOID_VPTR_IX_INT[1] BT_FN_VOID_VPTR_IX_INT[1]
3362#define BT_FN_BOOL_VPTR_PTR_I4_INT_INTBT_FN_BOOL_VPTR_PTR_IX_INT_INT[2] BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
3363#define BT_FN_I4_CONST_VPTR_INTBT_FN_IX_CONST_VPTR_INT[2] BT_FN_IX_CONST_VPTR_INT[2]
3364#define BT_FN_I4_VPTR_I4_INTBT_FN_IX_VPTR_IX_INT[2] BT_FN_IX_VPTR_IX_INT[2]
3365#define BT_FN_VOID_VPTR_I4_INTBT_FN_VOID_VPTR_IX_INT[2] BT_FN_VOID_VPTR_IX_INT[2]
3366#define BT_FN_BOOL_VPTR_PTR_I8_INT_INTBT_FN_BOOL_VPTR_PTR_IX_INT_INT[3] BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
3367#define BT_FN_I8_CONST_VPTR_INTBT_FN_IX_CONST_VPTR_INT[3] BT_FN_IX_CONST_VPTR_INT[3]
3368#define BT_FN_I8_VPTR_I8_INTBT_FN_IX_VPTR_IX_INT[3] BT_FN_IX_VPTR_IX_INT[3]
3369#define BT_FN_VOID_VPTR_I8_INTBT_FN_VOID_VPTR_IX_INT[3] BT_FN_VOID_VPTR_IX_INT[3]
3370#define BT_FN_BOOL_VPTR_PTR_I16_INT_INTBT_FN_BOOL_VPTR_PTR_IX_INT_INT[4] BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
3371#define BT_FN_I16_CONST_VPTR_INTBT_FN_IX_CONST_VPTR_INT[4] BT_FN_IX_CONST_VPTR_INT[4]
3372#define BT_FN_I16_VPTR_I16_INTBT_FN_IX_VPTR_IX_INT[4] BT_FN_IX_VPTR_IX_INT[4]
3373#define BT_FN_VOID_VPTR_I16_INTBT_FN_VOID_VPTR_IX_INT[4] BT_FN_VOID_VPTR_IX_INT[4]
3374#undef ATTR_NOTHROW_LIST(1 << 6)
3375#define ATTR_NOTHROW_LIST(1 << 6) ECF_NOTHROW(1 << 6)
3376#undef ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3377#define ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10) ECF_NOTHROW(1 << 6) | ECF_LEAF(1 << 10)
3378#undef ATTR_TMPURE_NOTHROW_LEAF_LIST(1 << 12) | (1 << 6) | (1 << 10)
3379#define ATTR_TMPURE_NOTHROW_LEAF_LIST(1 << 12) | (1 << 6) | (1 << 10) ECF_TM_PURE(1 << 12) | ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3380#undef ATTR_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10)
3381#define ATTR_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10) ECF_NORETURN(1 << 3) | ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3382#undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST(1 << 0) | (1 << 3) | (1 << 6) | (1 <<
 10)
3383#define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST(1 << 0) | (1 << 3) | (1 << 6) | (1 <<
 10) \
ECF_CONST(1 << 0) | ATTR_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10)
3385#undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST(1 << 12) | (1 << 3) | (1 << 6) | (1 <<
 10)
3386#define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST(1 << 12) | (1 << 3) | (1 << 6) | (1 <<
 10) \
ECF_TM_PURE(1 << 12) | ATTR_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10)
3388#undef ATTR_COLD_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3389#define ATTR_COLD_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10) \
/* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3391#undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10)
3392#define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10) \
/* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST(1 << 3) | (1 << 6) | (1 << 10)
3394#undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST(1 << 0) | (1 << 3) | (1 << 6) | (1 <<
 10)
3395#define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST(1 << 0) | (1 << 3) | (1 << 6) | (1 <<
 10) \
/* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST(1 << 0) | (1 << 3) | (1 << 6) | (1 <<
 10)
3397#undef ATTR_PURE_NOTHROW_LEAF_LIST(1 << 1) | (1 << 6) | (1 << 10)
3398#define ATTR_PURE_NOTHROW_LEAF_LIST(1 << 1) | (1 << 6) | (1 << 10) ECF_PURE(1 << 1) | ATTR_NOTHROW_LEAF_LIST(1 << 6) | (1 << 10)
3399#undef DEF_BUILTIN_STUB
3400#define DEF_BUILTIN_STUB(ENUM, NAME)
3401#undef DEF_SANITIZER_BUILTIN_1
3402#define DEF_SANITIZER_BUILTIN_1(ENUM, NAME, TYPE, ATTRS)		\
do {									\
  decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM,		\
		 BUILT_IN_NORMAL, NAME, NULL_TREE(tree) nullptr);	\
  set_call_expr_flags (decl, ATTRS);					\
  set_builtin_decl (ENUM, decl, true);				\
} while (0)
3409#undef DEF_SANITIZER_BUILTIN
3410#define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS)	\
DEF_SANITIZER_BUILTIN_1 (ENUM, NAME, TYPE, ATTRS);

3413#include "sanitizer.def"

/* -fsanitize=object-size uses __builtin_object_size, but that might
   not be available for e.g. Fortran at this point.  We use
   DEF_SANITIZER_BUILTIN here only as a convenience macro.  */
if ((flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_OBJECT_SIZE)
    && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE))
  DEF_SANITIZER_BUILTIN_1 (BUILT_IN_OBJECT_SIZE, "object_size",
	     BT_FN_SIZE_CONST_PTR_INT,
	     ATTR_PURE_NOTHROW_LEAF_LIST(1 << 1) | (1 << 6) | (1 << 10));

3424#undef DEF_SANITIZER_BUILTIN_1
3425#undef DEF_SANITIZER_BUILTIN
3426#undef DEF_BUILTIN_STUB
3427}

3429/* Called via htab_traverse.  Count number of emitted
 STRING_CSTs in the constant hash table.  */

3432int
3433count_string_csts (constant_descriptor_tree **slot,
   unsigned HOST_WIDE_INTlong *data)
3435{
struct constant_descriptor_tree *desc = *slot;
if (TREE_CODE (desc->value)((enum tree_code) (desc->value)->base.code) == STRING_CST
    && TREE_ASM_WRITTEN (desc->value)((desc->value)->base.asm_written_flag)
    && asan_protect_global (desc->value))
  ++*data;
return 1;
3442}

3444/* Helper structure to pass two parameters to
 add_string_csts.  */

3447struct asan_add_string_csts_data
3448{
tree type;
vec<constructor_elt, va_gc> *v;
3451};

3453/* Called via hash_table::traverse.  Call asan_add_global
 on emitted STRING_CSTs from the constant hash table.  */

3456int
3457add_string_csts (constant_descriptor_tree **slot,
 asan_add_string_csts_data *aascd)
3459{
struct constant_descriptor_tree *desc = *slot;
if (TREE_CODE (desc->value)((enum tree_code) (desc->value)->base.code) == STRING_CST
1
Assuming field 'code' is equal to STRING_CST→
3
←
Taking true branch→
    && TREE_ASM_WRITTEN (desc->value)((desc->value)->base.asm_written_flag)
2
←
Assuming field 'asm_written_flag' is not equal to 0→
    && asan_protect_global (desc->value))
  {
    asan_add_global (SYMBOL_REF_DECL (XEXP (desc->rtl, 0))((__extension__ ({ __typeof (((((desc->rtl)->u.fld[0]).
rt_rtx))) const _rtx = (((((desc->rtl)->u.fld[0]).rt_rtx
))); if (((enum rtx_code) (_rtx)->code) != SYMBOL_REF) rtl_check_failed_flag
 ("CONSTANT_POOL_ADDRESS_P", _rtx, "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3465, __FUNCTION__); _rtx; })->unchanging) ? nullptr : (
((((((desc->rtl)->u.fld[0]).rt_rtx)))->u.fld[1]).rt_tree
)),
4
←
Assuming field 'code' is equal to SYMBOL_REF→
5
←
Taking false branch→
6
←
Assuming field 'unchanging' is 0→
7
←
'?' condition is false→
8
←
Calling 'asan_add_global'→
       aascd->type, aascd->v);
  }
return 1;
3469}

3471/* Needs to be GTY(()), because cgraph_build_static_cdtor may
 invoke ggc_collect.  */
3473static GTY(()) tree asan_ctor_statements;

3475/* Module-level instrumentation.
 - Insert __asan_init_vN() into the list of CTORs.
 - TODO: insert redzones around globals.
*/

3480void
3481asan_finish_file (void)
3482{
varpool_node *vnode;
unsigned HOST_WIDE_INTlong gcount = 0;

if (shadow_ptr_types[0] == NULL_TREE(tree) nullptr)
  asan_init_shadow_ptr_types ();
/* Avoid instrumenting code in the asan ctors/dtors.
   We don't need to insert padding after the description strings,
   nor after .LASAN* array.  */
flag_sanitizeglobal_options.x_flag_sanitize &= ~SANITIZE_ADDRESS;

/* For user-space we want asan constructors to run first.
   Linux kernel does not support priorities other than default, and the only
   other user of constructors is coverage. So we run with the default
   priority.  */
int priority = flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_USER_ADDRESS
               ? MAX_RESERVED_INIT_PRIORITY100 - 1 : DEFAULT_INIT_PRIORITY65535;

if (flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_USER_ADDRESS)
  {
    tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
    append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
    fn = builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK);
    append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
  }
FOR_EACH_DEFINED_VARIABLE (vnode)for ((vnode) = symtab->first_defined_variable (); (vnode);
 (vnode) = symtab->next_defined_variable (vnode))
  if (TREE_ASM_WRITTEN (vnode->decl)((vnode->decl)->base.asm_written_flag)
&& asan_protect_global (vnode->decl))
    ++gcount;
hash_table<tree_descriptor_hasher> *const_desc_htab = constant_pool_htab ();
const_desc_htab->traverse<unsigned HOST_WIDE_INTlong *, count_string_csts>
  (&gcount);
if (gcount)
  {
    tree type = asan_global_struct (), var, ctor;
    tree dtor_statements = NULL_TREE(tree) nullptr;
    vec<constructor_elt, va_gc> *v;
    char buf[20];

    type = build_array_type_nelts (type, gcount);
    ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", 0)do { char *__p; (buf)[0] = '*'; (buf)[1] = '.'; __p = stpcpy (
&(buf)[2], "LASAN"); sprint_ul (__p, (unsigned long) (0))
; } while (0);
    var = build_decl (UNKNOWN_LOCATION((location_t) 0), VAR_DECL, get_identifier (buf)(__builtin_constant_p (buf) ? get_identifier_with_length ((buf
), strlen (buf)) : get_identifier (buf)),
	type);
    TREE_STATIC (var)((var)->base.static_flag) = 1;
    TREE_PUBLIC (var)((var)->base.public_flag) = 0;
    DECL_ARTIFICIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3527, __FUNCTION__))->decl_common.artificial_flag) = 1;
    DECL_IGNORED_P (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3528, __FUNCTION__))->decl_common.ignored_flag) = 1;
    vec_alloc (v, gcount);
    FOR_EACH_DEFINED_VARIABLE (vnode)for ((vnode) = symtab->first_defined_variable (); (vnode);
 (vnode) = symtab->next_defined_variable (vnode))
if (TREE_ASM_WRITTEN (vnode->decl)((vnode->decl)->base.asm_written_flag)
   && asan_protect_global (vnode->decl))
 asan_add_global (vnode->decl, TREE_TYPE (type)((contains_struct_check ((type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3533, __FUNCTION__))->typed.type), v);
    struct asan_add_string_csts_data aascd;
    aascd.type = TREE_TYPE (type)((contains_struct_check ((type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3535, __FUNCTION__))->typed.type);
    aascd.v = v;
    const_desc_htab->traverse<asan_add_string_csts_data *, add_string_csts>
     	(&aascd);
    ctor = build_constructor (type, v);
    TREE_CONSTANT (ctor)((non_type_check ((ctor), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3540, __FUNCTION__))->base.constant_flag) = 1;
    TREE_STATIC (ctor)((ctor)->base.static_flag) = 1;
    DECL_INITIAL (var)((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3542, __FUNCTION__))->decl_common.initial) = ctor;
    SET_DECL_ALIGN (var, MAX (DECL_ALIGN (var),(((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3544, __FUNCTION__))->decl_common.align) = ffs_hwi (((((
(contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) ? ((unsigned)1)
 << (((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) - 1) : 0)) >
 ((1UL << 3) * (8)) ? ((((contains_struct_check ((var),
 (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) ? ((unsigned)1)
 << (((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) - 1) : 0)) : ((
1UL << 3) * (8)))))
		ASAN_SHADOW_GRANULARITY * BITS_PER_UNIT))(((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3544, __FUNCTION__))->decl_common.align) = ffs_hwi (((((
(contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) ? ((unsigned)1)
 << (((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) - 1) : 0)) >
 ((1UL << 3) * (8)) ? ((((contains_struct_check ((var),
 (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) ? ((unsigned)1)
 << (((contains_struct_check ((var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3543, __FUNCTION__))->decl_common.align) - 1) : 0)) : ((
1UL << 3) * (8)))));

    varpool_node::finalize_decl (var);

    tree fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
    tree gcount_tree = build_int_cst (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], gcount);
    append_to_statement_list (build_call_expr (fn, 2,
				 build_fold_addr_expr (var)build_fold_addr_expr_loc (((location_t) 0), (var)),
				 gcount_tree),
		&asan_ctor_statements);

    fn = builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS);
    append_to_statement_list (build_call_expr (fn, 2,
				 build_fold_addr_expr (var)build_fold_addr_expr_loc (((location_t) 0), (var)),
				 gcount_tree),
		&dtor_statements);
    cgraph_build_static_cdtor ('D', dtor_statements, priority);
  }
if (asan_ctor_statements)
  cgraph_build_static_cdtor ('I', asan_ctor_statements, priority);
flag_sanitizeglobal_options.x_flag_sanitize |= SANITIZE_ADDRESS;
3565}

3567/* Poison or unpoison (depending on IS_CLOBBER variable) shadow memory based
 on SHADOW address.  Newly added statements will be added to ITER with
 given location LOC.  We mark SIZE bytes in shadow memory, where
 LAST_CHUNK_SIZE is greater than zero in situation where we are at the
 end of a variable.  */

3573static void
3574asan_store_shadow_bytes (gimple_stmt_iterator *iter, location_t loc,
	 tree shadow,
	 unsigned HOST_WIDE_INTlong base_addr_offset,
	 bool is_clobber, unsigned size,
	 unsigned last_chunk_size)
3579{
tree shadow_ptr_type;

switch (size)
  {
  case 1:
    shadow_ptr_type = shadow_ptr_types[0];
    break;
  case 2:
    shadow_ptr_type = shadow_ptr_types[1];
    break;
  case 4:
    shadow_ptr_type = shadow_ptr_types[2];
    break;
  default:
    gcc_unreachable ()(fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3594, __FUNCTION__));
  }

unsigned char c = (char) is_clobber ? ASAN_STACK_MAGIC_USE_AFTER_SCOPE0xf8 : 0;
unsigned HOST_WIDE_INTlong val = 0;
unsigned last_pos = size;
if (last_chunk_size && !is_clobber)
  last_pos = BYTES_BIG_ENDIAN0 ? 0 : size - 1;
for (unsigned i = 0; i < size; ++i)
  {
    unsigned char shadow_c = c;
    if (i == last_pos)
shadow_c = last_chunk_size;
    val |= (unsigned HOST_WIDE_INTlong) shadow_c << (BITS_PER_UNIT(8) * i);
  }

/* Handle last chunk in unpoisoning.  */
tree magic = build_int_cst (TREE_TYPE (shadow_ptr_type)((contains_struct_check ((shadow_ptr_type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3611, __FUNCTION__))->typed.type), val);

tree dest = build2 (MEM_REF, TREE_TYPE (shadow_ptr_type)((contains_struct_check ((shadow_ptr_type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3613, __FUNCTION__))->typed.type), shadow,
      build_int_cst (shadow_ptr_type, base_addr_offset));

gimple *g = gimple_build_assign (dest, magic);
gimple_set_location (g, loc);
gsi_insert_after (iter, g, GSI_NEW_STMT);
3619}

3621/* Expand the ASAN_MARK builtins.  */

3623bool
3624asan_expand_mark_ifn (gimple_stmt_iterator *iter)
3625{
gimple *g = gsi_stmt (*iter);
location_t loc = gimple_location (g);
HOST_WIDE_INTlong flag = tree_to_shwi (gimple_call_arg (g, 0));
bool is_poison = ((asan_mark_flags)flag) == ASAN_MARK_POISON;

tree base = gimple_call_arg (g, 1);
gcc_checking_assert (TREE_CODE (base) == ADDR_EXPR)((void)(!(((enum tree_code) (base)->base.code) == ADDR_EXPR
) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3632, __FUNCTION__), 0 : 0));
tree decl = TREE_OPERAND (base, 0)(*((const_cast<tree*> (tree_operand_check ((base), (0),
 "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3633, __FUNCTION__)))));

/* For a nested function, we can have: ASAN_MARK (2, &FRAME.2.fp_input, 4) */
if (TREE_CODE (decl)((enum tree_code) (decl)->base.code) == COMPONENT_REF
    && DECL_NONLOCAL_FRAME (TREE_OPERAND (decl, 0))((tree_check (((*((const_cast<tree*> (tree_operand_check
 ((decl), (0), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3637, __FUNCTION__)))))), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3637, __FUNCTION__, (VAR_DECL)))->base.default_def_flag))
  decl = TREE_OPERAND (decl, 0)(*((const_cast<tree*> (tree_operand_check ((decl), (0),
 "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3638, __FUNCTION__)))));

gcc_checking_assert (TREE_CODE (decl) == VAR_DECL)((void)(!(((enum tree_code) (decl)->base.code) == VAR_DECL
) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3640, __FUNCTION__), 0 : 0));

if (hwasan_sanitize_p ())
  {
    gcc_assert (param_hwasan_instrument_stack)((void)(!(global_options.x_param_hwasan_instrument_stack) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3644, __FUNCTION__), 0 : 0));
    gimple_seq stmts = NULLnullptr;
    /* Here we swap ASAN_MARK calls for HWASAN_MARK.
This is because we are using the approach of using ASAN_MARK as a
synonym until here.
That approach means we don't yet have to duplicate all the special
cases for ASAN_MARK and ASAN_POISON with the exact same handling but
called HWASAN_MARK etc.

N.b. __asan_poison_stack_memory (which implements ASAN_MARK for ASAN)
rounds the size up to its shadow memory granularity, while
__hwasan_tag_memory (which implements the same for HWASAN) does not.
Hence we emit HWASAN_MARK with an aligned size unlike ASAN_MARK.  */
    tree len = gimple_call_arg (g, 2);
    tree new_len = gimple_build_round_up (&stmts, loc, size_type_nodeglobal_trees[TI_SIZE_TYPE], len,
			    HWASAN_TAG_GRANULE_SIZEtargetm.memtag.granule_size ());
    gimple_build (&stmts, loc, CFN_HWASAN_MARK,
    void_type_nodeglobal_trees[TI_VOID_TYPE], gimple_call_arg (g, 0),
    base, new_len);
    gsi_replace_with_seq (iter, stmts, true);
    return false;
  }

if (is_poison)
  {
    if (asan_handled_variables == NULLnullptr)
asan_handled_variables = new hash_set<tree> (16);
    asan_handled_variables->add (decl);
  }
tree len = gimple_call_arg (g, 2);

gcc_assert (tree_fits_shwi_p (len))((void)(!(tree_fits_shwi_p (len)) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3675, __FUNCTION__), 0 : 0));
unsigned HOST_WIDE_INTlong size_in_bytes = tree_to_shwi (len);
gcc_assert (size_in_bytes)((void)(!(size_in_bytes) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3677, __FUNCTION__), 0 : 0));

g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
	   NOP_EXPR, base);
gimple_set_location (g, loc);
gsi_replace (iter, g, false);
tree base_addr = gimple_assign_lhs (g);

/* Generate direct emission if size_in_bytes is small.  */
if (size_in_bytes
    <= (unsigned)param_use_after_scope_direct_emission_thresholdglobal_options.x_param_use_after_scope_direct_emission_threshold)
  {
    const unsigned HOST_WIDE_INTlong shadow_size
= shadow_mem_size (size_in_bytes);
    const unsigned int shadow_align
= (get_pointer_alignment (base) / BITS_PER_UNIT(8)) >> ASAN_SHADOW_SHIFT3;

    tree shadow = build_shadow_mem_access (iter, loc, base_addr,
			     shadow_ptr_types[0], true);

    for (unsigned HOST_WIDE_INTlong offset = 0; offset < shadow_size;)
{
 unsigned size = 1;
 if (shadow_size - offset >= 4
     && (!STRICT_ALIGNMENT0 || shadow_align >= 4))
   size = 4;
 else if (shadow_size - offset >= 2
   && (!STRICT_ALIGNMENT0 || shadow_align >= 2))
   size = 2;

 unsigned HOST_WIDE_INTlong last_chunk_size = 0;
 unsigned HOST_WIDE_INTlong s = (offset + size) * ASAN_SHADOW_GRANULARITY(1UL << 3);
 if (s > size_in_bytes)
   last_chunk_size = ASAN_SHADOW_GRANULARITY(1UL << 3) - (s - size_in_bytes);

 asan_store_shadow_bytes (iter, loc, shadow, offset, is_poison,
		   size, last_chunk_size);
 offset += size;
}
  }
else
  {
    g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
	       NOP_EXPR, len);
    gimple_set_location (g, loc);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    tree sz_arg = gimple_assign_lhs (g);

    tree fun
= builtin_decl_implicit (is_poison ? BUILT_IN_ASAN_POISON_STACK_MEMORY
		 : BUILT_IN_ASAN_UNPOISON_STACK_MEMORY);
    g = gimple_build_call (fun, 2, base_addr, sz_arg);
    gimple_set_location (g, loc);
    gsi_insert_after (iter, g, GSI_NEW_STMT);
  }

return false;
3734}

3736/* Expand the ASAN_{LOAD,STORE} builtins.  */

3738bool
3739asan_expand_check_ifn (gimple_stmt_iterator *iter, bool use_calls)
3740{
gcc_assert (!hwasan_sanitize_p ())((void)(!(!hwasan_sanitize_p ()) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3741, __FUNCTION__), 0 : 0));
gimple *g = gsi_stmt (*iter);
location_t loc = gimple_location (g);
bool recover_p;
if (flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_USER_ADDRESS)
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
else
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;

HOST_WIDE_INTlong flags = tree_to_shwi (gimple_call_arg (g, 0));
gcc_assert (flags < ASAN_CHECK_LAST)((void)(!(flags < ASAN_CHECK_LAST) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3751, __FUNCTION__), 0 : 0));
bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
bool is_store = (flags & ASAN_CHECK_STORE) != 0;
bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;

tree base = gimple_call_arg (g, 1);
tree len = gimple_call_arg (g, 2);
HOST_WIDE_INTlong align = tree_to_shwi (gimple_call_arg (g, 3));

HOST_WIDE_INTlong size_in_bytes
  = is_scalar_access && tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;

if (use_calls)
  {
    /* Instrument using callbacks.  */
    gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
		      NOP_EXPR, base);
    gimple_set_location (g, loc);
    gsi_insert_before (iter, g, GSI_SAME_STMT);
    tree base_addr = gimple_assign_lhs (g);

    int nargs;
    tree fun = check_func (is_store, recover_p, size_in_bytes, &nargs);
    if (nargs == 1)
g = gimple_build_call (fun, 1, base_addr);
    else
{
 gcc_assert (nargs == 2)((void)(!(nargs == 2) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3778, __FUNCTION__), 0 : 0));
 g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
		   NOP_EXPR, len);
 gimple_set_location (g, loc);
 gsi_insert_before (iter, g, GSI_SAME_STMT);
 tree sz_arg = gimple_assign_lhs (g);
 g = gimple_build_call (fun, nargs, base_addr, sz_arg);
}
    gimple_set_location (g, loc);
    gsi_replace (iter, g, false);
    return false;
  }

HOST_WIDE_INTlong real_size_in_bytes = size_in_bytes == -1 ? 1 : size_in_bytes;

tree shadow_ptr_type = shadow_ptr_types[real_size_in_bytes == 16 ? 1 : 0];
tree shadow_type = TREE_TYPE (shadow_ptr_type)((contains_struct_check ((shadow_ptr_type), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3794, __FUNCTION__))->typed.type);

gimple_stmt_iterator gsi = *iter;

if (!is_non_zero_len)
  {
    /* So, the length of the memory area to asan-protect is
non-constant.  Let's guard the generated instrumentation code
like:

if (len != 0)
  {
    //asan instrumentation code goes here.
  }
// falltrough instructions, starting with *ITER.  */

    g = gimple_build_cond (NE_EXPR,
	    len,
	    build_int_cst (TREE_TYPE (len)((contains_struct_check ((len), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3812, __FUNCTION__))->typed.type), 0),
	    NULL_TREE(tree) nullptr, NULL_TREE(tree) nullptr);
    gimple_set_location (g, loc);

    basic_block then_bb, fallthrough_bb;
    insert_if_then_before_iter (as_a <gcond *> (g), iter,
		  /*then_more_likely_p=*/true,
		  &then_bb, &fallthrough_bb);
    /* Note that fallthrough_bb starts with the statement that was
pointed to by ITER.  */

    /* The 'then block' of the 'if (len != 0) condition is where
we'll generate the asan instrumentation code now.  */
    gsi = gsi_last_bb (then_bb);
  }

/* Get an iterator on the point where we can add the condition
   statement for the instrumentation.  */
basic_block then_bb, else_bb;
gsi = create_cond_insert_point (&gsi, /*before_p*/false,
		  /*then_more_likely_p=*/false,
		  /*create_then_fallthru_edge*/recover_p,
		  &then_bb,
		  &else_bb);

g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
	   NOP_EXPR, base);
gimple_set_location (g, loc);
gsi_insert_before (&gsi, g, GSI_NEW_STMT);
tree base_addr = gimple_assign_lhs (g);

tree t = NULL_TREE(tree) nullptr;
if (real_size_in_bytes >= 8)
  {
    tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
			     shadow_ptr_type);
    t = shadow;
  }
else
  {
    /* Slow path for 1, 2 and 4 byte accesses.  */
    /* Test (shadow != 0)
& ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow).  */
    tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
			     shadow_ptr_type);
    gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
    gimple_seq seq = NULLnullptr;
    gimple_seq_add_stmt (&seq, shadow_test);
    /* Aligned (>= 8 bytes) can test just
(real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
to be 0.  */
    if (align < 8)
{
 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
				   base_addr, 7));
 gimple_seq_add_stmt (&seq,
	       build_type_cast (shadow_type,
				gimple_seq_last (seq)));
 if (real_size_in_bytes > 1)
   gimple_seq_add_stmt (&seq,
		 build_assign (PLUS_EXPR,
			       gimple_seq_last (seq),
			       real_size_in_bytes - 1));
 t = gimple_assign_lhs (gimple_seq_last_stmt (seq));
}
    else
t = build_int_cst (shadow_type, real_size_in_bytes - 1);
    gimple_seq_add_stmt (&seq, build_assign (GE_EXPR, t, shadow));
    gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
			       gimple_seq_last (seq)));
    t = gimple_assign_lhs (gimple_seq_last (seq));
    gimple_seq_set_location (seq, loc);
    gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);

    /* For non-constant, misaligned or otherwise weird access sizes,
     check first and last byte.  */
    if (size_in_bytes == -1)
{
 g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
		   MINUS_EXPR, len,
		   build_int_cst (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], 1));
 gimple_set_location (g, loc);
 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
 tree last = gimple_assign_lhs (g);
 g = gimple_build_assign (make_ssa_name (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE]),
		   PLUS_EXPR, base_addr, last);
 gimple_set_location (g, loc);
 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
 tree base_end_addr = gimple_assign_lhs (g);

 tree shadow = build_shadow_mem_access (&gsi, loc, base_end_addr,
				 shadow_ptr_type);
 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
 gimple_seq seq = NULLnullptr;
 gimple_seq_add_stmt (&seq, shadow_test);
 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
				   base_end_addr, 7));
 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
				      gimple_seq_last (seq)));
 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
				   gimple_seq_last (seq),
				   shadow));
 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
				   gimple_seq_last (seq)));
 gimple_seq_add_stmt (&seq, build_assign (BIT_IOR_EXPR, t,
				   gimple_seq_last (seq)));
 t = gimple_assign_lhs (gimple_seq_last (seq));
 gimple_seq_set_location (seq, loc);
 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
}
  }

g = gimple_build_cond (NE_EXPR, t, build_int_cst (TREE_TYPE (t)((contains_struct_check ((t), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3924, __FUNCTION__))->typed.type), 0),
	 NULL_TREE(tree) nullptr, NULL_TREE(tree) nullptr);
gimple_set_location (g, loc);
gsi_insert_after (&gsi, g, GSI_NEW_STMT);

/* Generate call to the run-time library (e.g. __asan_report_load8).  */
gsi = gsi_start_bb (then_bb);
int nargs;
tree fun = report_error_func (is_store, recover_p, size_in_bytes, &nargs);
g = gimple_build_call (fun, nargs, base_addr, len);
gimple_set_location (g, loc);
gsi_insert_after (&gsi, g, GSI_NEW_STMT);

gsi_remove (iter, true);
*iter = gsi_start_bb (else_bb);

return true;
3941}

3943/* Create ASAN shadow variable for a VAR_DECL which has been rewritten
 into SSA.  Already seen VAR_DECLs are stored in SHADOW_VARS_MAPPING.  */

3946static tree
3947create_asan_shadow_var (tree var_decl,
	hash_map<tree, tree> &shadow_vars_mapping)
3949{
tree *slot = shadow_vars_mapping.get (var_decl);
if (slot == NULLnullptr)
  {
    tree shadow_var = copy_node (var_decl);

    copy_body_data id;
    memset (&id, 0, sizeof (copy_body_data));
    id.src_fn = id.dst_fn = current_function_decl;
    copy_decl_for_dup_finish (&id, var_decl, shadow_var);

    DECL_ARTIFICIAL (shadow_var)((contains_struct_check ((shadow_var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3960, __FUNCTION__))->decl_common.artificial_flag) = 1;
    DECL_IGNORED_P (shadow_var)((contains_struct_check ((shadow_var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3961, __FUNCTION__))->decl_common.ignored_flag) = 1;
    DECL_SEEN_IN_BIND_EXPR_P (shadow_var)((contains_struct_check ((shadow_var), (TS_DECL_WITH_VIS), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3962, __FUNCTION__))->decl_with_vis.seen_in_bind_expr) = 0;
    gimple_add_tmp_var (shadow_var);

    shadow_vars_mapping.put (var_decl, shadow_var);
    return shadow_var;
  }
else
  return *slot;
3970}

3972/* Expand ASAN_POISON ifn.  */

3974bool
3975asan_expand_poison_ifn (gimple_stmt_iterator *iter,
	bool *need_commit_edge_insert,
	hash_map<tree, tree> &shadow_vars_mapping)
3978{
gimple *g = gsi_stmt (*iter);
tree poisoned_var = gimple_call_lhs (g);
if (!poisoned_var || has_zero_uses (poisoned_var))
  {
    gsi_remove (iter, true);
    return true;
  }

if (SSA_NAME_VAR (poisoned_var)((tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3987, __FUNCTION__, (SSA_NAME)))->ssa_name.var == (tree)
 nullptr || ((enum tree_code) ((poisoned_var)->ssa_name.var
)->base.code) == IDENTIFIER_NODE ? (tree) nullptr : (poisoned_var
)->ssa_name.var) == NULL_TREE(tree) nullptr)
  SET_SSA_NAME_VAR_OR_IDENTIFIER (poisoned_var,do { tree var_ = (create_tmp_var (((contains_struct_check ((poisoned_var
), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__))->typed.type))); (tree_check ((poisoned_var
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (SSA_NAME)))->ssa_name.var = var_; (
tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (SSA_NAME)))->base.public_flag = (var_
 && ((enum tree_code) (var_)->base.code) == VAR_DECL
 && ((tree_check ((var_), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (VAR_DECL)))->base.u.bits.saturating_flag
)); } while (0)
		    create_tmp_var (TREE_TYPE (poisoned_var)))do { tree var_ = (create_tmp_var (((contains_struct_check ((poisoned_var
), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__))->typed.type))); (tree_check ((poisoned_var
), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (SSA_NAME)))->ssa_name.var = var_; (
tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (SSA_NAME)))->base.public_flag = (var_
 && ((enum tree_code) (var_)->base.code) == VAR_DECL
 && ((tree_check ((var_), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3989, __FUNCTION__, (VAR_DECL)))->base.u.bits.saturating_flag
)); } while (0);

tree shadow_var = create_asan_shadow_var (SSA_NAME_VAR (poisoned_var)((tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3991, __FUNCTION__, (SSA_NAME)))->ssa_name.var == (tree)
 nullptr || ((enum tree_code) ((poisoned_var)->ssa_name.var
)->base.code) == IDENTIFIER_NODE ? (tree) nullptr : (poisoned_var
)->ssa_name.var),
			    shadow_vars_mapping);

bool recover_p;
if (flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_USER_ADDRESS)
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
else
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
tree size = DECL_SIZE_UNIT (shadow_var)((contains_struct_check ((shadow_var), (TS_DECL_COMMON), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 3999, __FUNCTION__))->decl_common.size_unit);
gimple *poison_call
  = gimple_build_call_internal (IFN_ASAN_MARK, 3,
		  build_int_cst (integer_type_nodeinteger_types[itk_int],
				 ASAN_MARK_POISON),
		  build_fold_addr_expr (shadow_var)build_fold_addr_expr_loc (((location_t) 0), (shadow_var)), size);

gimple *use;
imm_use_iterator imm_iter;
FOR_EACH_IMM_USE_STMT (use, imm_iter, poisoned_var)for (struct auto_end_imm_use_stmt_traverse auto_end_imm_use_stmt_traverse
 ((((use) = first_imm_use_stmt (&(imm_iter), (poisoned_var
))), &(imm_iter))); !end_imm_use_stmt_p (&(imm_iter))
; (void) ((use) = next_imm_use_stmt (&(imm_iter))))
  {
    if (is_gimple_debug (use))
continue;

    int nargs;
    bool store_p = gimple_call_internal_p (use, IFN_ASAN_POISON_USE);
    gcall *call;
    if (hwasan_sanitize_p ())
{
 tree fun = builtin_decl_implicit (BUILT_IN_HWASAN_TAG_MISMATCH4);
 /* NOTE: hwasan has no __hwasan_report_* functions like asan does.
We use __hwasan_tag_mismatch4 with arguments that tell it the
size of access and load to report all tag mismatches.

The arguments to this function are:
  Address of invalid access.
  Bitfield containing information about the access
    (access_info)
  Pointer to a frame of registers
    (for use in printing the contents of registers in a dump)
    Not used yet -- to be used by inline instrumentation.
  Size of access.

The access_info bitfield encodes the following pieces of
information:
  - Is this a store or load?
    access_info & 0x10  =>  store
  - Should the program continue after reporting the error?
    access_info & 0x20  =>  recover
  - What size access is this (not used here since we can always
    pass the size in the last argument)

    if (access_info & 0xf == 0xf)
      size is taken from last argument.
    else
      size == 1 << (access_info & 0xf)

The last argument contains the size of the access iff the
access_info size indicator is 0xf (we always use this argument
rather than storing the size in the access_info bitfield).

See the function definition `__hwasan_tag_mismatch4` in
libsanitizer/hwasan for the full definition.
*/
 unsigned access_info = (0x20 * recover_p)
   + (0x10 * store_p)
   + (0xf);
 call = gimple_build_call (fun, 4,
		    build_fold_addr_expr (shadow_var)build_fold_addr_expr_loc (((location_t) 0), (shadow_var)),
		    build_int_cst (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE],
				   access_info),
		    build_int_cst (pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], 0),
		    size);
}
    else
{
 tree fun = report_error_func (store_p, recover_p, tree_to_uhwi (size),
			&nargs);
 call = gimple_build_call (fun, 1,
		    build_fold_addr_expr (shadow_var)build_fold_addr_expr_loc (((location_t) 0), (shadow_var)));
}
    gimple_set_location (call, gimple_location (use));
    gimple *call_to_insert = call;

    /* The USE can be a gimple PHI node.  If so, insert the call on
all edges leading to the PHI node.  */
    if (is_a <gphi *> (use))
{
 gphi *phi = dyn_cast<gphi *> (use);
 for (unsigned i = 0; i < gimple_phi_num_args (phi); ++i)
   if (gimple_phi_arg_def (phi, i) == poisoned_var)
     {
edge e = gimple_phi_arg_edge (phi, i);

/* Do not insert on an edge we can't split.  */
if (e->flags & EDGE_ABNORMAL)
  continue;

if (call_to_insert == NULLnullptr)
  call_to_insert = gimple_copy (call);

gsi_insert_seq_on_edge (e, call_to_insert);
*need_commit_edge_insert = true;
call_to_insert = NULLnullptr;
     }
}
    else
{
 gimple_stmt_iterator gsi = gsi_for_stmt (use);
 if (store_p)
   gsi_replace (&gsi, call, true);
 else
   gsi_insert_before (&gsi, call, GSI_NEW_STMT);
}
  }

SSA_NAME_IS_DEFAULT_DEF (poisoned_var)(tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4105, __FUNCTION__, (SSA_NAME)))->base.default_def_flag = true;
SSA_NAME_DEF_STMT (poisoned_var)(tree_check ((poisoned_var), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4106, __FUNCTION__, (SSA_NAME)))->ssa_name.def_stmt = gimple_build_nop ();
gsi_replace (iter, poison_call, false);

return true;
4110}

4112/* Instrument the current function.  */

4114static unsigned int
4115asan_instrument (void)
4116{
if (hwasan_sanitize_p ())
  {
    transform_statements ();
    return 0;
  }

if (shadow_ptr_types[0] == NULL_TREE(tree) nullptr)
  asan_init_shadow_ptr_types ();
transform_statements ();
last_alloca_addr = NULL_TREE(tree) nullptr;
return 0;
4128}

4130static bool
4131gate_asan (void)
4132{
return sanitize_flags_p (SANITIZE_ADDRESS);
4134}

4136namespace {

4138const pass_data pass_data_asan =
4139{
GIMPLE_PASS, /* type */
"asan", /* name */
OPTGROUP_NONE, /* optinfo_flags */
TV_NONE, /* tv_id */
( PROP_ssa(1 << 5) | PROP_cfg(1 << 3) | PROP_gimple_leh(1 << 2) ), /* properties_required */
0, /* properties_provided */
0, /* properties_destroyed */
0, /* todo_flags_start */
TODO_update_ssa(1 << 11), /* todo_flags_finish */
4149};

4151class pass_asan : public gimple_opt_pass
4152{
4153public:
pass_asan (gcc::context *ctxt)
  : gimple_opt_pass (pass_data_asan, ctxt)
{}

/* opt_pass methods: */
opt_pass * clone () { return new pass_asan (m_ctxt); }
virtual bool gate (function *) { return gate_asan () || gate_hwasan (); }
virtual unsigned int execute (function *) { return asan_instrument (); }

4163}; // class pass_asan

4165} // anon namespace

4167gimple_opt_pass *
4168make_pass_asan (gcc::context *ctxt)
4169{
return new pass_asan (ctxt);
4171}

4173namespace {

4175const pass_data pass_data_asan_O0 =
4176{
GIMPLE_PASS, /* type */
"asan0", /* name */
OPTGROUP_NONE, /* optinfo_flags */
TV_NONE, /* tv_id */
( PROP_ssa(1 << 5) | PROP_cfg(1 << 3) | PROP_gimple_leh(1 << 2) ), /* properties_required */
0, /* properties_provided */
0, /* properties_destroyed */
0, /* todo_flags_start */
TODO_update_ssa(1 << 11), /* todo_flags_finish */
4186};

4188class pass_asan_O0 : public gimple_opt_pass
4189{
4190public:
pass_asan_O0 (gcc::context *ctxt)
  : gimple_opt_pass (pass_data_asan_O0, ctxt)
{}

/* opt_pass methods: */
virtual bool gate (function *)
  {
    return !optimizeglobal_options.x_optimize && (gate_asan () || gate_hwasan ());
  }
virtual unsigned int execute (function *) { return asan_instrument (); }

4202}; // class pass_asan_O0

4204} // anon namespace

4206gimple_opt_pass *
4207make_pass_asan_O0 (gcc::context *ctxt)
4208{
return new pass_asan_O0 (ctxt);
4210}

4212/*  HWASAN  */

4214/* For stack tagging:

 Return the offset from the frame base tag that the "next" expanded object
 should have.  */
4218uint8_t
4219hwasan_current_frame_tag ()
4220{
return hwasan_frame_tag_offset;
4222}

4224/* For stack tagging:

 Return the 'base pointer' for this function.  If that base pointer has not
 yet been created then we create a register to hold it and record the insns
 to initialize the register in `hwasan_frame_base_init_seq` for later
 emission.  */
4230rtx
4231hwasan_frame_base ()
4232{
if (! hwasan_frame_base_ptr)
  {
    start_sequence ();
    hwasan_frame_base_ptr
= force_reg (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))),
     targetm.memtag.insert_random_tag (virtual_stack_vars_rtx((this_target_rtl->x_global_rtl)[GR_VIRTUAL_STACK_ARGS]),
				       NULL_RTX(rtx) 0));
    hwasan_frame_base_init_seq = get_insns ();
    end_sequence ();
  }

return hwasan_frame_base_ptr;
4245}

4247/* For stack tagging:

 Check whether this RTX is a standard pointer addressing the base of the
 stack variables for this frame.  Returns true if the RTX is either
 virtual_stack_vars_rtx or hwasan_frame_base_ptr.  */
4252bool
4253stack_vars_base_reg_p (rtx base)
4254{
return base == virtual_stack_vars_rtx((this_target_rtl->x_global_rtl)[GR_VIRTUAL_STACK_ARGS]) || base == hwasan_frame_base_ptr;
4256}

4258/* For stack tagging:

 Emit frame base initialisation.
 If hwasan_frame_base has been used before here then
 hwasan_frame_base_init_seq contains the sequence of instructions to
 initialize it.  This must be put just before the hwasan prologue, so we emit
 the insns before parm_birth_insn (which will point to the first instruction
 of the hwasan prologue if it exists).

 We update `parm_birth_insn` to point to the start of this initialisation
 since that represents the end of the initialisation done by
 expand_function_{start,end} functions and we want to maintain that.  */
4270void
4271hwasan_maybe_emit_frame_base_init ()
4272{
if (! hwasan_frame_base_init_seq)
  return;
emit_insn_before (hwasan_frame_base_init_seq, parm_birth_insn((&x_rtl)->x_parm_birth_insn));
parm_birth_insn((&x_rtl)->x_parm_birth_insn) = hwasan_frame_base_init_seq;
4277}

4279/* Record a compile-time constant size stack variable that HWASAN will need to
 tag.  This record of the range of a stack variable will be used by
 `hwasan_emit_prologue` to emit the RTL at the start of each frame which will
 set tags in the shadow memory according to the assigned tag for each object.

 The range that the object spans in stack space should be described by the
 bounds `untagged_base + nearest_offset` and
 `untagged_base + farthest_offset`.
 `tagged_base` is the base address which contains the "base frame tag" for
 this frame, and from which the value to address this object with will be
 calculated.

 We record the `untagged_base` since the functions in the hwasan library we
 use to tag memory take pointers without a tag.  */
4293void
4294hwasan_record_stack_var (rtx untagged_base, rtx tagged_base,
	 poly_int64 nearest_offset, poly_int64 farthest_offset)
4296{
hwasan_stack_var cur_var;
cur_var.untagged_base = untagged_base;
cur_var.tagged_base = tagged_base;
cur_var.nearest_offset = nearest_offset;
cur_var.farthest_offset = farthest_offset;
cur_var.tag_offset = hwasan_current_frame_tag ();

hwasan_tagged_stack_vars.safe_push (cur_var);
4305}

4307/* Return the RTX representing the farthest extent of the statically allocated
 stack objects for this frame.  If hwasan_frame_base_ptr has not been
 initialized then we are not storing any static variables on the stack in
 this frame.  In this case we return NULL_RTX to represent that.

 Otherwise simply return virtual_stack_vars_rtx + frame_offset.  */
4313rtx
4314hwasan_get_frame_extent ()
4315{
return (hwasan_frame_base_ptr
 ? plus_constant (Pmode(global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode (
(scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode ((scalar_int_mode
::from_int) E_SImode))), virtual_stack_vars_rtx((this_target_rtl->x_global_rtl)[GR_VIRTUAL_STACK_ARGS]), frame_offset((&x_rtl)->x_frame_offset))
 : NULL_RTX(rtx) 0);
4319}

4321/* For stack tagging:

 Increment the frame tag offset modulo the size a tag can represent.  */
4324void
4325hwasan_increment_frame_tag ()
4326{
uint8_t tag_bits = HWASAN_TAG_SIZEtargetm.memtag.tag_size ();
gcc_assert (HWASAN_TAG_SIZE((void)(!(targetm.memtag.tag_size () <= sizeof (hwasan_frame_tag_offset
) * 8) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4329, __FUNCTION__), 0 : 0))
     <= sizeof (hwasan_frame_tag_offset) * CHAR_BIT)((void)(!(targetm.memtag.tag_size () <= sizeof (hwasan_frame_tag_offset
) * 8) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4329, __FUNCTION__), 0 : 0));
hwasan_frame_tag_offset = (hwasan_frame_tag_offset + 1) % (1 << tag_bits);
/* The "background tag" of the stack is zero by definition.
   This is the tag that objects like parameters passed on the stack and
   spilled registers are given.  It is handy to avoid this tag for objects
   whose tags we decide ourselves, partly to ensure that buffer overruns
   can't affect these important variables (e.g. saved link register, saved
   stack pointer etc) and partly to make debugging easier (everything with a
   tag of zero is space allocated automatically by the compiler).

   This is not feasible when using random frame tags (the default
   configuration for hwasan) since the tag for the given frame is randomly
   chosen at runtime.  In order to avoid any tags matching the stack
   background we would need to decide tag offsets at runtime instead of
   compile time (and pay the resulting performance cost).

   When not using random base tags for each frame (i.e. when compiled with
   `--param hwasan-random-frame-tag=0`) the base tag for each frame is zero.
   This means the tag that each object gets is equal to the
   hwasan_frame_tag_offset used in determining it.
   When this is the case we *can* ensure no object gets the tag of zero by
   simply ensuring no object has the hwasan_frame_tag_offset of zero.

   There is the extra complication that we only record the
   hwasan_frame_tag_offset here (which is the offset from the tag stored in
   the stack pointer).  In the kernel, the tag in the stack pointer is 0xff
   rather than zero.  This does not cause problems since tags of 0xff are
   never checked in the kernel.  As mentioned at the beginning of this
   comment the background tag of the stack is zero by definition, which means
   that for the kernel we should skip offsets of both 0 and 1 from the stack
   pointer.  Avoiding the offset of 0 ensures we use a tag which will be
   checked, avoiding the offset of 1 ensures we use a tag that is not the
   same as the background.  */
if (hwasan_frame_tag_offset == 0 && ! param_hwasan_random_frame_tagglobal_options.x_param_hwasan_random_frame_tag)
  hwasan_frame_tag_offset += 1;
if (hwasan_frame_tag_offset == 1 && ! param_hwasan_random_frame_tagglobal_options.x_param_hwasan_random_frame_tag
    && sanitize_flags_p (SANITIZE_KERNEL_HWADDRESS))
  hwasan_frame_tag_offset += 1;
4367}

4369/* Clear internal state for the next function.
 This function is called before variables on the stack get expanded, in
 `init_vars_expansion`.  */
4372void
4373hwasan_record_frame_init ()
4374{
delete asan_used_labels;
asan_used_labels = NULLnullptr;

/* If this isn't the case then some stack variable was recorded *before*
   hwasan_record_frame_init is called, yet *after* the hwasan prologue for
   the previous frame was emitted.  Such stack variables would not have
   their shadow stack filled in.  */
gcc_assert (hwasan_tagged_stack_vars.is_empty ())((void)(!(hwasan_tagged_stack_vars.is_empty ()) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4382, __FUNCTION__), 0 : 0));
hwasan_frame_base_ptr = NULL_RTX(rtx) 0;
hwasan_frame_base_init_seq = NULLnullptr;

/* When not using a random frame tag we can avoid the background stack
   color which gives the user a little better debug output upon a crash.
   Meanwhile, when using a random frame tag it will be nice to avoid adding
   tags for the first object since that is unnecessary extra work.
   Hence set the initial hwasan_frame_tag_offset to be 0 if using a random
   frame tag and 1 otherwise.

   As described in hwasan_increment_frame_tag, in the kernel the stack
   pointer has the tag 0xff.  That means that to avoid 0xff and 0 (the tag
   which the kernel does not check and the background tag respectively) we
   start with a tag offset of 2.  */
hwasan_frame_tag_offset = param_hwasan_random_frame_tagglobal_options.x_param_hwasan_random_frame_tag
  ? 0
  : sanitize_flags_p (SANITIZE_KERNEL_HWADDRESS) ? 2 : 1;
4400}

4402/* For stack tagging:
 (Emits HWASAN equivalent of what is emitted by
 `asan_emit_stack_protection`).

 Emits the extra prologue code to set the shadow stack as required for HWASAN
 stack instrumentation.

 Uses the vector of recorded stack variables hwasan_tagged_stack_vars.  When
 this function has completed hwasan_tagged_stack_vars is empty and all
 objects it had pointed to are deallocated.  */
4412void
4413hwasan_emit_prologue ()
4414{
/* We need untagged base pointers since libhwasan only accepts untagged
  pointers in __hwasan_tag_memory.  We need the tagged base pointer to obtain
  the base tag for an offset.  */

if (hwasan_tagged_stack_vars.is_empty ())
  return;

poly_int64 bot = 0, top = 0;
for (hwasan_stack_var &cur : hwasan_tagged_stack_vars)
  {
    poly_int64 nearest = cur.nearest_offset;
    poly_int64 farthest = cur.farthest_offset;

    if (known_ge (nearest, farthest)(!maybe_lt (nearest, farthest)))
{
 top = nearest;
 bot = farthest;
}
    else
{
 /* Given how these values are calculated, one must be known greater
    than the other.  */
 gcc_assert (known_le (nearest, farthest))((void)(!((!maybe_lt (farthest, nearest))) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4437, __FUNCTION__), 0 : 0));
 top = farthest;
 bot = nearest;
}
    poly_int64 size = (top - bot);

    /* Assert the edge of each variable is aligned to the HWASAN tag granule
size.  */
    gcc_assert (multiple_p (top, HWASAN_TAG_GRANULE_SIZE))((void)(!(multiple_p (top, targetm.memtag.granule_size ())) ?
 fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4445, __FUNCTION__), 0 : 0));
    gcc_assert (multiple_p (bot, HWASAN_TAG_GRANULE_SIZE))((void)(!(multiple_p (bot, targetm.memtag.granule_size ())) ?
 fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4446, __FUNCTION__), 0 : 0));
    gcc_assert (multiple_p (size, HWASAN_TAG_GRANULE_SIZE))((void)(!(multiple_p (size, targetm.memtag.granule_size ())) ?
 fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4447, __FUNCTION__), 0 : 0));

    rtx fn = init_one_libfunc ("__hwasan_tag_memory");
    rtx base_tag = targetm.memtag.extract_tag (cur.tagged_base, NULL_RTX(rtx) 0);
    rtx tag = plus_constant (QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)), base_tag, cur.tag_offset);
    tag = hwasan_truncate_to_tag_size (tag, NULL_RTX(rtx) 0);

    rtx bottom = convert_memory_address (ptr_mode,convert_memory_address_addr_space ((ptr_mode), (plus_constant
 ((global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode
 ((scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode (
(scalar_int_mode::from_int) E_SImode))), cur.untagged_base, bot
)), 0)
			   plus_constant (Pmode,convert_memory_address_addr_space ((ptr_mode), (plus_constant
 ((global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode
 ((scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode (
(scalar_int_mode::from_int) E_SImode))), cur.untagged_base, bot
)), 0)
					  cur.untagged_base,convert_memory_address_addr_space ((ptr_mode), (plus_constant
 ((global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode
 ((scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode (
(scalar_int_mode::from_int) E_SImode))), cur.untagged_base, bot
)), 0)
					  bot))convert_memory_address_addr_space ((ptr_mode), (plus_constant
 ((global_options.x_ix86_pmode == PMODE_DI ? (scalar_int_mode
 ((scalar_int_mode::from_int) E_DImode)) : (scalar_int_mode (
(scalar_int_mode::from_int) E_SImode))), cur.untagged_base, bot
)), 0);
    emit_library_call (fn, LCT_NORMAL, VOIDmode((void) 0, E_VOIDmode),
	 bottom, ptr_mode,
	 tag, QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)),
	 gen_int_mode (size, ptr_mode), ptr_mode);
  }
/* Clear the stack vars, we've emitted the prologue for them all now.  */
hwasan_tagged_stack_vars.truncate (0);
4465}

4467/* For stack tagging:

 Return RTL insns to clear the tags between DYNAMIC and VARS pointers
 into the stack.  These instructions should be emitted at the end of
 every function.

 If `dynamic` is NULL_RTX then no insns are returned.  */
4474rtx_insn *
4475hwasan_emit_untag_frame (rtx dynamic, rtx vars)
4476{
if (! dynamic)
  return NULLnullptr;

start_sequence ();

dynamic = convert_memory_address (ptr_mode, dynamic)convert_memory_address_addr_space ((ptr_mode), (dynamic), 0);
vars = convert_memory_address (ptr_mode, vars)convert_memory_address_addr_space ((ptr_mode), (vars), 0);

rtx top_rtx;
rtx bot_rtx;
if (FRAME_GROWS_DOWNWARD1)
  {
    top_rtx = vars;
    bot_rtx = dynamic;
  }
else
  {
    top_rtx = dynamic;
    bot_rtx = vars;
  }

rtx size_rtx = expand_simple_binop (ptr_mode, MINUS, top_rtx, bot_rtx,
		      NULL_RTX(rtx) 0, /* unsignedp = */0,
		      OPTAB_DIRECT);

rtx fn = init_one_libfunc ("__hwasan_tag_memory");
emit_library_call (fn, LCT_NORMAL, VOIDmode((void) 0, E_VOIDmode),
     bot_rtx, ptr_mode,
     HWASAN_STACK_BACKGROUNDgen_int_mode (0, (scalar_int_mode ((scalar_int_mode::from_int
) E_QImode))), QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)),
     size_rtx, ptr_mode);

do_pending_stack_adjust ();
rtx_insn *insns = get_insns ();
end_sequence ();
return insns;
4512}

4514/* Needs to be GTY(()), because cgraph_build_static_cdtor may
 invoke ggc_collect.  */
4516static GTY(()) tree hwasan_ctor_statements;

4518/* Insert module initialization into this TU.  This initialization calls the
 initialization code for libhwasan.  */
4520void
4521hwasan_finish_file (void)
4522{
/* Do not emit constructor initialization for the kernel.
   (the kernel has its own initialization already).  */
if (flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_KERNEL_HWADDRESS)
  return;

/* Avoid instrumenting code in the hwasan constructors/destructors.  */
flag_sanitizeglobal_options.x_flag_sanitize &= ~SANITIZE_HWADDRESS;
int priority = MAX_RESERVED_INIT_PRIORITY100 - 1;
tree fn = builtin_decl_implicit (BUILT_IN_HWASAN_INIT);
append_to_statement_list (build_call_expr (fn, 0), &hwasan_ctor_statements);
cgraph_build_static_cdtor ('I', hwasan_ctor_statements, priority);
flag_sanitizeglobal_options.x_flag_sanitize |= SANITIZE_HWADDRESS;
4535}

4537/* For stack tagging:

 Truncate `tag` to the number of bits that a tag uses (i.e. to
 HWASAN_TAG_SIZE).  Store the result in `target` if it's convenient.  */
4541rtx
4542hwasan_truncate_to_tag_size (rtx tag, rtx target)
4543{
gcc_assert (GET_MODE (tag) == QImode)((void)(!(((machine_mode) (tag)->mode) == (scalar_int_mode
 ((scalar_int_mode::from_int) E_QImode))) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4544, __FUNCTION__), 0 : 0));
if (HWASAN_TAG_SIZEtargetm.memtag.tag_size () != GET_MODE_PRECISION (QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode))))
  {
    gcc_assert (GET_MODE_PRECISION (QImode) > HWASAN_TAG_SIZE)((void)(!(GET_MODE_PRECISION ((scalar_int_mode ((scalar_int_mode
::from_int) E_QImode))) > targetm.memtag.tag_size ()) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4547, __FUNCTION__), 0 : 0));
    rtx mask = gen_int_mode ((HOST_WIDE_INT_1U1UL << HWASAN_TAG_SIZEtargetm.memtag.tag_size ()) - 1,
	       QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)));
    tag = expand_simple_binop (QImode(scalar_int_mode ((scalar_int_mode::from_int) E_QImode)), AND, tag, mask, target,
		 /* unsignedp = */1, OPTAB_WIDEN);
    gcc_assert (tag)((void)(!(tag) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4552, __FUNCTION__), 0 : 0));
  }
return tag;
4555}

4557/* Construct a function tree for __hwasan_{load,store}{1,2,4,8,16,_n}.
 IS_STORE is either 1 (for a store) or 0 (for a load).  */
4559static combined_fn
4560hwasan_check_func (bool is_store, bool recover_p, HOST_WIDE_INTlong size_in_bytes,
   int *nargs)
4562{
static enum built_in_function check[2][2][6]
  = { { { BUILT_IN_HWASAN_LOAD1, BUILT_IN_HWASAN_LOAD2,
   BUILT_IN_HWASAN_LOAD4, BUILT_IN_HWASAN_LOAD8,
   BUILT_IN_HWASAN_LOAD16, BUILT_IN_HWASAN_LOADN },
 { BUILT_IN_HWASAN_STORE1, BUILT_IN_HWASAN_STORE2,
   BUILT_IN_HWASAN_STORE4, BUILT_IN_HWASAN_STORE8,
   BUILT_IN_HWASAN_STORE16, BUILT_IN_HWASAN_STOREN } },
{ { BUILT_IN_HWASAN_LOAD1_NOABORT,
   BUILT_IN_HWASAN_LOAD2_NOABORT,
   BUILT_IN_HWASAN_LOAD4_NOABORT,
   BUILT_IN_HWASAN_LOAD8_NOABORT,
   BUILT_IN_HWASAN_LOAD16_NOABORT,
   BUILT_IN_HWASAN_LOADN_NOABORT },
 { BUILT_IN_HWASAN_STORE1_NOABORT,
   BUILT_IN_HWASAN_STORE2_NOABORT,
   BUILT_IN_HWASAN_STORE4_NOABORT,
   BUILT_IN_HWASAN_STORE8_NOABORT,
   BUILT_IN_HWASAN_STORE16_NOABORT,
   BUILT_IN_HWASAN_STOREN_NOABORT } } };
if (size_in_bytes == -1)
  {
    *nargs = 2;
    return as_combined_fn (check[recover_p][is_store][5]);
  }
*nargs = 1;
int size_log2 = exact_log2 (size_in_bytes);
gcc_assert (size_log2 >= 0 && size_log2 <= 5)((void)(!(size_log2 >= 0 && size_log2 <= 5) ? fancy_abort
 ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4589, __FUNCTION__), 0 : 0));
return as_combined_fn (check[recover_p][is_store][size_log2]);
4591}

4593/* Expand the HWASAN_{LOAD,STORE} builtins.  */
4594bool
4595hwasan_expand_check_ifn (gimple_stmt_iterator *iter, bool)
4596{
gimple *g = gsi_stmt (*iter);
location_t loc = gimple_location (g);
bool recover_p;
if (flag_sanitizeglobal_options.x_flag_sanitize & SANITIZE_USER_HWADDRESS)
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_USER_HWADDRESS) != 0;
else
  recover_p = (flag_sanitize_recoverglobal_options.x_flag_sanitize_recover & SANITIZE_KERNEL_HWADDRESS) != 0;

HOST_WIDE_INTlong flags = tree_to_shwi (gimple_call_arg (g, 0));
gcc_assert (flags < ASAN_CHECK_LAST)((void)(!(flags < ASAN_CHECK_LAST) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4606, __FUNCTION__), 0 : 0));
bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
bool is_store = (flags & ASAN_CHECK_STORE) != 0;
bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;

tree base = gimple_call_arg (g, 1);
tree len = gimple_call_arg (g, 2);

/* `align` is unused for HWASAN_CHECK, but we pass the argument anyway
   since that way the arguments match ASAN_CHECK.  */
/* HOST_WIDE_INT align = tree_to_shwi (gimple_call_arg (g, 3));  */

unsigned HOST_WIDE_INTlong size_in_bytes
  = is_scalar_access ? tree_to_shwi (len) : -1;

gimple_stmt_iterator gsi = *iter;

if (!is_non_zero_len)
  {
    /* So, the length of the memory area to hwasan-protect is
non-constant.  Let's guard the generated instrumentation code
like:

if (len != 0)
  {
    // hwasan instrumentation code goes here.
  }
// falltrough instructions, starting with *ITER.  */

    g = gimple_build_cond (NE_EXPR,
	    len,
	    build_int_cst (TREE_TYPE (len)((contains_struct_check ((len), (TS_TYPED), "/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4637, __FUNCTION__))->typed.type), 0),
	    NULL_TREE(tree) nullptr, NULL_TREE(tree) nullptr);
    gimple_set_location (g, loc);

    basic_block then_bb, fallthrough_bb;
    insert_if_then_before_iter (as_a <gcond *> (g), iter,
		  /*then_more_likely_p=*/true,
		  &then_bb, &fallthrough_bb);
    /* Note that fallthrough_bb starts with the statement that was
pointed to by ITER.  */

    /* The 'then block' of the 'if (len != 0) condition is where
we'll generate the hwasan instrumentation code now.  */
    gsi = gsi_last_bb (then_bb);
  }

gimple_seq stmts = NULLnullptr;
tree base_addr = gimple_build (&stmts, loc, NOP_EXPR,
		 pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], base);

int nargs = 0;
combined_fn fn
  = hwasan_check_func (is_store, recover_p, size_in_bytes, &nargs);
if (nargs == 1)
  gimple_build (&stmts, loc, fn, void_type_nodeglobal_trees[TI_VOID_TYPE], base_addr);
else
  {
    gcc_assert (nargs == 2)((void)(!(nargs == 2) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4664, __FUNCTION__), 0 : 0));
    tree sz_arg = gimple_build (&stmts, loc, NOP_EXPR,
		  pointer_sized_int_nodeglobal_trees[TI_POINTER_SIZED_TYPE], len);
    gimple_build (&stmts, loc, fn, void_type_nodeglobal_trees[TI_VOID_TYPE], base_addr, sz_arg);
  }

gsi_insert_seq_after (&gsi, stmts, GSI_NEW_STMT);
gsi_remove (iter, true);
*iter = gsi;
return false;
4674}

4676/* For stack tagging:

 Dummy: the HWASAN_MARK internal function should only ever be in the code
 after the sanopt pass.  */
4680bool
4681hwasan_expand_mark_ifn (gimple_stmt_iterator *)
4682{
gcc_unreachable ()(fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/asan.c"
, 4683, __FUNCTION__));
4684}

4686bool
4687gate_hwasan ()
4688{
return hwasan_sanitize_p ();
4690}

4692#include "gt-asan.h"

←

/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/vec.h

1/* Vector API for GNU compiler.
2   Copyright (C) 2004-2021 Free Software Foundation, Inc.
3   Contributed by Nathan Sidwell <nathan@codesourcery.com>
4   Re-implemented in C++ by Diego Novillo <dnovillo@google.com>
5 
6This file is part of GCC.
7 
8GCC is free software; you can redistribute it and/or modify it under
9the terms of the GNU General Public License as published by the Free
10Software Foundation; either version 3, or (at your option) any later
11version.
12 
13GCC is distributed in the hope that it will be useful, but WITHOUT ANY
14WARRANTY; without even the implied warranty of MERCHANTABILITY or
15FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
16for more details.
17 
18You should have received a copy of the GNU General Public License
19along with GCC; see the file COPYING3.  If not see
20<http://www.gnu.org/licenses/>.  */
21 
22#ifndef GCC_VEC_H
23#define GCC_VEC_H
24 
25/* Some gen* file have no ggc support as the header file gtype-desc.h is
26   missing.  Provide these definitions in case ggc.h has not been included.
27   This is not a problem because any code that runs before gengtype is built
28   will never need to use GC vectors.*/
29 
30extern void ggc_free (void *);
31extern size_t ggc_round_alloc_size (size_t requested_size);
32extern void *ggc_realloc (void *, size_t MEM_STAT_DECL);
33 
34/* Templated vector type and associated interfaces.
35 
36   The interface functions are typesafe and use inline functions,
37   sometimes backed by out-of-line generic functions.  The vectors are
38   designed to interoperate with the GTY machinery.
39 
40   There are both 'index' and 'iterate' accessors.  The index accessor
41   is implemented by operator[].  The iterator returns a boolean
42   iteration condition and updates the iteration variable passed by
43   reference.  Because the iterator will be inlined, the address-of
44   can be optimized away.
45 
46   Each operation that increases the number of active elements is
47   available in 'quick' and 'safe' variants.  The former presumes that
48   there is sufficient allocated space for the operation to succeed
49   (it dies if there is not).  The latter will reallocate the
50   vector, if needed.  Reallocation causes an exponential increase in
51   vector size.  If you know you will be adding N elements, it would
52   be more efficient to use the reserve operation before adding the
53   elements with the 'quick' operation.  This will ensure there are at
54   least as many elements as you ask for, it will exponentially
55   increase if there are too few spare slots.  If you want reserve a
56   specific number of slots, but do not want the exponential increase
57   (for instance, you know this is the last allocation), use the
58   reserve_exact operation.  You can also create a vector of a
59   specific size from the get go.
60 
61   You should prefer the push and pop operations, as they append and
62   remove from the end of the vector. If you need to remove several
63   items in one go, use the truncate operation.  The insert and remove
64   operations allow you to change elements in the middle of the
65   vector.  There are two remove operations, one which preserves the
66   element ordering 'ordered_remove', and one which does not
67   'unordered_remove'.  The latter function copies the end element
68   into the removed slot, rather than invoke a memmove operation.  The
69   'lower_bound' function will determine where to place an item in the
70   array using insert that will maintain sorted order.
71 
72   Vectors are template types with three arguments: the type of the
73   elements in the vector, the allocation strategy, and the physical
74   layout to use
75 
76   Four allocation strategies are supported:
77 
78	- Heap: allocation is done using malloc/free.  This is the
79	  default allocation strategy.
80 
81  	- GC: allocation is done using ggc_alloc/ggc_free.
82 
83  	- GC atomic: same as GC with the exception that the elements
84	  themselves are assumed to be of an atomic type that does
85	  not need to be garbage collected.  This means that marking
86	  routines do not need to traverse the array marking the
87	  individual elements.  This increases the performance of
88	  GC activities.
89 
90   Two physical layouts are supported:
91 
92	- Embedded: The vector is structured using the trailing array
93	  idiom.  The last member of the structure is an array of size
94	  1.  When the vector is initially allocated, a single memory
95	  block is created to hold the vector's control data and the
96	  array of elements.  These vectors cannot grow without
97	  reallocation (see discussion on embeddable vectors below).
98 
99	- Space efficient: The vector is structured as a pointer to an
100	  embedded vector.  This is the default layout.  It means that
101	  vectors occupy a single word of storage before initial
102	  allocation.  Vectors are allowed to grow (the internal
103	  pointer is reallocated but the main vector instance does not
104	  need to relocate).
105 
106   The type, allocation and layout are specified when the vector is
107   declared.
108 
109   If you need to directly manipulate a vector, then the 'address'
110   accessor will return the address of the start of the vector.  Also
111   the 'space' predicate will tell you whether there is spare capacity
112   in the vector.  You will not normally need to use these two functions.
113 
114   Notes on the different layout strategies
115 
116   * Embeddable vectors (vec<T, A, vl_embed>)
117   
118     These vectors are suitable to be embedded in other data
119     structures so that they can be pre-allocated in a contiguous
120     memory block.
121 
122     Embeddable vectors are implemented using the trailing array
123     idiom, thus they are not resizeable without changing the address
124     of the vector object itself.  This means you cannot have
125     variables or fields of embeddable vector type -- always use a
126     pointer to a vector.  The one exception is the final field of a
127     structure, which could be a vector type.
128 
129     You will have to use the embedded_size & embedded_init calls to
130     create such objects, and they will not be resizeable (so the
131     'safe' allocation variants are not available).
132 
133     Properties of embeddable vectors:
134 
135	  - The whole vector and control data are allocated in a single
136	    contiguous block.  It uses the trailing-vector idiom, so
137	    allocation must reserve enough space for all the elements
138	    in the vector plus its control data.
139	  - The vector cannot be re-allocated.
140	  - The vector cannot grow nor shrink.
141	  - No indirections needed for access/manipulation.
142	  - It requires 2 words of storage (prior to vector allocation).
143 
144 
145   * Space efficient vector (vec<T, A, vl_ptr>)
146 
147     These vectors can grow dynamically and are allocated together
148     with their control data.  They are suited to be included in data
149     structures.  Prior to initial allocation, they only take a single
150     word of storage.
151 
152     These vectors are implemented as a pointer to embeddable vectors.
153     The semantics allow for this pointer to be NULL to represent
154     empty vectors.  This way, empty vectors occupy minimal space in
155     the structure containing them.
156 
157     Properties:
158 
159	- The whole vector and control data are allocated in a single
160	  contiguous block.
161  	- The whole vector may be re-allocated.
162  	- Vector data may grow and shrink.
163  	- Access and manipulation requires a pointer test and
164	  indirection.
165  	- It requires 1 word of storage (prior to vector allocation).
166 
167   An example of their use would be,
168 
169   struct my_struct {
170     // A space-efficient vector of tree pointers in GC memory.
171     vec<tree, va_gc, vl_ptr> v;
172   };
173 
174   struct my_struct *s;
175 
176   if (s->v.length ()) { we have some contents }
177   s->v.safe_push (decl); // append some decl onto the end
178   for (ix = 0; s->v.iterate (ix, &elt); ix++)
179     { do something with elt }
180*/
181 
182/* Support function for statistics.  */
183extern void dump_vec_loc_statistics (void);
184 
185/* Hashtable mapping vec addresses to descriptors.  */
186extern htab_t vec_mem_usage_hash;
187 
188/* Control data for vectors.  This contains the number of allocated
189   and used slots inside a vector.  */
190 
191struct vec_prefix
192{
193  /* FIXME - These fields should be private, but we need to cater to
194	     compilers that have stricter notions of PODness for types.  */
195 
196  /* Memory allocation support routines in vec.c.  */
197  void register_overhead (void *, size_t, size_t CXX_MEM_STAT_INFO);
198  void release_overhead (void *, size_t, size_t, bool CXX_MEM_STAT_INFO);
199  static unsigned calculate_allocation (vec_prefix *, unsigned, bool);
200  static unsigned calculate_allocation_1 (unsigned, unsigned);
201 
202  /* Note that vec_prefix should be a base class for vec, but we use
203     offsetof() on vector fields of tree structures (e.g.,
204     tree_binfo::base_binfos), and offsetof only supports base types.
205 
206     To compensate, we make vec_prefix a field inside vec and make
207     vec a friend class of vec_prefix so it can access its fields.  */
208  template <typename, typename, typename> friend struct vec;
209 
210  /* The allocator types also need access to our internals.  */
211  friend struct va_gc;
212  friend struct va_gc_atomic;
213  friend struct va_heap;
214 
215  unsigned m_alloc : 31;
216  unsigned m_using_auto_storage : 1;
217  unsigned m_num;
218};
219 
220/* Calculate the number of slots to reserve a vector, making sure that
221   RESERVE slots are free.  If EXACT grow exactly, otherwise grow
222   exponentially.  PFX is the control data for the vector.  */
223 
224inline unsigned
225vec_prefix::calculate_allocation (vec_prefix *pfx, unsigned reserve,
226				  bool exact)
227{
228  if (exact23.1
'exact' is false
23.1
'exact' is false
)
24
←
Taking false branch→
229    return (pfx ? pfx->m_num : 0) + reserve;
230  else if (!pfx24.1
'pfx' is null
24.1
'pfx' is null
)
25
←
Taking true branch→
231    return MAX (4, reserve)((4) > (reserve) ? (4) : (reserve));
26
←
'?' condition is true→
27
←
Returning the value 4, which participates in a condition later→
232  return calculate_allocation_1 (pfx->m_alloc, pfx->m_num + reserve);
233}
234 
235template<typename, typename, typename> struct vec;
236 
237/* Valid vector layouts
238 
239   vl_embed	- Embeddable vector that uses the trailing array idiom.
240   vl_ptr	- Space efficient vector that uses a pointer to an
241		  embeddable vector.  */
242struct vl_embed { };
243struct vl_ptr { };
244 
245 
246/* Types of supported allocations
247 
248   va_heap	- Allocation uses malloc/free.
249   va_gc	- Allocation uses ggc_alloc.
250   va_gc_atomic	- Same as GC, but individual elements of the array
251		  do not need to be marked during collection.  */
252 
253/* Allocator type for heap vectors.  */
254struct va_heap
255{
256  /* Heap vectors are frequently regular instances, so use the vl_ptr
257     layout for them.  */
258  typedef vl_ptr default_layout;
259 
260  template<typename T>
261  static void reserve (vec<T, va_heap, vl_embed> *&, unsigned, bool
262		       CXX_MEM_STAT_INFO);
263 
264  template<typename T>
265  static void release (vec<T, va_heap, vl_embed> *&);
266};
267 
268 
269/* Allocator for heap memory.  Ensure there are at least RESERVE free
270   slots in V.  If EXACT is true, grow exactly, else grow
271   exponentially.  As a special case, if the vector had not been
272   allocated and RESERVE is 0, no vector will be created.  */
273 
274template<typename T>
275inline void
276va_heap::reserve (vec<T, va_heap, vl_embed> *&v, unsigned reserve, bool exact
277		  MEM_STAT_DECL)
278{
279  size_t elt_size = sizeof (T);
280  unsigned alloc
281    = vec_prefix::calculate_allocation (v ? &v->m_vecpfx : 0, reserve, exact);
282  gcc_checking_assert (alloc)((void)(!(alloc) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/vec.h"
, 282, __FUNCTION__), 0 : 0));
283 
284  if (GATHER_STATISTICS0 && v)
285    v->m_vecpfx.release_overhead (v, elt_size * v->allocated (),
286				  v->allocated (), false);
287 
288  size_t size = vec<T, va_heap, vl_embed>::embedded_size (alloc);
289  unsigned nelem = v ? v->length () : 0;
290  v = static_cast <vec<T, va_heap, vl_embed> *> (xrealloc (v, size));
291  v->embedded_init (alloc, nelem);
292 
293  if (GATHER_STATISTICS0)
294    v->m_vecpfx.register_overhead (v, alloc, elt_size PASS_MEM_STAT);
295}
296 
297 
298#if GCC_VERSION(4 * 1000 + 2) >= 4007
299#pragma GCC diagnostic push
300#pragma GCC diagnostic ignored "-Wfree-nonheap-object"
301#endif
302 
303/* Free the heap space allocated for vector V.  */
304 
305template<typename T>
306void
307va_heap::release (vec<T, va_heap, vl_embed> *&v)
308{
309  size_t elt_size = sizeof (T);
310  if (v == NULLnullptr)
311    return;
312 
313  if (GATHER_STATISTICS0)
314    v->m_vecpfx.release_overhead (v, elt_size * v->allocated (),
315				  v->allocated (), true);
316  ::free (v);
317  v = NULLnullptr;
318}
319 
320#if GCC_VERSION(4 * 1000 + 2) >= 4007
321#pragma GCC diagnostic pop
322#endif
323 
324/* Allocator type for GC vectors.  Notice that we need the structure
325   declaration even if GC is not enabled.  */
326 
327struct va_gc
328{
329  /* Use vl_embed as the default layout for GC vectors.  Due to GTY
330     limitations, GC vectors must always be pointers, so it is more
331     efficient to use a pointer to the vl_embed layout, rather than
332     using a pointer to a pointer as would be the case with vl_ptr.  */
333  typedef vl_embed default_layout;
334 
335  template<typename T, typename A>
336  static void reserve (vec<T, A, vl_embed> *&, unsigned, bool
337		       CXX_MEM_STAT_INFO);
338 
339  template<typename T, typename A>
340  static void release (vec<T, A, vl_embed> *&v);
341};
342 
343 
344/* Free GC memory used by V and reset V to NULL.  */
345 
346template<typename T, typename A>
347inline void
348va_gc::release (vec<T, A, vl_embed> *&v)
349{
350  if (v)
351    ::ggc_free (v);
352  v = NULLnullptr;
353}
354 
355 
356/* Allocator for GC memory.  Ensure there are at least RESERVE free
357   slots in V.  If EXACT is true, grow exactly, else grow
358   exponentially.  As a special case, if the vector had not been
359   allocated and RESERVE is 0, no vector will be created.  */
360 
361template<typename T, typename A>
362void
363va_gc::reserve (vec<T, A, vl_embed> *&v, unsigned reserve, bool exact
364		MEM_STAT_DECL)
365{
366  unsigned alloc
367    = vec_prefix::calculate_allocation (v21.1
'v' is null
42.1
'v' is non-null
21.1
'v' is null
42.1
'v' is non-null
 ? &v->m_vecpfx : 0, reserve, exact);
22
←
'?' condition is false→
23
←
Calling 'vec_prefix::calculate_allocation'→
28
←
Returning from 'vec_prefix::calculate_allocation'→
43
←
'?' condition is true→
368  if (!alloc28.1
'alloc' is 4
28.1
'alloc' is 4
)
29
←
Taking false branch→
44
←
Assuming 'alloc' is 0→
45
←
Taking true branch→
369    {
370      ::ggc_free (v);
371      v = NULLnullptr;
46
←
Null pointer value stored to 'vinner'→
372      return;
373    }
374 
375  /* Calculate the amount of space we want.  */
376  size_t size = vec<T, A, vl_embed>::embedded_size (alloc);
377 
378  /* Ask the allocator how much space it will really give us.  */
379  size = ::ggc_round_alloc_size (size);
380 
381  /* Adjust the number of slots accordingly.  */
382  size_t vec_offset = sizeof (vec_prefix);
383  size_t elt_size = sizeof (T);
384  alloc = (size - vec_offset) / elt_size;
385 
386  /* And finally, recalculate the amount of space we ask for.  */
387  size = vec_offset + alloc * elt_size;
388 
389  unsigned nelem = v29.1
'v' is null
29.1
'v' is null
 ? v->length () : 0;
30
←
'?' condition is false→
390  v = static_cast <vec<T, A, vl_embed> *> (::ggc_realloc (v, size
31
←
Value assigned to 'vinner'→
391							       PASS_MEM_STAT));
392  v->embedded_init (alloc, nelem);
393}
394 
395 
396/* Allocator type for GC vectors.  This is for vectors of types
397   atomics w.r.t. collection, so allocation and deallocation is
398   completely inherited from va_gc.  */
399struct va_gc_atomic : va_gc
400{
401};
402 
403 
404/* Generic vector template.  Default values for A and L indicate the
405   most commonly used strategies.
406 
407   FIXME - Ideally, they would all be vl_ptr to encourage using regular
408           instances for vectors, but the existing GTY machinery is limited
409	   in that it can only deal with GC objects that are pointers
410	   themselves.
411 
412	   This means that vector operations that need to deal with
413	   potentially NULL pointers, must be provided as free
414	   functions (see the vec_safe_* functions above).  */
415template<typename T,
416         typename A = va_heap,
417         typename L = typename A::default_layout>
418struct GTY((user)) vec
419{
420};
421 
422/* Allow C++11 range-based 'for' to work directly on vec<T>*.  */
423template<typename T, typename A, typename L>
424T* begin (vec<T,A,L> *v) { return v ? v->begin () : nullptr; }
425template<typename T, typename A, typename L>
426T* end (vec<T,A,L> *v) { return v ? v->end () : nullptr; }
427template<typename T, typename A, typename L>
428const T* begin (const vec<T,A,L> *v) { return v ? v->begin () : nullptr; }
429template<typename T, typename A, typename L>
430const T* end (const vec<T,A,L> *v) { return v ? v->end () : nullptr; }
431 
432/* Generic vec<> debug helpers.
433 
434   These need to be instantiated for each vec<TYPE> used throughout
435   the compiler like this:
436 
437    DEFINE_DEBUG_VEC (TYPE)
438 
439   The reason we have a debug_helper() is because GDB can't
440   disambiguate a plain call to debug(some_vec), and it must be called
441   like debug<TYPE>(some_vec).  */
442 
443template<typename T>
444void
445debug_helper (vec<T> &ref)
446{
447  unsigned i;
448  for (i = 0; i < ref.length (); ++i)
449    {
450      fprintf (stderrstderr, "[%d] = ", i);
451      debug_slim (ref[i]);
452      fputc ('\n', stderrstderr);
453    }
454}
455 
456/* We need a separate va_gc variant here because default template
457   argument for functions cannot be used in c++-98.  Once this
458   restriction is removed, those variant should be folded with the
459   above debug_helper.  */
460 
461template<typename T>
462void
463debug_helper (vec<T, va_gc> &ref)
464{
465  unsigned i;
466  for (i = 0; i < ref.length (); ++i)
467    {
468      fprintf (stderrstderr, "[%d] = ", i);
469      debug_slim (ref[i]);
470      fputc ('\n', stderrstderr);
471    }
472}
473 
474/* Macro to define debug(vec<T>) and debug(vec<T, va_gc>) helper
475   functions for a type T.  */
476 
477#define DEFINE_DEBUG_VEC(T)template void debug_helper (vec<T> &); template void
 debug_helper (vec<T, va_gc> &); __attribute__ ((__used__
)) void debug (vec<T> &ref) { debug_helper <T>
 (ref); } __attribute__ ((__used__)) void debug (vec<T>
 *ptr) { if (ptr) debug (*ptr); else fprintf (stderr, "<nil>\n"
); } __attribute__ ((__used__)) void debug (vec<T, va_gc>
 &ref) { debug_helper <T> (ref); } __attribute__ ((
__used__)) void debug (vec<T, va_gc> *ptr) { if (ptr) debug
 (*ptr); else fprintf (stderr, "<nil>\n"); } \
478  template void debug_helper (vec<T> &);		\
479  template void debug_helper (vec<T, va_gc> &);		\
480  /* Define the vec<T> debug functions.  */		\
481  DEBUG_FUNCTION__attribute__ ((__used__)) void					\
482  debug (vec<T> &ref)					\
483  {							\
484    debug_helper <T> (ref);				\
485  }							\
486  DEBUG_FUNCTION__attribute__ ((__used__)) void					\
487  debug (vec<T> *ptr)					\
488  {							\
489    if (ptr)						\
490      debug (*ptr);					\
491    else						\
492      fprintf (stderrstderr, "<nil>\n");			\
493  }							\
494  /* Define the vec<T, va_gc> debug functions.  */	\
495  DEBUG_FUNCTION__attribute__ ((__used__)) void					\
496  debug (vec<T, va_gc> &ref)				\
497  {							\
498    debug_helper <T> (ref);				\
499  }							\
500  DEBUG_FUNCTION__attribute__ ((__used__)) void					\
501  debug (vec<T, va_gc> *ptr)				\
502  {							\
503    if (ptr)						\
504      debug (*ptr);					\
505    else						\
506      fprintf (stderrstderr, "<nil>\n");			\
507  }
508 
509/* Default-construct N elements in DST.  */
510 
511template <typename T>
512inline void
513vec_default_construct (T *dst, unsigned n)
514{
515#ifdef BROKEN_VALUE_INITIALIZATION
516  /* Versions of GCC before 4.4 sometimes leave certain objects
517     uninitialized when value initialized, though if the type has
518     user defined default ctor, that ctor is invoked.  As a workaround
519     perform clearing first and then the value initialization, which
520     fixes the case when value initialization doesn't initialize due to
521     the bugs and should initialize to all zeros, but still allows
522     vectors for types with user defined default ctor that initializes
523     some or all elements to non-zero.  If T has no user defined
524     default ctor and some non-static data members have user defined
525     default ctors that initialize to non-zero the workaround will
526     still not work properly; in that case we just need to provide
527     user defined default ctor.  */
528  memset (dst, '\0', sizeof (T) * n);
529#endif
530  for ( ; n; ++dst, --n)
531    ::new (static_cast<void*>(dst)) T ();
532}
533 
534/* Copy-construct N elements in DST from *SRC.  */
535 
536template <typename T>
537inline void
538vec_copy_construct (T *dst, const T *src, unsigned n)
539{
540  for ( ; n; ++dst, ++src, --n)
541    ::new (static_cast<void*>(dst)) T (*src);
542}
543 
544/* Type to provide NULL values for vec<T, A, L>.  This is used to
545   provide nil initializers for vec instances.  Since vec must be
546   a POD, we cannot have proper ctor/dtor for it.  To initialize
547   a vec instance, you can assign it the value vNULL.  This isn't
548   needed for file-scope and function-local static vectors, which
549   are zero-initialized by default.  */
550struct vnull
551{
552  template <typename T, typename A, typename L>
553  CONSTEXPRconstexpr operator vec<T, A, L> () const { return vec<T, A, L>(); }
554};
555extern vnull vNULL;
556 
557 
558/* Embeddable vector.  These vectors are suitable to be embedded
559   in other data structures so that they can be pre-allocated in a
560   contiguous memory block.
561 
562   Embeddable vectors are implemented using the trailing array idiom,
563   thus they are not resizeable without changing the address of the
564   vector object itself.  This means you cannot have variables or
565   fields of embeddable vector type -- always use a pointer to a
566   vector.  The one exception is the final field of a structure, which
567   could be a vector type.
568 
569   You will have to use the embedded_size & embedded_init calls to
570   create such objects, and they will not be resizeable (so the 'safe'
571   allocation variants are not available).
572 
573   Properties:
574 
575	- The whole vector and control data are allocated in a single
576	  contiguous block.  It uses the trailing-vector idiom, so
577	  allocation must reserve enough space for all the elements
578  	  in the vector plus its control data.
579  	- The vector cannot be re-allocated.
580  	- The vector cannot grow nor shrink.
581  	- No indirections needed for access/manipulation.
582  	- It requires 2 words of storage (prior to vector allocation).  */
583 
584template<typename T, typename A>
585struct GTY((user)) vec<T, A, vl_embed>
586{
587public:
588  unsigned allocated (void) const { return m_vecpfx.m_alloc; }
589  unsigned length (void) const { return m_vecpfx.m_num; }
590  bool is_empty (void) const { return m_vecpfx.m_num == 0; }
591  T *address (void) { return m_vecdata; }
592  const T *address (void) const { return m_vecdata; }
593  T *begin () { return address (); }
594  const T *begin () const { return address (); }
595  T *end () { return address () + length (); }
596  const T *end () const { return address () + length (); }
597  const T &operator[] (unsigned) const;
598  T &operator[] (unsigned);
599  T &last (void);
600  bool space (unsigned) const;
601  bool iterate (unsigned, T *) const;
602  bool iterate (unsigned, T **) const;
603  vec *copy (ALONE_CXX_MEM_STAT_INFO) const;
604  void splice (const vec &);
605  void splice (const vec *src);
606  T *quick_push (const T &);
607  T &pop (void);
608  void truncate (unsigned);
609  void quick_insert (unsigned, const T &);
610  void ordered_remove (unsigned);
611  void unordered_remove (unsigned);
612  void block_remove (unsigned, unsigned);
613  void qsort (int (*) (const void *, const void *))qsort (int (*) (const void *, const void *));
614  void sort (int (*) (const void *, const void *, void *), void *);
615  T *bsearch (const void *key, int (*compar)(const void *, const void *));
616  T *bsearch (const void *key,
617	      int (*compar)(const void *, const void *, void *), void *);
618  unsigned lower_bound (T, bool (*)(const T &, const T &)) const;
619  bool contains (const T &search) const;
620  static size_t embedded_size (unsigned);
621  void embedded_init (unsigned, unsigned = 0, unsigned = 0);
622  void quick_grow (unsigned len);
623  void quick_grow_cleared (unsigned len);
624 
625  /* vec class can access our internal data and functions.  */
626  template <typename, typename, typename> friend struct vec;
627 
628  /* The allocator types also need access to our internals.  */
629  friend struct va_gc;
630  friend struct va_gc_atomic;
631  friend struct va_heap;
632 
633  /* FIXME - These fields should be private, but we need to cater to
634	     compilers that have stricter notions of PODness for types.  */
635  vec_prefix m_vecpfx;
636  T m_vecdata[1];
637};
638 
639 
640/* Convenience wrapper functions to use when dealing with pointers to
641   embedded vectors.  Some functionality for these vectors must be
642   provided via free functions for these reasons:
643 
644	1- The pointer may be NULL (e.g., before initial allocation).
645 
646  	2- When the vector needs to grow, it must be reallocated, so
647  	   the pointer will change its value.
648 
649   Because of limitations with the current GC machinery, all vectors
650   in GC memory *must* be pointers.  */
651 
652 
653/* If V contains no room for NELEMS elements, return false. Otherwise,
654   return true.  */
655template<typename T, typename A>
656inline bool
657vec_safe_space (const vec<T, A, vl_embed> *v, unsigned nelems)
658{
659  return v16.1
'v' is null
16.1
'v' is null
 ? v->space (nelems) : nelems == 0;
17
←
'?' condition is false→
18
←
Returning zero, which participates in a condition later→
660}
661 
662 
663/* If V is NULL, return 0.  Otherwise, return V->length().  */
664template<typename T, typename A>
665inline unsigned
666vec_safe_length (const vec<T, A, vl_embed> *v)
667{
668  return v ? v->length () : 0;
669}
670 
671 
672/* If V is NULL, return NULL.  Otherwise, return V->address().  */
673template<typename T, typename A>
674inline T *
675vec_safe_address (vec<T, A, vl_embed> *v)
676{
677  return v ? v->address () : NULLnullptr;
678}
679 
680 
681/* If V is NULL, return true.  Otherwise, return V->is_empty().  */
682template<typename T, typename A>
683inline bool
684vec_safe_is_empty (vec<T, A, vl_embed> *v)
685{
686  return v ? v->is_empty () : true;
687}
688 
689/* If V does not have space for NELEMS elements, call
690   V->reserve(NELEMS, EXACT).  */
691template<typename T, typename A>
692inline bool
693vec_safe_reserve (vec<T, A, vl_embed> *&v, unsigned nelems, bool exact = false
694		  CXX_MEM_STAT_INFO)
695{
696  bool extend = nelems14.1
'nelems' is 1
38.1
'nelems' is 1
14.1
'nelems' is 1
38.1
'nelems' is 1
 ? !vec_safe_space (v, nelems) : false;
15
←
'?' condition is true→
16
←
Calling 'vec_safe_space<constructor_elt, va_gc>'→
19
←
Returning from 'vec_safe_space<constructor_elt, va_gc>'→
39
←
'?' condition is true→
40
←
Assuming the condition is true→
697  if (extend19.1
'extend' is true
40.1
'extend' is true
19.1
'extend' is true
40.1
'extend' is true
)
20
←
Taking true branch→
41
←
Taking true branch→
698    A::reserve (v, nelems, exact PASS_MEM_STAT);
21
←
Calling 'va_gc::reserve'→
32
←
Returning from 'va_gc::reserve'→
42
←
Calling 'va_gc::reserve'→
47
←
Returning from 'va_gc::reserve'→
699  return extend;
700}
701 
702template<typename T, typename A>
703inline bool
704vec_safe_reserve_exact (vec<T, A, vl_embed> *&v, unsigned nelems
705			CXX_MEM_STAT_INFO)
706{
707  return vec_safe_reserve (v, nelems, true PASS_MEM_STAT);
708}
709 
710 
711/* Allocate GC memory for V with space for NELEMS slots.  If NELEMS
712   is 0, V is initialized to NULL.  */
713 
714template<typename T, typename A>
715inline void
716vec_alloc (vec<T, A, vl_embed> *&v, unsigned nelems CXX_MEM_STAT_INFO)
717{
718  v = NULLnullptr;
719  vec_safe_reserve (v, nelems, false PASS_MEM_STAT);
720}
721 
722 
723/* Free the GC memory allocated by vector V and set it to NULL.  */
724 
725template<typename T, typename A>
726inline void
727vec_free (vec<T, A, vl_embed> *&v)
728{
729  A::release (v);
730}
731 
732 
733/* Grow V to length LEN.  Allocate it, if necessary.  */
734template<typename T, typename A>
735inline void
736vec_safe_grow (vec<T, A, vl_embed> *&v, unsigned len,
737	       bool exact = false CXX_MEM_STAT_INFO)
738{
739  unsigned oldlen = vec_safe_length (v);
740  gcc_checking_assert (len >= oldlen)((void)(!(len >= oldlen) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/vec.h"
, 740, __FUNCTION__), 0 : 0));
741  vec_safe_reserve (v, len - oldlen, exact PASS_MEM_STAT);
742  v->quick_grow (len);
743}
744 
745 
746/* If V is NULL, allocate it.  Call V->safe_grow_cleared(LEN).  */
747template<typename T, typename A>
748inline void
749vec_safe_grow_cleared (vec<T, A, vl_embed> *&v, unsigned len,
750		       bool exact = false CXX_MEM_STAT_INFO)
751{
752  unsigned oldlen = vec_safe_length (v);
753  vec_safe_grow (v, len, exact PASS_MEM_STAT);
754  vec_default_construct (v->address () + oldlen, len - oldlen);
755}
756 
757 
758/* Assume V is not NULL.  */
759 
760template<typename T>
761inline void
762vec_safe_grow_cleared (vec<T, va_heap, vl_ptr> *&v,
763		       unsigned len, bool exact = false CXX_MEM_STAT_INFO)
764{
765  v->safe_grow_cleared (len, exact PASS_MEM_STAT);
766}
767 
768/* If V does not have space for NELEMS elements, call
769   V->reserve(NELEMS, EXACT).  */
770 
771template<typename T>
772inline bool
773vec_safe_reserve (vec<T, va_heap, vl_ptr> *&v, unsigned nelems, bool exact = false
774		  CXX_MEM_STAT_INFO)
775{
776  return v->reserve (nelems, exact);
777}
778 
779 
780/* If V is NULL return false, otherwise return V->iterate(IX, PTR).  */
781template<typename T, typename A>
782inline bool
783vec_safe_iterate (const vec<T, A, vl_embed> *v, unsigned ix, T **ptr)
784{
785  if (v)
786    return v->iterate (ix, ptr);
787  else
788    {
789      *ptr = 0;
790      return false;
791    }
792}
793 
794template<typename T, typename A>
795inline bool
796vec_safe_iterate (const vec<T, A, vl_embed> *v, unsigned ix, T *ptr)
797{
798  if (v)
799    return v->iterate (ix, ptr);
800  else
801    {
802      *ptr = 0;
803      return false;
804    }
805}
806 
807 
808/* If V has no room for one more element, reallocate it.  Then call
809   V->quick_push(OBJ).  */
810template<typename T, typename A>
811inline T *
812vec_safe_push (vec<T, A, vl_embed> *&v, const T &obj CXX_MEM_STAT_INFO)
813{
814  vec_safe_reserve (v, 1, false PASS_MEM_STAT);
14
←
Calling 'vec_safe_reserve<constructor_elt, va_gc>'→
33
←
Returning from 'vec_safe_reserve<constructor_elt, va_gc>'→
38
←
Calling 'vec_safe_reserve<constructor_elt, va_gc>'→
48
←
Returning from 'vec_safe_reserve<constructor_elt, va_gc>'→
815  return v->quick_push (obj);
49
←
Called C++ object pointer is null
816}
817 
818 
819/* if V has no room for one more element, reallocate it.  Then call
820   V->quick_insert(IX, OBJ).  */
821template<typename T, typename A>
822inline void
823vec_safe_insert (vec<T, A, vl_embed> *&v, unsigned ix, const T &obj
824		 CXX_MEM_STAT_INFO)
825{
826  vec_safe_reserve (v, 1, false PASS_MEM_STAT);
827  v->quick_insert (ix, obj);
828}
829 
830 
831/* If V is NULL, do nothing.  Otherwise, call V->truncate(SIZE).  */
832template<typename T, typename A>
833inline void
834vec_safe_truncate (vec<T, A, vl_embed> *v, unsigned size)
835{
836  if (v)
837    v->truncate (size);
838}
839 
840 
841/* If SRC is not NULL, return a pointer to a copy of it.  */
842template<typename T, typename A>
843inline vec<T, A, vl_embed> *
844vec_safe_copy (vec<T, A, vl_embed> *src CXX_MEM_STAT_INFO)
845{
846  return src ? src->copy (ALONE_PASS_MEM_STAT) : NULLnullptr;
847}
848 
849/* Copy the elements from SRC to the end of DST as if by memcpy.
850   Reallocate DST, if necessary.  */
851template<typename T, typename A>
852inline void
853vec_safe_splice (vec<T, A, vl_embed> *&dst, const vec<T, A, vl_embed> *src
854		 CXX_MEM_STAT_INFO)
855{
856  unsigned src_len = vec_safe_length (src);
857  if (src_len)
858    {
859      vec_safe_reserve_exact (dst, vec_safe_length (dst) + src_len
860			      PASS_MEM_STAT);
861      dst->splice (*src);
862    }
863}
864 
865/* Return true if SEARCH is an element of V.  Note that this is O(N) in the
866   size of the vector and so should be used with care.  */
867 
868template<typename T, typename A>
869inline bool
870vec_safe_contains (vec<T, A, vl_embed> *v, const T &search)
871{
872  return v ? v->contains (search) : false;
873}
874 
875/* Index into vector.  Return the IX'th element.  IX must be in the
876   domain of the vector.  */
877 
878template<typename T, typename A>
879inline const T &
880vec<T, A, vl_embed>::operator[] (unsigned ix) const
881{
882  gcc_checking_assert (ix < m_vecpfx.m_num)((void)(!(ix < m_vecpfx.m_num) ? fancy_abort ("/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-clang-static-analyzer/build/gcc/vec.h"
, 882, __FUNCTION__), 0 : 0));
883  return m_vecdata[ix];
884}
885 
886template<typename T, typename A>
887inline T &
888vec<T, A, vl_embed>::operator[] (unsigned ix)
889{
890  gcc_checking_assert (ix < m_vecpfx.m_num)((void)(!(ix < m_vecpfx.m_num) ? fancy_abort ("/home