[PATCH] tree-object-size: Fix type-1 size for pointers to FAM-containing subobjects [PR126975]

["Gustavo A. R. Silva" <gustavoars@kernel.org>]

For a pointer to a subobject whose record/union type ends in a flexible-array
member (directly, or through its trailing nested struct), addr_object_size()
walked up to the enclosing object (v = TREE_OPERAND (v, 0)) instead of
measuring the referenced subobject. __builtin_object_size() and
__builtin_dynamic_object_size() type 1 therefore returned the whole-object
size, collapsing type 1 onto type 0 and losing the distinction between
&p->inner and p. FORTIFY_SOURCE relies on the type-1 distinction, so this
weakens its bounds checks.

Fix this by computing the size directly from the referenced record/union
instead of walking up, restoring the type-0/type-1 distinction that Clang
already implements.

Bootstraped and regtested on x86_64-linux-gnu.

	PR tree-optimization/126975

gcc/ChangeLog:

	* tree-object-size.cc (addr_object_size): For a reference to a
	record or union type, compute the object size from the referenced
	subobject instead of walking up to the enclosing object when the
	type recursively includes a flexible array member.

gcc/testsuite/ChangeLog:

	* gcc.dg/builtin-object-size-pr101832.c (main): Update the expected
	results of __builtin_object_size (..., 1) queries on subobjects
	whose type contains a flexible array member.
---
 .../gcc.dg/builtin-object-size-pr101832.c      |  6 +++---
 gcc/tree-object-size.cc                        | 18 +++++-------------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c b/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
index 60078e11634..d76286ae454 100644
--- a/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
+++ b/gcc/testsuite/gcc.dg/builtin-object-size-pr101832.c
@@ -92,9 +92,9 @@ int main (int argc, char *argv[])
   outer = (void *)magic1;
   outest = (void *)magic2;
 
-  expect (__builtin_object_size (&outer->a, 1), -1);
-  expect (__builtin_object_size (&outest->b, 1), -1);
-  expect (__builtin_object_size (&outest->b.a, 1), -1);
+  expect (__builtin_object_size (&outer->a, 1), sizeof(outer->a));
+  expect (__builtin_object_size (&outest->b, 1), sizeof(outest->b));
+  expect (__builtin_object_size (&outest->b.a, 1), sizeof(outest->b.a));
 
   struct B0 *outer0;
   struct C0 *outest0;
diff --git a/gcc/tree-object-size.cc b/gcc/tree-object-size.cc
index 54c320d36d0..5c8b4ee7862 100644
--- a/gcc/tree-object-size.cc
+++ b/gcc/tree-object-size.cc
@@ -732,21 +732,13 @@ addr_object_size (struct object_size_info *osi, const_tree ptr,
 			v = NULL_TREE;
 			break;
 		      }
-		    /* if the ref is to a record or union type, but the type
-		       does not include a flexible array recursively, compute
-		       the object size directly.  */
+		    /* If the ref is to a record or union type, compute the
+		       object size directly, regardless of whether the type
+		       recursively includes a flexible array member.  */
 		    if (RECORD_OR_UNION_TYPE_P (TREE_TYPE (v)))
 		      {
-			if (!TYPE_INCLUDES_FLEXARRAY (TREE_TYPE (v)))
-			  {
-			    v = NULL_TREE;
-			    break;
-			  }
-			else
-			  {
-			    v = TREE_OPERAND (v, 0);
-			    break;
-			  }
+			v = NULL_TREE;
+			break;
 		      }
 		    /* Now the ref is to an array type.  */
 		    gcc_assert (TREE_CODE (TREE_TYPE (v)) == ARRAY_TYPE);
-- 
2.47.3