When checking compatibility of types during assignment, collect
all pairs of types where the outermost bound needs to match at
run-time. This list is then processed to add runtime checks for
each bound.
gcc/c-family:
* c-opt (fvla-bounds): New flag.
gcc/c:
* c-typeck.cc (struct instrument_data): New structure.
(comp_target_types_instr convert_for_assignment_instrument): New
interfaces for existing functions.
(struct comptypes_data): Add instrumentation.
(comptypes_check_enum_int_intr): New interface.
(comptypes_check_enum_int): Old interface (calls new).
(comptypes_internal): Collect VLA types needed for UBSan.
(comp_target_types_instr): New interface.
(comp_target_types): Old interface (calls new).
(function_types_compatible_p): No instrumentation for function
arguments.
(process_vm_constraints): New function.
(convert_argument): Adapt.
(convert_for_assignment_instrument): New interface.
(convert_for_assignment): Instrument assignments.
(c_instrument_vm_assign): Helper function.
(process_vm_constraints): Helper function.
gcc/doc/:
* invoke.texi (fvla-bounds): Document new flag.
gcc/testsuite:
* gcc.dg/vla-bounds-1.c: New test.
* gcc.dg/vla-bounds-assign-1.c: New test.
* gcc.dg/vla-bounds-assign-2.c: New test.
* gcc.dg/vla-bounds-assign-3.c: New test.
* gcc.dg/vla-bounds-assign-4.c: New test.
* gcc.dg/vla-bounds-func-1.c: New test.
* gcc.dg/vla-bounds-init-1.c: New test.
* gcc.dg/vla-bounds-init-2.c: New test.
* gcc.dg/vla-bounds-init-3.c: New test.
* gcc.dg/vla-bounds-init-4.c: New test.
* gcc.dg/vla-bounds-nest-1.c: New test.
* gcc.dg/vla-bounds-nest-2.c: New test.
* gcc.dg/vla-bounds-ret-1.c: New test.
* gcc.dg/vla-bounds-ret-2.c: New test.
---
gcc/c-family/c.opt | 4 +
gcc/c/c-typeck.cc | 171 ++++++++++++++++++---
gcc/doc/invoke.texi | 15 ++
gcc/testsuite/gcc.dg/vla-bounds-1.c | 85 ++++++++++
gcc/testsuite/gcc.dg/vla-bounds-assign-1.c | 126 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-assign-2.c | 126 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-assign-3.c | 126 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-assign-4.c | 133 ++++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-func-1.c | 56 +++++++
gcc/testsuite/gcc.dg/vla-bounds-init-1.c | 125 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-init-2.c | 125 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-init-3.c | 126 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-init-4.c | 125 +++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-nest-1.c | 39 +++++
gcc/testsuite/gcc.dg/vla-bounds-nest-2.c | 33 ++++
gcc/testsuite/gcc.dg/vla-bounds-ret-1.c | 132 ++++++++++++++++
gcc/testsuite/gcc.dg/vla-bounds-ret-2.c | 133 ++++++++++++++++
17 files changed, 1661 insertions(+), 19 deletions(-)
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-assign-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-assign-2.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-assign-3.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-assign-4.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-func-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-init-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-init-2.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-init-3.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-init-4.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-nest-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-nest-2.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-ret-1.c
create mode 100644 gcc/testsuite/gcc.dg/vla-bounds-ret-2.c
diff --git a/gcc/c-family/c.opt b/gcc/c-family/c.opt
index b10c6057cd1..29bc0956181 100644
--- a/gcc/c-family/c.opt
+++ b/gcc/c-family/c.opt
@@ -2280,6 +2280,10 @@ fvisibility-ms-compat
C++ ObjC++ Var(flag_visibility_ms_compat)
Changes visibility to match Microsoft Visual Studio by default.
+fvla-bounds
+C Var(flag_vla_bounds)
+Emit run-time consistency checks for variably-modified types.
+
fvtable-gc
C++ ObjC++ WarnRemoved
No longer supported.
diff --git a/gcc/c/c-typeck.cc b/gcc/c/c-typeck.cc
index 1dbb4471a88..cb5887b6255 100644
--- a/gcc/c/c-typeck.cc
+++ b/gcc/c/c-typeck.cc
@@ -93,11 +93,13 @@ static tree qualify_type (tree, tree);
struct comptypes_data;
static bool tagged_types_tu_compatible_p (const_tree, const_tree,
struct comptypes_data *);
-static bool comp_target_types (location_t, tree, tree);
static bool function_types_compatible_p (const_tree, const_tree,
struct comptypes_data *);
static bool type_lists_compatible_p (const_tree, const_tree,
struct comptypes_data *);
+
+static bool comp_target_types_instr (location_t, tree, tree,
+ struct instrument_data **);
static tree lookup_field (tree, tree);
static int convert_arguments (location_t, vec<location_t>, tree,
vec<tree, va_gc> *, vec<tree, va_gc> *, tree,
@@ -106,6 +108,9 @@ static tree pointer_diff (location_t, tree, tree, tree *);
static tree convert_for_assignment (location_t, location_t, tree, tree, tree,
enum impl_conv, bool, tree, tree, int,
int = 0);
+static tree convert_for_assignment_instrument (location_t, location_t, tree,
tree, tree,
+ enum impl_conv, bool, tree, tree, int, int,
+ struct instrument_data **);
static tree valid_compound_expr_initializer (tree, tree);
static void push_string (const char *);
static void push_member_name (tree);
@@ -1058,6 +1063,38 @@ common_type (tree t1, tree t2)
return c_common_type (t1, t2);
}
+
+/* Instrument assignment of variably modified types. */
+
+static tree
+c_instrument_vm_assign (location_t loc, tree a, tree b)
+{
+ gcc_assert (flag_vla_bounds);
+
+ gcc_assert (TREE_CODE (a) == ARRAY_TYPE);
+ gcc_assert (TREE_CODE (b) == ARRAY_TYPE);
+
+ tree as = TYPE_MAX_VALUE (TYPE_DOMAIN (a));
+ tree bs = TYPE_MAX_VALUE (TYPE_DOMAIN (b));
+
+ as = fold_build2 (PLUS_EXPR, sizetype, as, size_one_node);
+ bs = fold_build2 (PLUS_EXPR, sizetype, bs, size_one_node);
+
+ tree t = build2 (NE_EXPR, boolean_type_node, as, bs);
+ tree tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP),
0);
+
+ return build3 (COND_EXPR, void_type_node, t, tt, void_node);
+}
+
+
+
+struct instrument_data {
+
+ tree t1;
+ tree t2;
+ struct instrument_data *next;
+};
+
struct comptypes_data {
bool enum_and_int_p;
bool different_types_p;
@@ -1065,6 +1102,8 @@ struct comptypes_data {
bool anon_field;
const struct tagged_tu_seen_cache* cache;
+
+ struct instrument_data **instr_vec;
};
/* Return 1 if TYPE1 and TYPE2 are compatible types for assignment
@@ -1083,16 +1122,25 @@ comptypes (tree type1, tree type2)
/* Like comptypes, but if it returns non-zero because enum and int are
compatible, it sets *ENUM_AND_INT_P to true. */
-int
-comptypes_check_enum_int (tree type1, tree type2, bool *enum_and_int_p)
+static int
+comptypes_check_enum_int_instr (tree type1, tree type2, bool *enum_and_int_p,
+ struct instrument_data **instr_vec)
{
struct comptypes_data data = { };
+ data.instr_vec = instr_vec;
bool ret = comptypes_internal (type1, type2, &data);
+
*enum_and_int_p = data.enum_and_int_p;
return ret ? (data.warning_needed ? 2 : 1) : 0;
}
+int
+comptypes_check_enum_int (tree type1, tree type2, bool *enum_and_int_p)
+{
+ return comptypes_check_enum_int_instr (type1, type2, enum_and_int_p, NULL);
+}
+
/* Like comptypes, but if it returns nonzero for different types, it
sets *DIFFERENT_TYPES_P to true. */
@@ -1252,7 +1300,18 @@ comptypes_internal (const_tree type1, const_tree type2,
if (d1_variable != d2_variable)
data->different_types_p = true;
if (d1_variable || d2_variable)
- return true;
+ {
+ if (NULL != data->instr_vec)
+ {
+ struct instrument_data *id
+ = (struct instrument_data *)xmalloc (sizeof *id);;
+ id->t1 = TYPE_MAIN_VARIANT (t2);
+ id->t2 = TYPE_MAIN_VARIANT (t1);
+ id->next = *data->instr_vec;
+ *data->instr_vec = id;
+ }
+ return true;
+ }
if (d1_zero && d2_zero)
return true;
if (d1_zero || d2_zero
@@ -1288,7 +1347,8 @@ comptypes_internal (const_tree type1, const_tree type2,
subset of the other. */
static bool
-comp_target_types (location_t location, tree ttl, tree ttr)
+comp_target_types_instr (location_t location, tree ttl, tree ttr,
+ struct instrument_data **instr_vec)
{
int val;
int val_ped;
@@ -1322,8 +1382,7 @@ comp_target_types (location_t location, tree ttl, tree
ttr)
? c_build_qualified_type (TYPE_MAIN_VARIANT (mvr), TYPE_QUAL_ATOMIC)
: TYPE_MAIN_VARIANT (mvr));
- enum_and_int_p = false;
- val = comptypes_check_enum_int (mvl, mvr, &enum_and_int_p);
+ val = comptypes_check_enum_int_instr (mvl, mvr, &enum_and_int_p, instr_vec);
if (val == 1 && val_ped != 1)
pedwarn_c11 (location, OPT_Wpedantic, "invalid use of pointers to arrays
with different qualifiers "
@@ -1338,6 +1397,13 @@ comp_target_types (location_t location, tree ttl, tree
ttr)
return val;
}
+
+static int
+comp_target_types (location_t location, tree ttl, tree ttr)
+{
+ return comp_target_types_instr (location, ttl, ttr, NULL);
+}
+
/* Subroutines of `comptypes'. */
@@ -1551,8 +1617,13 @@ function_types_compatible_p (const_tree f1, const_tree
f2,
return val;
}
- /* Both types have argument lists: compare them and propagate results. */
+ /* Both types have argument lists: compare them and propagate results.
+ Turn off instrumentation for bounds as these are all arrays of
+ unspecified size. */
+ auto instr_vec_tmp = data->instr_vec;
+ data->instr_vec = NULL;
val1 = type_lists_compatible_p (args1, args2, data);
+ data->instr_vec = instr_vec_tmp;
return val1;
}
@@ -3371,10 +3442,11 @@ convert_argument (location_t ploc, tree function, tree
fundecl,
if (excess_precision)
val = build1 (EXCESS_PRECISION_EXPR, valtype, val);
- tree parmval = convert_for_assignment (ploc, ploc, type,
- val, origtype, ic_argpass,
- npc, fundecl, function,
- parmnum + 1, warnopt);
+ tree parmval = convert_for_assignment_instrument (ploc, ploc, type,
+ val, origtype, ic_argpass,
+ npc, fundecl, function,
+ parmnum + 1, warnopt,
+ NULL);
if (targetm.calls.promote_prototypes (fundecl ? TREE_TYPE (fundecl) : 0)
&& INTEGRAL_TYPE_P (type)
@@ -3384,6 +3456,24 @@ convert_argument (location_t ploc, tree function, tree
fundecl,
return parmval;
}
+
+/* Process all constraints for variably-modified types. */
+
+static tree
+process_vm_constraints (location_t location,
+ struct instrument_data **instr_vec)
+{
+ tree instr_expr = void_node;
+
+ for (struct instrument_data* d = *instr_vec; d; d = d->next)
+ {
+ tree in = c_instrument_vm_assign (location, d->t1, d->t2);
+ instr_expr = fold_build2 (COMPOUND_EXPR, void_type_node, in, instr_expr);
+ }
+ return instr_expr;
+}
+
+
/* Convert the argument expressions in the vector VALUES
to the types in the list TYPELIST.
@@ -6741,7 +6831,50 @@ static tree
convert_for_assignment (location_t location, location_t expr_loc, tree type,
tree rhs, tree origtype, enum impl_conv errtype,
bool null_pointer_constant, tree fundecl,
- tree function, int parmnum, int warnopt /* = 0 */)
+ tree function, int parmnum, int warnopt)
+{
+ struct instrument_data *instr_first = NULL;
+ struct instrument_data **instr_vec = NULL;
+
+ if (flag_vla_bounds && (ic_init_const != errtype))
+ instr_vec = &instr_first;
+
+ tree ret = convert_for_assignment_instrument (location, expr_loc, type,
+ rhs, origtype, errtype,
+ null_pointer_constant, fundecl,
+ function, parmnum, warnopt,
+ instr_vec);
+ if (instr_vec)
+ {
+ if (ret && error_mark_node != ret && instr_first != NULL)
+ {
+ /* We have to make sure that the rhs is evaluated first,
+ because we may use size expressions in it to check bounds. */
+ tree instr_expr = process_vm_constraints (location, instr_vec);
+ if (void_node != instr_expr)
+ {
+ ret = save_expr (ret);
+ instr_expr = fold_build2 (COMPOUND_EXPR, void_type_node, ret,
instr_expr);
+ ret = fold_build2 (COMPOUND_EXPR, TREE_TYPE (ret), instr_expr,
ret);
+ }
+ }
+ while (instr_first)
+ {
+ struct instrument_data *next = instr_first->next;
+ free (instr_first);
+ instr_first = next;
+ }
+ instr_vec = NULL;
+ }
+ return ret;
+}
+
+static tree
+convert_for_assignment_instrument (location_t location, location_t expr_loc,
tree type,
+ tree rhs, tree origtype, enum impl_conv errtype,
+ bool null_pointer_constant, tree fundecl,
+ tree function, int parmnum, int warnopt,
+ struct instrument_data **instr_vec)
{
enum tree_code codel = TREE_CODE (type);
tree orig_rhs = rhs;
@@ -6985,11 +7118,11 @@ convert_for_assignment (location_t location, location_t
expr_loc, tree type,
rhs = build1 (ADDR_EXPR, build_pointer_type (TREE_TYPE (rhs)), rhs);
SET_EXPR_LOCATION (rhs, location);
- rhs = convert_for_assignment (location, expr_loc,
- build_pointer_type (TREE_TYPE (type)),
- rhs, origtype, errtype,
- null_pointer_constant, fundecl, function,
- parmnum, warnopt);
+ rhs = convert_for_assignment_instrument (location, expr_loc,
+ build_pointer_type (TREE_TYPE
(type)),
+ rhs, origtype, errtype,
+ null_pointer_constant, fundecl,
function,
+ parmnum, warnopt, instr_vec);
if (rhs == error_mark_node)
return error_mark_node;
@@ -7400,7 +7533,7 @@ convert_for_assignment (location_t location, location_t
expr_loc, tree type,
Meanwhile, the lhs target must have all the qualifiers of the rhs. */
if ((VOID_TYPE_P (ttl) && !TYPE_ATOMIC (ttl))
|| (VOID_TYPE_P (ttr) && !TYPE_ATOMIC (ttr))
- || (target_cmp = comp_target_types (location, type, rhstype))
+ || (target_cmp = comp_target_types_instr (location, type, rhstype,
instr_vec))
|| is_opaque_pointer
|| ((c_common_unsigned_type (mvl)
== c_common_unsigned_type (mvr))
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index 1748afdbfe0..c94ca59086b 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -10269,6 +10269,13 @@ void g (int n)
@option{-Warray-parameter} option triggers warnings for similar problems
involving ordinary array arguments.
+@opindex Wvla-parameter-missing-check
+@item -Wvla-parameter-missing-check
+Warn when function calls can not be instrumented with the use of
+@option{-fvla-bounds} to detect inconsistencies between the bounds of
+VLA parameters at runtime.
+
+
@opindex Wvolatile-register-var
@opindex Wno-volatile-register-var
@item -Wvolatile-register-var
@@ -20052,6 +20059,14 @@ computing CRC32).
The @var{string} should be different for every file you compile.
+@opindex fvla-bounds
+@item -fvla-bounds
+This option is only available when compiling C code. If activated,
+additional code is emitted that verifies at run time for assignments
+involving variably-modified types that corresponding size expressions
+evaluate to the same value.
+
+
@opindex save-temps
@item -save-temps
Store the usual ``temporary'' intermediate files permanently; name them
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-1.c
new file mode 100644
index 00000000000..7f71c1abbe5
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-1.c
@@ -0,0 +1,85 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+/* test return types */
+
+int main()
+{
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+
+ /* assignment */
+
+ pa = &a;
+
+ pb = &b;
+
+ pc0 = &c;
+
+ pc1 = &c;
+
+ pc2 = &c;
+
+ pd0 = &d;
+
+ pd1 = &d;
+
+ pd2 = &d;
+
+ pd3 = &d;
+
+ pe0 = &e;
+
+ pf = &f;
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-assign-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-assign-1.c
new file mode 100644
index 00000000000..40232925341
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-assign-1.c
@@ -0,0 +1,126 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+TRY( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-assign-2.c
b/gcc/testsuite/gcc.dg/vla-bounds-assign-2.c
new file mode 100644
index 00000000000..f1f98704a1e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-assign-2.c
@@ -0,0 +1,126 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+TRY( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-assign-3.c
b/gcc/testsuite/gcc.dg/vla-bounds-assign-3.c
new file mode 100644
index 00000000000..0a811de5ffc
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-assign-3.c
@@ -0,0 +1,126 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+TRY( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-assign-4.c
b/gcc/testsuite/gcc.dg/vla-bounds-assign-4.c
new file mode 100644
index 00000000000..3d8553c6426
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-assign-4.c
@@ -0,0 +1,133 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int m, n;
+
+static char (*z0(void))[5][5] { char (*p)[m][n] = 0; return p; }
+static char (*z1(void))[5][5] { char (*p)[5][n] = 0; return p; }
+static char (*z2(void))[5][5] { char (*p)[m][5] = 0; return p; }
+
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+TRY( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-func-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-func-1.c
new file mode 100644
index 00000000000..e4856017419
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-func-1.c
@@ -0,0 +1,56 @@
+/* { dg-do compile } */
+/* { dg-options "-fcheck-vla-bounds" } */
+
+// make sure we do not ICE on any of these
+
+const char* name = "hallo";
+
+
+typedef void (*ht)(int n, int m, char x[n][m]);
+void e(ht) { }
+
+int n, m;
+static void f0(char a[n][m]) { }
+static void f1(int u, int v, char a[u][v]) { }
+static void f2(int u, int v, char a[u][v]) { }
+
+void f(void)
+{
+ int x = 1;
+ int (*m)[x] = 0;
+ m = ({ long* d2; (int (*)[d2[0]])(0); });
+
+ /* function pointer assignments */
+
+ void (*gp)(char x[4][3]) = f0;
+ void (*hp)(int n, int m, char x[n][m]) = f1;
+ ht hp2 = f1;
+ e(f1);
+
+ /* composite type */
+
+ int u = 3; int v = 4;
+ char a[u][v];
+ (1 ? f1 : f2)(u, v, a);
+}
+
+/* size expression in parameter */
+
+extern void a(long N, char (*a)[N]);
+
+static void b(void)
+{
+ a(1, ({ int d = 0; (char (*)[d])0; }) );
+}
+
+/* composite type */
+
+int c(int u, char (*a)[u]);
+int c(int u, char (*a)[u]) { }
+
+int d(void)
+{
+ char a[3];
+ c(3, &a);
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-init-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-init-1.c
new file mode 100644
index 00000000000..9c9d959ee9e
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-init-1.c
@@ -0,0 +1,125 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+TRY( char (*qa)[v] = &a; ) // 3 != 4
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-init-2.c
b/gcc/testsuite/gcc.dg/vla-bounds-init-2.c
new file mode 100644
index 00000000000..8fb4ad8a3ea
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-init-2.c
@@ -0,0 +1,125 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+TRY( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-init-3.c
b/gcc/testsuite/gcc.dg/vla-bounds-init-3.c
new file mode 100644
index 00000000000..83df5796942
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-init-3.c
@@ -0,0 +1,126 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+TRY( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-init-4.c
b/gcc/testsuite/gcc.dg/vla-bounds-init-4.c
new file mode 100644
index 00000000000..81d252e3957
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-init-4.c
@@ -0,0 +1,125 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+TRY( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-nest-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-nest-1.c
new file mode 100644
index 00000000000..30b0496107c
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-nest-1.c
@@ -0,0 +1,39 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+/* { dg-require-effective-target trampolines } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort()
+
+static char bb[4][4];
+static char (*g())[4][4] { return &bb; }
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int n = 3;
+ char b[4];
+ char (*f())[++n] { return &b; }
+
+ if (4 != sizeof(*f()))
+ __builtin_abort();
+
+ TRY( char (*(*p)())[++n] = &f; );
+
+ if (5 != sizeof(*(*p)()))
+ __builtin_abort();
+
+ char (*(*q)())[++n][4];
+
+ if (6 * 4 != sizeof(*(*q)()))
+ __builtin_abort();
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-nest-2.c
b/gcc/testsuite/gcc.dg/vla-bounds-nest-2.c
new file mode 100644
index 00000000000..d871051225a
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-nest-2.c
@@ -0,0 +1,33 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+/* { dg-require-effective-target trampolines } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+
+static char bb[4][4];
+static char (*g())[4][4] { return &bb; }
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ int n = 3;
+ char b[4];
+ char (*f())[++n] { return &b; }
+
+ if (4 != sizeof(*f()))
+ __builtin_abort();
+
+ char (*(*p)())[++n] ERROR( = &f );
+
+TRY( char (*(*q)())[++n][4] = &g; );
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-ret-1.c
b/gcc/testsuite/gcc.dg/vla-bounds-ret-1.c
new file mode 100644
index 00000000000..beb7dd414ed
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-ret-1.c
@@ -0,0 +1,132 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+#define ERROR(...)
+
+int m, n;
+
+static char (*z0(void))[5][5] { char (*p)[m][n] = 0; return p; }
+static char (*z1(void))[5][5] { char (*p)[5][n] = 0; return p; }
+static char (*z2(void))[5][5] { char (*p)[m][5] = 0; return p; }
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+TRY( z0(); ) // 5 != 3, 5, != 3
+
+ERROR( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
diff --git a/gcc/testsuite/gcc.dg/vla-bounds-ret-2.c
b/gcc/testsuite/gcc.dg/vla-bounds-ret-2.c
new file mode 100644
index 00000000000..2df515e557f
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/vla-bounds-ret-2.c
@@ -0,0 +1,133 @@
+/* { dg-do run } */
+/* { dg-options "-fvla-bounds" } */
+
+#include <signal.h>
+#include <stdlib.h>
+
+static void handler(int) { exit(0); }
+
+#define ERROR(...)
+#define TRY(...) __VA_ARGS__ __builtin_abort();
+
+int n, m;
+
+static char (*z0(void))[5][5] { char (*p)[m][n] = 0; return p; }
+static char (*z1(void))[5][5] { char (*p)[5][n] = 0; return p; }
+static char (*z2(void))[5][5] { char (*p)[m][5] = 0; return p; }
+
+
+int main()
+{
+ signal(SIGILL, handler);
+
+ m = 4, n = 3;
+
+ int u = 4;
+ int v = 3;
+
+ /* initialization */
+
+ char a[4];
+ char (*pa)[u] = &a;
+ERROR( char (*qa)[v] = &a; ) // 3 != 4
+ char (*qa)[v];
+
+ char b[u];
+ const char (*pb)[u] = &b;
+ERROR( char (*qb)[v] = &b; ) // 3 != 4
+ char (*qb)[v];
+
+ char c[4][3];
+ char (*pc0)[u][v] = &c;
+ERROR( char (*qc0)[v][u] = &c; ) // 3 != 4, 4 != 3
+ char (*qc0)[v][u];
+
+ char (*pc1)[u][3] = &c;
+ERROR( char (*qc1)[v][3] = &c; ) // 3 != 4
+ char (*qc1)[v][3];
+
+ char (*pc2)[4][v] = &c;
+ERROR( char (*qc2)[4][u] = &c; ) // 4 != 3
+ char (*qc2)[4][u];
+
+ char (*pc3)[][v] = &c;
+ERROR( char (*qc3)[][u] = &c; ) // 4 != 3
+
+ char d[u][v];
+ char (*pd0)[4][3] = &d;
+ERROR( char (*qd0)[3][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd0)[3][4];
+
+ char (*pd1)[u][3] = &d;
+ERROR( char (*qd1)[v][4] = &d; ) // 3 != 4, 4 != 3
+ char (*qd1)[v][4];
+
+ char (*pd2)[4][v] = &d;
+ERROR( char (*qd2)[3][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd2)[3][u];
+
+ char (*pd3)[u][v] = &d;
+ERROR( char (*qd3)[v][u] = &d; ) // 3 != 4, 4 != 3
+ char (*qd3)[v][u];
+
+ char e[4][v];
+ char (*pe0)[4][3] = &e;
+ERROR( char (*qe0)[4][4] = &e; ) // 4 != 3
+ char (*qe0)[4][4];
+
+ char f[u][3];
+ char (*pf)[4][3] = &f;
+ERROR( char (*qf)[3][3] = &f; ) // 3 != 4
+ char (*qf)[3][3];
+
+ char (*g[u])[v];
+ char (*(*pg)[u])[v] = &g;
+ERROR( char (*(*qg)[v])[u] = &g; ) // 3 != 4, 4 != 3
+
+ /* assignment */
+
+ pa = &a;
+ERROR( qa = &a; ) // 3 != 4
+
+ pb = &b;
+ERROR( qb = &b; ) // 3 != 4
+
+ pc0 = &c;
+ERROR( qc0 = &c; ) // 3 != 4, 4 != 3
+
+ pc1 = &c;
+ERROR( qc1 = &c; ) // 3 != 4
+
+ pc2 = &c;
+ERROR( qc2 = &c; ) // 4 != 3
+
+ pd0 = &d;
+ERROR( qd0 = &d; ) // 3 != 4, 4 != 3
+
+ pd1 = &d;
+ERROR( qd1 = &d; ) // 3 != 4, 4 != 3
+
+ pd2 = &d;
+ERROR( qd2 = &d; ) // 3 != 4, 4 != 3
+
+ pd3 = &d;
+ERROR( qd3 = &d; ) // 3 != 4, 4 != 3
+
+ pe0 = &e;
+ERROR( qe0 = &e; ) // 4 != 3
+
+ pf = &f;
+ERROR( qf = &f; ) // 3 != 4
+
+ /* return */
+ERROR( z0(); ) // 5 != 3, 5, != 3
+
+TRY( z1(); ) // 4 != 3
+
+ERROR( z2(); ) // 5 != 4
+
+ERROR( char (*(*p)(void))[u][v] = &z0; ) // 4 != 5, 3 != 5
+
+ return 0;
+}
+
--
2.39.2
