--- a/gcc/cp/cp-ubsan.c	Fri Oct 27 22:46:09 2017 +0900
+++ b/gcc/cp/cp-ubsan.c	Thu Oct 25 07:37:49 2018 +0900
@@ -1,5 +1,5 @@
 /* UndefinedBehaviorSanitizer, undefined behavior detector.
-   Copyright (C) 2014-2017 Free Software Foundation, Inc.
+   Copyright (C) 2014-2018 Free Software Foundation, Inc.
    Contributed by Jakub Jelinek <jakub@redhat.com>
 
 This file is part of GCC.
@@ -121,7 +121,7 @@
   tree *opp = &CALL_EXPR_ARG (stmt, 0);
   tree op = *opp;
   if (op == error_mark_node
-      || !POINTER_TYPE_P (TREE_TYPE (op)))
+      || !INDIRECT_TYPE_P (TREE_TYPE (op)))
     return;
   while (TREE_CODE (op) == COMPOUND_EXPR)
     {
@@ -205,7 +205,7 @@
       if (TREE_CODE (t) == ADDR_EXPR)
 	{
 	  *walk_subtrees = 0;
-	  t = TREE_OPERAND (stmt, 0);
+	  t = TREE_OPERAND (t, 0);
 	  cp_walk_tree (&t, cp_ubsan_check_member_access_r, data, ucmd->pset);
 	}
       break;
@@ -257,15 +257,15 @@
 cp_ubsan_maybe_instrument_downcast (location_t loc, tree type,
 				    tree intype, tree op)
 {
-  if (!POINTER_TYPE_P (type)
-      || !POINTER_TYPE_P (intype)
-      || !POINTER_TYPE_P (TREE_TYPE (op))
+  if (!INDIRECT_TYPE_P (type)
+      || !INDIRECT_TYPE_P (intype)
+      || !INDIRECT_TYPE_P (TREE_TYPE (op))
       || !CLASS_TYPE_P (TREE_TYPE (TREE_TYPE (op)))
       || !is_properly_derived_from (TREE_TYPE (type), TREE_TYPE (intype)))
     return NULL_TREE;
 
   return cp_ubsan_maybe_instrument_vptr (loc, op, TREE_TYPE (type), true,
-					 TREE_CODE (type) == POINTER_TYPE
+					 TYPE_PTR_P (type)
 					 ? UBSAN_DOWNCAST_POINTER
 					 : UBSAN_DOWNCAST_REFERENCE);
 }
@@ -298,8 +298,7 @@
 
       /* Compute the location of the vtpr.  */
       tree vtbl_ptr
-	= build_vfield_ref (cp_build_indirect_ref (base_ptr, RO_NULL,
-						   tf_warning_or_error),
+	= build_vfield_ref (cp_build_fold_indirect_ref (base_ptr),
 			    TREE_TYPE (binfo));
       gcc_assert (vtbl_ptr != error_mark_node);