[Bug c++/102223] New: no warning whel calling member function on dangling reference

[Bug c++/102223] New: no warning whel calling member function on dangling reference

[federico.kircheis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

            Bug ID: 102223
           Summary: no warning whel calling member function on dangling
                    reference
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: federico.kircheis at gmail dot com
  Target Milestone: ---

Consider this code-snippet

----
struct s{
    s() noexcept;
    ~s();
    int value() const noexcept;
};

s foo() noexcept;

int bar(){
  const auto& v = static_cast<s>(foo());
  int res = v.value();
  return res;
}
----

Normally life-extension would kick in, but because we added an unnecessary
static_cast, it does not kick in and v is a dangling reference.

GCC does not emit any warning

[Bug c++/102223] no warning whel calling member function on dangling reference

[federico.kircheis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #1 from Federico Kircheis <federico.kircheis at gmail dot com> ---
Sorry, I copied the wrong snippet, it should have been

----
#include <utility>

struct s{
    s() noexcept;
    ~s();
    int value() const noexcept;
};

s foo() noexcept;

int bar(){
  const auto& v = std::move(foo());
  int res = v.value();
  return res;
}
----

As reference: https://godbolt.org/z/h31Trbsx6

[Bug c++/102223] no warning whel calling member function on dangling reference

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
           Severity|normal                      |enhancement

[Bug c++/102223] no warning when calling member function on dangling reference

[egallager at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

Eric Gallager <egallager at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |egallager at gcc dot gnu.org

--- Comment #2 from Eric Gallager <egallager at gcc dot gnu.org> ---
are you expecting this to go under an existing warning flag, or a new one?

[Bug c++/102223] no warning when calling member function on dangling reference

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=96780

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Your compiler explorer link doesn't enable optimizations. There's no way G++
can warn without optimization (specifically, without inlining). The std::move
call is an opaque function that returns a reference, which might have nothing
whatsoever to do with the function argument, so the reference it returns could
be valid.

With inlining, in theory it would be possible to diagnose the invalid access,
but other compilers don't do it either. It would be nice, but I'm not sure it's
likely to happen any time soon. GCC doesn't even get it right in constexpr
contexts, see PR 70331 and the linked bugs in the See Also field.

PR 96780 comment 2 could potentially help for the specific case of std::move,
but not the general case.

[Bug c++/102223] no warning when calling member function on dangling reference

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
N.B AddressSanitizer will diagnose this at runtime.

[Bug c++/102223] no warning when calling member function on dangling reference

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Federico Kircheis from comment #0)
> Normally life-extension would kick in, but because we added an unnecessary
> static_cast, it does not kick in and v is a dangling reference.

I assume you already know this, but the original testcase in comment 0 is
perfectly valid. The static_cast creates a new temporary, which *does* get its
lifetime extended.

[Bug c++/102223] no warning when calling member function on dangling reference

[federico.kircheis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #6 from Federico Kircheis <federico.kircheis at gmail dot com> ---
> are you expecting this to go under an existing warning flag, or a new one?

Ideally -Wall, but there might already be some flags related to dangling
pointers and references.

> Your compiler explorer link doesn't enable optimizations.

That's true, but if you look at the assembly there is no function call to
std::move, thus I assumed that contrary to another (non-inline) function call,
a diagnostic would have been possible even without optimizations.
But there is no warning even with optimizations enabled.


> I assume you already know this, but the original testcase in comment 0 is perfectly valid. The static_cast creates a new temporary, which *does* get its lifetime extended.


Yes, should have made it clearer in comment #1, sorry.
Unfortunately I realized after I wrote the message that I copied the wrong
snippet (and typed thus a wrong explanation), and I could not edited it.

> With inlining, in theory it would be possible to diagnose the invalid access, but other compilers don't do it either. It would be nice, but I'm not sure it's likely to happen any time soon.

I noticed too that other compiler do not do this diagnostic.
Too bad.


> GCC doesn't even get it right in constexpr contexts, see PR 70331 and the linked bugs in the See Also field.

Ouch.


> PR 96780 comment 2 could potentially help for the specific case of std::move, but not the general case.


AS I had a discussion explicitly about std::move/xvalues and lifetime
extension, I'll say it's a good start.
And it confused me until I realized std::move is a function, and thus obviously
destroys lifetime extension in the example I gave, while the cast not.


> N.B AddressSanitizer will diagnose this at runtime.
+1

[Bug c++/102223] no warning when calling member function on dangling reference

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Federico Kircheis from comment #6)
> That's true, but if you look at the assembly there is no function call to
> std::move,

There is though, on line 10.

[Bug c++/102223] no warning when calling member function on dangling reference

[federico.kircheis at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #8 from Federico Kircheis <federico.kircheis at gmail dot com> ---
> There is though, on line 10.

You are correct, I wonder how I could not see it.

[Bug c++/102223] no warning when calling member function on dangling reference

[egallager at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102223

--- Comment #9 from Eric Gallager <egallager at gcc dot gnu.org> ---
(In reply to Federico Kircheis from comment #6)
> > are you expecting this to go under an existing warning flag, or a new one?
> 
> Ideally -Wall, but there might already be some flags related to dangling
> pointers and references.

Yes, there's one for each of those now: -Wdangling-pointer and
-Wdangling-reference, so I presume that this one would go under the latter...