[Bug middle-end/104069] Wuse-after-free=2 -O0 false positive "may be used"

["slyfox at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104069

--- Comment #32 from Sergei Trofimovich <slyfox at gcc dot gnu.org> ---
Created attachment 55068
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55068&action=edit
gzip.c.c

> > You should be able to extract preprocessed file using
> > https://gcc.gnu.org/bugs/#need: you will need to find exact `gcc` invocation
> > that causes build failure, add `-save-temps` parameter to it, grab '*.i'
> > file and attach it along with exact command you used to produce it.
> 
> That gcc page does not say how to extract the command from the makefile that
> triggers the error, so I've tried to reproduce this bug manually and after
> like the 8th attempt when all the header files were finally found by the
> compiler, the linker errored out with some undefined references, so no luck.
> The good new is that this error is reproducible if the
> cflags/ldflags/configure...etc switches set up like in c#29

gcc help can't cover specifics of external build systems. You have to have a
bit of expertise to extract the actual command build system runs.

As elfutils is an automake-maked '$ make V=1' will print you every gcc command
the build system is running. It should be in a form you can copy and paste as
is (modulo current directory and a few environment variables).

I think I reproduced it on gcc-12.2.0 and elfutils-0.189. Attached as gzip.c.c.

Trigger on gcc-12.2.0:

$ gcc  -std=gnu99 -Wall  -Werror -Os -mtune=generic -c gzip.c.c
In function 'bigger_buffer',
    inlined from '__libdw_gunzip' at gzip.c.c:7751:13:
gzip.c.c:7609:13: error: pointer may be used after 'realloc'
[-Werror=use-after-free]
 7609 |         b = realloc (state->buffer, more -= 1024);
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
gzip.c.c:7605:15: note: call to 'realloc' here
 7605 |     char *b = realloc (state->buffer, more);
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

gcc-master does not seem to reproduce the failure. I did not test gcc-13.