From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 7545C3858D39; Tue, 18 Jan 2022 22:06:54 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7545C3858D39
From: "msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/104069] -Werror=use-after-free false positive on
 elfutils-0.186
Date: Tue, 18 Jan 2022 22:06:54 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 12.0
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: msebor at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: msebor at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: component
Message-ID: <bug-104069-4-mW8PqIy7rZ@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-104069-4@http.gcc.gnu.org/bugzilla/>
References: <bug-104069-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Jan 2022 22:06:54 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D104069

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |middle-end

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
The debug_ranger() output is below for reference:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 2 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: ret_13=20=20
Exports: ret_13=20=20
size_9(D)       int VARYING
    <bb 2> :
    _1 =3D (long unsigned int) size_9(D);
    ret_13 =3D __builtin_realloc (ptr_11(D), _1);
    if (ret_13 =3D=3D 0B)
      goto <bb 3>; [INV]
    else
      goto <bb 5>; [INV]

_1 : long unsigned int [0, 2147483647][18446744071562067968, +INF]
2->3  (T) ret_13 :      void * [0B, 0B]
2->5  (F) ret_13 :      void * [1B, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 3 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: size_9(D)=20=20
Exports: size_9(D)=20=20
size_9(D)       int VARYING
ret_13  void * [0B, 0B]
    <bb 3> :
    if (size_9(D) =3D=3D 0)
      goto <bb 4>; [INV]
    else
      goto <bb 5>; [INV]

3->4  (T) size_9(D) :   int [0, 0]
3->5  (F) size_9(D) :   int [-INF, -1][1, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 4 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    <bb 4> :
    ret_15 =3D __builtin_realloc (ptr_11(D), 1);


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 5 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: ret_3=20=20
Exports: ret_3=20=20
    <bb 5> :
    # ret_3 =3D PHI <ret_13(2), ret_13(3), ret_15(4)>
    if (ret_3 =3D=3D 0B)
      goto <bb 6>; [INV]
    else
      goto <bb 11>; [INV]

5->6  (T) ret_3 :       void * [0B, 0B]
5->11  (F) ret_3 :      void * [1B, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 6 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: ret_17=20=20
Exports: ret_17=20=20
size_9(D)       int VARYING
    <bb 6> :
    _2 =3D (long unsigned int) size_9(D);
    ret_17 =3D __builtin_realloc (ptr_11(D), _2);
    if (ret_17 =3D=3D 0B)
      goto <bb 7>; [INV]
    else
      goto <bb 9>; [INV]

_2 : long unsigned int [0, 2147483647][18446744071562067968, +INF]
6->7  (T) ret_17 :      void * [0B, 0B]
6->9  (F) ret_17 :      void * [1B, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 7 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: size_9(D)=20=20
Exports: size_9(D)=20=20
size_9(D)       int VARYING
ret_17  void * [0B, 0B]
    <bb 7> :
    if (size_9(D) =3D=3D 0)
      goto <bb 8>; [INV]
    else
      goto <bb 9>; [INV]

7->8  (T) size_9(D) :   int [0, 0]
7->9  (F) size_9(D) :   int [-INF, -1][1, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 8 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    <bb 8> :
    ret_19 =3D __builtin_realloc (ptr_11(D), 1);


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 9 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Imports: ret_4=20=20
Exports: ret_4=20=20
    <bb 9> :
    # ret_4 =3D PHI <ret_17(6), ret_17(7), ret_19(8)>
    if (ret_4 =3D=3D 0B)
      goto <bb 10>; [INV]
    else
      goto <bb 11>; [INV]

9->10  (T) ret_4 :      void * [0B, 0B]
9->11  (F) ret_4 :      void * [1B, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 10 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    <bb 10> :
    __builtin_abort ();


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 11 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Equivalence set : []
Equivalence set : [ret_5, _21]
    <bb 11> :
    # ret_5 =3D PHI <ret_3(5), ret_4(9)>
    _21 =3D ret_5;

ret_5 : void * [1B, +INF]
_21 : void * [1B, +INF]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BB 12 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
    <bb 12> :
  <L15>:
    return _21;

Non-varying global ranges:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D:
_1  : long unsigned int [0, 2147483647][18446744071562067968, +INF]
_2  : long unsigned int [0, 2147483647][18446744071562067968, +INF]
ret_5  : void * [1B, +INF]
_21  : void * [1B, +INF]=