[Bug middle-end/104076] New: bogus -Wdangling-pointer on a conditional

[Bug middle-end/104076] New: bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

            Bug ID: 104076
           Summary: bogus -Wdangling-pointer on a conditional
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

As reported in
https://gcc.gnu.org/pipermail/gcc-patches/2022-January/588620.html, the new
-Wdangling-pointer issues a false positive for the following test case:

$ cat t.C && g++ -S -Wall t.C
#include <initializer_list>

struct S1
{
  S1 (int);
  ~S1 ();
};

struct S2 { S2 (std::initializer_list<S1>); };

S2 f1();

S2 f2(bool b)
{
  return b ? f1() : S2{0};
}

t.C: In function ‘S2 f2(bool)’:
t.C:16:1: warning: dangling pointer to an unnamed temporary may be used
[-Wdangling-pointer=]
   16 | }
      | ^
t.C:15:25: note: unnamed temporary defined here
   15 |   return b ? f1() : S2{0};
      |                         ^
t.C:16:1: warning: dangling pointer to an unnamed temporary may be used
[-Wdangling-pointer=]
   16 | }
      | ^
t.C:15:25: note: unnamed temporary defined here
   15 |   return b ? f1() : S2{0};
      |                         ^

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2022-01-17
           Keywords|                            |diagnostic

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
This instance of the warning has disappeared with r12-6694.

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:6325041c2b68af096195e0eef92091b2e293e950

commit r12-6714-g6325041c2b68af096195e0eef92091b2e293e950
Author: Martin Sebor <msebor@redhat.com>
Date:   Tue Jan 18 17:56:20 2022 -0700

    Add test for bogus warning [PR104076].

    Related:
    PR middle-end/104076 - bogus -Wdangling-pointer on a conditional

    gcc/testsuite/ChangeLog:
            PR middle-end/104076
            * g++.dg/warn/Wdangling-pointer-3.C: New test.

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Looking at the IL before r12-6694 I'm not sure I see what could be done to keep
the warning from triggering but maybe someone has an idea for a solution I'm
not seeing, in case this comes back with a different test case.

struct S2 f2 (bool b)
{
  const struct S1 D.2507[1];
  ...

  <bb 2> :
  cleanup.1_26 = 0;
  cleanup.2_27 = 0;
  if (b_28(D) != 0)
    goto <bb 3>; [INV]
  else
    goto <bb 4>; [INV]

  <bb 3> :
  f1 ();
  goto <bb 6>; [INV]

  <bb 4> :
  _29 = &D.2507;                        <<< &D.2507
  _30 = _29;
  _31 = 0;
  cleanup.1_32 = 1;
  S1::S1 (_30, 0);

  <bb 5> :
  _35 = _30 + 1;
  _36 = _31 + -1;
  retval.0_37 = _29;
  _38 = 0;
  cleanup.2_39 = 1;
  D.2529.array = &D.2507;
  D.2529.nelts = 1;
  S2::S2 (&D.2525, D.2529);

  <bb 6> :
  # _7 = PHI <_29(5), _44(D)(3)>        <<< _7 == _29(5) == &D.2507 or
undefined
  # _9 = PHI <_38(5), _45(D)(3)>
  # cleanup.1_13 = PHI <cleanup.1_32(5), cleanup.1_26(3)>
  # cleanup.2_15 = PHI <cleanup.2_39(5), cleanup.2_27(3)>
  if (cleanup.2_15 != 0)
    goto <bb 7>; [INV]
  else
    goto <bb 10>; [INV]

  <bb 7> :
  _46 = &D.2507 + 1;

  <bb 8> :
  # _5 = PHI <_46(7), _47(9)>
  if (&D.2507 == _5)
    goto <bb 10>; [INV]
  else
    goto <bb 9>; [INV]

  <bb 9> :
  _47 = _5 + 18446744073709551615;
  S1::~S1 (_47);
  goto <bb 8>; [INV]

  <bb 10> :
  D.2507 ={v} {CLOBBER};                <<< D.2507 clobbered
  if (cleanup.1_13 != 0)
    goto <bb 11>; [INV]
  else
    goto <bb 15>; [INV]

  <bb 11> :
  if (_7 != 0B)
    goto <bb 12>; [INV]
  else
    goto <bb 15>; [INV]

  <bb 12> :
  _1 = -_9;
  _2 = (sizetype) _1;
  _50 = _7 + _2;

  <bb 13> :
  # _11 = PHI <_50(12), _51(14)>        <<< _11 points to &D.2507
  if (_11 == _7)                        <<< -Wdangling-pointer
    goto <bb 15>; [INV]
  else
    goto <bb 14>; [INV]

  <bb 14> :
  _51 = _11 + 18446744073709551615;     <<< _51
  S1::~S1 (_51);
  goto <bb 13>; [INV]

  <bb 15> :
  return D.2525;
  ...
}


cc1plus.r12-6693: all warnings being treated as errors

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
It's probably just gone latent indeed.  I think to give a good false positive
vs. false negative rate we should exclude equality compares from being
considered
as "uses" of a dangling pointer.  Note with optimization enabled the errorneous
path doesn't appear anymore (in the second instance of the warning).

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Unlike the false positive -Wuse-after-free in pr104232, the instance of
-Wdangling-pointer in this case (a PHI argument) is intentional so that we
diagnose problems like those in the request for it (pr63272), or in this more
involved test case:

void warn_cond_if (int i, int n)
{
  int *p;
  if (i)
    {
      int a[] = { 1, 2 };     // { dg-message "'a' declared" "note" }
      sink (a);
      p = a;
    }
  else
    p = (int*)malloc (n);

  sink (p);                   // { dg-warning "dangling pointer 'p' to 'a' may
be used" }
}

I could add another level to -Wdangling-pointer to separately control uses in
equality expressions, for consistency with -Wuse-after-free.

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |NEW
           Assignee|msebor at gcc dot gnu.org          |unassigned at gcc dot gnu.org

--- Comment #6 from Martin Sebor <msebor at gcc dot gnu.org> ---
I'm no longer working on this.

[Bug middle-end/104076] bogus -Wdangling-pointer on a conditional

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104076

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Let's close this bug, the testcase no longer warns.