public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug middle-end/104232] New: spurious -Wuse-after-free after conditional free
@ 2022-01-25 20:31 msebor at gcc dot gnu.org
  2022-01-25 20:32 ` [Bug middle-end/104232] [12 Regression] " msebor at gcc dot gnu.org
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: msebor at gcc dot gnu.org @ 2022-01-25 20:31 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104232

            Bug ID: 104232
           Summary: spurious -Wuse-after-free after conditional free
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

The test case below was reduced from
https://bugzilla.redhat.com/show_bug.cgi?id=2043195 (it's been greatly
simplified).  It shows a false positive caused by the warning's overly
simplistic PHI handling: the warning warns on any PHI use with an operand
that's been passed to free in a block that dominates the use.

$ cat rhbz2043195.c && gcc -O2 -S -Wall -fdump-tree-waccess3=/dev/stdout
rhbz2043195.c 
static inline void freep (void *p)
{
  __builtin_free (*(void**)p);
}

char *f (void);

int g (void)
{
  __attribute__ ((__cleanup__ (freep))) char *s = 0, *t = 0;

  t = f ();
  if (!t)
    return 0;

  s = f ();
  return 1;
}

;; Function g (g, funcdef_no=1, decl_uid=1984, cgraph_uid=2, symbol_order=1)

In function ‘freep’,
    inlined from ‘g’ at rhbz2043195.c:10:47:
rhbz2043195.c:3:3: warning: pointer ‘s’ used after ‘__builtin_free’
[-Wuse-after-free]
    3 |   __builtin_free (*(void**)p);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘freep’,
    inlined from ‘g’ at rhbz2043195.c:10:55:
rhbz2043195.c:3:3: note: call to ‘__builtin_free’ here
    3 |   __builtin_free (*(void**)p);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~
pointer_query counters:
  index cache size:   21
  index entries:      3
  access cache size:  6
  access entries:     3
  hits:               1
  misses:             3
  failures:           0
  max_depth:          3
int g ()
{
  char * s;
  char * _1;
  char * _2;
  int _3;

  <bb 2> [local count: 1073741824]:
  _1 = f ();
  if (_1 == 0B)
    goto <bb 4>; [30.95%]
  else
    goto <bb 3>; [69.05%]

  <bb 3> [local count: 741418729]:
  _2 = f ();

  <bb 4> [local count: 1073741824]:
  # _3 = PHI <0(2), 1(3)>
  # s_10 = PHI <_1(2), _2(3)>
  __builtin_free (_1);
  __builtin_free (s_10);
  return _3;

}

^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2022-01-31 19:08 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-25 20:31 [Bug middle-end/104232] New: spurious -Wuse-after-free after conditional free msebor at gcc dot gnu.org
2022-01-25 20:32 ` [Bug middle-end/104232] [12 Regression] " msebor at gcc dot gnu.org
2022-01-25 20:35 ` msebor at gcc dot gnu.org
2022-01-26  7:50 ` rguenth at gcc dot gnu.org
2022-01-31 15:41 ` msebor at gcc dot gnu.org
2022-01-31 15:46 ` msebor at gcc dot gnu.org
2022-01-31 15:47 ` msebor at gcc dot gnu.org
2022-01-31 19:06 ` cvs-commit at gcc dot gnu.org
2022-01-31 19:08 ` msebor at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).