[Bug middle-end/104761] New: [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[Bug middle-end/104761] New: [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

            Bug ID: 104761
           Summary: [12 Regression] False positive -Wdangling-pointer
                    warning on NetworkManager since r12-6606
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jakub at gcc dot gnu.org
  Target Milestone: ---

With -O0 -Wdangling-pointer or -O2 -Wall (the latter is a regression) the
following testcase emits 2 false positive warnings:
nm-shared-utils.i: In function ‘test’:
nm-shared-utils.i:21:40: warning: dangling pointer to ‘error’ may be used
[-Wdangling-pointer=]
   21 |           corge (qux (addrbin.s), error->t);
      |                                        ^~
nm-shared-utils.i:18:45: note: ‘error’ declared here
   18 |       __attribute__((__cleanup__ (bar))) T *error = (T *) 0;
      |                                             ^~~~~
nm-shared-utils.i:21:11: warning: dangling pointer to ‘addrbin’ may be used
[-Wdangling-pointer=]
   21 |           corge (qux (addrbin.s), error->t);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nm-shared-utils.i:13:5: note: ‘addrbin’ declared here
   13 |   S addrbin;
      |     ^~~~~~~
Commenting out the endless loop makes it go away.
Started with the addition of -Wdangling-pointer in
r12-6606-g9d6a0f388eb048f8d87f.

typedef struct { unsigned int s; } S;
int foo (S *);
typedef struct { char *t; } T;
void garply (T *);
static inline void bar (T **v) { if (*v) garply (*v); }
int baz (T **);
const char *qux (unsigned);
void corge (const char *, const char *);

int
test (int x)
{
  S addrbin;
  if (foo (&addrbin) != 1)
    return 0;
  if (x == 2)
    {
      __attribute__((__cleanup__ (bar))) T *error = (T *) 0;
      if (!baz (&error))
        {
          corge (qux (addrbin.s), error->t);
          for (;;)
            ;
        }
    }
  return 1;
}

[Bug middle-end/104761] [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
                 CC|                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2022-03-02
             Status|UNCONFIRMED                 |NEW

[Bug middle-end/104761] [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think the problem is in:
          if (!bitmap_set_bit (visited, bb->index))
            /* Avoid cycles. */
            return true;
pass_waccess::use_after_inval_p
When walking the bbs from use_bb:
  <bb 6> :
  error.0_3 = error;        // <--- use_stmt
  _4 = error.0_3->t;
  _5 = addrbin.s;
  _6 = qux (_5);
  corge (_6, _4);

  <bb 7> :
  goto <bb 7>; [INV]

The 7->7 edge is just EDGE_FALLTHRU and we visit bb 7 and then return true even
when there was an endless loop which means it can't reach inval_stmt.

[Bug middle-end/104761] [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think EDGE_DFS_BACK is only computed (or guaranteed to be correct?) if
mark_dfs_back_edges () is called, I think the waccess pass doesn't call that.

[Bug middle-end/104761] [12 Regression] False positive -Wdangling-pointer warning on NetworkManager since r12-6606

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Keywords|                            |diagnostic
             Blocks|                            |104077

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
That's right, the pass never calls mark_dfs_back_edges().  Thanks for the hint.

A slightly simplified test case:

$ cat pr104761.c && gcc -O1 -S -Wall -fdump-tree-waccess1=/dev/stdout
pr104761.c
typedef struct { int i; } S;

void f (S **); 

void g (int);

void test (int x)
{
  S s = { 0 };

  __attribute__((__cleanup__ (f))) S *p = 0;

  if (x) 
     {
       g (s.i);
       for ( ; ; );
         }
}

;; Function test (test, funcdef_no=0, decl_uid=1986, cgraph_uid=1,
symbol_order=0)

pr104761.c: In function ‘test’:
pr104761.c:15:8: warning: dangling pointer to ‘s’ may be used
[-Wdangling-pointer=]
   15 |        g (s.i);
      |        ^~~~~~~
pr104761.c:9:5: note: ‘s’ declared here
    9 |   S s = { 0 };
      |     ^

void test (int x)
{
  struct S * p;
  struct S s;
  int _1;

  <bb 2> :
  s.i = 0;
  p = 0B;
  if (x_5(D) != 0)
    goto <bb 3>; [INV]
  else
    goto <bb 5>; [INV]

  <bb 3> :
  _1 = s.i;
  g (_1);

  <bb 4> :
  goto <bb 4>; [INV]

  <bb 5> :
  f (&p);
  s ={v} {CLOBBER(eol)};
  p ={v} {CLOBBER(eol)};
  return;

}


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104077
[Bug 104077] bogus/missing -Wdangling-pointer

[Bug middle-end/104761] [12 Regression] bogus -Wdangling-pointer with cleanup and infinite loop

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] False       |[12 Regression] bogus
                   |positive -Wdangling-pointer |-Wdangling-pointer with
                   |warning on NetworkManager   |cleanup and infinite loop
                   |since r12-6606              |
           Keywords|                            |patch

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2022-March/591145.html

[Bug middle-end/104761] [12 Regression] bogus -Wdangling-pointer with cleanup and infinite loop

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:51149a05b8cc8e4fc5a77a65857894daa371de89

commit r12-7467-g51149a05b8cc8e4fc5a77a65857894daa371de89
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Mar 3 13:58:00 2022 -0700

    Call mark_dfs_back_edges before testing EDGE_DFS_BACK [PR104761].

    Resolves:
    PR middle-end/104761 - bogus -Wdangling-pointer with cleanup and infinite
loop

    gcc/ChangeLog:

            PR middle-end/104761
            * gimple-ssa-warn-access.cc (pass_waccess::execute): Call
            mark_dfs_back_edges.

    gcc/testsuite/ChangeLog:

            PR middle-end/104761
            * g++.dg/warn/Wdangling-pointer-4.C: New test.
            * gcc.dg/Wdangling-pointer-4.c: New test.

[Bug middle-end/104761] [12 Regression] bogus -Wdangling-pointer with cleanup and infinite loop

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104761

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in r12-7467.