[Bug c++/105580] New: False warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[Bug c++/105580] New: False warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[j.gaffiot at laposte dot net]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

            Bug ID: 105580
           Summary: False warning "potential null pointer dereference"
                    raised when using istreambuf_iterator and any "-O"
                    flag
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: j.gaffiot at laposte dot net
  Target Milestone: ---

I found what I believe is a false positive with g++ 12 when using the
"null-dereference" warning and istreambuf_iterator with any level of
optimisation. And of course the "-Werror" flag is mandatory in my company
process.
I have searched for such similar bug report.

This behavior does not show up with g++ 11.2.0 or g++ 9.4.0.

Minimal example (basically the first lines of the cppreference example for
istreambuf_iterator):

#include <string>
#include <sstream>

int main()
{
    std::istringstream in{"Hello, world"};
    std::istreambuf_iterator<char> it(in), end;
    std::string ss{it, end};
    return 0;
}

Compiled with:
g++-12 -O -Wnull-dereference <my_file>

Compiler version (default g++-12 on Ubuntu 22.04):
g++ (Ubuntu 12-20220319-1ubuntu1) 12.0.1 20220319 (experimental) [master
r12-7719-g8ca61ad148f]



Full version:
Using built-in specs.
COLLECT_GCC=g++-12
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/12/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu
12-20220319-1ubuntu1' --with-bugurl=file:///usr/share/doc/gcc-12/README.Bugs
--enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++,m2 --prefix=/usr
--with-gcc-major-version-only --program-suffix=-12
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new
--enable-gnu-unique-object --disable-vtable-verify --enable-plugin
--enable-default-pie --with-system-zlib --enable-libphobos-checking=release
--with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch
--disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64
--with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-12-OcsLtf/gcc-12-12-20220319/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-12-OcsLtf/gcc-12-12-20220319/debian/tmp-gcn/usr
--enable-offload-defaulted --without-cuda-driver --enable-checking=release
--build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.1 20220319 (experimental) [master r12-7719-g8ca61ad148f]
(Ubuntu 12-20220319-1ubuntu1)

[Bug c++/105580] [12/13 Regression] False warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.2
           Keywords|                            |diagnostic
            Summary|False warning "potential    |[12/13 Regression] False
                   |null pointer dereference"   |warning "potential null
                   |raised when using           |pointer dereference" raised
                   |istreambuf_iterator and any |when using
                   |"-O" flag                   |istreambuf_iterator and any
                   |                            |"-O" flag

[Bug libstdc++/105580] [12/13 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c++                         |libstdc++
            Summary|[12/13 Regression] False    |[12/13 Regression] warning
                   |warning "potential null     |"potential null pointer
                   |pointer dereference" raised |dereference" raised when
                   |when using                  |using istreambuf_iterator
                   |istreambuf_iterator and any |and any "-O" flag
                   |"-O" flag                   |
                 CC|                            |jason at gcc dot gnu.org

--- Comment #1 from Jason Merrill <jason at gcc dot gnu.org> ---
The theory of the warning seems to be that if istreambuf_iterator::_M_get,
called from operator* for *__beg in _M_construct, hits EOF, it clears _M_sbuf,
and then ++__beg will try to refer to members of the now-null __beg._M_sbuf. 
At first glance, this seems like a plausible theory.  Why does _M_get clear
_M_sbuf?

      int_type
      _M_get() const
      {
        int_type __ret = _M_c;
        if (_M_sbuf && _S_is_eof(__ret) && _S_is_eof(__ret = _M_sbuf->sgetc()))
          _M_sbuf = 0;
        return __ret;
      }

[Bug libstdc++/105580] [12/13 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Might be due to the changes in r253417

[Bug libstdc++/105580] [12/13 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug libstdc++/105580] [12/13 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2023-03-31

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jason Merrill from comment #1)
> Why does _M_get clear _M_sbuf?

Because that's what the standard implies should happen:

  If the end of stream is reached (streambuf_type::sgetc() returns
traits::eof()),
  the iterator becomes equal to the end-of-stream iterator value."

  charT operator*() const;
  1 Returns: The character obtained via the streambuf member sbuf_->sgetc().


But this means that a dereferenceable iterator can become non-dereferenceable
as a result of dereferencing it ... which seems very wrong indeed.

It seems better to check for EOF on operator++ and only clear _M_sbuf in that
function, but we need to basically rewrite the entire class (without ABI
changes) to do that.

[Bug libstdc++/105580] [12/13 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I've implemented the suggested changes to istreamubf_iterator and also proposed
them as a resolution for LWG 2366 https://wg21.link/lwg2366

[Bug libstdc++/105580] [12/13/14 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug libstdc++/105580] [12/13/14 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jlame646 at gmail dot com

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
*** Bug 112421 has been marked as a duplicate of this bug. ***

[Bug libstdc++/105580] [12/13/14/15 Regression] warning "potential null pointer dereference" raised when using istreambuf_iterator and any "-O" flag

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105580

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hewillk at gmail dot com

--- Comment #8 from Jonathan Wakely <redi at gcc dot gnu.org> ---
*** Bug 115067 has been marked as a duplicate of this bug. ***