[Bug libstdc++/106238] New: Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[Bug libstdc++/106238] New: Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

            Bug ID: 106238
           Summary: Inline optimization causes dangling pointer on
                    "include/c++/12.1.0/bits/stl_tree.h"
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rogerio.souza at gmail dot com
  Target Milestone: ---

Created attachment 53282
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53282&action=edit
Preprocessed file to reroduce the issue

When compiling the code below, we get a dangling pointer warning.

====================================================================
#include <map>

struct sysDLoc {                        /* Coordinates (in DBU) */
  double        x, y;
};

std::map<int*, sysDLoc> static_copy;

void realSwap()
{
  std::map<int*, sysDLoc> local_copy;
  extern void getLocalCopy(std::map<int*, sysDLoc>&);
  getLocalCopy(local_copy);
  local_copy.swap(static_copy);
}
====================================================================

Compilation command:
g++ -Wdangling-pointer -c -O2 bug.cpp


Warning log:
In file included from
/grid/common/test/gcc-v12.1.0d2rh74_lnx86/include/c++/12.1.0/map:60,
                 from bug.cpp:1:
In member function 'void std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare,
_Alloc>::swap(std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare, _Alloc>&) [with
_Key = int*; _Val = std::pair<int* const, sysDLoc>; _KeyOfValue =
std::_Select1st<std::pair<int* const, sysDLoc> >; _Compare = std::less<int*>;
_Alloc = std::allocator<std::pair<int* const, sysDLoc> >]',
    inlined from 'void std::map<_Key, _Tp, _Compare,
_Alloc>::swap(std::map<_Key, _Tp, _Compare, _Alloc>&) [with _Key = int*; _Tp =
sysDLoc; _Compare = std::less<int*>; _Alloc = std::allocator<std::pair<int*
const, sysDLoc> >]' at
/grid/common/test/gcc-v12.1.0d2rh74_lnx86/include/c++/12.1.0/bits/stl_map.h:1172:18,
    inlined from 'void realSwap()' at bug.cpp:14:18:
/grid/common/test/gcc-v12.1.0d2rh74_lnx86/include/c++/12.1.0/bits/stl_tree.h:2090:32:
warning: storing the address of local variable 'local_copy' in '*MEM[(struct
_Rb_tree_node_base * &)&local_copy + 16].std::_Rb_tree_node_base::_M_paren
' [-Wdangling-pointer=]
 2090 |           _M_root()->_M_parent = _M_end();
      |           ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~
bug.cpp: In function 'void realSwap()':
bug.cpp:11:27: note: 'local_copy' declared here
   11 |   std::map<int*, sysDLoc> local_copy;
      |                           ^~~~~~~~~~
bug.cpp:11:27: note: 'local_copy.std::map<int*, sysDLoc, std::less<int*>,
std::allocator<std::pair<int* const, sysDLoc> > >::_M_t.std::_Rb_tree<int*,
std::pair<int* const, sysDLoc>, std::_Select1st<std::pair<int* const, sysDLoc>
>, std::less<int*>, std::allocator<std::pair<int* const, sysDLoc> >
>::_M_impl.std::_Rb_tree<int*, std::pair<int* const, sysDLoc>,
std::_Select1st<std::pair<int* const, sysDLoc> >, std::less<int*>,
std::allocator<std::pair<int* const, sysDLoc> >
>::_Rb_tree_impl<std::less<int*>,
true>::<unnamed>.std::_Rb_tree_header::_M_header.std::_Rb_tree_node_base::_M_parent'
declared here

This warning only happens on GCC v12.1. Using -O1,
"-fno-inline-small-functions”, or  “-fno-inline-functions” prevents the error
from happening.

Regards,
Rogerio

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |missed-optimization

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---

  getLocalCopy (&local_copy);
...
  pretmp_67 = MEM[(struct _Rb_tree_node_base * &)&static_copy + 16];
....
  pretmp_67->_M_parent = &MEM[(struct _Rb_tree_header *)&local_copy +
8B]._M_header;
  _28 = MEM[(struct _Rb_tree_header &)&static_copy + 8]._M_node_count;
  MEM[(struct _Rb_tree_header *)&local_copy + 8B]._M_node_count = _28;
  MEM[(struct _Rb_tree_header *)&static_copy + 8B]._M_header._M_parent = 0B;


Hmm, the warning for the IR seems correct, I cannot comment any more because
GCC would need to know the knowledge of getLocalCopy really as far as I can
tell.

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #2 from Rogério de Souza Moraes <rogerio.souza at gmail dot com> ---
Created attachment 53287
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53287&action=edit
C++ code to reproduce the issue.

C++ code to reproduce the issue.

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #3 from Rogério de Souza Moraes <rogerio.souza at gmail dot com> ---
Created attachment 53288
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53288&action=edit
Second example to reproduce the issue

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #4 from Rogério de Souza Moraes <rogerio.souza at gmail dot com> ---
Hi Andrew,

thank you for the quick reply. The "getLocalCopy" on this example is just to
provide a quick way to reproduce the issue. Here is the getLocalCopy function
of this example.

extern void getLocalCopy(std::map<int*, sysDLoc>&);

I added the file bug2.cpp which is another way to reproduce the issue.

The issue only happens when the compiler uses inline, which triggers the error
on "stl_tree.h:2090:32".

I could not find any condition that would consider the example codes as invalid
or that leads to "undefined behavior", do you see any?

Considering that this warning only happens on GCC 12.1, the testcases are valid
wouldn´t it be an issue on this compiler version? Wouldn´t it require a fix on
"stl_tree.h" to prevent this warning?

Regards,
Rogerio

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[romain.geissler at amadeus dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

Romain Geissler <romain.geissler at amadeus dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |romain.geissler at amadeus dot com

--- Comment #5 from Romain Geissler <romain.geissler at amadeus dot com> ---
Hi,

This seems to still happen with current trunk:


#include <map>

std::map<int, int> _Map;

void f()
{
    std::map<int, int> localMap;
    _Map.swap(localMap);
}

compiled with -Wall -Werror -O2:

In file included from
/opt/compiler-explorer/gcc-trunk-20230108/include/c++/13.0.0/map:62,
                 from <source>:1:
In member function 'void std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare,
_Alloc>::swap(std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare, _Alloc>&) [with
_Key = int; _Val = std::pair<const int, int>; _KeyOfValue =
std::_Select1st<std::pair<const int, int> >; _Compare = std::less<int>; _Alloc
= std::allocator<std::pair<const int, int> >]',
    inlined from 'void std::map<_Key, _Tp, _Compare,
_Alloc>::swap(std::map<_Key, _Tp, _Compare, _Alloc>&) [with _Key = int; _Tp =
int; _Compare = std::less<int>; _Alloc = std::allocator<std::pair<const int,
int> >]' at
/opt/compiler-explorer/gcc-trunk-20230108/include/c++/13.0.0/bits/stl_map.h:1172:18,
    inlined from 'void f()' at <source>:8:14:
/opt/compiler-explorer/gcc-trunk-20230108/include/c++/13.0.0/bits/stl_tree.h:2091:36:
error: storing the address of local variable 'localMap' in '*MEM[(struct
_Rb_tree_node_base * &)&localMap + 16].std::_Rb_tree_node_base::_M_parent'
[-Werror=dangling-pointer=]
 2091 |           __t._M_root()->_M_parent = __t._M_end();
      |           ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
<source>: In function 'void f()':
<source>:7:24: note: 'localMap' declared here
    7 |     std::map<int, int> localMap;
      |                        ^~~~~~~~
<source>:7:24: note: 'localMap.std::map<int, int, std::less<int>,
std::allocator<std::pair<const int, int> > >::_M_t.std::_Rb_tree<int,
std::pair<const int, int>, std::_Select1st<std::pair<const int, int> >,
std::less<int>, std::allocator<std::pair<const int, int> >
>::_M_impl.std::_Rb_tree<int, std::pair<const int, int>,
std::_Select1st<std::pair<const int, int> >, std::less<int>,
std::allocator<std::pair<const int, int> > >::_Rb_tree_impl<std::less<int>,
true>::<unnamed>.std::_Rb_tree_header::_M_header.std::_Rb_tree_node_base::_M_parent'
declared here
cc1plus: all warnings being treated as errors
Compiler returned: 1


Cheers,
Romain

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[romain.geissler at amadeus dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #6 from Romain Geissler <romain.geissler at amadeus dot com> ---
Hi,

After upgrading to the latest gcc trunk, I have hit another variant of this
problem. For people just willing to exchange containers with swap, just
swapping the arguments makes it work, and actually has the same logic:


#include <set>

void f(std::set<int>& a)
{
    std::set<int> b;

    // b.swap(a); // Ok and has same effect
    a.swap(b); // KO
}

Compiled on x86_64 with -O2 -Werror=dangling-pointer:

In file included from
/opt/compiler-explorer/gcc-trunk-20230314/include/c++/13.0.1/set:62,
                 from <source>:1:
In member function 'void std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare,
_Alloc>::swap(std::_Rb_tree<_Key, _Val, _KeyOfValue, _Compare, _Alloc>&) [with
_Key = int; _Val = int; _KeyOfValue = std::_Identity<int>; _Compare =
std::less<int>; _Alloc = std::allocator<int>]',
    inlined from 'void std::set<_Key, _Compare, _Alloc>::swap(std::set<_Key,
_Compare, _Alloc>&) [with _Key = int; _Compare = std::less<int>; _Alloc =
std::allocator<int>]' at
/opt/compiler-explorer/gcc-trunk-20230314/include/c++/13.0.1/bits/stl_set.h:443:18,
    inlined from 'void f(std::set<int>&)' at <source>:8:11:
/opt/compiler-explorer/gcc-trunk-20230314/include/c++/13.0.1/bits/stl_tree.h:2092:36:
error: storing the address of local variable 'b' in '*MEM[(struct
_Rb_tree_node_base * &)&b + 16].std::_Rb_tree_node_base::_M_parent'
[-Werror=dangling-pointer=]
 2092 |           __t._M_root()->_M_parent = __t._M_end();
      |           ~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
<source>: In function 'void f(std::set<int>&)':
<source>:5:19: note: 'b' declared here
    5 |     std::set<int> b;
      |                   ^
<source>:5:19: note: 'b.std::set<int, std::less<int>, std::allocator<int>
>::_M_t.std::_Rb_tree<int, int, std::_Identity<int>, std::less<int>,
std::allocator<int> >::_M_impl.std::_Rb_tree<int, int, std::_Identity<int>,
std::less<int>, std::allocator<int> >::_Rb_tree_impl<std::less<int>,
true>::<unnamed>.std::_Rb_tree_header::_M_header.std::_Rb_tree_node_base::_M_parent'
declared here
cc1plus: some warnings being treated as errors
Compiler returned: 1

[Bug tree-optimization/106238] Inline optimization causes dangling pointer on "include/c++/12.1.0/bits/stl_tree.h"

[romain.geissler at amadeus dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #7 from Romain Geissler <romain.geissler at amadeus dot com> ---
Another case in real life code base (in this case Boost):
https://github.com/boostorg/algorithm/pull/113

[Bug tree-optimization/106238] [12/13 regression] Inline optimization causes dangling pointer warning on "include/c++/12.1.0/bits/stl_tree.h"

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.3
             Status|UNCONFIRMED                 |NEW
            Summary|Inline optimization causes  |[12/13 regression] Inline
                   |dangling pointer on         |optimization causes
                   |"include/c++/12.1.0/bits/st |dangling pointer warning on
                   |l_tree.h"                   |"include/c++/12.1.0/bits/st
                   |                            |l_tree.h"
                 CC|                            |jason at gcc dot gnu.org
   Last reconfirmed|                            |2023-03-14
           Priority|P3                          |P2

--- Comment #8 from Jason Merrill <jason at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/106238] [12/13/14 regression] Inline optimization causes dangling pointer warning on "include/c++/12.1.0/bits/stl_tree.h"

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug tree-optimization/106238] [12/13/14 regression] Inline optimization causes dangling pointer warning on "include/c++/12.1.0/bits/stl_tree.h"

[romain.geissler at amadeus dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

--- Comment #10 from Romain Geissler <romain.geissler at amadeus dot com> ---
Hi,

It seems the reproducers from comment #1 and #5 don't happen anymore with gcc
13 or trunk. So it seems fixed.

Cheers,
Romain

[Bug tree-optimization/106238] [12 regression] Inline optimization causes dangling pointer warning on "include/c++/12.1.0/bits/stl_tree.h"

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106238

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 regression]       |[12 regression] Inline
                   |Inline optimization causes  |optimization causes
                   |dangling pointer warning on |dangling pointer warning on
                   |"include/c++/12.1.0/bits/st |"include/c++/12.1.0/bits/st
                   |l_tree.h"                   |l_tree.h"
                 CC|                            |law at gcc dot gnu.org

--- Comment #11 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Adjusting regression markers per c#10.