[Bug middle-end/106776] Unexpected use-after-free warning

["msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106776

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Reproduced with the following reduced test case:

$ cat pr106776.C && g++ -O2 -S -Wall pr106776.C
#include <map>

struct matrix_t
{
  int* count;

  matrix_t() :
    count(new int(1)) {}

  matrix_t(const matrix_t& p) :
    count(p.count) { ++*count; }

  ~matrix_t() { if (--*count == 0) { delete count; } }
};

typedef std::map<int, matrix_t> cache_t;

cache_t CACHE;

matrix_t* cache(cache_t::iterator lb)
{
  matrix_t wftable;

  return &CACHE.insert(lb, cache_t::value_type(1, wftable))->second;
}
In destructor ‘matrix_t::~matrix_t()’,
    inlined from ‘matrix_t* cache(std::map<int, matrix_t>::iterator)’ at
pr106776.C:25:1:
pr106776.C:13:23: warning: pointer used after ‘void operator delete(void*,
std::size_t)’ [-Wuse-after-free]
   13 |   ~matrix_t() { if (--*count == 0) { delete count; } }
      |                       ^~~~~~
In destructor ‘matrix_t::~matrix_t()’,
    inlined from ‘std::pair<const int, matrix_t>::~pair()’ at
/build/gcc-master/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/stl_pair.h:187:12,
    inlined from ‘matrix_t* cache(std::map<int, matrix_t>::iterator)’ at
pr106776.C:24:37:
pr106776.C:13:45: note: call to ‘void operator delete(void*, std::size_t)’ here
   13 |   ~matrix_t() { if (--*count == 0) { delete count; } }
      |                                             ^~~~~

The IL in shows the reason for the warning in bb 8 in struct matrix_t * cache
(struct iterator lb), seen in the output of -fdump-tree-waccess3:

  ...
  <bb 8> [local count: 335388518]:
  operator delete (_3, 4);      <<< _3 deleted
  pretmp_50 = MEM[(int *)_3];   <<< _3 dereferenced