From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 0D0273852741; Tue, 30 Aug 2022 16:34:48 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 0D0273852741 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1661877288; bh=1Sk1RZ8Z2fQX95E+A/ymhmmv9Zmw7ASmo7owuUnNUYk=; h=From:To:Subject:Date:In-Reply-To:References:From; b=UJ1aOKkCf/1+n2hbS+aOO2eHmNrE71xdPGnBtKp/EKSkbive1ChGInlfkgg7U49Zt ERCIYkB8qEWK/wLWvOC80szmuZlh00mf2s8nXtbPj6kuyRe+xPRYPsA/SFeBi/NdbP 3jOeiVUwCenYgxZsnWENm34p693DBNPU4wcTUVq8= From: "msebor at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug middle-end/106776] Unexpected use-after-free warning Date: Tue, 30 Aug 2022 16:34:47 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: middle-end X-Bugzilla-Version: 12.2.0 X-Bugzilla-Keywords: diagnostic X-Bugzilla-Severity: normal X-Bugzilla-Who: msebor at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D106776 Martin Sebor changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |msebor at gcc dot gnu.org --- Comment #1 from Martin Sebor --- Reproduced with the following reduced test case: $ cat pr106776.C && g++ -O2 -S -Wall pr106776.C #include struct matrix_t { int* count; matrix_t() : count(new int(1)) {} matrix_t(const matrix_t& p) : count(p.count) { ++*count; } ~matrix_t() { if (--*count =3D=3D 0) { delete count; } } }; typedef std::map cache_t; cache_t CACHE; matrix_t* cache(cache_t::iterator lb) { matrix_t wftable; return &CACHE.insert(lb, cache_t::value_type(1, wftable))->second; } In destructor =E2=80=98matrix_t::~matrix_t()=E2=80=99, inlined from =E2=80=98matrix_t* cache(std::map::iterator= )=E2=80=99 at pr106776.C:25:1: pr106776.C:13:23: warning: pointer used after =E2=80=98void operator delete= (void*, std::size_t)=E2=80=99 [-Wuse-after-free] 13 | ~matrix_t() { if (--*count =3D=3D 0) { delete count; } } | ^~~~~~ In destructor =E2=80=98matrix_t::~matrix_t()=E2=80=99, inlined from =E2=80=98std::pair::~pair()=E2=80=99 = at /build/gcc-master/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/stl_pair.h:= 187:12, inlined from =E2=80=98matrix_t* cache(std::map::iterator= )=E2=80=99 at pr106776.C:24:37: pr106776.C:13:45: note: call to =E2=80=98void operator delete(void*, std::s= ize_t)=E2=80=99 here 13 | ~matrix_t() { if (--*count =3D=3D 0) { delete count; } } | ^~~~~ The IL in shows the reason for the warning in bb 8 in struct matrix_t * cac= he (struct iterator lb), seen in the output of -fdump-tree-waccess3: ... [local count: 335388518]: operator delete (_3, 4); <<< _3 deleted pretmp_50 =3D MEM[(int *)_3]; <<< _3 dereferenced=