From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 309F5385842F; Sat, 22 Oct 2022 01:24:25 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 309F5385842F
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1666401865;
	bh=FDPnLBDZF6uGvkVuDCOmdlRpZ+L9SjnWGoQfniQOcyI=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=bZ2XjwZ639yqQd2dft3yD+X36UypMzuu9/mIya7xrY36Lr7ifJG2fmeAeUZYgNXMT
	 rp+CuAVUFa1TEolQd9StbN8mU9c9ZUmupyAgmXZDHv2PG+aqZRTXlQmEjzAKjEGgTt
	 zU+khwsul5w+4z1YXq72bzBMsY7hrHmOlqc/2S5U=
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/106776] Unexpected use-after-free warning
Date: Sat, 22 Oct 2022 01:24:24 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 12.2.0
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-106776-4-nDgBuljNDA@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-106776-4@http.gcc.gnu.org/bugzilla/>
References: <bug-106776-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D106776

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Here is a reduced testcase without any std::map or otherwise:
```
struct matrix_t
{
  int* count;

  matrix_t() :
    count(new int(1)) {}

  matrix_t(const matrix_t& p) :
    count(p.count) { ++*count; }

  ~matrix_t() { if (--*count =3D=3D 0) { delete count;  } }
};

void f();
void cache1(void)
{
  matrix_t wftable;
  matrix_t wftable1(wftable);
  f();
}

```
basically what is going on is GCC cannot figure out the load from the count=
 in
the first deconstructor will be greater than 1. GCC didn't inline the
deconstructor on the unwinding from exception which is causing GCC to think
count escapes and is read by f; the original case there is similar non-inli=
ning
which is causing a similar issue.

The warning is a false positive but it is hard to prove unless you understa=
nd
the IR and such.=