public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "drfiemost at email dot it" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug middle-end/106776] New: Unexpected use-after-free warning Date: Tue, 30 Aug 2022 09:12:15 +0000 [thread overview] Message-ID: <bug-106776-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106776 Bug ID: 106776 Summary: Unexpected use-after-free warning Product: gcc Version: 12.2.0 Status: UNCONFIRMED Keywords: diagnostic Severity: normal Priority: P3 Component: middle-end Assignee: unassigned at gcc dot gnu.org Reporter: drfiemost at email dot it Target Milestone: --- Created attachment 53520 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53520&action=edit test program When compiling the attached program with the -O2 and -Wuse-after-free flags I get the following warning, which seems bogus as the pointer is not actually dereferenced in case it is deleted: $ g++ -O2 -Wuse-after-free test_ref.cpp In member function 'unsigned int counter::decrease()', inlined from 'matrix_t::~matrix_t()' at test_ref.cpp:32:38, inlined from 'matrix_t* cache(int, const char*)' at test_ref.cpp:53:1: test_ref.cpp:14:40: warning: pointer used after 'void operator delete(void*, std::size_t)' [-Wuse-after-free] 14 | unsigned int decrease() { return --c; } | ^ In destructor 'matrix_t::~matrix_t()', inlined from 'std::pair<const int, matrix_t>::~pair()' at C:/msys64/mingw64/include/c++/12.2.0/bits/stl_pair.h:185:12, inlined from 'matrix_t* cache(int, const char*)' at test_ref.cpp:52:40: test_ref.cpp:32:56: note: call to 'void operator delete(void*, std::size_t)' here 32 | ~matrix_t() { if (count->decrease() == 0) { delete count; delete data; } } | ^~~~~ The IL dump confirms that the pointer _1 is either accessed <bb 3> or deleted <bb 5>: void matrix<short int>::~matrix (struct matrix * const this) { struct counter * _1; short int * _2; unsigned int _10; unsigned int _11; <bb 2> [local count: 1073741824]: _1 = this_5(D)->count; _10 = _1->c; _11 = _10 + 4294967295; if (_11 == 0) goto <bb 5>; [33.00%] else goto <bb 3>; [67.00%] <bb 3> [local count: 719407024]: _1->c = _11; <bb 4> [local count: 884279007]: goto <bb 7>; [100.00%] <bb 5> [local count: 354334800]: operator delete (_1, 4); _2 = this_5(D)->data; if (_2 != 0B) goto <bb 6>; [53.47%] else goto <bb 8>; [46.53%] <bb 8> [local count: 164871983]: goto <bb 4>; [100.00%] <bb 6> [local count: 189462817]: operator delete [] (_2); [tail call] <bb 7> [local count: 1073741824]: return; } The warning doesn't appear when using the -O1 flag or if the variable is decalared volatile. If I'm not missing anything obvious the warning should not be issued at all.
next reply other threads:[~2022-08-30 9:12 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-08-30 9:12 drfiemost at email dot it [this message] 2022-08-30 16:34 ` [Bug middle-end/106776] " msebor at gcc dot gnu.org 2022-09-28 14:33 ` drfiemost at email dot it 2022-10-22 1:08 ` pinskia at gcc dot gnu.org 2022-10-22 1:24 ` pinskia at gcc dot gnu.org 2022-10-22 1:27 ` pinskia at gcc dot gnu.org 2023-05-30 17:03 ` drfiemost at yahoo dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-106776-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).