[Bug c++/107200] New: False positive -Wdangling-pointer?

[Bug c++/107200] New: False positive -Wdangling-pointer?

[carlosgalvezp at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107200

            Bug ID: 107200
           Summary: False positive -Wdangling-pointer?
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: carlosgalvezp at gmail dot com
  Target Milestone: ---

Hi, 

The following code triggers a -Wdangling-pointer on GCC 12 and GCC 13:

#include <iostream>
#include <Eigen/Core>

Eigen::Vector2d foo() { 
    return {1.0, 2.0};
}

int main()
{
    auto x = 0.5 * foo();
    std::cout << x(0) << ", " << x(1) << std::endl;
}

<source>: In function 'int main()':
<source>:10:23: note: unnamed temporary defined here
   10 |     auto x = 0.5 * foo();
      |                    ~~~^~
In member function 'const Eigen::internal::scalar_product_op<LhsScalar,
RhsScalar>::result_type Eigen::internal::scalar_product_op<LhsScalar,
RhsScalar>::operator()(const LhsScalar&, const RhsScalar&) const [with
LhsScalar = double; RhsScalar = double]',
    inlined from
'Eigen::internal::binary_evaluator<Eigen::CwiseBinaryOp<BinaryOp, Lhs, Rhs>,
Eigen::internal::IndexBased, Eigen::internal::IndexBased>::CoeffReturnType
Eigen::internal::binary_evaluator<Eigen::CwiseBinaryOp<BinaryOp, Lhs, Rhs>,
Eigen::internal::IndexBased, Eigen::internal::IndexBased>::coeff(Eigen::Index)
const [with BinaryOp = Eigen::internal::scalar_product_op<double, double>; Lhs
= const Eigen::CwiseNullaryOp<Eigen::internal::scalar_constant_op<double>,
const Eigen::Matrix<double, 2, 1> >; Rhs = const Eigen::Matrix<double, 2, 1>]'
at
/opt/compiler-explorer/libs/eigen/v3.3.9/Eigen/src/Core/CoreEvaluators.h:719:21,
    inlined from 'Eigen::DenseCoeffsBase<Derived, 0>::CoeffReturnType
Eigen::DenseCoeffsBase<Derived, 0>::coeff(Eigen::Index) const [with Derived =
Eigen::CwiseBinaryOp<Eigen::internal::scalar_product_op<double, double>, const
Eigen::CwiseNullaryOp<Eigen::internal::scalar_constant_op<double>, const
Eigen::Matrix<double, 2, 1> >, const Eigen::Matrix<double, 2, 1> >]' at
/opt/compiler-explorer/libs/eigen/v3.3.9/Eigen/src/Core/DenseCoeffsBase.h:144:59,
    inlined from 'Eigen::DenseCoeffsBase<Derived, 0>::CoeffReturnType
Eigen::DenseCoeffsBase<Derived, 0>::operator()(Eigen::Index) const [with
Derived = Eigen::CwiseBinaryOp<Eigen::internal::scalar_product_op<double,
double>, const
Eigen::CwiseNullaryOp<Eigen::internal::scalar_constant_op<double>, const
Eigen::Matrix<double, 2, 1> >, const Eigen::Matrix<double, 2, 1> >]' at
/opt/compiler-explorer/libs/eigen/v3.3.9/Eigen/src/Core/DenseCoeffsBase.h:181:19,
    inlined from 'int main()' at <source>:11:37:
/opt/compiler-explorer/libs/eigen/v3.3.9/Eigen/src/Core/functors/BinaryFunctors.h:86:128:
warning: using a dangling pointer to an unnamed temporary [-Wdangling-pointer=]
   86 |   EIGEN_DEVICE_FUNC EIGEN_STRONG_INLINE const result_type operator()
(const LhsScalar& a, const RhsScalar& b) const { return a * b; }
      |     

Reproducible on Godbolt: https://godbolt.org/z/7475f7WvK

The warning goes away with this change:

-    auto x = 0.5 * foo();
+    Eigen::Vector2d x = 0.5 * foo();

What could be the reason for this behavior?

Thanks!

[Bug c++/107200] False positive -Wdangling-pointer?

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107200

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-10-10

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Can you attach the preprocessed source?

[Bug tree-optimization/107200] False positive -Wdangling-pointer?

[carlosgalvezp at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107200

--- Comment #2 from Carlos Galvez <carlosgalvezp at gmail dot com> ---
Created attachment 53688
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53688&action=edit
Preprocessed source

Attaching preprocessed source. Had to use a tarball since it exceeds the 1 MB
limit. Alternatively, you can get the same by adding "-E" to the flags in the
Compiler Explorer example I posted above.

Let me know if I can provide more info! Thanks for looking into it :)

[Bug tree-optimization/107200] False positive -Wdangling-pointer?

[remi.galanalfonso at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107200

Rémi Galan Alfonso <remi.galanalfonso at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |remi.galanalfonso at gmail dot com

--- Comment #3 from Rémi Galan Alfonso <remi.galanalfonso at gmail dot com> ---
Hello,

If I remember correctly, Eigen uses expression templates (and the names in the
inline stack make it look like it).
In that case your auto would not be Eigen::Vector2d (which you can see in your
godbolt by adding e.g. "static_assert(std::is_same<decltype(x),
Eigen::Vector2d>::value, "Not Eigen::Vector2d.");"), it would be a type that
represents the expression "0.5 * Eigen::Vector2d{1.0, 2.0}", which probably
contains a reference to the temporary Vector2d, which is destroyed at the end
of the line, before the "x(0)" and "x(1)". And that would explain why you don't
see the problem when you replace the auto with "Eigen::Vector2d", as in that
case that causes the evaluation of the expression template while the temporary
still exists.

Moreover, if you enable "Execute the code" on godbolt and add the option
"-fsanitize=address", it trigger the address sanitizer with auto and not
Vector2d, with "ERROR: AddressSanitizer: stack-use-after-scope".
(And bonus: when running the code without sanitizer in O3, what is printed is
not the "expected" result, for example I get "0, 1.03725e-317" on godbolt, GCC
optimized assuming the code doesn't use the dangling values)

So I think the warning is correct, but you probably want to wait for
confirmation from a GCC developer ;).

[Bug tree-optimization/107200] False positive -Wdangling-pointer?

[carlosgalvezp at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107200

Carlos Galvez <carlosgalvezp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |INVALID

--- Comment #4 from Carlos Galvez <carlosgalvezp at gmail dot com> ---
Wow, that's just mind blowing, thanks a lot! Can't believe we haven't caught
this issue before...