From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id E0F543858D37; Tue, 14 Mar 2023 09:55:25 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E0F543858D37
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1678787725;
	bh=nRnpgxXmC0kJQchYAzPnSlRE7S2jcFgLXgJx/K/QX6Y=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=TyFH+4KtsDq8bz/AaJlatGSDS0mybfqSbqEgXWew26Sb3JTGVjbaaqA7XS3tbIfwD
	 ZhoqQI/NRW7Yq1ZiFcyLMECjxEtQqYFfea2tsE8AOLpbGC3mB/zYCBgYAHbkEqu2MM
	 IJa/eRmmSNsId4G1ztuIOPHIRGC/P8j0jTuNqrA8=
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/109123] Bogus warning: pointer used after 'realloc'
 -Wuse-after-free with -O2
Date: Tue, 14 Mar 2023 09:55:25 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 12.2.1
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: everconfirmed bug_status cf_reconfirmed_on
Message-ID: <bug-109123-4-HhJzOR97RH@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-109123-4@http.gcc.gnu.org/bugzilla/>
References: <bug-109123-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D109123

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-03-14

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
    size_t old_size =3D vector_objective_size(v);
    if (n > old_capacity) {
        v->_begin =3D realloc(v->_begin, sizeof(double) * n);
        v->_end =3D v->_begin + old_size;

GCC has sunk part of the old_size computation (not the loads but the
subtraction) to after the realloc but before the use of old_size.

The diagnostic code doesn't deal with this code motion very well (read:
it diagnoses it).  We do have plenty of dups for this but the author of
the diagnostic says diagnosing is done on purpose here.

There's no way to fix this.  It doesn't make sense to limit optimization
for this academic "use-after-free", nor would it be an easy task because
of the lack of explicit dependences in the IL.

Confirmed (the diagnostic is happening).=