[Bug c++/109448] New: _M_exception_object’ may be used uninitialized [-Werror=maybe-uninitialized]

[Bug c++/109448] New: _M_exception_object’ may be used uninitialized [-Werror=maybe-uninitialized]

[jincikang at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

            Bug ID: 109448
           Summary: _M_exception_object’ may be used uninitialized
                    [-Werror=maybe-uninitialized]
           Product: gcc
           Version: 12.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jincikang at gmail dot com
  Target Milestone: ---

```cpp
// test.cpp
#include <variant>
#include <vector>
#include <cassert>
#include <cstdint>
#include <exception>
#include <atomic>

template <typename T>
class Try {
public:
    Try() = default;
    ~Try() = default;

    Try(Try<T>&& other) = default;

    Try& operator=(Try<T>&& other) = default;
    Try& operator=(std::exception_ptr error) {
        if (std::holds_alternative<std::exception_ptr>(_value) &&
            std::get<std::exception_ptr>(_value) == error) {
            return *this;
        }

        _value.template emplace<std::exception_ptr>(error);
        return *this;
    }

    template <class... U>
    Try(U&&... value)
        requires std::is_constructible_v<T, U...>
        : _value(std::in_place_type<T>, std::forward<U>(value)...) {}

    Try(std::exception_ptr error) : _value(error) {}

private:
    Try(const Try&) = delete;
    Try& operator=(const Try&) = delete;

public:
    constexpr bool available() const noexcept {
        return !std::holds_alternative<std::monostate>(_value);
    }
    constexpr bool hasError() const noexcept {
        return std::holds_alternative<std::exception_ptr>(_value);
    }
    const T& value() const& {
        checkHasTry();
        return std::get<T>(_value);
    }
    T& value() & {
        checkHasTry();
        return std::get<T>(_value);
    }
    T&& value() && {
        checkHasTry();
        return std::move(std::get<T>(_value));
    }
    const T&& value() const&& {
        checkHasTry();
        return std::move(std::get<T>(_value));
    }

    template <class... Args>
    T& emplace(Args&&... args) {
        return _value.template emplace<T>(std::forward<Args>(args)...);
    }

    void setException(std::exception_ptr error) {
        if (std::holds_alternative<std::exception_ptr>(_value) &&
            std::get<std::exception_ptr>(_value) == error) {
            return;
        }
        _value.template emplace<std::exception_ptr>(error);
    }
    std::exception_ptr getException() const {
        logicAssert(std::holds_alternative<std::exception_ptr>(_value),
                    "Try object do not has on error");
        return std::get<std::exception_ptr>(_value);
    }
private:
    inline void checkHasTry() const {
        if (std::holds_alternative<T>(_value))
           { return; }
        else if (std::holds_alternative<std::exception_ptr>(_value)) {
            std::rethrow_exception(std::get<std::exception_ptr>(_value));
        } else if (std::holds_alternative<std::monostate>(_value)) {
            throw std::logic_error("Try object is empty");
        } else {
            assert(false);
        }
    }

private:
    std::variant<std::monostate, T, std::exception_ptr> _value;
};


namespace detail {

enum class State : uint8_t {
    START = 0,
    ONLY_RESULT = 1 << 0,
    ONLY_CONTINUATION = 1 << 1,
    DONE = 1 << 5,
};

constexpr State operator|(State lhs, State rhs) {
    return State((uint8_t)lhs | (uint8_t)rhs);
}

constexpr State operator&(State lhs, State rhs) {
    return State((uint8_t)lhs & (uint8_t)rhs);
}

}  // namespace detail

template <class T>
struct TestPromise {
public:
    TestPromise() : _state(detail::State::START) {}
    ~TestPromise() {}

public:
    bool hasResult() const noexcept {
        constexpr auto allow = detail::State::DONE |
detail::State::ONLY_RESULT;
        auto state = _state.load(std::memory_order_acquire);
        return (state & allow) != detail::State();
    }

    void setResult(Try<T>&& value) {
        assert(!hasResult());
        _try_value = std::move(value);
    }

    std::atomic<detail::State> _state;
    Try<T> _try_value;
};

struct Empty {};

int main() {
    int n = 10;
    std::vector<TestPromise<Empty>> promise(n);
    for (int i = 0; i < n; ++i) {
        promise[i].setResult(Empty());
    }
}
```

# no problem
$ g++-11 -std=c++20 -Wall -Werror -O3 test.cpp

# no problem
$ g++ -std=c++20 -Wall -Werror -O0 test.cpp

# Error：‘*(std::__exception_ptr::exception_ptr*)((char*)&<unnamed> +
offsetof(Try<Empty>,Try<Empty>::_value.std::variant<std::monostate, Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Variant_base<std::monostate,
Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Move_assign_base<false,
std::monostate, Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Copy_assign_base<false,
std::monostate, Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Move_ctor_base<false,
std::monostate, Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Copy_ctor_base<false,
std::monostate, Empty,
std::__exception_ptr::exception_ptr>::<unnamed>.std::__detail::__variant::_Variant_storage<false,
std::monostate, Empty,
std::__exception_ptr::exception_ptr>::_M_u)).std::__exception_ptr::exception_ptr::_M_exception_object’
may be used uninitialized [-Werror=maybe-uninitialized]
$ g++ -std=c++20 -Wall -Werror -O3 test.cpp

[Bug c++/109448] _M_exception_object’ may be used uninitialized [-Werror=maybe-uninitialized]

[jincikang at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

--- Comment #1 from jinci kang <jincikang at gmail dot com> ---
This problem occurs under GCC12 and when compiling optimization is turned on,
and only if the template T type is the empty type.

[Bug tree-optimization/109448] [12/13 Regression] wrong uninitialized warning with std::variant of an empty class and std::exception_ptr

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|_M_exception_object’ may be |[12/13 Regression] wrong
                   |used uninitialized          |uninitialized warning with
                   |[-Werror=maybe-uninitialize |std::variant of an empty
                   |d]                          |class and
                   |                            |std::exception_ptr
   Target Milestone|---                         |12.3
      Known to fail|                            |12.1.0
      Known to work|                            |11.3.0

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced further:
```
#include <variant>
#include <cassert>
#include <exception>
#include <atomic>
struct Empty {};

struct Try {
    Try() = default;
    ~Try() = default;
    Try(Empty a): _value(a){}
    Try(Try&& other) = default;
    Try& operator=(Try&& other) = default;
    std::variant<Empty, std::exception_ptr> _value;
};

struct TestPromise {
    void setResult(Try&& value) {
        if(_state != 0) __builtin_abort();
        _try_value = std::move(value);
    }
    std::atomic<int> _state = 0;
    Try _try_value;
};


int main() {
  TestPromise promise;
  promise.setResult(Empty());
}
```

[Bug tree-optimization/109448] [12/13 Regression] wrong uninitialized warning with std::variant of an empty class and std::exception_ptr

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |missed-optimization
           Priority|P3                          |P2
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-04-12
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
<bb 2> [local count: 1073741824]:
promise = {};
D.22193 ={v} {CLOBBER};
MEM[(struct __as_base  &)&D.22193] ={v} {CLOBBER};
MEM[(union _Variadic_union *)&D.22193] ={v} {CLOBBER};
MEM[(struct _Uninitialized *)&D.22193] ={v} {CLOBBER};
MEM[(struct _Variant_storage *)&D.22193]._M_index = 0;
_16 = __atomic_load_4 (&MEM[(const struct __atomic_base *)&promise]._M_i, 5);
if (_16 != 0)
  goto <bb 3>; [0.00%]
else
  goto <bb 4>; [100.00%]

<bb 4> [local count: 1073741824]:
_20 = MEM[(const struct variant
*)&D.22193].D.21735.D.21220.D.21138.D.21006.D.20892.D.20796._M_index;
_21 = (signed char) _20;
_22 = (long unsigned int) _21;
if (_22 == 1)
  goto <bb 12>; [33.33%]

without checking it looks like we fail to CSE _M_index to 0 here and
run into the unreachable code region dominated by BB 12.  That's
because __atomic_load_4 is a full barrier since D.22193 excapes
in the call to _M_reset later in the function (yep, our escape handling
isn't flow-sensitive).

We sofar made no attempts in relaxing the barrier-ness of __atomic_* for
any of the memory order parameters, not sure if in this case the CSE
would be valid when D.22193 were global memory.

Btw, we fail to mod-ref analyze the _M_reset this as not escaping because
it escapes through the _M_release call done and that function is
out-of-line:

  _10 = &MEM[(struct __aligned_membuf *)this_4(D)]._M_storage;
  std::__exception_ptr::exception_ptr::_M_release (_10);

there's currently no way to annotate the std::__exception_ptr methods
manually, we'd need to add this capability somehow.

[Bug tree-optimization/109448] [12/13/14 Regression] wrong uninitialized warning with std::variant of an empty class and std::exception_ptr

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug tree-optimization/109448] [12/13/14/15 Regression] wrong uninitialized warning with std::variant of an empty class and std::exception_ptr

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109448

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.4                        |12.5

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.4 is being released, retargeting bugs to GCC 12.5.