[Bug c++/110055] New: Dangling pointer warning inside std::vector on RISC-V

[Bug c++/110055] New: Dangling pointer warning inside std::vector on RISC-V

[spriteovo at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

            Bug ID: 110055
           Summary: Dangling pointer warning inside std::vector on RISC-V
           Product: gcc
           Version: 13.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: spriteovo at gmail dot com
  Target Milestone: ---

This bug can only be reproduce on RISC-V platform.

Minimum reproducible example:

```cpp
#include <cstdint>
#include <vector>

struct Data {
  std::vector<uint16_t> v = {1, 1};
};

int main() {
  Data a;
  Data b;
}
```

Compile with `g++ main.cpp -Werror -Wall -fno-exceptions -O3`

Error message:

```
In file included from /usr/include/c++/13.1.1/vector:62,
                 from main.cpp:2:
In static member function ‘static _Up* std::__copy_move<_IsMove, true,
std::random_access_iterator_tag>::__copy_m(_Tp*, _Tp*, _Up*) [with _Tp = const
short unsigned int; _Up = short unsigned int; bool _IsMove = false]’,
    inlined from ‘_OI std::__copy_move_a2(_II, _II, _OI) [with bool _IsMove =
false; _II = const short unsigned int*; _OI = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_algobase.h:506:30,
    inlined from ‘_OI std::__copy_move_a1(_II, _II, _OI) [with bool _IsMove =
false; _II = const short unsigned int*; _OI = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_algobase.h:533:42,
    inlined from ‘_OI std::__copy_move_a(_II, _II, _OI) [with bool _IsMove =
false; _II = const short unsigned int*; _OI = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_algobase.h:540:31,
    inlined from ‘_OI std::copy(_II, _II, _OI) [with _II = const short unsigned
int*; _OI = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_algobase.h:633:7,
    inlined from ‘static _ForwardIterator
std::__uninitialized_copy<true>::__uninit_copy(_InputIterator, _InputIterator,
_ForwardIterator) [with _InputIterator = const short unsigned int*;
_ForwardIterator = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_uninitialized.h:147:27,
    inlined from ‘_ForwardIterator std::uninitialized_copy(_InputIterator,
_InputIterator, _ForwardIterator) [with _InputIterator = const short unsigned
int*; _ForwardIterator = short unsigned int*]’ at
/usr/include/c++/13.1.1/bits/stl_uninitialized.h:185:15,
    inlined from ‘_ForwardIterator std::__uninitialized_copy_a(_InputIterator,
_InputIterator, _ForwardIterator, allocator<_Tp>&) [with _InputIterator = const
short unsigned int*; _ForwardIterator = short unsigned int*; _Tp = short
unsigned int]’ at /usr/include/c++/13.1.1/bits/stl_uninitialized.h:373:37,
    inlined from ‘void std::vector<_Tp,
_Alloc>::_M_range_initialize(_ForwardIterator, _ForwardIterator,
std::forward_iterator_tag) [with _ForwardIterator = const short unsigned int*;
_Tp = short unsigned int; _Alloc = std::allocator<short unsigned int>]’ at
/usr/include/c++/13.1.1/bits/stl_vector.h:1692:33,
    inlined from ‘std::vector<_Tp, _Alloc>::vector(std::initializer_list<_Tp>,
const allocator_type&) [with _Tp = short unsigned int; _Alloc =
std::allocator<short unsigned int>]’ at
/usr/include/c++/13.1.1/bits/stl_vector.h:679:21,
    inlined from ‘constexpr Data::Data()’ at main.cpp:4:8,
    inlined from ‘int main()’ at main.cpp:10:8:
/usr/include/c++/13.1.1/bits/stl_algobase.h:437:30: error: using a dangling
pointer to ‘C.0’ [-Werror=dangling-pointer=]
  437 |             __builtin_memmove(__result, __first, sizeof(_Tp) * _Num);
      |             ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
main.cpp: In function ‘int main()’:
main.cpp:4:8: note: ‘C.0’ declared here
    4 | struct Data {
      |        ^~~~
cc1plus: all warnings being treated as errors
```

[Bug c++/110055] Dangling pointer warning inside std::vector on RISC-V

[spriteovo at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #1 from Sprite <spriteovo at gmail dot com> ---
$ g++ -v

```
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/riscv64-unknown-linux-gnu/13.1.1/lto-wrapper
Target: riscv64-unknown-linux-gnu
Configured with: /build/gcc/src/gcc/configure
--enable-languages=c,c++,d,fortran,go,lto,objc,obj-c++ --enable-bootstrap
--prefix=/usr --libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--with-build-config=bootstrap-lto --with-linker-hash-style=gnu
--with-system-zlib --enable-__cxa_atexit --enable-cet=auto
--enable-checking=release --enable-clocale=gnu --enable-default-pie
--enable-default-ssp --enable-gnu-indirect-function --enable-gnu-unique-object
--enable-libstdcxx-backtrace --enable-link-serialization=1
--enable-linker-build-id --enable-lto --enable-plugin --enable-shared
--enable-threads=posix --disable-libssp --disable-libstdcxx-pch
--disable-multilib --disable-werror
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.1.1 20230429 (GCC)
```

[Bug c++/110055] Dangling pointer warning inside std::vector on RISC-V

[spriteovo at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #2 from Sprite <spriteovo at gmail dot com> ---
Note that the error is raised only on the second and subsequent variables, the
first variable works fine.

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-05-31
     Ever confirmed|0                           |1
             Target|                            |aarch64-linux-gnu
                   |                            |riscv*-linux-gnu
          Component|c++                         |middle-end

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
>  C.0 ={v} {CLOBBER(eol)};


Should never have been emitted from the gimplifier.


Confirmed, I have not reduced the testcase yet.
But I can also confirm it on aarch64-linux-gnu with -O3 -mstrict-align
-fno-exceptions .

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|aarch64-linux-gnu           |aarch64-linux-gnu
                   |riscv*-linux-gnu            |riscv*-linux-gnu
                   |                            |mips64-linux-gnu

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
>This bug can only be reproduce on RISC-V platform.


No it can reproduced on mips and aarch64 (with -mstrict-align) too.

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> >  C.0 ={v} {CLOBBER(eol)};
> 
> 
> Should never have been emitted from the gimplifier.
> 
> 
> Confirmed, I have not reduced the testcase yet.
> But I can also confirm it on aarch64-linux-gnu with -O3 -mstrict-align
> -fno-exceptions .

So what is happening is we emitting the clobber and then changing it to be a
static variable.

This part happens even for x86_64 though the memcpy here can be removed.


      C.0 = {CLOBBER(eol)};

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
confirmed - that's quite an odd thing.  gimplify_init_constructor creates this
constant pool entry, not sure who ends up ending its lifetime.

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
The clobber is built by gimplify_target_expr and TARGET_EXPR_SLOT is changed
in place to the static variable.

Does the following fix the RISC-V issue?

diff --git a/gcc/gimplify.cc b/gcc/gimplify.cc
index ade6e335da7..aece89a3e9b 100644
--- a/gcc/gimplify.cc
+++ b/gcc/gimplify.cc
@@ -7154,8 +7154,10 @@ gimplify_target_expr (tree *expr_p, gimple_seq *pre_p,
gimple_seq *post_p)
        gimplify_and_add (init, &init_pre_p);

       /* Add a clobber for the temporary going out of scope, like
-        gimplify_bind_expr.  */
+        gimplify_bind_expr.  But only if we did not promote the
+        temporary to static storage.  */
       if (gimplify_ctxp->in_cleanup_point_expr
+         && !TREE_STATIC (temp)
          && needs_to_live_in_memory (temp))
        {
          if (flag_stack_reuse == SR_ALL)

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[spriteovo at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #8 from Sprite <spriteovo at gmail dot com> ---
(In reply to Richard Biener from comment #7)
> The clobber is built by gimplify_target_expr and TARGET_EXPR_SLOT is changed
> in place to the static variable.
> 
> Does the following fix the RISC-V issue?
> 
> diff --git a/gcc/gimplify.cc b/gcc/gimplify.cc
> index ade6e335da7..aece89a3e9b 100644
> --- a/gcc/gimplify.cc
> +++ b/gcc/gimplify.cc
> @@ -7154,8 +7154,10 @@ gimplify_target_expr (tree *expr_p, gimple_seq
> *pre_p, gimple_seq *post_p)
>         gimplify_and_add (init, &init_pre_p);
>  
>        /* Add a clobber for the temporary going out of scope, like
> -        gimplify_bind_expr.  */
> +        gimplify_bind_expr.  But only if we did not promote the
> +        temporary to static storage.  */
>        if (gimplify_ctxp->in_cleanup_point_expr
> +         && !TREE_STATIC (temp)
>           && needs_to_live_in_memory (temp))
>         {
>           if (flag_stack_reuse == SR_ALL)

Yes, I have tested this patch on RISC-V platform, it fixes the issue. Thank
you!

[Bug middle-end/110055] Dangling pointer warning inside std::vector on RISC-V

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:84eec2916fa68cd2e2b3a2cf764f2ba595cce843

commit r14-1562-g84eec2916fa68cd2e2b3a2cf764f2ba595cce843
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 5 08:56:53 2023 +0200

    middle-end/110055 - avoid CLOBBERing static variables

    The gimplifier can elide initialized constant automatic variables
    to static storage in which case TARGET_EXPR gimplification needs
    to avoid emitting a CLOBBER for them since their lifetime is no
    longer limited.  Failing to do so causes spurious dangling-pointer
    diagnostics on the added testcase for some targets.

            PR middle-end/110055
            * gimplify.cc (gimplify_target_expr): Do not emit
            CLOBBERs for variables which have static storage duration
            after gimplifying their initializers.

            * g++.dg/warn/Wdangling-pointer-pr110055.C: New testcase.

[Bug middle-end/110055] [13 Regression] Dangling pointer warning inside std::vector on RISC-V

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org
           Priority|P3                          |P2
            Summary|Dangling pointer warning    |[13 Regression] Dangling
                   |inside std::vector on       |pointer warning inside
                   |RISC-V                      |std::vector on RISC-V
   Target Milestone|---                         |13.2

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk, introduced with r0-113304-gd0ad58f94e22dc so it's a regression
(but this seems to be the first discovered fallout).  I'm queuing backports for
GCC 13 only sofar.

[Bug middle-end/110055] [13 Regression] Dangling pointer warning inside std::vector on RISC-V

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:b0856bb588c76e16a518b459a8c9a012dc2b4e21

commit r13-7467-gb0856bb588c76e16a518b459a8c9a012dc2b4e21
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Jun 5 08:56:53 2023 +0200

    middle-end/110055 - avoid CLOBBERing static variables

    The gimplifier can elide initialized constant automatic variables
    to static storage in which case TARGET_EXPR gimplification needs
    to avoid emitting a CLOBBER for them since their lifetime is no
    longer limited.  Failing to do so causes spurious dangling-pointer
    diagnostics on the added testcase for some targets.

            PR middle-end/110055
            * gimplify.cc (gimplify_target_expr): Do not emit
            CLOBBERs for variables which have static storage duration
            after gimplifying their initializers.

            * g++.dg/warn/Wdangling-pointer-pr110055.C: New testcase.

    (cherry picked from commit 84eec2916fa68cd2e2b3a2cf764f2ba595cce843)

[Bug middle-end/110055] [13 Regression] Dangling pointer warning inside std::vector on RISC-V

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110055

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |13.1.0
      Known to work|                            |13.1.1, 14.0
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed, though the underlying issue is latent for longer.