[Bug tree-optimization/110501] [13/14 regression] Invalid -Wuse-after-free / realloc with a store/load happening

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110501

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to John Baldwin from comment #7)
> I believe I am hitting this same issue using GCC 13 to compile FreeBSD's
> userland. (I looked through several of the other bugs for the
> Wuse-after-free metabug and this one seems the closest to what I'm
> encountering).  The code in question does not trigger the -Wuse-after-free
> warning when using GCC 12, but now triggers the warning with GCC 13.  It is
> just calling free on the old value after realloc fails which should be safe.
> The simplest version I've encountered so far in FreeBSD's tree is this:
> 
> static int
> group_resize(void)
> {
> 	char *buf;
> 
> 	if (gbufsize == 0)
> 		gbufsize = 1024;
> 	else
> 		gbufsize *= 2;
> 
> 	buf = gbuffer;
> 	gbuffer = realloc(buf, gbufsize);
> 	if (gbuffer == NULL) {
> 		free(buf);

the problem with this is that 'gbuffer' is a global and we diagnose this
early before applying memory CSE so we don't see the 'gbuffer' being
stored and 'gbuffer' being tested against NULL as equal.

IIRC with GCC 13 we moved some diagnostics early from late as late has
issues with jump threading exposing very many false positives.

Testcase (which I believe we have a duplicate for):

void *gbuffer;
unsigned long gbufsize;
void foo()
{
  char *buf = gbuffer;
  gbuffer = __builtin_realloc(buf, gbufsize);
  if (!gbuffer) {
      __builtin_free(buf);
      return;
  }
  __builtin_memset (gbuffer, 0, gbufsize);
}

I'll note that for the early -Wuninitialized I added cheap value numbering
to prune unreachable code paths.  The plan was to wrap all of the early
diagnostics with such cheap VN _analysis_ (but not do any code changes)
which would allow these cases to be identified as equal.  The diagnostic
passes would need to apply some valueization then of course.