From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 35D723858C50; Thu,  4 Apr 2024 07:39:50 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 35D723858C50
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1712216390;
	bh=eDmvUxratQ3+5jP95HhnfFROYiPrqVIuc1OvhCDindk=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=vw0K6mHsVNdMDcYfRdtSm08UZ7xhZAmFDBKbMWsTe7RDUFyonJwwy4haAKpD+i9zI
	 QWI0lxiLURSuIiYu6Q99USTTUQdlNa9vpPKc1eUW+JxnP1BXAg5AQ0ixc8Awi+RENA
	 /nbs2gY9jP/344vC6MkVqNq0lNgj2Yq3hgKbVBwc=
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/110501] [13/14 regression] Invalid
 -Wuse-after-free / realloc with a store/load happening
Date: Thu, 04 Apr 2024 07:39:48 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 12.3.1
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 13.3
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: target_milestone
Message-ID: <bug-110501-4-6oKn8jBdE0@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-110501-4@http.gcc.gnu.org/bugzilla/>
References: <bug-110501-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D110501

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.3

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to John Baldwin from comment #7)
> I believe I am hitting this same issue using GCC 13 to compile FreeBSD's
> userland. (I looked through several of the other bugs for the
> Wuse-after-free metabug and this one seems the closest to what I'm
> encountering).  The code in question does not trigger the -Wuse-after-free
> warning when using GCC 12, but now triggers the warning with GCC 13.  It =
is
> just calling free on the old value after realloc fails which should be sa=
fe.
> The simplest version I've encountered so far in FreeBSD's tree is this:
>=20
> static int
> group_resize(void)
> {
> 	char *buf;
>=20
> 	if (gbufsize =3D=3D 0)
> 		gbufsize =3D 1024;
> 	else
> 		gbufsize *=3D 2;
>=20
> 	buf =3D gbuffer;
> 	gbuffer =3D realloc(buf, gbufsize);
> 	if (gbuffer =3D=3D NULL) {
> 		free(buf);

the problem with this is that 'gbuffer' is a global and we diagnose this
early before applying memory CSE so we don't see the 'gbuffer' being
stored and 'gbuffer' being tested against NULL as equal.

IIRC with GCC 13 we moved some diagnostics early from late as late has
issues with jump threading exposing very many false positives.

Testcase (which I believe we have a duplicate for):

void *gbuffer;
unsigned long gbufsize;
void foo()
{
  char *buf =3D gbuffer;
  gbuffer =3D __builtin_realloc(buf, gbufsize);
  if (!gbuffer) {
      __builtin_free(buf);
      return;
  }
  __builtin_memset (gbuffer, 0, gbufsize);
}

I'll note that for the early -Wuninitialized I added cheap value numbering
to prune unreachable code paths.  The plan was to wrap all of the early
diagnostics with such cheap VN _analysis_ (but not do any code changes)
which would allow these cases to be identified as equal.  The diagnostic
passes would need to apply some valueization then of course.=