[Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0

["jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up.
long a, *d, *h;
int b, c, e, g, i;
signed char f = -26;

int
main ()
{
  long j;
  for (c = 0; c != 7; ++c)
    {
      long k = 0;
      long l = k;
      long **m = &d;
      for (; f + i != 0; i++)
        h = &l;
      g = h != (*m = &j);
      int *n = &b;
      *n = g;
      while (e)
        while (a)
          ++a;
    }
  if (b != 1)
    __builtin_abort ();
}

I'd say this is just invalid code.
In the c == 0 iteration, h is set to address of l, local in the loop (many
times).
But when that l var goes out of the scope at the end of the iteration, the h
pointer pointing to it becomes invalid, it doesn't point to any valid object.
In the c == 1 iteration, it isn't reinitialized, so I think using it for the
comparison is UB.
ASan use-after-scope can't catch such sort of thing, it can catch stuff when
such pointer is dereferenced, but that is not the case here.  Plus, when l
starts lifetime in the c == 1 and later iterations, it would be unpoisoned
again and nothing would be reported even if it was dereferenced.

This is essentially
int *p;

int
main ()
{
  for (int i = 0; i < 10; ++i)
    {
      int l = 0;
      if (i == 0)
        p = &l;
      *p = 42;
    }
}
which isn't reported with -fsanitize=address -fsanitize-address-use-after-scope
-g
by either gcc or clang, yet is clearly undefined behavior.  The earlier
testcase
doesn't dereference but IMHO has the same problem.