[Bug c++/84414] miscompile due to assuming that object returned by value cannot alias its own member pointer values

["redi at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84414

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Richard Smith from comment #2)
> In fact, I think the *only* problem here is that the above rule does not
> allow the caller and the callee to observe the objects having the same
> address.

Would it be fair to argue that the A::children pointer storing the address of
the temporary becomes an invalid pointer value as soon as the temporary is
destroyed, and then it's not valid to use that invalid pointer value. Testing
`a.children == &a` has an unspecified (at best?) result, so you can't actually
detect whether a temporary was created or not. You can observe that the
arbitrary bit pattern of an invalid pointer value happens to equal &a but that
bit pattern could have magically morphed when it became invalid (because the
implementation tracks pointer provenance and intentionally messes with pointer
values when they become invalid just to screw with you).

Inside Bar using a.children[i] is using the invalid pointer value that points
to an out-of-scope temporary, which is UB. Attempting to observe whether
a.children == &a also uses that invalid pointer value and has an unspecified
result.

> I'll take this to the committee and see whether we can get that rule relaxed
> slightly.

I see you sent the email with subject "on implicit object copies in function
return and alias analysis" and nobody replied. I don't think it ever made it to
the issues list either.

I'll repeat the above argument there.