Re: [PATCH] tree-optimization/109170 - bogus use-after-free with __builtin_expect

[Jakub Jelinek <jakub@redhat.com>]

On Fri, Mar 17, 2023 at 02:18:52PM +0000, Richard Biener wrote:
> > And as you show on the testcases, it probably isn't a good idea for
> > BUILT_IN_EXPECT* either.
> > 
> > So, perhaps use op_cfn_pass_through_arg1 for the ERF_RETURNS_ARG functions
> > and BUILT_IN_EXPECT* ?
> 
> But that already causes the problems (I didn't yet finish testing
> adding RET1 to BUILT_IN_EXPECT*).  Note FRE currently does not use
> returns_arg but I have old patches that do - but those replace
> uses after a RET1 function with the return value to also reduce
> spilling around a call (they of course CSE equal calls).

I meant in your patch drop the builtins.cc hunk and add from your
other patch
> > +    case CFN_BUILT_IN_EXPECT:
> > +    case CFN_BUILT_IN_EXPECT_WITH_PROBABILITY:
> > +      m_valid = true;
> > +      m_op1 = gimple_call_arg (call, 0);
> > +      m_int = &op_cfn_pass_through_arg1;
> > +      break;

hunk to gimple_range_op_handler::maybe_builtin_call.
Does that already cause the problems?
I mean, if we e.g. see that a range of the argument is singleton,
then it is fine to optimize the __builtin_expect away.

	Jakub