[Bug middle-end/104069] -Werror=use-after-free false positive on elfutils-0.186

msebor at gcc dot gnu.org gcc-bugzilla@gcc.gnu.org
Tue Jan 18 22:06:54 GMT 2022


https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104069

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |middle-end

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
The debug_ranger() output is below for reference:

=========== BB 2 ============
Imports: ret_13  
Exports: ret_13  
size_9(D)       int VARYING
    <bb 2> :
    _1 = (long unsigned int) size_9(D);
    ret_13 = __builtin_realloc (ptr_11(D), _1);
    if (ret_13 == 0B)
      goto <bb 3>; [INV]
    else
      goto <bb 5>; [INV]

_1 : long unsigned int [0, 2147483647][18446744071562067968, +INF]
2->3  (T) ret_13 :      void * [0B, 0B]
2->5  (F) ret_13 :      void * [1B, +INF]

=========== BB 3 ============
Imports: size_9(D)  
Exports: size_9(D)  
size_9(D)       int VARYING
ret_13  void * [0B, 0B]
    <bb 3> :
    if (size_9(D) == 0)
      goto <bb 4>; [INV]
    else
      goto <bb 5>; [INV]

3->4  (T) size_9(D) :   int [0, 0]
3->5  (F) size_9(D) :   int [-INF, -1][1, +INF]

=========== BB 4 ============
    <bb 4> :
    ret_15 = __builtin_realloc (ptr_11(D), 1);


=========== BB 5 ============
Imports: ret_3  
Exports: ret_3  
    <bb 5> :
    # ret_3 = PHI <ret_13(2), ret_13(3), ret_15(4)>
    if (ret_3 == 0B)
      goto <bb 6>; [INV]
    else
      goto <bb 11>; [INV]

5->6  (T) ret_3 :       void * [0B, 0B]
5->11  (F) ret_3 :      void * [1B, +INF]

=========== BB 6 ============
Imports: ret_17  
Exports: ret_17  
size_9(D)       int VARYING
    <bb 6> :
    _2 = (long unsigned int) size_9(D);
    ret_17 = __builtin_realloc (ptr_11(D), _2);
    if (ret_17 == 0B)
      goto <bb 7>; [INV]
    else
      goto <bb 9>; [INV]

_2 : long unsigned int [0, 2147483647][18446744071562067968, +INF]
6->7  (T) ret_17 :      void * [0B, 0B]
6->9  (F) ret_17 :      void * [1B, +INF]

=========== BB 7 ============
Imports: size_9(D)  
Exports: size_9(D)  
size_9(D)       int VARYING
ret_17  void * [0B, 0B]
    <bb 7> :
    if (size_9(D) == 0)
      goto <bb 8>; [INV]
    else
      goto <bb 9>; [INV]

7->8  (T) size_9(D) :   int [0, 0]
7->9  (F) size_9(D) :   int [-INF, -1][1, +INF]

=========== BB 8 ============
    <bb 8> :
    ret_19 = __builtin_realloc (ptr_11(D), 1);


=========== BB 9 ============
Imports: ret_4  
Exports: ret_4  
    <bb 9> :
    # ret_4 = PHI <ret_17(6), ret_17(7), ret_19(8)>
    if (ret_4 == 0B)
      goto <bb 10>; [INV]
    else
      goto <bb 11>; [INV]

9->10  (T) ret_4 :      void * [0B, 0B]
9->11  (F) ret_4 :      void * [1B, +INF]

=========== BB 10 ============
    <bb 10> :
    __builtin_abort ();


=========== BB 11 ============
Equivalence set : []
Equivalence set : [ret_5, _21]
    <bb 11> :
    # ret_5 = PHI <ret_3(5), ret_4(9)>
    _21 = ret_5;

ret_5 : void * [1B, +INF]
_21 : void * [1B, +INF]

=========== BB 12 ============
    <bb 12> :
  <L15>:
    return _21;

Non-varying global ranges:
=========================:
_1  : long unsigned int [0, 2147483647][18446744071562067968, +INF]
_2  : long unsigned int [0, 2147483647][18446744071562067968, +INF]
ret_5  : void * [1B, +INF]
_21  : void * [1B, +INF]


More information about the Gcc-bugs mailing list