https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106776
Martin Sebor <msebor at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |msebor at gcc dot gnu.org
--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Reproduced with the following reduced test case:
$ cat pr106776.C && g++ -O2 -S -Wall pr106776.C
#include <map>
struct matrix_t
{
int* count;
matrix_t() :
count(new int(1)) {}
matrix_t(const matrix_t& p) :
count(p.count) { ++*count; }
~matrix_t() { if (--*count == 0) { delete count; } }
};
typedef std::map<int, matrix_t> cache_t;
cache_t CACHE;
matrix_t* cache(cache_t::iterator lb)
{
matrix_t wftable;
return &CACHE.insert(lb, cache_t::value_type(1, wftable))->second;
}
In destructor ‘matrix_t::~matrix_t()’,
inlined from ‘matrix_t* cache(std::map<int, matrix_t>::iterator)’ at
pr106776.C:25:1:
pr106776.C:13:23: warning: pointer used after ‘void operator delete(void*,
std::size_t)’ [-Wuse-after-free]
13 | ~matrix_t() { if (--*count == 0) { delete count; } }
| ^~~~~~
In destructor ‘matrix_t::~matrix_t()’,
inlined from ‘std::pair<const int, matrix_t>::~pair()’ at
/build/gcc-master/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/stl_pair.h:187:12,
inlined from ‘matrix_t* cache(std::map<int, matrix_t>::iterator)’ at
pr106776.C:24:37:
pr106776.C:13:45: note: call to ‘void operator delete(void*, std::size_t)’ here
13 | ~matrix_t() { if (--*count == 0) { delete count; } }
| ^~~~~
The IL in shows the reason for the warning in bb 8 in struct matrix_t * cache
(struct iterator lb), seen in the output of -fdump-tree-waccess3:
...
<bb 8> [local count: 335388518]:
operator delete (_3, 4); <<< _3 deleted
pretmp_50 = MEM[(int *)_3]; <<< _3 dereferenced
