https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118300
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> --- FWIW it seems to be just "-fsanitize=undefined" that's needed, not "address": https://gcc.godbolt.org/z/bbcoa4oWK Adding -fdump-ipa-analyzer=stderr shows: VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV int main () { int * * * new; int D.3797; void * _1; int * * _2; void * _3; int * * _4; int * _5; int * * _6; int _17; <bb 2> : new_9 = malloc (8); _1 = malloc (8); .UBSAN_NULL (new_9, 1B, 8); *new_9 = _1; .UBSAN_NULL (new_9, 0B, 8); _2 = *new_9; _3 = malloc (4); .UBSAN_NULL (_2, 1B, 8); *_2 = _3; .UBSAN_NULL (new_9, 0B, 8); _4 = *new_9; .UBSAN_NULL (_4, 0B, 8); _5 = *_4; free (_5); .UBSAN_NULL (new_9, 0B, 8); _6 = *new_9; free (_6); free (new_9); _17 = 0; <bb 3> : <L0>: return _17; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ so perhaps -fanalyzer is getting confused by all those .UBSAN_NULL; will take a look.
