https://gcc.gnu.org/bugzilla/show_bug.cgi?id=121685

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jwakely at redhat dot com

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
So even though m_mcowner cannot possibly be bound to nullptr it might still
bind to a released object?  Likewise may it bind to an object of insufficient
size?  So, consider

int *p = new int;
int &q = *p;
delete p;
fun (q, 0);

with

int fun(int &q, int released) { if (!released) return q; return 0; }

or

char c;
int &q = *(char *)&c;

alternatively

int *p = (int *)malloc (1);
int &q = *p;

or

char c[1];
int &q = new int (&c);

Reply via email to