https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109123
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Status|UNCONFIRMED |NEW
Last reconfirmed| |2023-03-14
--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
size_t old_size = vector_objective_size(v);
if (n > old_capacity) {
v->_begin = realloc(v->_begin, sizeof(double) * n);
v->_end = v->_begin + old_size;
GCC has sunk part of the old_size computation (not the loads but the
subtraction) to after the realloc but before the use of old_size.
The diagnostic code doesn't deal with this code motion very well (read:
it diagnoses it). We do have plenty of dups for this but the author of
the diagnostic says diagnosing is done on purpose here.
There's no way to fix this. It doesn't make sense to limit optimization
for this academic "use-after-free", nor would it be an easy task because
of the lack of explicit dependences in the IL.
Confirmed (the diagnostic is happening).
