https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113531
Bug ID: 113531 Summary: AddressSanitizer: stack-use-after-scope when iterating over initializer list Product: gcc Version: 14.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: sanitizer Assignee: unassigned at gcc dot gnu.org Reporter: gcc at pauldreik dot se CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org, jakub at gcc dot gnu.org, kcc at gcc dot gnu.org Target Milestone: --- Sorry for not being able to condense this better, it is reduced from several thousand lines in multiple files into this. The false alarm easily goes away when something changes, I guess it is the optimizer removing things. Therefore, the program is run in catch and not as a simple main() function. I have git bisected this to happen at commit 4d935f52b0d5c00fcc154461b87415ebd8791a94 "c++: make initializer_list array static again [PR110070]" which seems related. Address sanitizer gives me a warning about stack-use-after-scope on the for loop, which I believe is legal C++. Here is a godbolt link: https://godbolt.org/z/vrWEWzd9a , but I include the program and error message below as well: // compile with -std=c++20 -fsanitize=address -lCatch2Main #include <cstdio> #include <catch2/catch_test_macros.hpp> struct Inner { enum class Indices { A, B, C }; Inner() { // must be three indices, if only two the problem goes away for (auto i : { Indices::A, Indices::B, Indices::C }) // <------------------------------ ERROR: AddressSanitizer: stack-use-after-scope { } std::puts("this line must be here"); } }; struct Outer { int return_42() const { // not 42, to trigger the test (so the code is not optimized away, I assume) return 0; } Inner inner; }; TEST_CASE("demonstrate AddressSanitizer: stack-use-after-scope") { Outer c; WHEN("this WHEN must be here, otherwise the error does not trigger") { REQUIRE(c.return_42() == 42); } } And the error message: Program returned: 1 ================================================================= ==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x0000004c3380 at pc 0x00000040b924 bp 0x7ffd52eff450 sp 0x7ffd52eff448 READ of size 4 at 0x0000004c3380 thread T0 #0 0x40b923 in Inner::Inner() /app/example.cpp:17 #1 0x40b9d5 in Outer::Outer() /app/example.cpp:24 #2 0x40a3c7 in ____C_A_T_C_H____T_E_S_T____0 /app/example.cpp:37 #3 0x45a68d in Catch::TestInvokerAsFunction::invoke() const (/app/output.s+0x45a68d) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #4 0x440c86 in Catch::TestCaseHandle::invoke() const (/app/output.s+0x440c86) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #5 0x440062 in Catch::RunContext::invokeActiveTestCase() (/app/output.s+0x440062) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #6 0x43fdf1 in Catch::RunContext::runCurrentTest(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/app/output.s+0x43fdf1) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #7 0x43e99b in Catch::RunContext::runTest(Catch::TestCaseHandle const&) (/app/output.s+0x43e99b) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #8 0x447bac in Catch::(anonymous namespace)::TestGroup::execute() (/app/output.s+0x447bac) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #9 0x448b6c in Catch::Session::runInternal() (/app/output.s+0x448b6c) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #10 0x4488a0 in Catch::Session::run() (/app/output.s+0x4488a0) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #11 0x40a26a in int Catch::Session::run<char>(int, char const* const*) (/app/output.s+0x40a26a) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #12 0x40a18b in main (/app/output.s+0x40a18b) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) #13 0x7f0adaa29d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9) #14 0x7f0adaa29e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9) #15 0x40a084 in _start (/app/output.s+0x40a084) (BuildId: 433ece10f75938fe33f68968e4c7ab9a1f766f29) 0x0000004c3380 is located 0 bytes inside of global variable 'C.1' defined in '/app/example.cpp:17:60' (0x4c3380) of size 12 SUMMARY: AddressSanitizer: stack-use-after-scope /app/example.cpp:17 in Inner::Inner() Shadow bytes around the buggy address: 0x0000004c3100: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 0x0000004c3180: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 0x0000004c3200: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 0x0000004c3280: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 0x0000004c3300: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 =>0x0000004c3380:[f8]f8 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0000004c3400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000004c3480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000004c3500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000004c3580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000004c3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1==ABORTING