https://gcc.gnu.org/bugzilla/show_bug.cgi?id=121685
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jwakely at redhat dot com
--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
So even though m_mcowner cannot possibly be bound to nullptr it might still
bind to a released object? Likewise may it bind to an object of insufficient
size? So, consider
int *p = new int;
int &q = *p;
delete p;
fun (q, 0);
with
int fun(int &q, int released) { if (!released) return q; return 0; }
or
char c;
int &q = *(char *)&c;
alternatively
int *p = (int *)malloc (1);
int &q = *p;
or
char c[1];
int &q = new int (&c);