https://gcc.gnu.org/g:27a05f8d11798889ecfb610db9bde781c3d218f7

commit r15-7158-g27a05f8d11798889ecfb610db9bde781c3d218f7
Author: Jakub Jelinek <ja...@redhat.com>
Date:   Thu Jan 23 11:46:18 2025 +0100

    tree-assume: Fix UB in assume_query [PR118605]
    
    The assume_query constructor does
    assume_query::assume_query (function *f, bitmap p) : m_parm_list (p),
                                                         m_func (f)
    where m_parm_list is bitmap &.  This is compile time UB, because
    as soon as the constructor returns, m_parm_list reference is still
    bound to the parameter of the constructor which is no longer in scope.
    
    Now, one possible fix would be change the ctor argument to be bitmap &,
    but that doesn't really work because in the only user of that class
    we have
          auto_bitmap decls;
    ...
          assume_query query (fun, decls);
    and auto_bitmap just has
      operator bitmap () { return &m_bits; }
    Could be perhaps const bitmap &, but why?  bitmap is a pointer:
    typedef class bitmap_head *bitmap;
    and the EXECUTE_IF_SET_IN_BITMAP macros don't really change that point,
    they just inspect what is inside of that bitmap_head the pointer points
    to.
    
    So, the simplest I think is avoid references (which cause even worse
    code as it has to be dereferenced twice rather than once).
    
    2025-01-23  Jakub Jelinek  <ja...@redhat.com>
    
            PR tree-optimization/118605
            * tree-assume.cc (assume_query::m_parm_list): Change type
            from bitmap & to bitmap.

Diff:
---
 gcc/tree-assume.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gcc/tree-assume.cc b/gcc/tree-assume.cc
index de8acc99949c..c9288608b1e5 100644
--- a/gcc/tree-assume.cc
+++ b/gcc/tree-assume.cc
@@ -97,7 +97,7 @@ protected:
 
   ssa_lazy_cache m_path;   // Values found on path
   ssa_lazy_cache m_parms;  // Cumulative parameter value calculated
-  bitmap &m_parm_list;    // Parameter ssa-names list.
+  bitmap m_parm_list;     // Parameter ssa-names list.
   function *m_func;
 };

Reply via email to