[Bug middle-end/106578] spurious -Wuse-after-free=2 after conditional free()

[rguenth at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106578

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-08-10
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
The pattern matching of the if (result == NULL) doesn't work reliably without
optimization because it goes through memory:

  <bb 2> :
  tmp_5 = buf;
  _1 = realloc (tmp_5, 10);
  buf = _1;
  buf.0_2 = buf;
  if (buf.0_2 == 0B)
    goto <bb 3>; [INV]
  else
    goto <bb 4>; [INV]

  <bb 3> :
  free (tmp_5);

  <bb 4> :
  _9 = 0;

  <bb 5> :
<L2>:
  return _9;

using 'tmp' instead makes it properly fire.  Could be fixed with extra
compile-time cycles doing virtual VN like we do for early uninit
analysis (note this is the late waccess pass).