https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106776
Bug ID: 106776 Summary: Unexpected use-after-free warning Product: gcc Version: 12.2.0 Status: UNCONFIRMED Keywords: diagnostic Severity: normal Priority: P3 Component: middle-end Assignee: unassigned at gcc dot gnu.org Reporter: drfiemost at email dot it Target Milestone: --- Created attachment 53520 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53520&action=edit test program When compiling the attached program with the -O2 and -Wuse-after-free flags I get the following warning, which seems bogus as the pointer is not actually dereferenced in case it is deleted: $ g++ -O2 -Wuse-after-free test_ref.cpp In member function 'unsigned int counter::decrease()', inlined from 'matrix_t::~matrix_t()' at test_ref.cpp:32:38, inlined from 'matrix_t* cache(int, const char*)' at test_ref.cpp:53:1: test_ref.cpp:14:40: warning: pointer used after 'void operator delete(void*, std::size_t)' [-Wuse-after-free] 14 | unsigned int decrease() { return --c; } | ^ In destructor 'matrix_t::~matrix_t()', inlined from 'std::pair<const int, matrix_t>::~pair()' at C:/msys64/mingw64/include/c++/12.2.0/bits/stl_pair.h:185:12, inlined from 'matrix_t* cache(int, const char*)' at test_ref.cpp:52:40: test_ref.cpp:32:56: note: call to 'void operator delete(void*, std::size_t)' here 32 | ~matrix_t() { if (count->decrease() == 0) { delete count; delete data; } } | ^~~~~ The IL dump confirms that the pointer _1 is either accessed <bb 3> or deleted <bb 5>: void matrix<short int>::~matrix (struct matrix * const this) { struct counter * _1; short int * _2; unsigned int _10; unsigned int _11; <bb 2> [local count: 1073741824]: _1 = this_5(D)->count; _10 = _1->c; _11 = _10 + 4294967295; if (_11 == 0) goto <bb 5>; [33.00%] else goto <bb 3>; [67.00%] <bb 3> [local count: 719407024]: _1->c = _11; <bb 4> [local count: 884279007]: goto <bb 7>; [100.00%] <bb 5> [local count: 354334800]: operator delete (_1, 4); _2 = this_5(D)->data; if (_2 != 0B) goto <bb 6>; [53.47%] else goto <bb 8>; [46.53%] <bb 8> [local count: 164871983]: goto <bb 4>; [100.00%] <bb 6> [local count: 189462817]: operator delete [] (_2); [tail call] <bb 7> [local count: 1073741824]: return; } The warning doesn't appear when using the -O1 flag or if the variable is decalared volatile. If I'm not missing anything obvious the warning should not be issued at all.