Add -Wuse-after-free [PR80532].

gcc/c-family/ChangeLog

	PR tree-optimization/80532
	* c.opt (-Wuse-after-free): New options.

gcc/ChangeLog:

	PR tree-optimization/80532
	* common.opt (-Wuse-after-free): New options.
	* diagnostic-spec.c (nowarn_spec_t::nowarn_spec_t): Handle
	OPT_Wreturn_local_addr and OPT_Wuse_after_free_.
	* diagnostic-spec.h (NW_DANGLING): New enumerator.
	* doc/invoke.texi (-Wuse-after-free): Document new option.
	* gimple-ssa-warn-access.cc (pass_waccess::check_call): Rename...
	(pass_waccess::check_call_access): ...to this.
	(pass_waccess::check): Rename...
	(pass_waccess::check_block): ...to this.
	(pass_waccess::check_pointer_uses): New function.
	(pass_waccess::gimple_call_return_arg): New function.
	(pass_waccess::warn_invalid_pointer): New function.
	(pass_waccess::check_builtin): Handle free and realloc.
	(gimple_use_after_inval_p): New function.
	(get_realloc_lhs): New function.
	(maybe_warn_mismatched_realloc): New function.
	(pointers_related_p): New function.
	(pass_waccess::check_call): Call check_pointer_uses.
	(pass_waccess::execute): Compute and free dominance info.

libcpp/ChangeLog:

	* files.c (_cpp_find_file): Substitute a valid pointer for
	an invalid one to avoid -Wuse-after-free.

libiberty/ChangeLog:

	* regex.c: Suppress -Wuse-after-free.

gcc/testsuite/ChangeLog:

	PR tree-optimization/80532
	* gcc.dg/Wmismatched-dealloc-2.c: Avoid -Wuse-after-free.
	* gcc.dg/Wmismatched-dealloc-3.c: Same.
	* gcc.dg/analyzer/file-1.c: Prune expected warning.
	* gcc.dg/analyzer/file-2.c: Same.
	* gcc.dg/attr-alloc_size-6.c: Disable -Wuse-after-free.
	* gcc.dg/attr-alloc_size-7.c: Same.
	* c-c++-common/Wuse-after-free-2.c: New test.
	* c-c++-common/Wuse-after-free-3.c: New test.
	* c-c++-common/Wuse-after-free-4.c: New test.
	* c-c++-common/Wuse-after-free-5.c: New test.
	* c-c++-common/Wuse-after-free-6.c: New test.
	* c-c++-common/Wuse-after-free-7.c: New test.
	* c-c++-common/Wuse-after-free.c: New test.
	* g++.dg/warn/Wmismatched-dealloc-3.C: New test.
	* g++.dg/warn/Wuse-after-free.C: New test.

1 files changed, 103 insertions, 0 deletions

diff --git a/gcc/testsuite/c-c++-common/Wuse-after-free-5.c b/gcc/testsuite/c-c++-common/Wuse-after-free-5.c
new file mode 100644
index 0000000..c6ff1f3
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/Wuse-after-free-5.c
@@ -0,0 +1,103 @@
+/* Verify -Wuse-after-free=2 triggers for conditional as well as
+   unconditional uses but not for equality expressions.
+   { dg-do compile }
+   { dg-options "-O0 -Wall -Wuse-after-free=2" } */
+
+
+#if __cplusplus
+#  define EXTERN_C extern "C"
+#else
+#  define EXTERN_C extern
+#endif
+
+EXTERN_C void free (void*);
+
+void sink (void*);
+
+
+void warn_double_free (void *p)
+{
+  free (p);
+  free (p);         // { dg-warning "pointer 'p' used" }
+}
+
+void warn_cond_double_free (void *p, int c)
+{
+  free (p);
+  if (c)
+    free (p);       // { dg-warning "pointer 'p' may be used" }
+}
+
+void warn_call_after_free (void *p)
+{
+  free (p);
+  sink (p);         // { dg-warning "pointer 'p' used" }
+}
+
+void warn_cond_call_after_free (void *p, int c)
+{
+  free (p);
+  if (c)
+    sink (p);       // { dg-warning "pointer 'p' may be used" }
+}
+
+void* warn_return_after_free (void *p)
+{
+  free (p);
+  return p;         // { dg-warning "pointer 'p' used" }
+}
+
+void* warn_cond_return_after_free (void *p, int c)
+{
+  free (p);
+  if (c)
+    return p;       // { dg-warning "pointer 'p' may be used" }
+  return 0;
+}
+
+void warn_relational_after_free (char *p, char *q[])
+{
+  free (p);
+
+  int a[] =
+    {
+     p < q[0],      // { dg-warning "pointer 'p' used" }
+     p <= q[1],     // { dg-warning "pointer 'p' used" }
+     p > q[2],      // { dg-warning "pointer 'p' used" }
+     p >= q[3],     // { dg-warning "pointer 'p' used" }
+     p == q[4],
+     p != q[5]
+    };
+
+  sink (a);
+}
+
+void warn_cond_relational_after_free (char *p, char *q[], int c)
+{
+  free (p);
+
+  int a[] =
+    {
+     c ? p < q[0] : q[0][0],  // { dg-warning "pointer 'p' may be used" }
+     c ? p <= q[1] : q[1][1], // { dg-warning "pointer 'p' may be used" }
+     c ? p > q[2] : q[2][2],  // { dg-warning "pointer 'p' may be used" }
+     c ? p >= q[3] : q[3][3], // { dg-warning "pointer 'p' may be used" }
+     c ? p == q[4] : q[4][4],
+     c ? p != q[5] : q[5][5],
+    };
+
+  sink (a);
+}
+
+
+// Verify warning for the example in the manual.
+
+struct A { int refcount; void *data; };
+
+void release (struct A *p)
+{
+  int refcount = --p->refcount;
+  free (p);
+  if (refcount == 0)
+    free (p->data); // { dg-warning "pointer 'p' may be used" }
+}