10 files changed, 234 insertions, 0 deletions
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-1.C b/gcc/testsuite/g++.dg/asan/use-after-scope-1.C
new file mode 100644
index 00000000000..fd875ad7a13
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-1.C
@@ -0,0 +1,21 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include <functional>
+
+int main() {
+  std::function<int()> function;
+  {
+    int v = 0;
+    function = [&v]()
+    {
+      return v;
+    };
+  }
+  return function();
+}
+
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "READ of size 4 at.*" }
+// { dg-output ".*'v' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-2.C b/gcc/testsuite/g++.dg/asan/use-after-scope-2.C
new file mode 100644
index 00000000000..92a4bd13029
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-2.C
@@ -0,0 +1,40 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include <stdio.h>
+
+struct Test
+{
+  Test ()
+    {
+      my_value = 0;
+    }
+
+  ~Test ()
+    {
+      fprintf (stderr, "Value: %d\n", *my_value);
+    }
+
+  void init (int *v)
+    {
+      my_value = v;
+    }
+
+  int *my_value;
+};
+
+int main(int argc, char **argv)
+{
+  Test t;
+
+  {
+    int x = argc;
+    t.init(&x);
+  }
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "READ of size 4 at.*" }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-3.C b/gcc/testsuite/g++.dg/asan/use-after-scope-3.C
new file mode 100644
index 00000000000..172f374704b
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-3.C
@@ -0,0 +1,22 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+struct IntHolder {
+  int val;
+};
+
+const IntHolder *saved;
+
+void save(const IntHolder &holder) {
+  saved = &holder;
+}
+
+int main(int argc, char *argv[]) {
+  save({10});
+  int x = saved->val;  // BOOM
+  return x;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "READ of size 4 at.*" }
+// { dg-output ".*'<unknown>' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-4.C b/gcc/testsuite/g++.dg/asan/use-after-scope-4.C
new file mode 100644
index 00000000000..c3b6932609b
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-4.C
@@ -0,0 +1,36 @@
+/* Caused ICE in in make_decl_rtl, at varasm.c:1311.  */
+/* { dg-do compile } */
+
+class A
+{
+public:
+  A () : value (123) {}
+  int value;
+};
+
+template <typename StoredFunction> class B
+{
+public:
+  template <typename F> B (F p1) : mFunction (p1) { mFunction (); }
+  StoredFunction mFunction;
+};
+template <typename Function>
+void
+NS_NewRunnableFunction (Function p1)
+{
+  (B<Function> (p1));
+}
+class C
+{
+  void DispatchConnectionCloseEvent (A);
+  void AsyncCloseConnectionWithErrorMsg (const A &);
+};
+void
+C::AsyncCloseConnectionWithErrorMsg (const A &)
+{
+  {
+    A message;
+    NS_NewRunnableFunction (
+      [this, message] { DispatchConnectionCloseEvent (message); });
+  }
+}
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types-1.C b/gcc/testsuite/g++.dg/asan/use-after-scope-types-1.C
new file mode 100644
index 00000000000..bedcfa4edb9
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types-1.C
@@ -0,0 +1,17 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include "use-after-scope-types.h"
+
+int main()
+{
+  using Tests = void (*)();
+  Tests t = &test<bool>;
+  t();
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "WRITE of size " }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types-2.C b/gcc/testsuite/g++.dg/asan/use-after-scope-types-2.C
new file mode 100644
index 00000000000..75a01d9eb36
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types-2.C
@@ -0,0 +1,17 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include "use-after-scope-types.h"
+
+int main()
+{
+  using Tests = void (*)();
+  Tests t = &test<float>;
+  t();
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "WRITE of size " }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types-3.C b/gcc/testsuite/g++.dg/asan/use-after-scope-types-3.C
new file mode 100644
index 00000000000..3350c69c6ae
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types-3.C
@@ -0,0 +1,17 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include "use-after-scope-types.h"
+
+int main()
+{
+  using Tests = void (*)();
+  Tests t = &test<void *>;
+  t();
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "WRITE of size " }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types-4.C b/gcc/testsuite/g++.dg/asan/use-after-scope-types-4.C
new file mode 100644
index 00000000000..44f4d3b09f5
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types-4.C
@@ -0,0 +1,17 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include "use-after-scope-types.h"
+
+int main()
+{
+  using Tests = void (*)();
+  Tests t = &test<std::vector<std::string>>;
+  t();
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "READ of size " }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types-5.C b/gcc/testsuite/g++.dg/asan/use-after-scope-types-5.C
new file mode 100644
index 00000000000..42abc2a0ccd
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types-5.C
@@ -0,0 +1,17 @@
+// { dg-do run }
+// { dg-shouldfail "asan" }
+
+#include "use-after-scope-types.h"
+
+int main()
+{
+  using Tests = void (*)();
+  Tests t = &test<char[1000]>;
+  t();
+
+  return 0;
+}
+
+// { dg-output "ERROR: AddressSanitizer: stack-use-after-scope on address.*(\n|\r\n|\r)" }
+// { dg-output "WRITE of size " }
+// { dg-output ".*'x' <== Memory access at offset \[0-9\]* is inside this variable.*" }
diff --git a/gcc/testsuite/g++.dg/asan/use-after-scope-types.h b/gcc/testsuite/g++.dg/asan/use-after-scope-types.h
new file mode 100644
index 00000000000..b96b02ba88c
--- /dev/null
+++ b/gcc/testsuite/g++.dg/asan/use-after-scope-types.h
@@ -0,0 +1,30 @@
+#include <stdlib.h>
+#include <string>
+#include <vector>
+
+template <class T> struct Ptr {
+  void Store(T *ptr) { t = ptr; }
+
+  void Access() { *t = {}; }
+
+  T *t;
+};
+
+template <class T, size_t N> struct Ptr<T[N]> {
+  using Type = T[N];
+  void Store(Type *ptr) { t = *ptr; }
+
+  void Access() { *t = {}; }
+
+  T *t;
+};
+
+template <class T> __attribute__((noinline)) void test() {
+  Ptr<T> ptr;
+  {
+    T x;
+    ptr.Store(&x);
+  }
+
+  ptr.Access();
+}