[Bug c++/100307] New: Wrong placement-new warning

[Bug c++/100307] New: Wrong placement-new warning

[s.rueckerl at tum dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

            Bug ID: 100307
           Summary: Wrong placement-new warning
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: s.rueckerl at tum dot de
  Target Milestone: ---

A placement new warning is generated whenever the placement new is used with
in-line pointer arithmetic resulting in a negative offset to the original
pointers address. It does not fail with a positive offset or if the calculation
is done with a temporary variable before.

This did not happen with GCC-10 and can be observed with different GCC-11
versions (and the trunk version as provided on godbolt.org).

The following code replicates this behavior: (https://godbolt.org/z/nPGvEM44e)

```
#include <new>

static char myMemory [128];

int main()
{
    //make it fail
    char* memoryPtr = myMemory+32;
    int* myValue = new (memoryPtr - 1) int {42};

    //does not fail with positive offset
    char* secondMemoryPtr = myMemory+64;
    int* mySecondValue = new (secondMemoryPtr + 1) int {42};

    //does not fail with temporary
    char* thirdMemoryPtr = myMemory+96;
    char* placementNewAddress = thirdMemoryPtr - 1;
    int* myThirdValue = new (placementNewAddress) int {1};

    // use all variables for return value to avoid unused variable warnings
    return *myValue + *mySecondValue + *myThirdValue;
}
```

[Bug c++/100307] [11/12 Regression] Wrong placement-new warning

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |10.3.0
           Keywords|                            |diagnostic
   Target Milestone|---                         |11.2
            Summary|Wrong placement-new warning |[11/12 Regression] Wrong
                   |                            |placement-new warning

[Bug c++/100307] [11/12 Regression] Wrong placement-new warning

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-04-28
     Ever confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r11-3827-g83685efd5fd1623cfc4e4c435ce2773d95d458d1

[Bug middle-end/100307] [11/12 Regression] spurious -Wplacement-new with negative pointer offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] Wrong    |[11/12 Regression] spurious
                   |placement-new warning       |-Wplacement-new with
                   |                            |negative pointer offset
      Known to fail|                            |11.1.0, 12.0
          Component|c++                         |middle-end

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed with the simplified test case below.  Thanks for the report and the
small test case!

$ cat pr100307.C && gcc -S -Wall pr100307.C
void* operator new (__SIZE_TYPE__, void *p) { return p; }

static char a[2];

void* f ()
{
  char* p = a + 1;
  char *q = new (p - 1) char ();   // bogus -Wplacement-new
  return q;
}

void* g ()
{
  char* p = a + 1;
  char *q = new (p - 2) char ();   // valid -Wplacement-new
  return q;
}
pr100307.C: In function ‘void* f()’:
pr100307.C:8:20: warning: placement new constructing an object of type ‘char’
and size ‘1’ in a region of type ‘char*’ and size ‘0’ [-Wplacement-new=]
    8 |   char *q = new (p - 1) char ();   // bogus -Wplacement-new
      |                  ~~^~~
pr100307.C:7:9: note: at offset -1 from ‘p’ declared here
    7 |   char* p = a + 1;
      |         ^
pr100307.C: In function ‘void* g()’:
pr100307.C:15:20: warning: placement new constructing an object of type ‘char’
and size ‘1’ in a region of type ‘char*’ and size ‘0’ [-Wplacement-new=]
   15 |   char *q = new (p - 2) char ();   // valid -Wplacement-new
      |                  ~~^~~
pr100307.C:14:9: note: at offset -2 from ‘p’ declared here
   14 |   char* p = a + 1;
      |         ^

When the compute_objsize_r() function sees a pointer whose target it can't
determine it sets the size of the pointed to object to the maximum but it
doesn't clear the base0 flag to indicate that the offset need not be
zero-based.  This is done when the source is in SSA form but not before. 
Clearing the base0 flag avoids the false positive but also makes the valid
warning disappear.  Running -Wplacement-new in the front end is too early.  It
needs to run before placement new is inlined but after the program has been
converted to SSA.

The same bug affects -Wformat-overflow at -O0 (but not at higher optimization
levels):

$ cat pr100307.c && gcc -S -Wall pr100307.c
char a[4];

void f ()
{
  char *p = a + 1;
  __builtin_sprintf (p - 1, "%i", 123);
}
pr100307.c: In function ‘f’:
pr100307.c:6:30: warning: ‘%i’ directive writing 3 bytes into a region of size
0 [-Wformat-overflow=]
    6 |   __builtin_sprintf (p - 1, "%i", 123);
      |                              ^~
pr100307.c:6:3: note: ‘__builtin_sprintf’ output 4 bytes into a destination of
size 0
    6 |   __builtin_sprintf (p - 1, "%i", 123);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Bug middle-end/100307] [11/12 Regression] spurious -Wplacement-new with negative pointer offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
           Keywords|                            |patch

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-April/569126.html

[Bug middle-end/100307] [11/12 Regression] spurious -Wplacement-new with negative pointer offset

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:158cdc7bd97d7ccca5bc8adaaf80fe51eacdc038

commit r12-445-g158cdc7bd97d7ccca5bc8adaaf80fe51eacdc038
Author: Martin Sebor <msebor@redhat.com>
Date:   Tue May 4 13:46:37 2021 -0600

    PR middle-end/100307 - spurious -Wplacement-new with negative pointer
offset

    gcc/ChangeLog:

            PR middle-end/100307
            * builtins.c (compute_objsize_r): Clear base0 for pointers.

    gcc/testsuite/ChangeLog:

            PR middle-end/100307
            * g++.dg/warn/Wplacement-new-size-9.C: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-26.c: New test.

[Bug middle-end/100307] [11 Regression] spurious -Wplacement-new with negative pointer offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] spurious |[11 Regression] spurious
                   |-Wplacement-new with        |-Wplacement-new with
                   |negative pointer offset     |negative pointer offset
      Known to fail|12.0                        |

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed on trunk.

[Bug middle-end/100307] [11 Regression] spurious -Wplacement-new with negative pointer offset

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Martin Sebor
<msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:c2791cd4e62731ccde165c0e62b83f8e7ee38118

commit r11-8600-gc2791cd4e62731ccde165c0e62b83f8e7ee38118
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Jun 17 10:24:34 2021 -0600

    Backported from trunk:

    PR middle-end/100307 - spurious -Wplacement-new with negative pointer
offset

    gcc/ChangeLog:

            PR middle-end/100307
            * builtins.c (compute_objsize_r): Clear base0 for pointers.

    gcc/testsuite/ChangeLog:

            PR middle-end/100307
            * g++.dg/warn/Wplacement-new-size-9.C: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-26.c: New test.

[Bug middle-end/100307] [11 Regression] spurious -Wplacement-new with negative pointer offset

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100307

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
Backported to GCC 11.2.