[Bug tree-optimization/101494] New: -Wmaybe-uninitialized false alarm with memrchr of size 0

[Bug tree-optimization/101494] New: -Wmaybe-uninitialized false alarm with memrchr of size 0

[eggert at cs dot ucla.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

            Bug ID: 101494
           Summary: -Wmaybe-uninitialized false alarm with memrchr of size
                    0
           Product: gcc
           Version: 11.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: eggert at cs dot ucla.edu
  Target Milestone: ---

I ran into this problem when compiling Gnulib tests on gcc (GCC) 11.1.1
20210531 (Red Hat 11.1.1-3) on x86-64. Here is a stripped down program
illustrating the bug:

void *malloc (unsigned long)
  __attribute__((__malloc__)) __attribute__((__alloc_size__ (1)));

void *memrchr (const void *, int, unsigned long)
  __attribute__((__access__ (__read_only__, 1, 3)));

int
main (void)
{
  char *input = malloc (1);
  if (!input)
    return 1;
  *input = 0;
  return !!memrchr (input, 'a', 0);
}


The following command:

gcc -Wmaybe-uninitialized -O2 -S w.i

outputs:
w.i: In function 'main':
w.i:14:12: warning: 'input' may be used uninitialized [-Wmaybe-uninitialized]
   14 |   return !!memrchr (input, 'a', 0);
      |            ^~~~~~~~~~~~~~~~~~~~~~~
w.i:4:7: note: in a call to 'memrchr' declared with attribute 'access
(read_onl\
y, 1, 3)' here
    4 | void *memrchr (const void *, int, unsigned long)
      |       ^~~~~~~

This warning is bogus, as 'input' is initialized; and even if "input = 0;" were
removed the call to memrchr would still be valid as the size argument is 0.

[Bug tree-optimization/101494] -Wmaybe-uninitialized false alarm with memrchr of size 0

[bruno at clisp dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Bruno Haible <bruno at clisp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bruno at clisp dot org

--- Comment #1 from Bruno Haible <bruno at clisp dot org> ---
It's a regression, since GCC 10.3.0 does not produce a warning here.

[Bug tree-optimization/101494] -Wmaybe-uninitialized false alarm with memrchr of size 0

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-07-21
             Status|UNCONFIRMED                 |NEW
                 CC|                            |msebor at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed.  I think this exposes two underlying bugs: one that the
initialization isn't detected and another that the second argument to attribute
access isn't respected.  A slightly enhanced test case:

$ cat b.c && gcc -O2 -S -Wall b.c
__attribute__ ((access (read_only, 1, 2))) void f (const void*, int);

void g (void)
{
  char *p = __builtin_alloca (1);
  *p = 0;
  f (p, 0);        // bogus -Wmaybe-uninitialized
}

void h (void)
{
  char *p = __builtin_malloc (1);
  f (p, 0);        // bogus -Wmaybe-uninitialized
}

b.c: In function ‘g’:
b.c:7:3: warning: ‘p’ is used uninitialized [-Wuninitialized]
    7 |   f (p, 0);        // bogus -Wmaybe-uninitialized
      |   ^~~~~~~~
b.c:1:49: note: in a call to ‘f’ declared with attribute ‘access (read_only, 1,
2)’ here
    1 | __attribute__ ((access (read_only, 1, 2))) void f (const void*, int);
      |                                                 ^
b.c: In function ‘h’:
b.c:13:3: warning: ‘p’ is used uninitialized [-Wuninitialized]
   13 |   f (p, 0);        // bogus -Wmaybe-uninitialized
      |   ^~~~~~~~
b.c:1:49: note: in a call to ‘f’ declared with attribute ‘access (read_only, 1,
2)’ here
    1 | __attribute__ ((access (read_only, 1, 2))) void f (const void*, int);
      |                                                 ^

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
            Summary|-Wmaybe-uninitialized false |[11 Regression]
                   |alarm with memrchr of size  |-Wmaybe-uninitialized false
                   |0                           |alarm with memrchr of size
                   |                            |0
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
      Known to fail|                            |11.1.0

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
It is a regression but only because GCC 10 doesn't check accesses to allocated
storage to see if it's initialized.

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
   Target Milestone|---                         |11.2

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-July/575862.html

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.2                        |11.3

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.2 is being released, retargeting bugs to GCC 11.3

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:1121e495b70105deeb82295f8210e30f2080bc37

commit r12-2583-g1121e495b70105deeb82295f8210e30f2080bc37
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Jul 28 16:25:40 2021 -0600

    Correct uninitialized object offset and size computation [PR101494].

    Resolves:
    PR middle-end/101494 - -Wuninitialized false alarm with memrchr of size 0

    gcc/ChangeLog:

            PR middle-end/101494
            * tree-ssa-uninit.c (maybe_warn_operand): Correct object offset
            and size computation.

    gcc/testsuite/ChangeLog:

            PR middle-end/101494
            * gcc.dg/uninit-pr101494.c: New test.

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in GCC 12 by r12-2583.  Will backport to GCC 11.

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.3                        |11.4

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11.3 is being released, retargeting bugs to GCC 11.4.

[Bug tree-optimization/101494] [11 Regression] -Wmaybe-uninitialized false alarm with memrchr of size 0

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101494

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.4                        |11.5

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 11.4 is being released, retargeting bugs to GCC 11.5.