From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id D51CD3858C53; Wed, 27 Apr 2022 07:15:12 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D51CD3858C53
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/105346] [11/12 Regression] -Wno-free-nonheap-object
 false positive (on Bison-generated grammar code)
Date: Wed, 27 Apr 2022 07:15:11 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 11.2.0
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 11.4
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-105346-4-iXkXqhEsGp@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-105346-4@http.gcc.gnu.org/bugzilla/>
References: <bug-105346-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Apr 2022 07:15:12 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105346

--- Comment #13 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Andrew Macleod from comment #11)
> (In reply to Richard Biener from comment #6)
>=20
> >=20
> >   <bb 2> :
> >   bufp_2 =3D &buf;
> >   if (&buf !=3D bufp_2)
> >     goto <bb 3>; [INV]
> >   else
> >     goto <bb 4>; [INV]
> >=20
> >   <bb 3> :
> >   __builtin_free (bufp_2);
> >=20
> > and for the stmt __builtin_free (bufp_2) I'd like to ask if we know
> > that bufp_2 is !=3D &buf (I'd expect a 'true' answer).  I think the
> > relation oracle should be able to answer this but I can't find the
> > appropriate API to use for this?
>=20
> - The relation oracle currently only works with ssa-names.
> - Ranger also doesn't currently track that sort of symbolic equivalence w=
ith
> irange.
> - the VRP passes have a pointer tracking mechanism as part of the dom wal=
k,
> and the call to rvrp_folder::value_of_expr (bufp_2) would give us &buf.  I
> also think we also would fold the stmt in VRP.  This could in theory be
> extended to any pass doing a dom walk.  however:
> - I believe the upcoming prange extension for pointer ranges in stage 1 w=
ill
> make this happen naturally with rangers query system. range_of_stmt ( if
> <..>) would then produce bool [0, 0].  I would also expect that prange wi=
ll
> have an easy way to ask what its base/equivalence(s) are.

OK, I was hoping I can so sth like

 range_simplify_expr (NE_EXPR, bufp_2, &buf, at_free_stmt);

and then by means of the dominating if condition get a 'true'.  Note the
diagnostic pass is not within a DOM walk so all I can use is an ad-hoc
query.  I'm not looking to simplify the conditional itself as that won't
help me with the current pass structure.=