[Bug c/111240] New: Incorrect warning from -Wmaybe-uninitialized

[Bug c/111240] New: Incorrect warning from -Wmaybe-uninitialized

[bruce at momjian dot us]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

            Bug ID: 111240
           Summary: Incorrect warning from -Wmaybe-uninitialized
           Product: gcc
           Version: 12.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bruce at momjian dot us
  Target Milestone: ---

Compiling this file from the PostgreSQL master source tree generates a warning
when I don't think it should.  To reproduce, only -O1 produces the bug, not
-O0/-O2/-O3:

    gcc -Wmaybe-uninitialized -O1 -c clauses.i

Yields:

clauses.c: In function ‘recheck_cast_function_args’:
clauses.c:4293:19: warning: ‘actual_arg_types’ may be used uninitialized
[-Wmaybe-uninitialized]
 4293 |         rettype = enforce_generic_type_consistency(actual_arg_types,
In file included from clauses.c:45:
../../../../src/include/parser/parse_coerce.h:82:17: note: by argument 1 of
type ‘const Oid *’ {aka ‘const unsigned int *’} to
‘enforce_generic_type_consistency’ declared here
   82 | extern Oid      enforce_generic_type_consistency(const Oid
*actual_arg_types,
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
clauses.c:4279:24: note: ‘actual_arg_types’ declared here
 4279 |         Oid                     actual_arg_types[FUNC_MAX_ARGS];
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Here is the C code.  nargs prevents uninitialized values from being used when
calling enforce_generic_type_consistency().

-------------------------------------

static void
recheck_cast_function_args(List *args, Oid result_type,
                           Oid *proargtypes, int pronargs,
                           HeapTuple func_tuple)
{
    Form_pg_proc funcform = (Form_pg_proc) GETSTRUCT(func_tuple);
    int         nargs;
    Oid         actual_arg_types[FUNC_MAX_ARGS];
    Oid         declared_arg_types[FUNC_MAX_ARGS];
    Oid         rettype;
    ListCell   *lc;

    if (list_length(args) > FUNC_MAX_ARGS)
        elog(ERROR, "too many function arguments");
    nargs = 0;
    foreach(lc, args)
    {
        actual_arg_types[nargs++] = exprType((Node *) lfirst(lc));
    }
    Assert(nargs == pronargs);
    memcpy(declared_arg_types, proargtypes, pronargs * sizeof(Oid));
    rettype = enforce_generic_type_consistency(actual_arg_types,
                                               declared_arg_types,
                                               nargs,
                                               funcform->prorettype,
                                               false);

[Bug tree-optimization/111240] Incorrect warning from -Wmaybe-uninitialized

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 111239 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/111240] Incorrect warning from -Wmaybe-uninitialized

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2023-08-30
     Ever confirmed|0                           |1

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Can you provide the preprocessed source?

[Bug tree-optimization/111240] Incorrect warning from -Wmaybe-uninitialized

[bruce at momjian dot us]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

--- Comment #3 from Bruce Momjian <bruce at momjian dot us> ---
Created attachment 55817
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55817&action=edit
preprocessed C file

[Bug tree-optimization/111240] Incorrect warning from -Wmaybe-uninitialized

[bruce at momjian dot us]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

--- Comment #4 from Bruce Momjian <bruce at momjian dot us> ---
(In reply to Andrew Pinski from comment #2)
> Can you provide the preprocessed source?

Done.  Sorry my previous file was 1.1MB and I didn't realize the attachment
failed.  I have gzipped the file.

[Bug tree-optimization/111240] Incorrect warning from -Wmaybe-uninitialized

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|1                           |0
             Status|WAITING                     |UNCONFIRMED

[Bug tree-optimization/111240] [12/13/14 Regression] Incorrect warning from -Wmaybe-uninitialized

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |11.4.0
             Status|UNCONFIRMED                 |NEW
            Summary|Incorrect warning from      |[12/13/14 Regression]
                   |-Wmaybe-uninitialized       |Incorrect warning from
                   |                            |-Wmaybe-uninitialized
   Last reconfirmed|2023-08-30 00:00:00         |2023-08-31
   Target Milestone|---                         |12.4
      Known to fail|                            |12.1.0, 12.2.0, 13.2.0,
                   |                            |14.0
           Keywords|                            |needs-reduction
     Ever confirmed|0                           |1

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

rettype_58 = enforce_generic_type_consistency (&actual_arg_types,
&declared_arg_types, 0, _56, 0);

and we reach this on the args == 0 path where indeed actual_arg_types
is uninitialized and our heuristic says that a const qualified pointer
is an input and thus might be read.  So you get a maybe-uninitialized
diagnostic at the call.

GCC doesn't know that the 'nargs' argument relates to the array and
that at most 'nargs' (zero here) arguments are inspected.

So I think it works as designed, we have some duplicate bugreports
complaining about this "heuristic".

We are exposing this to ourselves by optimizing the args == 0 case
(skipping the initialization loop and constant propagating the
nargs argument).  Aka jump-threading.

[Bug tree-optimization/111240] [12/13/14 Regression] Incorrect warning from -Wmaybe-uninitialized

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111240

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
           Priority|P3                          |P2