[Bug middle-end/111253] New: Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[Bug middle-end/111253] New: Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

            Bug ID: 111253
           Summary: Dodgy pointer name (*_42 = PHI ...) in
                    -Wfree-nonheap-object diagnostic
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
            Blocks: 99098
  Target Milestone: ---

Created attachment 55823
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55823&action=edit
object_cache.i

With gcc-13 (Gentoo Hardened 13.2.1_p20230826 p7) 13.2.1 20230826:
```
/bin/sh ../libtool  --tag=CC   --mode=compile x86_64-pc-linux-gnu-gcc
-DHAVE_CONFIG_H -I. -I..    -fvisibility=hidden -pthread -std=gnu99 -O2 -pipe
-march=native -fdiagnostics-color=always -frecord-gcc-switch
es -Wreturn-type      -ggdb3 -Wall -Wmissing-prototypes -Wextra
-DLT_BUILDING_DLL=1 -c -o data-struct/object_cache.lo
data-struct/object_cache.c
libtool: compile:  x86_64-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I..
-fvisibility=hidden -pthread -std=gnu99 -O2 -pipe -march=native
-fdiagnostics-color=always -frecord-gcc-switches -Wreturn-type -ggdb3 -Wall
-Wmissing-prototypes -Wextra -DLT_BUILDING_DLL=1 -c data-struct/object_cache.c 
-fPIC -DPIC -o data-struct/.libs/object_cache.o
In function 'resize_memory_caches',
    inlined from 'find_cache' at data-struct/object_cache.c:211:4:
data-struct/object_cache.c:150:29: warning: 'realloc' called on pointer '*_42 =
PHI <lcs.14_40(29), lcs.19_48(30)>.t_mem_caches' with nonzero offset 640
[-Wfree-nonheap-object]
  150 |         lcs->t_mem_caches = realloc(lcs->t_mem_caches,
      |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
  151 |                                     lcs->t_mem_caches_total *
sizeof(struct local_cache));
      |                                    
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

gcc -O2 -c object_cache.i is enough to reproduce.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098
[Bug 99098] invalid/missing -Wfree-nonheap-object warnings

[Bug middle-end/111253] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 55825
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55825&action=edit
reduced.i

[Bug middle-end/111253] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-08-31
           Keywords|                            |diagnostic
                 CC|                            |msebor at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
We use

2034      if (!warning_at (loc, OPT_Wfree_nonheap_object,
2035                       "%qD called on pointer %qE with nonzero offset%s",
2036                       dealloc_decl, aref.ref, offstr))

so this is %qE handling where in c_pretty_printer::primary_expression for
an SSA name we do

      if (SSA_NAME_VAR (e))
        ...
      else
        {
          /* Print only the right side of the GIMPLE assignment.  */
          gimple *def_stmt = SSA_NAME_DEF_STMT (e);
          pp_gimple_stmt_1 (this, def_stmt, 0, TDF_RHS_ONLY);
        }

this regressed with r11-6508-gabb1b6058c09a7 which of course was supposed
to be an improvement.  But I'm not sure in which cases it actually is?
Possibly when the definition is a memory read (but then this can also
appear to falsely re-order loads across stores).

Fixing this gets us again

t.i:21:5: warning: 'realloc' called on pointer '*<unknown>.t_mem_caches' with
nonzero offset 40 [-Wfree-nonheap-object]
   21 |     realloc(__trans_tmp_1.t_mem_caches, sizeof(int));
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

the idea of expanding GIMPLE stmts until we hit a named one might be
appealing but then we need to do so recursively and for example
expand PHIs as <condition> ? A : B (or even more complex for PHIs with
more than one argument).

The following still passes the three testcases adjusted/added with the
original change.

diff --git a/gcc/c-family/c-pretty-print.cc b/gcc/c-family/c-pretty-print.cc
index 7536a7c471f..679aa766fe0 100644
--- a/gcc/c-family/c-pretty-print.cc
+++ b/gcc/c-family/c-pretty-print.cc
@@ -33,6 +33,9 @@ along with GCC; see the file COPYING3.  If not see
 #include "langhooks.h"
 #include "options.h"
 #include "internal-fn.h"
+#include "function.h"
+#include "basic-block.h"
+#include "gimple.h"

 /* The pretty-printer code is primarily designed to closely follow
    (GNU) C and C++ grammars.  That is to be contrasted with spaghetti
@@ -1380,12 +1383,14 @@ c_pretty_printer::primary_expression (tree e)
          else
            primary_expression (var);
        }
-      else
+      else if (gimple_assign_single_p (SSA_NAME_DEF_STMT (e)))
        {
          /* Print only the right side of the GIMPLE assignment.  */
          gimple *def_stmt = SSA_NAME_DEF_STMT (e);
          pp_gimple_stmt_1 (this, def_stmt, 0, TDF_RHS_ONLY);
        }
+      else
+       expression (e);
       break;

     default:

[Bug middle-end/111253] [11/12/13/14 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Dodgy pointer name (*_42 =  |[11/12/13/14 Regression]
                   |PHI ...) in                 |Dodgy pointer name (*_42 =
                   |-Wfree-nonheap-object       |PHI ...) in
                   |diagnostic                  |-Wfree-nonheap-object
                   |                            |diagnostic
   Target Milestone|---                         |11.5

[Bug middle-end/111253] [11/12/13/14 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 111254 has been marked as a duplicate of this bug. ***

[Bug middle-end/111253] [11/12/13/14 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Successfully tested.

[Bug middle-end/111253] [11/12/13/14 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e3ece7684b02c47d2b259899cf8009d6bdcccaf3

commit r14-3595-ge3ece7684b02c47d2b259899cf8009d6bdcccaf3
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Aug 31 13:53:21 2023 +0200

    middle-end/111253 - partly revert r11-6508-gabb1b6058c09a7

    The following keeps dumping SSA def stmt RHS during diagnostic
    reporting only for gimple_assign_single_p defs which means
    memory loads.  This avoids diagnostics containing PHI nodes
    like

      warning: 'realloc' called on pointer '*_42 = PHI <lcs.14_40(29),
lcs.19_48(30)>.t_mem_caches' with nonzero offset 40

    instead getting back the previous behavior:

      warning: 'realloc' called on pointer '*<unknown>.t_mem_caches' with
nonzero offset 40

            PR middle-end/111253
    gcc/c-family/
            * c-pretty-print.cc (c_pretty_printer::primary_expression):
            Only dump gimple_assign_single_p SSA def RHS.

    gcc/testsuite/
            * gcc.dg/Wfree-nonheap-object-7.c: New testcase.

[Bug middle-end/111253] [11/12/13 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
            Summary|[11/12/13/14 Regression]    |[11/12/13 Regression] Dodgy
                   |Dodgy pointer name (*_42 =  |pointer name (*_42 = PHI
                   |PHI ...) in                 |...) in
                   |-Wfree-nonheap-object       |-Wfree-nonheap-object
                   |diagnostic                  |diagnostic
      Known to work|                            |14.0

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug middle-end/111253] [11/12/13 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:f1e717bd8b043e07e74accff3235d04e6eb719cc

commit r13-8036-gf1e717bd8b043e07e74accff3235d04e6eb719cc
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Aug 31 13:53:21 2023 +0200

    middle-end/111253 - partly revert r11-6508-gabb1b6058c09a7

    The following keeps dumping SSA def stmt RHS during diagnostic
    reporting only for gimple_assign_single_p defs which means
    memory loads.  This avoids diagnostics containing PHI nodes
    like

      warning: 'realloc' called on pointer '*_42 = PHI <lcs.14_40(29),
lcs.19_48(30)>.t_mem_caches' with nonzero offset 40

    instead getting back the previous behavior:

      warning: 'realloc' called on pointer '*<unknown>.t_mem_caches' with
nonzero offset 40

            PR middle-end/111253
    gcc/c-family/
            * c-pretty-print.cc (c_pretty_printer::primary_expression):
            Only dump gimple_assign_single_p SSA def RHS.

    gcc/testsuite/
            * gcc.dg/Wfree-nonheap-object-7.c: New testcase.

    (cherry picked from commit e3ece7684b02c47d2b259899cf8009d6bdcccaf3)

[Bug middle-end/111253] [11/12 Regression] Dodgy pointer name (*_42 = PHI ...) in -Wfree-nonheap-object diagnostic

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111253

--- Comment #8 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e26608db3c2b2644decca5f49dab1e6846a9d1b0

commit r12-10041-ge26608db3c2b2644decca5f49dab1e6846a9d1b0
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Aug 31 13:53:21 2023 +0200

    middle-end/111253 - partly revert r11-6508-gabb1b6058c09a7

    The following keeps dumping SSA def stmt RHS during diagnostic
    reporting only for gimple_assign_single_p defs which means
    memory loads.  This avoids diagnostics containing PHI nodes
    like

      warning: 'realloc' called on pointer '*_42 = PHI <lcs.14_40(29),
lcs.19_48(30)>.t_mem_caches' with nonzero offset 40

    instead getting back the previous behavior:

      warning: 'realloc' called on pointer '*<unknown>.t_mem_caches' with
nonzero offset 40

            PR middle-end/111253
    gcc/c-family/
            * c-pretty-print.cc (c_pretty_printer::primary_expression):
            Only dump gimple_assign_single_p SSA def RHS.

    gcc/testsuite/
            * gcc.dg/Wfree-nonheap-object-7.c: New testcase.

    (cherry picked from commit e3ece7684b02c47d2b259899cf8009d6bdcccaf3)