[Bug c/113984] New: -Wfree-nonheap-object false positive with VLA parameter

[Bug c/113984] New: -Wfree-nonheap-object false positive with VLA parameter

[alx at kernel dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113984

            Bug ID: 113984
           Summary: -Wfree-nonheap-object false positive with VLA
                    parameter
           Product: gcc
           Version: 13.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: alx at kernel dot org
  Target Milestone: ---

I can reproduce it with both of these:

$ gcc-13 --version | head -n1
gcc-13 (Debian 13.2.0-13) 13.2.0
$ gcc-14 --version | head -n1
gcc-14 (Debian 14-20240201-3) 14.0.1 20240131 (experimental) [master
r14-8680-g2f14c0dbb78]


See a small reproducer:


```c
#include <err.h>
#include <stddef.h>
#include <stdlib.h>


static const char **add_string(size_t *restrict n,
    const char *strings[restrict *n], const char *restrict string);


int
main(int argc, char *argv[argc + 1])
{
        size_t      n = 0;
        const char  **strings = NULL;

        add_string(&n, strings, argv[0]);
}


static const char **
add_string(size_t *restrict n, const char *strings[restrict *n],
    const char *restrict string)
{
        strings = reallocarray(strings, ++*n, sizeof(const char *));
        if (strings == NULL)
                err(EXIT_FAILURE, "reallocarray(3)");

        strings[*n - 1] = string;

        return strings;
}
```


alx@debian:~/tmp$ gcc-13 -Wall nonheap.c 
nonheap.c: In function ‘add_string’:
nonheap.c:24:19: warning: ‘reallocarray’ called on unallocated object ‘strings’
[-Wfree-nonheap-object]
   24 |         strings = reallocarray(strings, ++*n, sizeof(const char *));
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nonheap.c:21:44: note: declared here
   21 | add_string(size_t *restrict n, const char *strings[restrict *n],
      |                                ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~
alx@debian:~/tmp$ gcc-14 -Wall nonheap.c 
nonheap.c: In function ‘add_string’:
nonheap.c:24:19: warning: ‘reallocarray’ called on unallocated object ‘strings’
[-Wfree-nonheap-object]
   24 |         strings = reallocarray(strings, ++*n, sizeof(const char *));
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nonheap.c:21:44: note: declared here
   21 | add_string(size_t *restrict n, const char *strings[restrict *n],
      |                                ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~


If I change the function to have the parameter be `const char **restrict
strings`, the warning vanishes.

[Bug c/113984] -Wfree-nonheap-object false positive with VLA parameter

[alx at kernel dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113984

--- Comment #1 from Alejandro Colomar <alx at kernel dot org> ---
With -O3, the warning also vanishes, as the function is probably inlined, and
there's no VLA parameter any more.

alx@debian:~/tmp$ gcc-14 -Wall -O3 nonheap.c 
alx@debian:~/tmp$ gcc-13 -Wall -O3 nonheap.c 
alx@debian:~/tmp$

[Bug middle-end/113984] -Wfree-nonheap-object false positive with VLA parameter that is a derefenced

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113984

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
            Summary|-Wfree-nonheap-object false |-Wfree-nonheap-object false
                   |positive with VLA parameter |positive with VLA parameter
                   |                            |that is a derefenced
   Last reconfirmed|                            |2024-02-19

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, reduced testcase:
```
const char **
add_string(int *restrict n, const char *strings[restrict *n])
{
  strings = __builtin_realloc(strings, *n);
  if (!strings)
    return 0;
  return strings;
}
```

Note if we had `int n` instead of a pointer, then there would be no warning.

[Bug middle-end/113984] -Wfree-nonheap-object false positive with VLA parameter that has a size which is not a simple decl

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113984

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|-Wfree-nonheap-object false |-Wfree-nonheap-object false
                   |positive with VLA parameter |positive with VLA parameter
                   |that is a derefenced        |that has a size which is
                   |                            |not a simple decl

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Another testcase:
```
struct a
{
  int n;
};
const char **
add_string(struct a n, const char *strings[restrict n.n])
{
  strings = __builtin_realloc(strings, n.n);
  if (!strings)
    return 0;
  return strings;
}
```