[Bug middle-end/99098] New: invalid/missing -Wfree-nonheap-object warnings

[Bug middle-end/99098] New: invalid/missing -Wfree-nonheap-object warnings

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

            Bug ID: 99098
           Summary: invalid/missing -Wfree-nonheap-object warnings
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

This is a meta-bug to track false positives and negatives in the
-Wfree-nonheap-object warning.

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
              Alias|                            |Wfree-nonheap-object
   Last reconfirmed|                            |2021-02-14
            Version|11.0                        |4.7.0
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |diagnostic, meta-bug

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
-Wfree-nonheap-object was introduced in r178004 (in GCC 4.7.0).

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098
Bug 99098 depends on bug 93873, which changed state.

Bug 93873 Summary: gcc or lto-wrapper does not consider individual bitfield values on static analysis and instead tests the whole value of all bitfield bits combined
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93873

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[pross at xvid dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

Peter Ross <pross at xvid dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pross at xvid dot org

--- Comment #2 from Peter Ross <pross at xvid dot org> ---
The following test case produces a -Wfree-nonheap-object false positive. I
argue that the memory being free'd is heap memory. It is offset by one to
accomodate the negative offset applied immediately after malloc.

```
#include <stdlib.h>
char * knn_alloc()
{
    char * w = malloc(sizeof(char));
    if (!w)
        return NULL;
    return w - 1;
}
void knn_free(char * w)
{
    free(w + 1);
}
int main()
{
    char * w = knn_alloc();
    if (!w)
        return -1;

    knn_free(w);
    return 0;
}
```

```
$ gcc knn.c -save-temps
knn.c: In function ‘knn_free’:
knn.c:11:5: warning: ‘free’ called on pointer ‘w’ with nonzero offset 1
[-Wfree-nonheap-object]
   11 |     free(w + 1);
      |     ^~~~~~~~~~~

```

gcc --version: gcc (Debian 13.2.0-2) 13.2.0
uname -a: Linux computer 6.4.0-3-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.4.11-1
(2023-08-17) x86_64 GNU/Linux

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[pross at xvid dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

--- Comment #3 from Peter Ross <pross at xvid dot org> ---
Created attachment 55814
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55814&action=edit
Test case -save-temps output

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Peter Ross from comment #2)
> The following test case produces a -Wfree-nonheap-object false positive. I
> argue that the memory being free'd is heap memory. It is offset by one to
> accomodate the negative offset applied immediately after malloc.

Doing -1 on an allocated memory location is undefined because you can only have
the address of 0...size to be taken of the "object" according to the C
standard. So the warning might seem wrong but you have undefined code
happening.

[Bug middle-end/99098] invalid/missing -Wfree-nonheap-object warnings

[pross at xvid dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098

--- Comment #5 from Peter Ross <pross at xvid dot org> ---
The -1 occurs after checking the malloc()==0 case, so the negative offset is
only ever applied to addresses in [1..limit] range. Thanks for your time!