diff mbox

PR35503 - warn for restrict pointer

Message ID CAAgBjMnakS3C2LX3HLrABJvN3artp-MYJZr_5VZ9Z_ULe+5cwQ@mail.gmail.com
State Superseded
Headers show

Commit Message

Prathamesh Kulkarni Sept. 1, 2016, 9:25 a.m. UTC
On 1 September 2016 at 12:25, Richard Biener <rguenther@suse.de> wrote:
> On Tue, 30 Aug 2016, Tom de Vries wrote:

>

>> On 30/08/16 17:34, Prathamesh Kulkarni wrote:

>> > On 30 August 2016 at 20:24, Tom de Vries <Tom_deVries@mentor.com> wrote:

>> > > On 26/08/16 13:39, Prathamesh Kulkarni wrote:

>> > > >

>> > > > Hi,

>> > > > The following patch adds option -Wrestrict that warns when an argument

>> > > > is passed to a restrict qualified parameter and it aliases with

>> > > > another argument.

>> > > >

>> > > > eg:

>> > > > int foo (const char *__restrict buf, const char *__restrict fmt, ...);

>> > > >

>> > > > void f(void)

>> > > > {

>> > > >   char buf[100] = "hello";

>> > > >   foo (buf, "%s-%s", buf, "world");

>> > > > }

>> > >

>> > >

>> > > Does -Wrestrict generate a warning for this example?

>> > >

>> > > ...

>> > > void h(int n, int * restrict p, int * restrict q, int * restrict r)

>> > > {

>> > >   int i;

>> > >   for (i = 0; i < n; i++)

>> > >     p[i] = q[i] + r[i];

>> > > }

>> > >

>> > > h (100, a, b, b)

>> > > ...

>> > >

>> > > [ Note that this is valid C, and does not violate the restrict definition.

>> > > ]

>> > >

>> > > If -Wrestrict indeed generates a warning, then we should be explicit in

>> > > the

>> > > documentation that while the warning triggers on this type of example, the

>> > > code is correct.

>> > I am afraid it would warn for the above case. The patch just checks if

>> > the parameter is qualified

>> > with restrict, and if the corresponding argument has aliases in the

>> > call (by calling operand_equal_p).

>>

>> > Is such code common in practice ?

>>

>> [ The example is from the definition of restrict in the c99 standard. ]

>>

>> According to the definition of restrict, only the restrict on p is required to

>> know that p doesn't alias with q and that p doesn't alias with r.

>>

>> AFAIK the current implementation of gcc already generates optimal code if

>> restrict is only on p. But earlier versions (and possibly other compilers as

>> well?) need the restrict on q and r as well.

>>

>> So I expect this code to occur.

>>

>> > If it is, I wonder if we should keep

>> > the warning in -Wall ?

>> >

>>

>> Hmm, I wonder if we can use the const keyword to silence the warning.

>>

>> So if we generate a warning for:

>> ...

>> void h(int n, int * restrict p, int * restrict q, int * restrict r)

>> {

>>   int i;

>>   for (i = 0; i < n; i++)

>>     p[i] = q[i] + r[i];

>> }

>> h (100, a, b, b)

>> ...

>>

>> but not for:

>> ...

>> void h(int n, int * restrict p, const int * restrict q, const int * restrict

>> r)

>> {

>>   int i;

>>   for (i = 0; i < n; i++)

>>     p[i] = q[i] + r[i];

>> }

>> h (100, a, b, b)

>> ...

>>

>> Then there's an easy way to rewrite the example such that the warning doesn't

>> trigger, without having to remove the restrict.

>

> Note that I've seen restrict being used even for

>

> void h(int n, int * restrict p, int * restrict q)

> {

>   int i;

>   for (i = 0; i < n; i++)

>     p[2*i] = p[2*i] + q[2*i + 1];

> }

>

> thus where the actual accesses do not alias (the pointers are used

> to access every other element).  I think the definition of "object"

> (based on accessed lvalues) makes this example valid.  So we

> shouldn't warn about

>

> h (n, p, p)

>

> but we could warn about

>

> h (n, p, p + 1)

>

> and yes, only one of the pointers need to be restrict qualified.

>

> Note that as with all other alias warnings if you want to avoid

> false positives and rely on conservative analysis then you can

> as well simply avoid taking advantate of the bug in the code

> (as we do for TBAA and trivial must-alias cases).  If you allow

> false positives then you ultimatively end up with a mess like

> our existing -Wstrict-aliasing warnings (which are IMHO quite

> useless).

>

> Note that nowhere in GCC we implement anything closely matching

> the formal definition of restrict as writte in the C standard --

> only in fronted code could we properly derive the 'based-on'

> property and note lvalues affected by restrict.  Currently we

> are restricted to looking at restrict qualified parameters

> because of this.

Hi,
The attached version passes bootstrap+test on ppc64le-linux-gnu.
Given that it only looks if parameters are restrict qualified and not
how they're used inside the callee,
this can have false positives as in above test-cases.
Should the warning be put in Wextra rather than Wall (I have left it
in Wall in the patch)  or only enabled with -Wrestrict ?

Thanks,
Prathamesh
>

> Richard.

Comments

Prathamesh Kulkarni Sept. 5, 2016, 11:54 a.m. UTC | #1
On 1 September 2016 at 21:28, Martin Sebor <msebor@gmail.com> wrote:
>> The attached version passes bootstrap+test on ppc64le-linux-gnu.

>> Given that it only looks if parameters are restrict qualified and not

>> how they're used inside the callee,

>> this can have false positives as in above test-cases.

>> Should the warning be put in Wextra rather than Wall (I have left it

>> in Wall in the patch)  or only enabled with -Wrestrict ?

>

>

> Awesome!  I've wished for years for a warning like this!

Thanks for experimenting with the patch!
>

> I'm curious if you've tested other examples from 6.7.3.1 of C11

> besides Example 3.  Example 4 seems like something GCC should be

> able to detect but I didn't get a warning with the patch.

Oops, I wasn't aware about example 4, and only implemented the warning
for function call. IIUC, the assignment p = q will result in undefined behavior
if q is qualified with restrict and p is at an outer-scope relative to q ?
>

> I would expect the warning to be especially valuable with string

> manipulation functions like memcpy that have undefined behavior

> for overlapping regions, such as in:

>

>   char a[4];

>

>   void g (void)

>   {

>     __builtin_memcpy (a, a + 1, 3);

>   }

>

> But here, too, I didn't get a warning.  I understand that this

> case cannot be handled for arbitrary functions whose semantics

> aren't known but with standard functions for which GCC provides

> intrinsics the effects are known and aliasing violations can in

> common cases be detected.

Indeed, thanks for the suggestions. I will add support for some
standard functions in a follow-up patch.

Thanks,
Prathamesh
>

> Martin
diff mbox

Patch

diff --git a/gcc/c-family/c-common.c b/gcc/c-family/c-common.c
index 3feb910..a3dae34 100644
--- a/gcc/c-family/c-common.c
+++ b/gcc/c-family/c-common.c
@@ -47,6 +47,7 @@  along with GCC; see the file COPYING3.  If not see
 #include "gimplify.h"
 #include "substring-locations.h"
 #include "spellcheck.h"
+#include "gcc-rich-location.h"
 
 cpp_reader *parse_in;		/* Declared in c-pragma.h.  */
 
@@ -13057,4 +13058,76 @@  diagnose_mismatched_attributes (tree olddecl, tree newdecl)
   return warned;
 }
 
+/* Warn if an argument at position param_pos is passed to a
+   restrict-qualified param, and it aliases with another argument.  */
+
+void
+warn_for_restrict (unsigned param_pos, vec<tree, va_gc> *args)
+{
+  tree arg = (*args)[param_pos];
+  if (TREE_VISITED (arg) || operand_equal_p (arg, null_pointer_node, 0))
+    return;
+
+  location_t loc = EXPR_LOC_OR_LOC (arg, input_location);
+  gcc_rich_location richloc (loc);
+
+  unsigned i;
+  tree current_arg;
+  auto_vec<unsigned> arg_positions;
+
+  FOR_EACH_VEC_ELT (*args, i, current_arg) 
+    {
+      if (i == param_pos)
+	continue;
+
+      tree current_arg = (*args)[i];
+      if (operand_equal_p (arg, current_arg, 0))
+	{
+	  TREE_VISITED (current_arg) = 1; 
+	  arg_positions.safe_push (i);
+	}
+    }
+
+  if (arg_positions.is_empty ())
+    return;
+
+  struct obstack fmt_obstack;
+  gcc_obstack_init (&fmt_obstack);
+  char *fmt = (char *) obstack_alloc (&fmt_obstack, 0);
+
+  char num[32];
+  sprintf (num, "%u", param_pos + 1);
+
+  obstack_grow (&fmt_obstack, "passing argument ",
+		strlen ("passing argument "));
+  obstack_grow (&fmt_obstack, num, strlen (num));
+  obstack_grow (&fmt_obstack,
+		" to restrict-qualified parameter aliases with argument",
+		strlen (" to restrict-qualified parameter "
+			"aliases with argument"));
+
+  /* make argument plural and append space.  */
+  if (arg_positions.length () > 1)
+    obstack_1grow (&fmt_obstack, 's');
+  obstack_1grow (&fmt_obstack, ' ');
+
+  unsigned pos;
+  FOR_EACH_VEC_ELT (arg_positions, i, pos)
+    {
+      tree arg = (*args)[pos];
+      if (EXPR_HAS_LOCATION (arg))
+	richloc.add_range (EXPR_LOCATION (arg), false);
+
+      sprintf (num, "%u", pos + 1);
+      obstack_grow (&fmt_obstack, num, strlen (num));
+
+      if (i < arg_positions.length () - 1)
+	obstack_grow (&fmt_obstack, ", ",  strlen (", "));
+    }
+
+  obstack_1grow (&fmt_obstack, 0);
+  warning_at_rich_loc (&richloc, OPT_Wrestrict, fmt);
+  obstack_free (&fmt_obstack, fmt);
+}
+
 #include "gt-c-family-c-common.h"
diff --git a/gcc/c-family/c-common.h b/gcc/c-family/c-common.h
index bc22baa..cdb762e 100644
--- a/gcc/c-family/c-common.h
+++ b/gcc/c-family/c-common.h
@@ -920,6 +920,7 @@  extern void c_parse_final_cleanups (void);
 
 extern void warn_for_omitted_condop (location_t, tree);
 extern void warn_for_memset (location_t, tree, tree, int);
+extern void warn_for_restrict (unsigned, vec<tree, va_gc> *);
 
 /* These macros provide convenient access to the various _STMT nodes.  */
 
diff --git a/gcc/c-family/c.opt b/gcc/c-family/c.opt
index a5358ed..5ec3a25 100644
--- a/gcc/c-family/c.opt
+++ b/gcc/c-family/c.opt
@@ -1012,6 +1012,11 @@  Wduplicate-decl-specifier
 C ObjC Var(warn_duplicate_decl_specifier) Warning LangEnabledBy(C ObjC,Wall)
 Warn when a declaration has duplicate const, volatile, restrict or _Atomic specifier.
 
+Wrestrict
+C ObjC C++ ObjC++ Var(warn_restrict) Warning LangEnabledBy(C ObjC C++ ObjC++,Wall)
+Warn when an argument passed to a restrict-qualified parameter aliases with
+another argument.
+
 ansi
 C ObjC C++ ObjC++
 A synonym for -std=c89 (for C) or -std=c++98 (for C++).
diff --git a/gcc/c/c-parser.c b/gcc/c/c-parser.c
index fe0c95f..05510f6 100644
--- a/gcc/c/c-parser.c
+++ b/gcc/c/c-parser.c
@@ -8369,6 +8369,25 @@  c_parser_postfix_expression_after_primary (c_parser *parser,
 	      warn_for_memset (expr_loc, arg0, arg2, literal_zero_mask);
 	    }
 
+	  if (TREE_CODE (expr.value) == FUNCTION_DECL && warn_restrict)
+	    {
+	      unsigned i;
+	      tree arg;
+	      FOR_EACH_VEC_SAFE_ELT (exprlist, i, arg)
+		TREE_VISITED (arg) = 0;
+
+	      unsigned param_pos = 0;
+	      function_args_iterator iter;
+	      tree t;
+	      FOREACH_FUNCTION_ARGS (TREE_TYPE (expr.value), t, iter)
+		{
+		  if (POINTER_TYPE_P (t) && TYPE_RESTRICT (t)
+		      && !TYPE_READONLY (TREE_TYPE (t)))
+		    warn_for_restrict (param_pos, exprlist);
+		  param_pos++;
+		}
+	    }
+
 	  start = expr.get_start ();
 	  finish = parser->tokens_buf[0].get_finish ();
 	  expr.value
diff --git a/gcc/cp/parser.c b/gcc/cp/parser.c
index 690e928..ab73655 100644
--- a/gcc/cp/parser.c
+++ b/gcc/cp/parser.c
@@ -6878,6 +6878,26 @@  cp_parser_postfix_expression (cp_parser *parser, bool address_p, bool cast_p,
 		warn_for_memset (input_location, arg0, arg2, literal_mask);
 	      }
 
+	    if (TREE_CODE (postfix_expression) == FUNCTION_DECL
+		&& warn_restrict)
+	      {
+		unsigned i;
+		tree arg;
+		FOR_EACH_VEC_SAFE_ELT (args, i, arg)
+		  TREE_VISITED (arg) = 0;
+
+		unsigned param_pos = 0;
+		for (tree decl = DECL_ARGUMENTS (postfix_expression);
+		     decl != NULL_TREE;
+		     decl = DECL_CHAIN (decl), param_pos++)
+		  {
+		    tree type = TREE_TYPE (decl);
+		    if (POINTER_TYPE_P (type) && TYPE_RESTRICT (type)
+			&& !TYPE_READONLY (TREE_TYPE (type)))
+		      warn_for_restrict (param_pos, args);
+		  }
+	      }
+
 	    if (TREE_CODE (postfix_expression) == COMPONENT_REF)
 	      {
 		tree instance = TREE_OPERAND (postfix_expression, 0);
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index 1f04501..869bf07 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -288,7 +288,7 @@  Objective-C and Objective-C++ Dialects}.
 -Wparentheses -Wno-pedantic-ms-format @gol
 -Wplacement-new -Wplacement-new=@var{n} @gol
 -Wpointer-arith  -Wno-pointer-to-int-cast @gol
--Wno-pragmas -Wredundant-decls  -Wno-return-local-addr @gol
+-Wno-pragmas -Wredundant-decls -Wrestrict  -Wno-return-local-addr @gol
 -Wreturn-type  -Wsequence-point  -Wshadow  -Wno-shadow-ivar @gol
 -Wshift-overflow -Wshift-overflow=@var{n} @gol
 -Wshift-count-negative -Wshift-count-overflow -Wshift-negative-value @gol
@@ -5274,6 +5274,12 @@  compilations.
 Warn when deleting a pointer to incomplete type, which may cause
 undefined behavior at runtime.  This warning is enabled by default.
 
+@item -Wrestrict
+@opindex Wrestrict
+@opindex Wno-restrict
+Warn when an argument passed to a restrict-qualified parameter
+aliases with another argument
+
 @item -Wuseless-cast @r{(C++ and Objective-C++ only)}
 @opindex Wuseless-cast
 @opindex Wno-useless-cast
diff --git a/gcc/testsuite/c-c++-common/pr35503-1.c b/gcc/testsuite/c-c++-common/pr35503-1.c
new file mode 100644
index 0000000..25e3721
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/pr35503-1.c
@@ -0,0 +1,10 @@ 
+/* { dg-do compile } */
+/* { dg-options "-Wrestrict" } */
+
+int foo (char *__restrict buf, const char *__restrict fmt, ...);
+
+void f(void)
+{
+  char buf[100] = "hello";
+  foo (buf, "%s-%s", buf, "world"); /*  { dg-warning "passing argument 1 to restrict-qualified parameter aliases with argument 3" } */
+}
diff --git a/gcc/testsuite/c-c++-common/pr35503-2.c b/gcc/testsuite/c-c++-common/pr35503-2.c
new file mode 100644
index 0000000..bfcd944
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/pr35503-2.c
@@ -0,0 +1,14 @@ 
+/* { dg-do compile } */
+/* { dg-options "-fdiagnostics-show-caret -Wrestrict" } */
+
+void f(int *__restrict x, int *y, int *__restrict z, int *w);
+
+void foo(int alpha, int beta)
+{
+  f (&alpha, &beta, &alpha, &alpha); /* { dg-warning "passing argument 1 to restrict-qualified parameter aliases with arguments 3, 4" } */
+
+/* { dg-begin-multiline-output "" }
+   f (&alpha, &beta, &alpha, &alpha);
+      ^~~~~~         ~~~~~~  ~~~~~~
+   { dg-end-multiline-output "" } */
+}
diff --git a/gcc/testsuite/c-c++-common/pr35503-3.c b/gcc/testsuite/c-c++-common/pr35503-3.c
new file mode 100644
index 0000000..8cbacab
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/pr35503-3.c
@@ -0,0 +1,9 @@ 
+/* { dg-do compile } */
+/* { dg-options "-Wrestrict" } */
+
+void f(int *x, int *__restrict y);
+
+void foo(int a)
+{
+  f (&a, &a); /* { dg-warning "passing argument 2 to restrict-qualified parameter aliases with argument 1" } */
+}