https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116977
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Thanks for looking at this, and for filing the bug. There are two ways of tracking state in the analyzer: (a) using state machines, like in sm-malloc.cc, which let program_state instances track per-svalue states using sm_state_map. (b) by using the region_model, which tracks information on the state of memory. Each program_state has one of these. and sometimes the way these two systems interact is, alas, rather ugly/hackish. The region-model code has a concept of a region, and of memory spaces. See enum memory_space in gcc/analyzer/region.h. Currently there's a concept of a heap_allocated_region, which will be in memory space MEMSPACE_HEAP, and be a child region of the heap_region. It strikes me that "host" vs "device" pointers could be tracked as a new kind of memory space, perhaps with a second heap_region instance representing device memory. That way acc_malloc could return a pointer to a heap_allocated_region in that memory space, and "free" could complain if the underlying buffer of its argument isn't in MEMSPACE_HEAP but is instead in MEMSPACE_DEVICE_HEAP, or somesuch. Note that the analyzer assumes that pointers in different memory spaces can't alias. So that might be worth modeling, if I'm understanding OpenACC's pointer model correctly. That said, looking at the existing code, free_of_non_heap is implemented in sm-malloc.cc as part of the state machine logic, called from malloc_state_machine::on_deallocator_call. So maybe that's the simplest place to implement this?
