PR56955 prompted me to handle BUILT_IN_REALLOC just the same way we already handle BUILT_IN_STR[N]DUP.
Bootstrap and regtest running on x86_64-unknown-linux-gnu. Now this will disambiguate *p and *q for p = realloc (q, n) for any value of n (including those that don't actually trigger re-allocation and thus where p == q after the call). I don't think that any such use would be valid - but I can certainly play safer here and implement the points-to part as a pass-through (that is, make p point to what q points). That's of course less optimization. I can't quite find language that specifies that the object can no longer accessed via the pointer argument q (at least if p didn't return NULL and size was not NULL). The C99 standard explicitely mentions that p may have the same pointer value as q though. Thoughts? Thanks, Richard. 2014-05-21 Richard Biener <rguent...@suse.de> * tree-ssa-alias.c (ref_maybe_used_by_call_p_1): Handle BUILT_IN_REALLOC like BUILT_IN_STRDUP. (call_may_clobber_ref_p_1): Likewise. * tree-ssa-structalias.c (find_func_aliases_for_builtin_call): Likewise. (handle_lhs_call): Use flags argument instead of recomputing it. (find_func_aliases_for_call): Call handle_lhs_call with proper call return flags. * gcc.dg/tree-ssa/alias-33.c: New testcase. Index: gcc/tree-ssa-alias.c =================================================================== *** gcc/tree-ssa-alias.c.orig 2014-05-21 14:38:57.841133822 +0200 --- gcc/tree-ssa-alias.c 2014-05-21 14:39:05.954133263 +0200 *************** ref_maybe_used_by_call_p_1 (gimple call, *** 1594,1599 **** --- 1594,1600 ---- /* These read memory pointed to by the first argument. */ case BUILT_IN_STRDUP: case BUILT_IN_STRNDUP: + case BUILT_IN_REALLOC: { ao_ref dref; tree size = NULL_TREE; *************** call_may_clobber_ref_p_1 (gimple call, a *** 1958,1963 **** --- 1959,1965 ---- case BUILT_IN_MALLOC: case BUILT_IN_ALIGNED_ALLOC: case BUILT_IN_CALLOC: + case BUILT_IN_REALLOC: case BUILT_IN_STRDUP: case BUILT_IN_STRNDUP: /* Unix98 specifies that errno is set on allocation failure. */ Index: gcc/tree-ssa-structalias.c =================================================================== *** gcc/tree-ssa-structalias.c.orig 2014-05-21 14:38:57.844133822 +0200 --- gcc/tree-ssa-structalias.c 2014-05-21 14:45:50.896105384 +0200 *************** handle_lhs_call (gimple stmt, tree lhs, *** 3974,3980 **** /* If the call returns an argument unmodified override the rhs constraints. */ - flags = gimple_call_return_flags (stmt); if (flags & ERF_RETURNS_ARG && (flags & ERF_RETURN_ARG_MASK) < gimple_call_num_args (stmt)) { --- 3974,3979 ---- *************** find_func_aliases_for_builtin_call (stru *** 4299,4307 **** return true; case BUILT_IN_STRDUP: case BUILT_IN_STRNDUP: if (gimple_call_lhs (t)) { ! handle_lhs_call (t, gimple_call_lhs (t), gimple_call_flags (t), vNULL, fndecl); get_constraint_for_ptr_offset (gimple_call_lhs (t), NULL_TREE, &lhsc); --- 4298,4308 ---- return true; case BUILT_IN_STRDUP: case BUILT_IN_STRNDUP: + case BUILT_IN_REALLOC: if (gimple_call_lhs (t)) { ! handle_lhs_call (t, gimple_call_lhs (t), ! gimple_call_return_flags (t) | ERF_NOALIAS, vNULL, fndecl); get_constraint_for_ptr_offset (gimple_call_lhs (t), NULL_TREE, &lhsc); *************** find_func_aliases_for_call (struct funct *** 4535,4541 **** else handle_rhs_call (t, &rhsc); if (gimple_call_lhs (t)) ! handle_lhs_call (t, gimple_call_lhs (t), flags, rhsc, fndecl); rhsc.release (); } else --- 4536,4543 ---- else handle_rhs_call (t, &rhsc); if (gimple_call_lhs (t)) ! handle_lhs_call (t, gimple_call_lhs (t), ! gimple_call_return_flags (t), rhsc, fndecl); rhsc.release (); } else Index: gcc/testsuite/gcc.dg/tree-ssa/alias-33.c =================================================================== *** /dev/null 1970-01-01 00:00:00.000000000 +0000 --- gcc/testsuite/gcc.dg/tree-ssa/alias-33.c 2014-05-21 14:39:06.003133260 +0200 *************** *** 0 **** --- 1,20 ---- + /* { dg-do run } */ + /* { dg-options "-O -fdump-tree-fre1-details" } */ + + int j; + int main () + { + int i = 1; + int **p; + j = 0; + p = __builtin_malloc (sizeof (int *)); + *p = &i; + p = __builtin_realloc (p, 2 * sizeof (int *)); + **p = 0; + if (i != 0) + __builtin_abort (); + return j; + } + + /* { dg-final { scan-tree-dump "Replaced j with 0" "fre1" } } */ + /* { dg-final { cleanup-tree-dump "fre1" } } */