Undo a shrinking in-place realloc in the reverse sweep.

Since #1925 an in-place `p = realloc(p, n)` keeps the reallocated
pointer for both p and its adjoint instead of saving and restoring it,
because realloc frees the old block and a saved pointer would dangle.
That is correct only when the buffer grows or keeps its size: a
shrinking realloc leaves the reverse sweep addressing a buffer smaller
than the indices the forward pass wrote, reading past its end.

Track the pointer's allocation size in a size_t shadow set at
malloc/calloc/realloc. At an in-place realloc, capture the pre- and
post-realloc sizes in the forward pass and, in the reverse sweep, call
clad::reverse_realloc to resize both the primal and adjoint buffers back
to the pre-realloc size so the earlier accesses stay in bounds; the
adjoint's re-grown tail is zeroed so fresh derivatives start at 0. Each
realloc captures its own sizes, so chained reallocs unwind correctly.

Only pointers actually reallocated in place need the shadow, so
DiffCollector records them on the DiffRequest during planning -- reusing
the traversal it already runs -- and reverse mode shadows exactly those,
leaving every other allocation untouched. The shadow rides on the
pointer's existing adjoint record rather than a separate map. Without a
tracked size the previous keep-the-pointer behaviour still applies.

Add Gradient/ReallocShrink.C, covering a shrinking and a chained
shrink-then-grow realloc, Memcheck-clean under the valgrind row only
with this change; update Gradient/Pointers.C for the shadows.

Author: vgvassilev

include/clad/Differentiator/BuiltinDerivatives.h

@@ -12,6 +12,8 @@
 
 #include <algorithm>
 #include <cmath>
+#include <cstdlib>
+#include <cstring>
 #include <functional>
 
 #define elidable_reverse_forw __attribute__((annotate("elidable_reverse_forw")))
@@ -1600,6 +1602,30 @@ void constructor_pullback(ValueAndPushforward<T, U> rhs,
 }
 } // namespace class_functions
 } // namespace custom_derivatives
+
+// Reverse-mode helper for an in-place realloc: resize `ptr` back to the byte
+// size it had before the forward realloc. When that regrows a buffer the
+// forward pass shrank, zero the re-grown tail for adjoint buffers so fresh
+// derivatives start at 0; primal buffers pass zeroGrownTail=false, their tail
+// being overwritten by value restores. Returns the possibly-moved pointer.
+// NOLINTBEGIN(cppcoreguidelines-no-malloc)
+// NOLINTBEGIN(cppcoreguidelines-owning-memory)
+// NOLINTBEGIN(cppcoreguidelines-pro-bounds-pointer-arithmetic)
+inline void* reverse_realloc(void* ptr, size_t oldBytes, size_t newBytes,
+                             bool zeroGrownTail) {
+  void* resized = ::realloc(ptr, oldBytes);
+  // realloc failed: keep the original buffer instead of leaking it.
+  if (!resized)
+    return ptr;
+  ptr = resized;
+  if (zeroGrownTail && oldBytes > newBytes)
+    ::memset(static_cast<char*>(ptr) + newBytes, 0, oldBytes - newBytes);
+  return ptr;
+}
+// NOLINTEND(cppcoreguidelines-pro-bounds-pointer-arithmetic)
+// NOLINTEND(cppcoreguidelines-owning-memory)
+// NOLINTEND(cppcoreguidelines-no-malloc)
+
 } // namespace clad
 
   // FIXME: These math functions depend on promote_2 just like pow:

include/clad/Differentiator/DiffPlanner.h

@@ -9,6 +9,7 @@
 
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclBase.h"
+#include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/Stmt.h"
@@ -17,10 +18,13 @@
 
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/SmallVector.h"
+#include "llvm/ADT/StringSwitch.h"
+#include "llvm/Support/Casting.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/SaveAndRestore.h"
 #include "llvm/Support/raw_ostream.h"
 
+#include <cstdint>
 #include <functional>
 #include <iterator>
 #include <map>
@@ -49,6 +53,84 @@ using ParamInfo = std::map<const clang::FunctionDecl*, ParamSet>;
 /// rediscovering them inside a visitor, keeps them available to every visitor
 /// and correct after a request is copied and re-pointed at another Function.
 struct DiffRequest {
+  /// Recognises a C heap-memory builtin call and centralises the invariants
+  /// reverse mode must preserve for it, so all memory-op reasoning goes through
+  /// one place instead of ad-hoc name checks scattered across the code base.
+  /// The planner uses it to record which pointers are reallocated in place; the
+  /// reverse-mode visitor uses it to emit and undo the resize.
+  class AllocCallInfo {
+  public:
+    enum class Kind : std::uint8_t { None, Malloc, Calloc, Realloc, Free };
+
+    AllocCallInfo() = default;
+
+    // Recognise E as a memory builtin; Kind::None if it is not one. Strips the
+    // C-style cast that wraps the call (e.g. `(double*)realloc(...)`), so
+    // IgnoreParenCasts, not IgnoreParenImpCasts, is required here.
+    [[nodiscard]] static AllocCallInfo recognize(clang::Expr* E) {
+      auto* CE = llvm::dyn_cast_or_null<clang::CallExpr>(
+          E ? E->IgnoreParenCasts() : nullptr);
+      if (!CE)
+        return {};
+      const clang::FunctionDecl* FD = CE->getDirectCallee();
+      // getName() asserts on non-identifier names (operators, constructors),
+      // which vector/STL code produces; the builtins are plain identifiers.
+      if (!FD || !FD->getDeclName().isIdentifier())
+        return {};
+      Kind k = llvm::StringSwitch<Kind>(FD->getName())
+                   .Case("malloc", Kind::Malloc)
+                   .Case("calloc", Kind::Calloc)
+                   .Case("realloc", Kind::Realloc)
+                   .Case("free", Kind::Free)
+                   .Default(Kind::None);
+      return AllocCallInfo(k, CE);
+    }
+
+    [[nodiscard]] Kind getKind() const { return m_Kind; }
+    [[nodiscard]] clang::CallExpr* getCall() const { return m_Call; }
+
+    // The number-of-bytes operand that a following memset must zero:
+    // malloc(n) -> n, realloc(p, n) -> n. calloc self-zeroes and needs no
+    // memset, so it (and free/none) report null here.
+    [[nodiscard]] clang::Expr* memsetByteSize() const {
+      switch (m_Kind) {
+      case Kind::Malloc:
+        return m_Call->getArg(0);
+      case Kind::Realloc:
+        return m_Call->getArg(1);
+      default:
+        return nullptr;
+      }
+    }
+
+    // True for an in-place `p = realloc(p, n)`: the LHS is realloc's own
+    // pointer argument. Only then may the reallocated pointer be kept across
+    // the call (realloc frees the old block, so a saved pointer would dangle).
+    [[nodiscard]] bool isInPlaceRealloc(const clang::Expr* LHS) const {
+      if (m_Kind != Kind::Realloc || m_Call->getNumArgs() == 0)
+        return false;
+      const auto* LDRE =
+          llvm::dyn_cast<clang::DeclRefExpr>(LHS->IgnoreParenCasts());
+      const auto* ArgDRE = llvm::dyn_cast<clang::DeclRefExpr>(
+          m_Call->getArg(0)->IgnoreParenCasts());
+      return LDRE && ArgDRE && LDRE->getDecl() == ArgDRE->getDecl();
+    }
+
+    // The pointer variable of an in-place `p = realloc(p, n)`, or null.
+    [[nodiscard]] const clang::VarDecl*
+    getInPlaceReallocPtr(const clang::Expr* LHS) const {
+      if (!isInPlaceRealloc(LHS))
+        return nullptr;
+      return llvm::dyn_cast<clang::VarDecl>(
+          llvm::cast<clang::DeclRefExpr>(LHS->IgnoreParenCasts())->getDecl());
+    }
+
+  private:
+    AllocCallInfo(Kind k, clang::CallExpr* c) : m_Kind(k), m_Call(c) {}
+    Kind m_Kind = Kind::None;
+    clang::CallExpr* m_Call = nullptr;
+  };
+
 private:
   /// Based on To-Be-Recorded analysis performed before differentiation, tells
   /// UsefulToStoreGlobal whether a variable with a given SourceLocation has to
@@ -109,6 +191,16 @@ struct DiffRequest {
   const clang::Expr* Args = nullptr;
   /// Indexes of global GPU args of function as a subset of Args.
   std::vector<size_t> CUDAGlobalArgsIndexes;
+  /// Pointer variables that are the target of an in-place `p = realloc(p, n)`
+  /// in this function, collected by DiffCollector during planning. Reverse
+  /// mode gives exactly these an allocation-size shadow so the realloc can be
+  /// undone; other allocated pointers get none. Empty unless the body
+  /// reallocates in place.
+  std::set<const clang::VarDecl*> InPlaceReallocPtrs;
+  /// Whether VD is reallocated in place somewhere in this function.
+  bool isInPlaceReallocated(const clang::VarDecl* VD) const {
+    return InPlaceReallocPtrs.count(VD) != 0;
+  }
   /// Requested differentiation mode, forward or reverse.
   DiffMode Mode = DiffMode::unknown;
   /// If function appears in the call to clad::gradient/differentiate,
@@ -323,6 +415,10 @@ struct RequestOptions {
     void Walk(clang::DeclGroupRef DGR);
     bool VisitCallExpr(clang::CallExpr* E);
     bool VisitDeclRefExpr(clang::DeclRefExpr* DRE);
+    /// Record an in-place `p = realloc(p, n)` on the request whose body is
+    /// being traversed, so reverse mode knows p needs an allocation-size
+    /// shadow.
+    bool VisitBinaryOperator(clang::BinaryOperator* BO);
     bool VisitCXXConstructExpr(clang::CXXConstructExpr* e);
     bool shouldVisitImplicitCode() const { return true; }
     /// Here we use TraverseLambdaExpr and not VisitLambdaExpr to ensure the

include/clad/Differentiator/ReverseModeVisitor.h

@@ -591,6 +591,12 @@ namespace clad {
     /// @returns The call to memset if the condition is met, otherwise nullptr.
     clang::Expr* CheckAndBuildCallToMemset(clang::Expr* LHS, clang::Expr* RHS);
 
+    /// The byte-size operand of a malloc/calloc/realloc call, in the primal's
+    /// terms: malloc(n) -> n, calloc(k, s) -> k*s, realloc(p, n) -> n. Returns
+    /// null if `allocExpr` is not one of those. Used to track allocation sizes
+    /// so a realloc can be undone in the reverse sweep.
+    clang::Expr* buildAllocByteSize(clang::Expr* allocExpr);
+
     static DeclDiff<clang::StaticAssertDecl>
     DifferentiateStaticAssertDecl(const clang::StaticAssertDecl* SAD);
 

include/clad/Differentiator/VisitorBase.h

@@ -242,6 +242,11 @@ namespace clad {
     struct AdjointInfo {
       clang::VarDecl* Decl = nullptr;
       enum WrapKind : std::uint8_t { Plain, Deref, ParenDeref } Wrap = Plain;
+      /// For a pointer reallocated in place, the `size_t` variable tracking its
+      /// current allocation size in bytes: set where the pointer is allocated,
+      /// read where it is realloc'd to undo the resize in reverse. Null for
+      /// every other variable.
+      clang::VarDecl* AllocSize = nullptr;
     };
     /// Map used to keep track of variable declarations and match them
     /// with their derivatives.

lib/Differentiator/DiffPlanner.cpp

@@ -1569,6 +1569,18 @@ static QualType GetDerivedFunctionType(const CallExpr* CE) {
     return true;
   }
 
+  bool DiffCollector::VisitBinaryOperator(BinaryOperator* BO) {
+    // Runs while TraverseFunctionDeclOnce walks a request's body, with
+    // m_ParentReq pointing at that request (still local, added to the graph
+    // only after the walk) -- so this eagerly records into the very request
+    // reverse mode will consume. Outside a request body m_ParentReq is null.
+    if (m_ParentReq && BO->getOpcode() == BO_Assign)
+      if (const VarDecl* p = DiffRequest::AllocCallInfo::recognize(BO->getRHS())
+                                 .getInPlaceReallocPtr(BO->getLHS()))
+        m_ParentReq->InPlaceReallocPtrs.insert(p);
+    return true;
+  }
+
   bool DiffCollector::VisitDeclRefExpr(DeclRefExpr* DRE) {
     // m_TopMostReq is dereferenced below; it is null when PlanNestedRequest
     // walks a lazy request's body just to record its early-return flag, and no