[Bug middle-end/42577] New: array bounds false positive with -O3, goes away with -O2

[Bug middle-end/42577] New: array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2743 bytes --]

when building ScummVM (http://scummvm.org) using GCC 4.4.1 on Ubuntu
9.10/amd64:
matt@ghuang-desktop:~/src/scummvm$ g++-4.4
-Wp,-MMD,"engines/saga/.deps/animation.d",-MQ,"engines/saga/animation.o",-MP
-Wall -Werror -g -ansi -W -Wno-unused-parameter -Wno-empty-body -pedantic
-Wno-long-long -Wno-multichar -Wno-unknown-pragmas -Wno-reorder
-fno-strict-aliasing  -Wpointer-arith -Wcast-qual -Wcast-align -Wshadow
-Wimplicit -Wnon-virtual-dtor -Wwrite-strings -fno-rtti -fno-exceptions
-fcheck-new -O3 -Wuninitialized -DSCUMMVM_SVN_REVISION=\"46563\"
-DHAVE_CONFIG_H -DUNIX -DDATA_PATH=\"/usr/local/share/scummvm\"
-DPLUGIN_DIRECTORY=\"/usr/local/lib/scummvm\" -DSDL_BACKEND
-DENABLE_SCUMM=STATIC_PLUGIN -DENABLE_SCUMM_7_8 -DENABLE_HE
-DENABLE_AGI=STATIC_PLUGIN -DENABLE_AGOS=STATIC_PLUGIN -DENABLE_AGOS2
-DENABLE_CINE=STATIC_PLUGIN -DENABLE_CRUISE=STATIC_PLUGIN
-DENABLE_DRACI=STATIC_PLUGIN -DENABLE_DRASCULA=STATIC_PLUGIN
-DENABLE_GOB=STATIC_PLUGIN -DENABLE_GROOVIE=STATIC_PLUGIN -DENABLE_GROOVIE2
-DENABLE_KYRA=STATIC_PLUGIN -DENABLE_LOL -DENABLE_LURE=STATIC_PLUGIN
-DENABLE_M4=STATIC_PLUGIN -DENABLE_MADE=STATIC_PLUGIN
-DENABLE_PARALLACTION=STATIC_PLUGIN -DENABLE_QUEEN=STATIC_PLUGIN
-DENABLE_SAGA=STATIC_PLUGIN -DENABLE_IHNM -DENABLE_SAGA2
-DENABLE_SCI=STATIC_PLUGIN -DENABLE_SCI32 -DENABLE_SKY=STATIC_PLUGIN
-DENABLE_SWORD1=STATIC_PLUGIN -DENABLE_SWORD2=STATIC_PLUGIN
-DENABLE_TEENAGENT=STATIC_PLUGIN -DENABLE_TINSEL=STATIC_PLUGIN
-DENABLE_TOUCHE=STATIC_PLUGIN -DENABLE_TUCKER=STATIC_PLUGIN -I. -I. -I./engines
-I/usr/include/SDL -D_GNU_SOURCE=1 -D_REENTRANT -c engines/saga/animation.cpp
cc1plus: warnings being treated as errors
./engines/saga/animation.h: In member function ‘int
Saga::Anim::playCutaway(int, bool)’:
./engines/saga/animation.h:175: error: array subscript is above array bounds

Relevant code in question:
#define MAX_ANIMATIONS 10
AnimationData *_animations[MAX_ANIMATIONS];

void validateAnimationId(uint16 animId) {
  if (animId >= MAX_ANIMATIONS) {
    // ...
  } else {
    if (_animations[animId] == NULL) {
      error("validateAnimationId: animId=%i unassigned.", animId);
    }
  }
}

pre-processed output is attached. This bug appears to already be fixed in GCC
4.5 snapshot as on 2009-12-28.


-- 
           Summary: array bounds false positive with -O3, goes away with -O2
           Product: gcc
           Version: 4.4.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: matt at use dot net
 GCC build triplet: x86_64-linux-unknown
  GCC host triplet: x86_64-linux-unknown
GCC target triplet: x86_64-linux-unknown


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

------- Comment #1 from matt at use dot net  2010-01-01 21:02 -------
Created an attachment (id=19439)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=19439&action=view)
pre-processed output of the file that emitted the warning

commandline:
g++-4.4
-Wp,-MMD,"engines/saga/.deps/animation.d",-MQ,"engines/saga/animation.o",-MP
-Wall -Werror -g -ansi -W -Wno-unused-parameter -Wno-empty-body -pedantic
-Wno-long-long -Wno-multichar -Wno-unknown-pragmas -Wno-reorder
-fno-strict-aliasing  -Wpointer-arith -Wcast-qual -Wcast-align -Wshadow
-Wimplicit -Wnon-virtual-dtor -Wwrite-strings -fno-rtti -fno-exceptions
-fcheck-new -O3 -Wuninitialized -DSCUMMVM_SVN_REVISION=\"46563\"
-DHAVE_CONFIG_H -DUNIX -DDATA_PATH=\"/usr/local/share/scummvm\"
-DPLUGIN_DIRECTORY=\"/usr/local/lib/scummvm\" -DSDL_BACKEND
-DENABLE_SCUMM=STATIC_PLUGIN -DENABLE_SCUMM_7_8 -DENABLE_HE
-DENABLE_AGI=STATIC_PLUGIN -DENABLE_AGOS=STATIC_PLUGIN -DENABLE_AGOS2
-DENABLE_CINE=STATIC_PLUGIN -DENABLE_CRUISE=STATIC_PLUGIN
-DENABLE_DRACI=STATIC_PLUGIN -DENABLE_DRASCULA=STATIC_PLUGIN
-DENABLE_GOB=STATIC_PLUGIN -DENABLE_GROOVIE=STATIC_PLUGIN -DENABLE_GROOVIE2
-DENABLE_KYRA=STATIC_PLUGIN -DENABLE_LOL -DENABLE_LURE=STATIC_PLUGIN
-DENABLE_M4=STATIC_PLUGIN -DENABLE_MADE=STATIC_PLUGIN
-DENABLE_PARALLACTION=STATIC_PLUGIN -DENABLE_QUEEN=STATIC_PLUGIN
-DENABLE_SAGA=STATIC_PLUGIN -DENABLE_IHNM -DENABLE_SAGA2
-DENABLE_SCI=STATIC_PLUGIN -DENABLE_SCI32 -DENABLE_SKY=STATIC_PLUGIN
-DENABLE_SWORD1=STATIC_PLUGIN -DENABLE_SWORD2=STATIC_PLUGIN
-DENABLE_TEENAGENT=STATIC_PLUGIN -DENABLE_TINSEL=STATIC_PLUGIN
-DENABLE_TOUCHE=STATIC_PLUGIN -DENABLE_TUCKER=STATIC_PLUGIN -I. -I. -I./engines
-I/usr/include/SDL -D_GNU_SOURCE=1 -D_REENTRANT -E engines/saga/animation.cpp >
~/array-bounds-false-positive.i


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

------- Comment #2 from matt at use dot net  2010-01-01 21:16 -------
sorry, I lied. This is still an issue in GCC 4.5.20091228.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2010-01-01 22:42 -------
The array indexing is done with D.25175_104, but

  D.25173_102 = (uint16) cutawaySlot_256;
  D.25174_103 = D.25173_102 + 10;
  D.25175_104 = (int) D.25174_103;
...
  if (D.25174_103 > 9)
    goto <bb 26>;
  else
    goto <bb 30>;

the actual check is done on D.25174_103.  We do not add asserts for
D.25175_104 on the edge to BB30.  D.25174 is unsigned short.

So we end up with

D.25173_102: [0, 1]
D.25174_103: [10, 11]
D.25175_104: [10, 11]

and warn for the access that is dominated by BB30.

So the issue is that we warn for dead code.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #4 from rguenth at gcc dot gnu dot org  2010-01-02 14:57 -------
I have a patch.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |rguenth at gcc dot gnu dot
                   |dot org                     |org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2010-01-02 14:57:22
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4/4.5 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #5 from rguenth at gcc dot gnu dot org  2010-01-02 16:41 -------
It's at least a regression towards where we didn't have array bound warnings.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
            Summary|array bounds false positive |[4.4/4.5 Regression] array
                   |with -O3, goes away with -O2|bounds false positive with -
                   |                            |O3, goes away with -O2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4/4.5 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.4.3


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #7 from rguenth at gcc dot gnu dot org  2010-01-02 19:15 -------
Fixed on the trunk sofar.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|rguenth at gcc dot gnu dot  |unassigned at gcc dot gnu
                   |org                         |dot org
             Status|ASSIGNED                    |NEW
      Known to work|                            |4.5.0
            Summary|[4.4/4.5 Regression] array  |[4.4 Regression] array
                   |bounds false positive with -|bounds false positive with -
                   |O3, goes away with -O2      |O3, goes away with -O2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4/4.5 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #6 from rguenth at gcc dot gnu dot org  2010-01-02 19:15 -------
Subject: Bug 42577

Author: rguenth
Date: Sat Jan  2 19:14:52 2010
New Revision: 155577

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=155577
Log:
2010-01-02  Richard Guenther  <rguenther@suse.de>

        PR middle-end/42577
        * tree-vrp.c (check_all_array_refs): Skip non-excutable blocks.
        (simplify_switch_using_ranges): Mark to be removed edges
        as non-executable.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/tree-vrp.c


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

------- Comment #8 from matt at use dot net  2010-01-03 19:57 -------
can this be backported to 4.4 as well so I can integrate it into our 4.4-based
toolchain?


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #9 from rguenth at gcc dot gnu dot org  2010-01-03 22:33 -------
The patch should apply more-or-less literally to the 4.4 branch.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

------- Comment #10 from matt at use dot net  2010-01-04 01:04 -------
what I mean to ask is: can this fix be committed to the 4.4 branch? I'd prefer
to minimize the number of local patches we apply to our custom build.

Thanks for the quick fix, by the way! :)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

------- Comment #11 from rguenth at gcc dot gnu dot org  2010-01-04 14:26 -------
Sure, but let's wait for possible problems with the patch to show up in 4.5.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[jakub at gcc dot gnu dot org]

-- 

jakub at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.4.3                       |4.4.4


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[matt at use dot net]

------- Comment #12 from matt at use dot net  2010-02-10 01:26 -------
I haven't had any issues come up with this in the last month, testing with a
new profiledbootstrap of GCC trunk every week or so. Can this be backported to
4.4 now? Or is there some specific testing you'd like me to do? Let me know :)

Thanks!


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577

[Bug middle-end/42577] [4.4 Regression] array bounds false positive with -O3, goes away with -O2

[jakub at gcc dot gnu dot org]

-- 

jakub at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|4.4.4                       |4.4.5


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42577