[Bug c++/100137] New: -Werror=array-bounds false positive:"subscript -1 is outside array bounds"

[Bug c++/100137] New: -Werror=array-bounds false positive:"subscript -1 is outside array bounds"

[spamandnoise at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

            Bug ID: 100137
           Summary: -Werror=array-bounds false positive:"subscript -1 is
                    outside array bounds"
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: spamandnoise at gmail dot com
  Target Milestone: ---

- exact version of GCC: 11.0.1 20210417 (bug first appeared in GCC 10.3)
- system type: x86_64-linux-gnu
- options given when GCC was configured/built: see below
- complete command line that triggers the bug: `g++ -O2 -Werror -Wall
-std=c++17 -c test.cpp`
compiler output:

-----
test.cpp: In function 'int main()':
test.cpp:38:11: error: array subscript -1 is outside array bounds of 'char [6]'
[-Werror=array-bounds]
   38 |     s.back() = '2';
      |     ~~~~~~^~
test.cpp:36:10: note: while referencing 'hello'
   36 |     char hello[] = "hello";
      |          ^~~~~
cc1plus: all warnings being treated as errors
Compiler returned: 1
-----
- preprocessed file that triggers the bug:

-----
typedef long unsigned int size_t;  // expanded from <stddef.h>

struct span
{
    span( char* _data, size_t _size )
    : first_( _data ),
      last_( _data != nullptr ? _data + _size : nullptr )
    {
        if ( _size != 0 && _data == nullptr ) throw 42;
    }

    char& back() const
    {
        //return *( first_ + ( last_ - first_ - 1 ) );  // this works
        return *( last_ - 1 );
    }

    char* first_;
    char* last_;
};

size_t string_length( char const * ptr, size_t max = (size_t) - 1 )
{
    size_t len = 0;
    while ( len < max && ptr[len] )
    {
        ++len;
    }
    return len;
}

int
main()
{
    char hello[] = "hello";
    span s{ hello, string_length( hello ) };
    s.back() = '2';
}
-----

`g++ -v` output:

-----
Using built-in specs.
COLLECT_GCC=/opt/compiler-explorer/gcc-snapshot/bin/g++
Target: x86_64-linux-gnu
Configured with: ../gcc-trunk-20210418/configure
--prefix=/opt/compiler-explorer/gcc-build/staging --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu --disable-bootstrap
--enable-multiarch --with-abi=m64 --with-multilib-list=m32,m64,mx32
--enable-multilib --enable-clocale=gnu --enable-languages=c,c++,fortran,ada,d
--enable-ld=yes --enable-gold=yes --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --enable-linker-build-id --enable-lto
--enable-plugins --enable-threads=posix
--with-pkgversion=Compiler-Explorer-Build
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.1 20210417 (experimental) (Compiler-Explorer-Build) 
COLLECT_GCC_OPTIONS='-fdiagnostics-color=always' '-g' '-o' '/app/output.s'
'-masm=intel' '-S' '-v' '-O2' '-Werror' '-Wall' '-std=c++17' '-shared-libgcc'
'-mtune=generic' '-march=x86-64' '-dumpdir' '/app/'

/opt/compiler-explorer/gcc-trunk-20210418/bin/../libexec/gcc/x86_64-linux-gnu/11.0.1/cc1plus
-quiet -v -imultiarch x86_64-linux-gnu -iprefix
/opt/compiler-explorer/gcc-trunk-20210418/bin/../lib/gcc/x86_64-linux-gnu/11.0.1/
-D_GNU_SOURCE <source> -quiet -dumpdir /app/ -dumpbase output.cpp -dumpbase-ext
.cpp -masm=intel -mtune=generic -march=x86-64 -g -O2 -Werror -Wall -std=c++17
-version -fdiagnostics-color=always -o /app/output.s
GNU C++17 (Compiler-Explorer-Build) version 11.0.1 20210417 (experimental)
(x86_64-linux-gnu)
        compiled by GNU C version 7.5.0, GMP version 6.1.0, MPFR version 3.1.4,
MPC version 1.0.3, isl version isl-0.18-GMP

GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
[...]
Compiler executable checksum: c26ce8a3d2d070f1dc9f9a165aea3eaf
-----

[Bug c++/100137] -Werror=array-bounds false positive:"subscript -1 is outside array bounds"

[spamandnoise at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

--- Comment #1 from Moritz Beutel <spamandnoise at gmail dot com> ---
The problem was discovered in gsl-lite by a user of the library:
https://github.com/gsl-lite/gsl-lite/issues/303

This bug (if confirmed) should probably be added to the -Warray-bounds
meta-bug:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org
     Ever confirmed|0                           |1
      Known to work|                            |10.2.0
          Component|c++                         |tree-optimization
             Status|UNCONFIRMED                 |NEW
            Summary|-Werror=array-bounds false  |[10/11 Regression]
                   |positive:"subscript -1 is   |-Warray-bounds false
                   |outside array bounds"       |positive on varying offset
                   |                            |plus negative
   Last reconfirmed|                            |2021-04-19
      Known to fail|                            |10.3.0, 11.0

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed.  The bug is caused by -Warray-bounds ignoring varying offsets
instead of setting the offset range to that of the referenced object. 
Bisection points to g:e7fd3b783238d034018443e43a58ff87908b4db6 but that just
exposed the underlying bug in the warning.  The test case triggers the false
positive in 10.3.0 and 11.0 but not in 10.2.0 or prior. 

int main ()
{
  ...
  <bb 5> [local count: 114863531]:
  # len_11 = PHI <18446744073709551615(3), len_23(4)>
  s ={v} {CLOBBER};
  s.first_ = &hello;
  iftmp.0_13 = &hello + len_11;                          <<< len_11:
VR_VARYING, iftmp.0_13 taken to point to &hello
  s.last_ = iftmp.0_13;
  _15 = len_11 != 0;
  MEM[(char &)iftmp.0_13 + 18446744073709551615] = 50;   <<< iftmp.0_13[-1] =
'2'; <<< -Warray-bounds
  hello ={v} {CLOBBER};
  s ={v} {CLOBBER};
  return 0;

}

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning bug was introduced in r262893 (GCC 10).  A trivial test case is:

$ cat a.c && gcc -O2 -S -Wall a.c
int f (long i)
{
  const char *p = "123";
  p += i;
  return p[-1];
}
a.c: In function ‘f’:
a.c:5:11: warning: array subscript -1 is outside array bounds of ‘char[4]’
[-Warray-bounds]
    5 |   return p[-1];
      |          ~^~~~

This same thing is handled correctly elsewhere (e.h., -Wstringop_overflow) so
the ideal fix is to replace the warning code with the new pointer_query class.

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[spamandnoise at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

--- Comment #4 from Moritz Beutel <spamandnoise at gmail dot com> ---
Interesting. I had figured that the test case could probably be reduced
further, but I didn't try because the bug appeared so brittle. Slightly
changing seemingly unrelated details made it vanish:

-----
// line 10:
        if ( _size != 0 && _data == nullptr ) throw 42;  // bug
        //if ( _size != 0 && _data == nullptr ) throw 42;  // no bug

// line 23:
size_t string_length( char const * ptr, size_t max = (size_t) -1 )  // bug
size_t string_length( char const * ptr, size_t max = (size_t) -2 )  // no bug

// line 26:
    while ( len < max && ptr[len] )  // bug
    while ( ptr[len] )  // no bug

-----

Link for experimentation: https://gcc.godbolt.org/z/af8P7v64T

[Bug tree-optimization/100137] [10/11/12 Regression] -Warray-bounds false positive on varying offset plus negative

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-June/573349.html

[Bug tree-optimization/100137] [10/11/12 Regression] -Warray-bounds false positive on varying offset plus negative

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.2

[Bug tree-optimization/100137] [10/11/12 Regression] -Warray-bounds false positive on varying offset plus negative

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.2                        |10.4

[Bug tree-optimization/100137] [10/11/12 Regression] -Warray-bounds false positive on varying offset plus negative

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:a110855667782dac7b674d3e328b253b3b3c919b

commit r12-2132-ga110855667782dac7b674d3e328b253b3b3c919b
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Jul 7 14:05:25 2021 -0600

    Correct handling of variable offset minus constant in -Warray-bounds
[PR100137]

    Resolves:
    PR tree-optimization/100137 - -Warray-bounds false positive on varying
offset plus negative
    PR tree-optimization/99121 - ICE in -Warray-bounds on a multidimensional
    PR tree-optimization/97027 - missing warning on buffer overflow storing a
larger scalar into a smaller array

    gcc/ChangeLog:

            PR tree-optimization/100137
            PR tree-optimization/99121
            PR tree-optimization/97027
            * builtins.c (access_ref::access_ref): Also set offmax.
            (access_ref::offset_in_range): Define new function.
            (access_ref::add_offset): Set offmax.
            (access_ref::inform_access): Handle access_none.
            (handle_mem_ref): Clear ostype.
            (compute_objsize_r): Handle ASSERT_EXPR.
            * builtins.h (struct access_ref): Add offmax member.
            * gimple-array-bounds.cc (array_bounds_checker::check_mem_ref): Use
            compute_objsize() and simplify.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/100137
            PR tree-optimization/99121
            PR tree-optimization/97027
            * c-c++-common/Warray-bounds-3.c: Remove xfail
            * c-c++-common/Warray-bounds-4.c: Add an expected warning.
            * c-c++-common/Warray-bounds-9.c: New test.
            * c-c++-common/Warray-bounds-10.c: New test.
            * g++.dg/asan/asan_test.C: Suppress expected warnings.
            * g++.dg/pr95768.C: Same.
            * g++.dg/warn/Warray-bounds-10.C: Adjust text of expected messages.
            * g++.dg/warn/Warray-bounds-11.C: Same.
            * g++.dg/warn/Warray-bounds-12.C: Same.
            * g++.dg/warn/Warray-bounds-13.C: Same.
            * g++.dg/warn/Warray-bounds-17.C: Same.
            * g++.dg/warn/Warray-bounds-20.C: Same.
            * gcc.dg/Warray-bounds-29.c: Same.
            * gcc.dg/Warray-bounds-30.c: Add xfail.
            * gcc.dg/Warray-bounds-31.c: Adjust text of expected messages.
            * gcc.dg/Warray-bounds-32.c: Same.
            * gcc.dg/Warray-bounds-52.c: Same.
            * gcc.dg/Warray-bounds-53.c: Same.
            * gcc.dg/Warray-bounds-58.c: Remove xfail.
            * gcc.dg/Warray-bounds-63.c: Adjust text of expected messages.
            * gcc.dg/Warray-bounds-66.c: Same.
            * gcc.dg/Warray-bounds-69.c: Same.
            * gcc.dg/Wstringop-overflow-34.c: Same.
            * gcc.dg/Wstringop-overflow-47.c: Same.
            * gcc.dg/Wstringop-overflow-61.c: Same.
            * gcc.dg/Warray-bounds-77.c: New test.
            * gcc.dg/Warray-bounds-78.c: New test.
            * gcc.dg/Warray-bounds-79.c: New test.

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|11.0                        |11.1.0
            Summary|[10/11/12 Regression]       |[10/11 Regression]
                   |-Warray-bounds false        |-Warray-bounds false
                   |positive on varying offset  |positive on varying offset
                   |plus negative               |plus negative

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in GCC 12.0.  The patch is too big to backport but a more targeted/modest
fix should be possible.

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137
Bug 100137 depends on bug 101374, which changed state.

Bug 101374 Summary: [12 Regression] bootstrap failure varpool.c:490:19: error: array subscript 'varpool_node[0]' is partly outside array bounds of 'varpool_node [0]' [-Werror=array-bounds]
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101374

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

[Bug tree-optimization/100137] [10/11 Regression] -Warray-bounds false positive on varying offset plus negative

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug tree-optimization/100137] [11 Regression] -Warray-bounds false positive on varying offset plus negative

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.