[Bug c++/100137] New: -Werror=array-bounds false positive:"subscript -1 is outside array bounds"

["spamandnoise at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100137

            Bug ID: 100137
           Summary: -Werror=array-bounds false positive:"subscript -1 is
                    outside array bounds"
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: spamandnoise at gmail dot com
  Target Milestone: ---

- exact version of GCC: 11.0.1 20210417 (bug first appeared in GCC 10.3)
- system type: x86_64-linux-gnu
- options given when GCC was configured/built: see below
- complete command line that triggers the bug: `g++ -O2 -Werror -Wall
-std=c++17 -c test.cpp`
compiler output:

-----
test.cpp: In function 'int main()':
test.cpp:38:11: error: array subscript -1 is outside array bounds of 'char [6]'
[-Werror=array-bounds]
   38 |     s.back() = '2';
      |     ~~~~~~^~
test.cpp:36:10: note: while referencing 'hello'
   36 |     char hello[] = "hello";
      |          ^~~~~
cc1plus: all warnings being treated as errors
Compiler returned: 1
-----
- preprocessed file that triggers the bug:

-----
typedef long unsigned int size_t;  // expanded from <stddef.h>

struct span
{
    span( char* _data, size_t _size )
    : first_( _data ),
      last_( _data != nullptr ? _data + _size : nullptr )
    {
        if ( _size != 0 && _data == nullptr ) throw 42;
    }

    char& back() const
    {
        //return *( first_ + ( last_ - first_ - 1 ) );  // this works
        return *( last_ - 1 );
    }

    char* first_;
    char* last_;
};

size_t string_length( char const * ptr, size_t max = (size_t) - 1 )
{
    size_t len = 0;
    while ( len < max && ptr[len] )
    {
        ++len;
    }
    return len;
}

int
main()
{
    char hello[] = "hello";
    span s{ hello, string_length( hello ) };
    s.back() = '2';
}
-----

`g++ -v` output:

-----
Using built-in specs.
COLLECT_GCC=/opt/compiler-explorer/gcc-snapshot/bin/g++
Target: x86_64-linux-gnu
Configured with: ../gcc-trunk-20210418/configure
--prefix=/opt/compiler-explorer/gcc-build/staging --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu --disable-bootstrap
--enable-multiarch --with-abi=m64 --with-multilib-list=m32,m64,mx32
--enable-multilib --enable-clocale=gnu --enable-languages=c,c++,fortran,ada,d
--enable-ld=yes --enable-gold=yes --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --enable-linker-build-id --enable-lto
--enable-plugins --enable-threads=posix
--with-pkgversion=Compiler-Explorer-Build
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.1 20210417 (experimental) (Compiler-Explorer-Build) 
COLLECT_GCC_OPTIONS='-fdiagnostics-color=always' '-g' '-o' '/app/output.s'
'-masm=intel' '-S' '-v' '-O2' '-Werror' '-Wall' '-std=c++17' '-shared-libgcc'
'-mtune=generic' '-march=x86-64' '-dumpdir' '/app/'

/opt/compiler-explorer/gcc-trunk-20210418/bin/../libexec/gcc/x86_64-linux-gnu/11.0.1/cc1plus
-quiet -v -imultiarch x86_64-linux-gnu -iprefix
/opt/compiler-explorer/gcc-trunk-20210418/bin/../lib/gcc/x86_64-linux-gnu/11.0.1/
-D_GNU_SOURCE <source> -quiet -dumpdir /app/ -dumpbase output.cpp -dumpbase-ext
.cpp -masm=intel -mtune=generic -march=x86-64 -g -O2 -Werror -Wall -std=c++17
-version -fdiagnostics-color=always -o /app/output.s
GNU C++17 (Compiler-Explorer-Build) version 11.0.1 20210417 (experimental)
(x86_64-linux-gnu)
        compiled by GNU C version 7.5.0, GMP version 6.1.0, MPFR version 3.1.4,
MPC version 1.0.3, isl version isl-0.18-GMP

GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
[...]
Compiler executable checksum: c26ce8a3d2d070f1dc9f9a165aea3eaf
-----