From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 936D4393A433; Thu,  8 Jul 2021 15:47:50 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 936D4393A433
From: "msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug bootstrap/101374] [12 Regression] bootstrap failure
 varpool.c:490:19: error: array subscript 'varpool_node[0]' is partly outside
 array bounds of 'varpool_node [0]' [-Werror=array-bounds]
Date: Thu, 08 Jul 2021 15:47:50 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: bootstrap
X-Bugzilla-Version: 12.0
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: msebor at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: msebor at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 12.0
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-101374-4-sg14a3rBYV@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-101374-4@http.gcc.gnu.org/bugzilla/>
References: <bug-101374-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Jul 2021 15:47:50 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D101374

--- Comment #9 from Martin Sebor <msebor at gcc dot gnu.org> ---
For the test case the warning sees this:

int varpool_node::_ZN12varpool_node16get_availabilityEv.part.0 (struct
varpool_node * const this)
{
  ...
  struct symtab_node * _7;
  struct varpool_node * _12;
  ...
  <bb 2> [local count: 1073741824]:
  _7 =3D &this_1(D)->D.2395;            <<< varpool_node::symtab_node subob=
ject
  _11 =3D is_a<varpool_node*, symtab_node*> (_7);
  if (_11 !=3D 0)
    goto <bb 4>; [71.00%]
  else
    goto <bb 3>; [29.00%]

  <bb 3> [local count: 311385128]:

  <bb 4> [local count: 1073741824]:
  # _12 =3D PHI <_7(2), 0B(3)>          <<< _12 size is (at most) 4
  _15 =3D BIT_FIELD_REF <*_12, 8, 0>;   <<< -Warray-bounds

The MEM_REF *_12 accesses a varpool_node object with size 8 but _12 points =
to a
symtab_node subobject with size of just 4.  So the warning code works
correctly.  It triggers because the call to compute_objsize(..., 1, ...) (w=
ith
Object Size Type 1) respects subobject boundaries and so doesn't consider t=
hat
_12, or more precisely _7, points to a subobject of a larger object.  Before
r12-2132 -Warray-bounds did its own slightly more conservative computation
which was roughly equivalent to Object Size Type 0.

Calling compute_objsize(..., 0, ...) instead avoids the warning for the red=
uced
test case.  Let me see if it also fixes the rest of the problems.=