[Bug c++/102006] New: A false warning "Array subscript -N is outside array bounds warning"

[Bug c++/102006] New: A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

            Bug ID: 102006
           Summary: A false warning "Array subscript -N is outside array
                    bounds warning"
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: d-ef at yandex dot ru
  Target Milestone: ---

I am not sure if referencing an entire Git repository is allowed here, but
probably it is an easier way to reproduce the bug:

git clone https://github.com/dmitriano/Awl --branch gcc-warn
mkdir -p build/awl
cd build/awl
cmake ../../Awl/ -DCMAKE_BUILD_TYPE=Release
make Tests/ListTest.cpp.o

Compiler output:

/home/def/Awl/Tests/ListTest.cpp: In function ‘void List_TestFunc(const
awl::testing::TestContext&)’:
/home/def/Awl/Tests/ListTest.cpp:118:70: warning: array subscript 0 is outside
array bounds of ‘{anonymous}::ListHolder<awl::quick_link> [1]’ [-Warray-bounds]
  118 |             for (typename ELEMENT_LIST::iterator i = list.begin(); i !=
list.end(); ++i)
      |                                                                   
~~^~~~~~~~~~~~~
/home/def/Awl/Tests/ListTest.cpp:138:33: note: while referencing ‘holder’
  138 |     ListHolder<awl::quick_link> holder(context);
      |                                 ^~~~~~

If you comment line 114 in Tests/ListTest.cpp the warning disappears that
probably is a bit strange, because this line does not relate to the code that
produces the warning.

My OS: Ubuntu 18.04
My compiler: g++ (Ubuntu 11.1.0-1ubuntu1~18.04.1) 11.1.0

for more information on how to build Awl on Ubuntu 18 see
https://developernote.com/2021/08/compiling-awl-on-ubuntu-18-with-gcc-11/

[Bug c++/102006] A false warning "Array subscript -N is outside array bounds warning"

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Can you attach the prepcoessed source?

[Bug c++/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #2 from Dmitriano <d-ef at yandex dot ru> ---
Created attachment 51340
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51340&action=edit
preprocessed source file

[Bug c++/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #3 from Dmitriano <d-ef at yandex dot ru> ---
(In reply to Dmitriano from comment #2)
> Created attachment 51340 [details]
> preprocessed source file

attached ListTest.cpp.i file that I generated with the command

make Tests/ListTest.cpp.i

[Bug c++/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #4 from Dmitriano <d-ef at yandex dot ru> ---
(In reply to Andrew Pinski from comment #1)
> Can you attach the prepcoessed source?

attached ListTest.cpp.i file that I generated with the command

make Tests/ListTest.cpp.i

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |56456
                 CC|                            |msebor at gcc dot gnu.org
           Keywords|                            |diagnostic
          Component|c++                         |tree-optimization

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
I ca confirm the warning but not yet that it's a bug or limitation in GCC.

The IL does show an access via an out-of-bounds pointer to a local object:
(struct Element *)&holder + -32B, so it's working as designed.  I can't tell if
the access itself, adjusted for the offset of the member, is valid (i.e.,
what's D.146911's offset within holder), but even if it is, the warning
validates pointers without considering subsequent adjustments so if something
earlier ends up emitting one that's out-of-bounds the warning will trigger.

The out-of-bounds offset first shows up in the fixup_cfg3 dump.  ListHolder is
multiply derived from the same base class whose members freely cast the this
pointer to the derived class so maybe that somehow results in the intermediate
negative offset.  The translation unit is almost 90,000 of twisty C++ code so
it will take a bit of time to reduce to something manageable.

void List_TestFunc (const struct TestContext & context)
{
  ...
  struct ListHolder holder;
  ...
  <bb 3> [local count: 1073741824]:
  _15 = MEM[(struct base_single_link *)&holder].pNext;
  if (_15 != 0B)
    goto <bb 4>; [85.10%]
  else
    goto <bb 5>; [14.90%]

  <bb 4> [local count: 913754293]:
  iftmp.2_16 = &MEM[(struct Element *)_15 + -32B].D.146911;

  <bb 5> [local count: 1073741821]:
  # i$m_p_24 = PHI <iftmp.2_16(4), 0B(3)>
  goto <bb 8>; [100.00%]

  ...

  <bb 8> [local count: 9761289345]:
  # i$m_p_21 = PHI <i$m_p_24(5), _22(7)>
  if (&MEM[(struct Element *)&holder + -32B].D.146911 != i$m_p_21)   <<<
-Warray-bounds
    goto <bb 6>; [89.00%]
  else
    goto <bb 27>; [11.00%]


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456
[Bug 56456] [meta-bug] bogus/missing -Warray-bounds

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
It sounds like the usual upcasting of a link-only node which is strictly
non-conforming and can also result in TBAA issues but it's wide-spread.  Note I
didn't look into the source at all.

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #7 from Dmitriano <d-ef at yandex dot ru> ---
(In reply to Richard Biener from comment #6)
> It sounds like the usual upcasting of a link-only node which is strictly
> non-conforming and can also result in TBAA issues but it's wide-spread. 
> Note I didn't look into the source at all.

Yes it is a warning about upcasting, I cast a list node (or list link) of type
Link to list element of type T. Theoretically Link should always be a subobject
of T in my code.

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #8 from Dmitriano <d-ef at yandex dot ru> ---
(In reply to Dmitriano from comment #7)
> (In reply to Richard Biener from comment #6)
> > It sounds like the usual upcasting of a link-only node which is strictly
> > non-conforming and can also result in TBAA issues but it's wide-spread. 
> > Note I didn't look into the source at all.
> 
> Yes it is a warning about upcasting, I cast a list node (or list link) of
> type Link to list element of type T. Theoretically Link should always be a
> subobject of T in my code.

Saying more exactly, Link should be a subobject of T when I cast it, but not
always.

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #9 from Martin Sebor <msebor at gcc dot gnu.org> ---
Created attachment 51366
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51366&action=edit
Reduced test case.

Attached is a reduced test case.

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #10 from Martin Sebor <msebor at gcc dot gnu.org> ---
With the reduced test case from attachment 51366 I get the same warning:

$ gcc -O2 -S -Wall -std=c++20 -xc++ ListTest.cpp.i
In constructor ‘double_iterator<T, DLink, ForwardLink,
BackwardLink>::double_iterator(single_iterator<T, ForwardLink>) [with T =
Element; DLink = quick_link; ForwardLink = forward_link<quick_link>;
BackwardLink = backward_link<quick_link>]’,
    inlined from ‘quick_list<T, DLink>::iterator quick_list<T, DLink>::end()
[with T = Element; DLink = quick_link]’ at ListTest.cpp.i:66:43,
    inlined from ‘void ListHolder::PrintList()’ at ListTest.cpp.i:92:73,
    inlined from ‘void List_TestFunc(const TestContext&)’ at
ListTest.cpp.i:103:19:
ListTest.cpp.i:30:96: warning: array subscript 0 is outside array bounds of
‘ListHolder [1]’ [-Warray-bounds]
   30 | ator<T, ForwardLink> i) : double_iterator(static_cast<DLink *>(*i)) { }
      |                                                                   ^

ListTest.cpp.i: In function ‘void List_TestFunc(const TestContext&)’:
ListTest.cpp.i:102:14: note: at offset -16 into object ‘holder’ of size 16
  102 |   ListHolder holder (context);
      |              ^~~~~~

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[d-ef at yandex dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

--- Comment #11 from Dmitriano <d-ef at yandex dot ru> ---
It was UB in my code, I dereference a pointer to an object that does not exist.

[Bug tree-optimization/102006] A false warning "Array subscript -N is outside array bounds warning"

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102006

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #12 from Martin Sebor <msebor at gcc dot gnu.org> ---
Thanks for letting us know.  Resolving as invalid then.