[Bug c++/104165] New: Incorrectly identifying array bounds with -O2 -Werror=array-bounds

[Bug c++/104165] New: Incorrectly identifying array bounds with -O2 -Werror=array-bounds

[kbrabml at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

            Bug ID: 104165
           Summary: Incorrectly identifying array bounds with -O2
                    -Werror=array-bounds
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kbrabml at gmail dot com
  Target Milestone: ---

In file included from /home/install/include/c++/12.0.1/algorithm:61,
                 from repro.cpp:1:
In function ‘void std::__final_insertion_sort(_RandomAccessIterator,
_RandomAccessIterator, _Compare) [with _RandomAccessIterator = int*; _Compare =
__gnu_cxx::__ops::_Iter_comp_iter<bar(int, int)::<lambda(int, int)> >]’,
    inlined from ‘void std::__sort(_RandomAccessIterator,
_RandomAccessIterator, _Compare) [with _RandomAccessIterator = int*; _Compare =
__gnu_cxx::__ops::_Iter_comp_iter<bar(int, int)::<lambda(int, int)> >]’ at
/home/install/include/c++/12.0.1/bits/stl_algo.h:1940:31,
    inlined from ‘void std::sort(_RAIter, _RAIter, _Compare) [with _RAIter =
int*; _Compare = bar(int, int)::<lambda(int, int)>]’ at
/home/install/include/c++/12.0.1/bits/stl_algo.h:4853:18,
    inlined from ‘int bar(int, int)’ at repro.cpp:17:14,
    inlined from ‘int foo(int)’ at repro.cpp:25:13:
/home/install/include/c++/12.0.1/bits/stl_algo.h:1849:32: error: array
subscript 16 is outside array bounds of ‘unsigned char [16]’
[-Werror=array-bounds]
 1849 |           std::__insertion_sort(__first, __first + int(_S_threshold),
__comp);
      |          
~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘int bar(int, int)’,
    inlined from ‘int foo(int)’ at repro.cpp:25:13:
repro.cpp:4:7: note: at offset 64 into object ‘f.140’ of size 16
    4 |   int f[l];
      |       ^
cc1plus: all warnings being treated as errors
make: *** [Makefile:5: all] Error 1

Getting the above bogus warning when compiling following reproducer

#include <algorithm>

static int bar(int n, int l) { // make function non-static and warning goes
away
        int f[l];
        int x = 0;
        int r = n;

        for (; x < l;) {
                if (r) {
                        x = l;
                } else { // Take out this else and the warning goes away
                        r = 1;
                }
        }

        if (r == 1) { // Take out this branch and the warning goes away
                std::sort(f, f + x,
                                [](int a, int b) { return a > b; });
        }
        return 1;

}

int foo(int n) {
        return bar(n, 4);
}


Compiled with HEAD of GCC (as of 20/01/2021)
g++ -c -march=armv8-a -Werror -Wall -O2  repro.cpp

The compiler sees that the size of the array is 4 ints (16-bytes), but doesn't
see that x <= 4, so that no array out of bounds should occur. Workaround is to
use malloc for the array.

[Bug tree-optimization/104165] [12 Regression] Incorrectly identifying array bounds with -O2 -Werror=array-bounds

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |12.0
   Target Milestone|---                         |12.0
             Target|armv8-a                     |
           Keywords|                            |diagnostic
            Summary|Incorrectly identifying     |[12 Regression] Incorrectly
                   |array bounds with -O2       |identifying array bounds
                   |-Werror=array-bounds        |with -O2
                   |                            |-Werror=array-bounds
      Known to work|                            |11.1.0
          Component|c++                         |tree-optimization

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2022-01-21
             Blocks|                            |56456
            Summary|[12 Regression] Incorrectly |[12 Regression]
                   |identifying array bounds    |-Warray-bounds for
                   |with -O2                    |unreachable code inlined
                   |-Werror=array-bounds        |from std::sort()
     Ever confirmed|0                           |1

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning triggers for the out of bounds pointer addition in &f.148 + 64 for
an array of 16 chars:

int foo (int n)
{
  unsigned char f.148[16];
  ...
  <bb 8> [local count: 116203857]:
  _25 = ASSERT_EXPR <_15, _15 != &f.148>;
  _6 = (signed long) _14;
  _19 = _6 /[ex] 4;
  __n.3_20 = (long unsigned int) _19;
  _21 = __builtin_clzl (__n.3_20);
  _22 = 63 - _21;
  _23 = (long int) _22;
  _24 = _23 * 2;
  std::__introsort_loop<int*, long int,
__gnu_cxx::__ops::_Iter_comp_iter<bar(int, int)::<lambda(int, int)> > >
(&f.148, _25, _24, __comp);
  if (_14 > 64)
    goto <bb 9>; [50.00%]
  else
    goto <bb 15>; [50.00%]

  <bb 9> [local count: 58101929]:
  std::__insertion_sort.constprop (&f.148, &MEM <int[0:D.48109]> [(void
*)&f.148 + 64B]);   <<< -Warray-bounds
  goto <bb 14>; [100.00%]

The basic block is removed later, in CCP3, as unreachable:

Removing basic block 8
;; basic block 8, loop depth 0
;;  pred:      
std::__insertion_sort.constprop (&f.148, &MEM <int[0:D.48109]> [(void *)&f.148
+ 64B]);
if (&MEM <int[0:D.48109]> [(void *)&f.148 + 64B] != _15)
  goto <bb 9>; [89.00%]
else
  goto <bb 13>; [11.00%]
;;  succ:       9
;;              13


The warning runs too early to benefit from the subsequent simplification.  This
is one instance of a false positive that something like __builtin_warning()
would cure.

GCC 11 emits (and eliminates) the same invalid expression but the warning is
suppressed because in GCC 11 -Warray-bounds wasn't issued code inlined from
system headers.  That's a GCC 12 change.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456
[Bug 56456] [meta-bug] bogus/missing -Warray-bounds

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=2051783
           Keywords|                            |missed-optimization

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
See also another similar test case reduced in
https://bugzilla.redhat.com/show_bug.cgi?id=2051783:

#include <algorithm>

bool cond;
int foo;

int func (void)
{
  int a[3], qa = 0;
  for(int i = 0; i < 3; i++)
    if (cond)
      a[qa++] = foo;

  std::sort (a, a + qa);
  return 0;
}

The warning is issued for the synthesized call to std::__insertion_sort.isra()
in basic block 9 (vrp1 output):

  <bb 9> [local count: 71766220]:
  std::__insertion_sort.isra (&a, &MEM <int[3]> [(void *)&a + 64B]);   <<<
-Warray-bounds
  goto <bb 14>; [100.00%]

The block is unreachable but GCC is unable to determine that from the loop. 
Adding an annotation just after the loop asserting that avoids the warning and
also improves the emitted object code.

The same warning triggers in GCC 11 with -Wsystem-headers.  The difference in
GCC 12 is that -Wsystem-headers no longer disables warnings for code defined in
system headers that's inlined into user code.

[Bug tree-optimization/104165] [12/13 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.0                        |12.2

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 12.1 is being released, retargeting bugs to GCC 12.2.

[Bug tree-optimization/104165] [12/13 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org
      Known to work|                            |13.0
           Keywords|                            |needs-bisection
            Summary|[12/13 Regression]          |[12 Regression]
                   |-Warray-bounds for          |-Warray-bounds for
                   |unreachable code inlined    |unreachable code inlined
                   |from std::sort()            |from std::sort()

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
This seems to be fixed on trunk - can somebody bisect what did so?

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
r13-2894-gbe4a6551ed37c1e7dbdfb9400fc2e2b5d40c5be2 made the warning go away.

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:790ff87f675f28bce5e7e35918ae09c3ece4ec4d

commit r13-4499-g790ff87f675f28bce5e7e35918ae09c3ece4ec4d
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Dec 6 08:22:01 2022 +0100

    tree-optimization/104165 - bougs -Warray-bounds, add testcase

    The following adds the testcase from the description which was
    fixed by r13-2894-gbe4a6551ed37c1.

            PR tree-optimization/104165
            * g++.dg/warn/Warray-bounds-pr104165-1.C: New testcase.

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
I have opened PR107986 for the testcase in comment#2 which isn't yet fixed on
trunk.

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug tree-optimization/104165] [12 Regression] -Warray-bounds for unreachable code inlined from std::sort()

[fchelnokov at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104165

--- Comment #10 from Fedor Chelnokov <fchelnokov at gmail dot com> ---
This issue happens in GCC 13.2 as well:
https://godbolt.org/z/TfGx3YccG