[Bug c++/104603] New: wrong detection of g++ -Warray-bounds about downcast

[Bug c++/104603] New: wrong detection of g++ -Warray-bounds about downcast

[herumi at nifty dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

            Bug ID: 104603
           Summary: wrong detection of g++ -Warray-bounds about downcast
           Product: gcc
           Version: 10.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: herumi at nifty dot com
  Target Milestone: ---

Created attachment 52477
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52477&action=edit
a minimal sample of the bug

g++-10.3.0 and g++-11.2 -O2 -Warray-bounds on Ubuntu 20.04.3 LTS show wrong
warnings to the attachment code.

g++ -O2 -Warray-bounds -DA t.cpp does not show the warnings.
g++-9 -O2 -Warray-bounds does not, too.

---
>cat t.cpp
struct Base {
  bool isX_;
  Base(bool isX = false) : isX_(isX) { }
  bool isX() const { return isX_; }
  bool operator==(const Base& rhs) const;
};

struct X : public Base {
  X(const Base& b) : Base(true), b_(b) { }
  bool operator==(const X& rhs) const { return b_ == rhs.b_; }
  Base b_;
};

inline bool Base::operator==(const Base& rhs) const
{
    return isX() && rhs.isX() && static_cast<const X&>(*this) ==
static_cast<const X&>(rhs);
}

Base base;

#ifndef A
void f()
{
  X(base) == X(base);
}
#endif

int main()
{
#ifdef A
  X(base) == X(base);
#endif
}
---

---
% g++-10 --version
g++-10 (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0
% g++-10 -O2 -Warray-bounds array-bounds-bug.cpp
array-bounds-bug.cpp: In function 'void f()':
array-bounds-bug.cpp:18:29: warning: array subscript 2 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:9: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |         ^
array-bounds-bug.cpp:18:29: warning: array subscript 2 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:20: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |                    ^
array-bounds-bug.cpp:18:29: warning: array subscript 3 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:9: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |         ^
array-bounds-bug.cpp:18:29: warning: array subscript 3 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:20: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |                    ^
array-bounds-bug.cpp:18:29: warning: array subscript 4 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:9: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |         ^
array-bounds-bug.cpp:18:29: warning: array subscript 4 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:20: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |                    ^
array-bounds-bug.cpp:18:29: warning: array subscript 5 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:9: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |         ^
array-bounds-bug.cpp:18:29: warning: array subscript 5 is outside array bounds
of 'X [1]' [-Warray-bounds]
   18 |   bool isX() const { return isX_; }
      |                             ^~~~
array-bounds-bug.cpp:38:20: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |                    ^
array-bounds-bug.cpp:24:51: warning: array subscript 2 is outside array bounds
of 'X [1]' [-Warray-bounds]
   24 |   bool operator==(const X& rhs) const { return b_ == rhs.b_; }
      |                                                ~~~^~~~~~~~~
array-bounds-bug.cpp:38:9: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
      |         ^
array-bounds-bug.cpp:24:58: warning: array subscript 2 is outside array bounds
of 'X [1]' [-Warray-bounds]
   24 |   bool operator==(const X& rhs) const { return b_ == rhs.b_; }
      |                                                      ~~~~^~
array-bounds-bug.cpp:38:20: note: while referencing '<anonymous>'
   38 |   X(base) == X(base);
---

[Bug c++/104603] wrong detection of g++ -Warray-bounds about downcast

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
-DA just changes inlining.

This is just an inlining mess which you can see from the diagnostic on the
trunk:
In member function 'bool Base::isX() const',
    inlined from 'bool Base::operator==(const Base&) const' at <source>:16:15,
    inlined from 'bool X::operator==(const X&) const' at <source>:10:51,
    inlined from 'bool Base::operator==(const Base&) const' at <source>:16:63,
    inlined from 'bool X::operator==(const X&) const' at <source>:10:51,
    inlined from 'void f()' at <source>:24:11:
<source>:4:29: warning: array subscript 2 is outside array bounds of 'X [1]'
[-Warray-bounds]
    4 |   bool isX() const { return isX_; }
      |                             ^~~~


The warning happens before some other optimizations happen which allows GCC to
prove the function will just always return false ...

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|wrong detection of g++      |[10/11/12 Regression] wrong
                   |-Warray-bounds about        |detection of
                   |downcast                    |-Warray-bounds for
                   |                            |interesting tail resusive
                   |                            |case
          Component|c++                         |tree-optimization
   Target Milestone|---                         |10.4

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Someone else needs to look into this further than me because the warning only
happens because there are cases where the access can happen but the accesses
are not really used.

Also if this is from some larger code, it might be useful to have the
non-reduced testcase since the reduced testcase might being showing something
different.

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[herumi at nifty dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #3 from herumi <herumi at nifty dot com> ---
>Also if this is from some larger code,
>it might be useful to have the non-reduced testcase
>since the reduced testcase might being showing something different.

The reason why I made this code is from the issue:
https://github.com/herumi/xbyak/issues/137

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to herumi from comment #3)
> The reason why I made this code is from the issue:
> https://github.com/herumi/xbyak/issues/137

Can you file a seperate issue with the preprocessed source (-save-temps) since
it really does look like a seperate issue all together. If it is not a seperate
issue in the end, at least we recorded the issue with the original source.

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[herumi at nifty dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #5 from herumi <herumi at nifty dot com> ---

>Can you file a seperate issue with the preprocessed source (-save-temps) since it really does look like a seperate issue all together.

May I attach a zipped a.ii which is generated by the following commands?
The size of a.ii is over 1700KiB.

---
>cat a.cpp
#include <xbyak/xbyak.h>

using namespace Xbyak::util;

void f()
{
  ptr[eax] == ptr[eax];
}
---
---
g++-11.2 -O2 -I ../ -Warray-bounds -c a.cpp -save-temps
---

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to herumi from comment #5)
> >Can you file a seperate issue with the preprocessed source (-save-temps) since it really does look like a seperate issue all together.
> 
> May I attach a zipped a.ii which is generated by the following commands?

Zipped is perfect.

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[herumi at nifty dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

--- Comment #7 from herumi <herumi at nifty dot com> ---
Created attachment 52478
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52478&action=edit
an original code

The array-bounds.zip file is a little stripped original issue.

array-bounds% g++-11.2 -O2 -c a.cpp -Warray-bounds -save-temps

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-03-01
                 CC|                            |msebor at gcc dot gnu.org

--- Comment #8 from Martin Sebor <msebor at gcc dot gnu.org> ---
It looks like the problem is that the call to Base::operator==() might enter
infinite recursion.  With the changed test case below GCC issues
-Winfinite-recursion pointing it out.  With the original test case the infinite
recursion isn't inevitable but because it can't be ruled out GCC emits
(invalid) code that then triggers -Warray-bounds.  It might be possible to do
better: detect the possible infinite recursion early and fold the equality to
false.  (As far as I can see, that's what recent Clang seems to do.)

$ cat pr104603.C && gcc -O2 -S -Wall -fdump-tree-optimized=/dev/stdout
pr104603.C
struct Base {
  bool isX_;
  Base(bool isX = false) : isX_(isX) { }
  bool isX() const { return isX_; }
  bool operator==(const Base& rhs) const;
};

struct X : public Base {
  X(const Base& b) : Base(true), b_(b) { }
  bool operator==(const X& rhs) const { return b_ == rhs.b_; }
  Base b_;
};

inline bool Base::operator==(const Base& rhs) const
{
    return /* isX() && rhs.isX() && */ static_cast<const X&>(*this) ==
static_cast<const X&>(rhs);
}

Base base (true);

int main ()
{
  return X(base) == X(base);
}
pr104603.C: In member function ‘bool X::operator==(const X&) const’:
pr104603.C:10:8: warning: infinite recursion detected [-Winfinite-recursion]
   10 |   bool operator==(const X& rhs) const { return b_ == rhs.b_; }
      |        ^~~~~~~~
In member function ‘bool Base::operator==(const Base&) const’,
    inlined from ‘bool X::operator==(const X&) const’ at pr104603.C:10:51:
pr104603.C:16:69: note: recursive call
   16 | rn /* isX() && rhs.isX() && */ static_cast<const X&>(*this) ==
static_cast<const X&>(rhs);
      |                               
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~


;; Function main (main, funcdef_no=9, decl_uid=2452, cgraph_uid=10,
symbol_order=10) (executed once)

Merging blocks 3 and 4
int main ()
{
  <bb 2> [local count: 10631108]:

  <bb 3> [local count: 1073741824]:
  goto <bb 3>; [100.00%]

}

[Bug tree-optimization/104603] [10/11/12 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |missed-optimization
           Priority|P3                          |P2

[Bug tree-optimization/104603] [10/11/12/13 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug tree-optimization/104603] [11/12/13/14 Regression] wrong detection of -Warray-bounds for interesting tail resusive case

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104603

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.