[Bug middle-end/104986] [12 Regression] bogus writing 1 byte into a region of size 0 with -fwrapv and -O2 -fpeel-loops since r12-4698-gf6d012338bf87f42

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104986

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Andrew Macleod from comment #5)
> Looking at the strlen1 output, it only ever asks ranger about 6 names:
> 
> 334      range_of_expr(_36) at stmt _52 = iftmp.1_17 + _36;
>          TRUE : (334) range_of_expr (_36) sizetype [3, 5]
> maybe_invalidate called for *_52 = _60;
> maybe_invalidate returns 1
> 342      range_of_expr(_69) at stmt _71 = iftmp.1_7 + _69;
>          TRUE : (342) range_of_expr (_69) sizetype [3, 5]
> maybe_invalidate called for *_71 = _72;
> maybe_invalidate returns 1
> 348      range_of_expr(_6) at stmt _31 = iftmp.1_76 + _6;
>          TRUE : (348) range_of_expr (_6) sizetype [2, 4]
> maybe_invalidate called for *_31 = _32;
> maybe_invalidate returns 1
> 367      range_of_expr(_37) at stmt _39 = iftmp.1_76 + _37;
>          TRUE : (367) range_of_expr (_37) sizetype [1, 3]
> maybe_invalidate called for *_39 = _40;
>   statement may clobber object _31 0 bytes in size
>   
> maybe_invalidate returns 1
> 375      range_of_expr(_45) at stmt _47 = iftmp.1_76 + _45;
>          TRUE : (375) range_of_expr (_45) sizetype [0, 2]
> maybe_invalidate called for *_47 = _48;
>   statement may clobber object _39 0 bytes in size
> maybe_invalidate returns 1
> 383      range_of_expr(_53) at stmt _55 = iftmp.1_76 + _53;
>          TRUE : (383) range_of_expr (_53) sizetype [1, 1]

So maybe strlen can invoke ranger on GIMPLE_CONDs to mark unreachable
code on the fly?  IIRC domwalk has some ability to skip not executable
edges so if the walk makes sure to properly initialize that for
outgoing edges it might work in that it would refrain from
optimizing/diagnosing
in unreachable regions.

> Is there a reason it runs before vrp2?

Likely historical or the idea that VRP can do something with its results,
like propagate constants (but there's now a CCP pass after it).