[Bug middle-end/106559] New: Spurious warning format-truncation (regression from 9)

[Bug middle-end/106559] New: Spurious warning format-truncation (regression from 9)

[phdiv at fastmail dot fm]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106559

            Bug ID: 106559
           Summary: Spurious warning format-truncation (regression from 9)
           Product: gcc
           Version: 10.3.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: phdiv at fastmail dot fm
  Target Milestone: ---

Created attachment 53426
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53426&action=edit
Reproducer.

> cat w.cpp
extern char buffer[64];
extern unsigned int number[16];

void f(){
  static const char string[16][3]={
      "01","02","03","04","05","06","07","08",
      "09","10","11","12","13","14","15","16"};

  for(unsigned int i=0; i<16; ++i)
    __builtin_snprintf(buffer,sizeof(buffer),"%u (%s):   %8x",
      i,string[i],number[i]);
}

> g++ -O1 -Wformat-truncation -c w.cpp
w.cpp: In function 'void f()':
w.cpp:10:61: warning: '__builtin_snprintf' output may be truncated before the
last format character [-Wformat-truncation=]
   10 |     __builtin_snprintf(buffer,sizeof(buffer),"%u (%s):   %8x",
      |                                                             ^
w.cpp:10:23: note: '__builtin_snprintf' output between 17 and 65 bytes into a
destination of size 64
   10 |     __builtin_snprintf(buffer,sizeof(buffer),"%u (%s):   %8x",
      |     ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   11 |       i,string[i],number[i]);
      |       ~~~~~~~~~~~~~~~~~~~~~~


Granted, the documentation of Wformat-truncation mentions possible false
positives, but this is a regression in GCC 10 with respect to GCC 9
(and present up to trunk).

For some more variations which do or do not exhibit this bug, see 
https://godbolt.org/z/PvfrchP7E .

[Bug tree-optimization/106559] [10/11/12/13 Regression] Spurious warning -Wformat-truncation (regression from 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106559

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |10.5
           Priority|P3                          |P2
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-08-09
            Summary|Spurious warning            |[10/11/12/13 Regression]
                   |format-truncation           |Spurious warning
                   |(regression from 9)         |-Wformat-truncation
                   |                            |(regression from 9)
      Known to fail|                            |10.4.0, 11.3.0, 12.1.0,
                   |                            |9.5.0
      Known to work|                            |8.4.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/106559] [10/11/12/13 Regression] Spurious warning -Wformat-truncation (regression from 9)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106559

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org
             Blocks|                            |85741

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning triggers because it considers the size of the whole `string' array
passed as an argument to the %s directive.  It does that because the analysis
is unable to determine which array element the argument points to and it's not
"smart" enough to see that all the elements are strings of the same length. 
The output of the -fdump-tree-strlen option below helps see what's gooing on
(the numbers next  to each Result: show the minimum, maximum, likely, and
unlikely amount of output produced by the directive, with the corresponding
running totals in parentheses).

The problem can be reduced to a missed optimization opportunity in the test
following test case: the condition in each iteration of the loop is false so
the loop can be optimized away, but because of the incomplete analysis above it
is not.

void f (void)
{
  static const char string[16][3]={
      "01","02","03","04","05","06","07","08",
      "09","10","11","12","13","14","15","16"};

  for(unsigned int i=0; i<16; ++i)
      if (__builtin_strlen (string[i]) != 2)
          __builtin_abort ();
}

Short of improving the strlen optimization the warning could also be suppressed
by considering the cast in the assignment `_2 = (const char[3] *) ivtmp.11_15;'
and using the size of the array as the upper bound on the length of the string.
 (This wouldn't be safe for the optimization.)

Until this is fixed in GCC, the warning can be suppressed and the emitted code
improved by asserting in each iteration that the length of the string is (at
most) two, like so:

    if (__builtin_strlen (string[i]) != 2)
      __builtin_unreachable ();

pr106559.c:11: __builtin_snprintf: objsize = 64, fmtstr = "%u (%s):   %8x"
  Directive 1 at offset 0: "%u"
    Result: 1, 2, 2, 2 (1, 2, 2, 2)
  Directive 2 at offset 2: " (", length = 2
    Result: 2, 2, 2, 2 (3, 4, 4, 4)
  Directive 3 at offset 4: "%s"
    Result: 0, 47, 47, 9223372036854775807 (3, 51, 51, -9223372036854775805)
  Directive 4 at offset 6: "):   ", length = 5
    Result: 5, 5, 5, 5 (8, 56, 56, -9223372036854775800)
  Directive 5 at offset 11: "%8x"
    Result: 8, 8, 8, 8 (16, 64, 64, -9223372036854775792)
  Directive 6 at offset 14: "", length = 1
pr106559.c: In function ‘f’:
pr106559.c:11:61: warning: ‘__builtin_snprintf’ output may be truncated before
the last format character [-Wformat-truncation=]
   11 |     __builtin_snprintf(buffer,sizeof(buffer),"%u (%s):   %8x",
      |                                                             ^
pr106559.c:11:5: note: ‘__builtin_snprintf’ output between 17 and 65 bytes into
a destination of size 64
   11 |     __builtin_snprintf(buffer,sizeof(buffer),"%u (%s):   %8x",
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   12 |       i,string[i],number[i]);
      |       ~~~~~~~~~~~~~~~~~~~~~~

void f ()
{
  unsigned long ivtmp.11;
  unsigned long ivtmp.5;
  unsigned int i;
  static const char string[16][3] = {"01", "02", "03", "04", "05", "06", "07",
"08", "09", "10", "11", "12", "13", "14", "15", "16"};
  unsigned int _1;
  const char[3] * _2;
  unsigned int _18;

  <bb 2> [local count: 63136016]:
  ivtmp.11_17 = (unsigned long) &string;

  <bb 3> [local count: 1010605809]:
  # ivtmp.5_13 = PHI <ivtmp.5_14(5), 0(2)>
  # ivtmp.11_15 = PHI <ivtmp.11_16(5), ivtmp.11_17(2)>
  _18 = (unsigned int) ivtmp.5_13;
  _1 = MEM[(unsigned int *)&number + ivtmp.5_13 * 4];
  _2 = (const char[3] *) ivtmp.11_15;                                <<< cast
not considered
  __builtin_snprintf (&buffer, 64, "%u (%s):   %8x", _18, _2, _1);   <<<
warning here for _2


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85741
[Bug 85741] [meta-bug] bogus/missing -Wformat-overflow

[Bug tree-optimization/106559] [10/11/12/13 Regression] Spurious warning -Wformat-truncation (regression from 9)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106559

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cjamcl at gmail dot com

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 108091 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/106559] [11/12/13/14 Regression] Spurious warning -Wformat-truncation (regression from 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106559

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.