[Bug tree-optimization/106931] New: -Wstringop-overflow false positive

[Bug tree-optimization/106931] New: -Wstringop-overflow false positive

[kasper93 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

            Bug ID: 106931
           Summary: -Wstringop-overflow false positive
           Product: gcc
           Version: 12.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kasper93 at gmail dot com
  Target Milestone: ---

Created attachment 53572
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53572&action=edit
minimal test case

Hello,

I noticed increased amount of -Wstringop-overflow warnings on FFmpeg build with
gcc 12.2.0, doesn't happen with gcc 11.3.0. At first glance most of them are
bogus and happen only when specific set of compiler flags are used.

I minimized one case, see attachment, it is pretty simple. I think gcc should
handle this properly. Happens with this specific command
gcc -O3 -fno-tree-vectorize -Wstringop-overflow -c test.c

Attached case is minimized cbs_av1.c. For more cases which looks like gcc12
regression you can compile FFmpeg
./configure --enable-lto
make

Note that lto has to be enabled, without lto it doesn't produce those warnings.
I can minimize more cases, but frankly I don't want to spend time minimizing it
only to see the same pattern at the end. So maybe let's work on this first.

Tested with FFmpeg 60d8c2019f

Thanks,
Kacper

[Bug tree-optimization/106931] [12/13 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic, needs-bisection
            Summary|-Wstringop-overflow false   |[12/13 Regression]
                   |positive                    |-Wstringop-overflow false
                   |                            |positive  -O3
                   |                            |-fno-tree-vectorize
   Target Milestone|---                         |12.3

[Bug tree-optimization/106931] [12/13 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize since r12-3300-gece28da924ddda8b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-09-13
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org
           Keywords|needs-bisection             |
             Status|UNCONFIRMED                 |NEW
            Summary|[12/13 Regression]          |[12/13 Regression]
                   |-Wstringop-overflow false   |-Wstringop-overflow false
                   |positive  -O3               |positive  -O3
                   |-fno-tree-vectorize         |-fno-tree-vectorize since
                   |                            |r12-3300-gece28da924ddda8b

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-3300-gece28da924ddda8b.

[Bug tree-optimization/106931] [12/13 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize with loop unrolling since r12-3300-gece28da924ddda8b

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression]          |[12/13 Regression]
                   |-Wstringop-overflow false   |-Wstringop-overflow false
                   |positive  -O3               |positive  -O3
                   |-fno-tree-vectorize since   |-fno-tree-vectorize with
                   |r12-3300-gece28da924ddda8b  |loop unrolling since
                   |                            |r12-3300-gece28da924ddda8b

--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> ---
The false positive is issued for the store to A[i_90] in BB 10 by the strlen
pass, where i_90's range is [8, 8].

  <bb 10> [local count: 712060]:
  _35 = (sizetype) i_90;
  _36 = B.1_83 + _35;
  _37 = *_36;
  A[i_90] = _37;    << -Wstringop-overflow
  _20 = _93 + 9;
  i_39 = (int) _20;
  goto <bb 12>; [100.00%]

Changing i's type to unsigned avoids the warning.  The IL looks very close but
i_90's range in BB 10 is VR_UNDEFINED instead.

The following is debug_ranger() output for BBs 9 and 10 in the original test
case.

=========== BB 9 ============
Imports: _93  
Exports: _8  i_90  _93  
         _8 : _93(I)  
         _86 : i_82(I)  
         _87 : i_82(I)  B.1_83(I)  _86  
         i_90 : _8  _93(I)  
i_82    [irange] int [7, 7] NONZERO 0x7
_93     [irange] unsigned int [0, 0] NONZERO 0x0
Relational : (_8 > _93)
    <bb 9> [local count: 801058]:
    _86 = (sizetype) i_82;
    _87 = B.1_83 + _86;
    _88 = *_87;
    A[i_82] = _88;
    _8 = _93 + 8;
    i_90 = (int) _8;
    if (i_90 != 8)
      goto <bb 10>; [88.89%]
    else
      goto <bb 12>; [11.11%]

_8 : [irange] unsigned int [8, 8] NONZERO 0x8
_86 : [irange] sizetype [7, 7] NONZERO 0x7
_87 : [irange] char * [1, +INF]
i_90 : [irange] int [8, 8] NONZERO 0x8
9->10  (T) _8 :         [irange] UNDEFINED
9->10  (T) i_90 :       [irange] UNDEFINED
9->10  (T) _93 :        [irange] UNDEFINED
9->12  (F) _8 :         [irange] unsigned int [8, 8] NONZERO 0x8
9->12  (F) i_90 :       [irange] int [8, 8] NONZERO 0x8
9->12  (F) _93 :        [irange] unsigned int [0, 0] NONZERO 0x0

=========== BB 10 ============
_93     [irange] UNDEFINED
    <bb 10> [local count: 712060]:
    _35 = (sizetype) i_90;
    _36 = B.1_83 + _35;
    _37 = *_36;
    A[i_90] = _37;
    _20 = _93 + 9;
    i_39 = (int) _20;
    goto <bb 12>; [100.00%]

whereas for the unsigned case:

=========== BB 10 ============
_85     [irange] UNDEFINED
i_90    [irange] UNDEFINED

[Bug tree-optimization/106931] [12/13 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize with loop unrolling since r12-3300-gece28da924ddda8b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/106931] [12/13/14 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize with loop unrolling since r12-3300-gece28da924ddda8b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug tree-optimization/106931] [12 Regression] -Wstringop-overflow false positive -O3 -fno-tree-vectorize with loop unrolling since r12-3300-gece28da924ddda8b

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106931

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12 Regression]
                   |-Wstringop-overflow false   |-Wstringop-overflow false
                   |positive  -O3               |positive  -O3
                   |-fno-tree-vectorize with    |-fno-tree-vectorize with
                   |loop unrolling since        |loop unrolling since
                   |r12-3300-gece28da924ddda8b  |r12-3300-gece28da924ddda8b
                 CC|                            |law at gcc dot gnu.org

--- Comment #4 from Jeffrey A. Law <law at gcc dot gnu.org> ---
False positive is fixed w/ gcc-13 and the trunk.