[Bug tree-optimization/107004] New: GCC12 warning in OOB access: array subscript is partly outside array bounds

[Bug tree-optimization/107004] New: GCC12 warning in OOB access: array subscript is partly outside array bounds

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

            Bug ID: 107004
           Summary: GCC12 warning in OOB access: array subscript is partly
                    outside array bounds
           Product: gcc
           Version: 12.2.0
               URL: https://godbolt.org/z/aoYh66EYb
            Status: UNCONFIRMED
          Keywords: TREE
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rogerio.souza at gmail dot com
  Target Milestone: ---

The code below triggers the warning:

/opt/compiler-explorer/gcc-12.2.0/include/c++/12.2.0/bits/stl_construct.h:119:7:
warning: array subscript 'int*[0]' is partly outside array bounds of 'unsigned
char [8]' [-Warray-bounds]
  119 |       ::new((void*)__p) _Tp(std::forward<_Args>(__args)...);
      |       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Source code:

#include <vector>
#include <cassert>

void foo(std::vector<int*>& v)
{
    assert(v.size() >= 1);
    v.resize(1);
}

Build command line:
g++ -std=c++20 -Wall -Wextra -pedantic -O3

Using -O2 prevents the warning, also if we use "-Wno-array-bounds". This issue
is not reproducible on GCC 11.3 or older.

Would this issue be a duplicate from
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105348?

The issue could be reproduced on Compiler Explorer:
https://godbolt.org/z/aoYh66EYb

Regards,
Rogerio

[Bug tree-optimization/107004] [12/13 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-09-22
     Ever confirmed|0                           |1
      Known to fail|                            |12.2.0, 13.0
             Blocks|                            |56456
   Target Milestone|---                         |12.3
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |11.3.0
            Summary|GCC12 warning in OOB        |[12/13 Regression] GCC12
                   |access: array subscript is  |warning in OOB access:
                   |partly outside array bounds |array subscript is partly
                   |                            |outside array bounds

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56456
[Bug 56456] [meta-bug] bogus/missing -Warray-bounds

[Bug tree-optimization/107004] [12/13 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|13.0                        |
            Summary|[12/13 Regression] GCC12    |[12 Regression] GCC12
                   |warning in OOB access:      |warning in OOB access:
                   |array subscript is partly   |array subscript is partly
                   |outside array bounds        |outside array bounds
                 CC|                            |marxin at gcc dot gnu.org
      Known to work|                            |13.0
           Keywords|                            |needs-bisection

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
This seems to be fixed since a while, not sure by what.

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed with r13-3596-ge7310e24b1c0ca67.

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[rogerio.souza at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

--- Comment #5 from Rogério de Souza Moraes <rogerio.souza at gmail dot com> ---
I tried to apply the patch r13-3596-ge7310e24b1c0ca67, but it has not fixed the
issue. Although, the issue is not reproducible on GCC 13.1.0.

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[sbouchex at infovista dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

sbouchex <sbouchex at infovista dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sbouchex at infovista dot com

--- Comment #6 from sbouchex <sbouchex at infovista dot com> ---
The same testcase is failing on :

[...]
g++ --version
g++ (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4)
[...]

[...]
[root@dev-sbo-eva-ol8 CorrCommon]# g++ -std=c++20 -Wall -Wextra -Werror
-pedantic -Warray-bounds -O3 -o /tmp/toto /tmp/toto.cpp
In file included from /usr/include/c++/13/bits/stl_iterator.h:85,
                 from /usr/include/c++/13/bits/stl_algobase.h:67,
                 from /usr/include/c++/13/vector:62,
                 from /tmp/toto.cpp:1:
In function 'constexpr void std::_Construct(_Tp*, _Args&& ...) [with _Tp =
int*; _Args = {}]',
    inlined from 'static constexpr _ForwardIterator
std::__uninitialized_default_n_1<true>::__uninit_default_n(_ForwardIterator,
_Size) [with _ForwardIterator = int**; _Size = long unsigned int]' at
/usr/include/c++/13/bits/stl_uninitialized.h:666:23,
    inlined from 'static constexpr _ForwardIterator
std::__uninitialized_default_n_1<true>::__uninit_default_n(_ForwardIterator,
_Size) [with _ForwardIterator = int**; _Size = long unsigned int]' at
/usr/include/c++/13/bits/stl_uninitialized.h:660:9,
    inlined from 'constexpr _ForwardIterator
std::__uninitialized_default_n(_ForwardIterator, _Size) [with _ForwardIterator
= int**; _Size = long unsigned int]' at
/usr/include/c++/13/bits/stl_uninitialized.h:706:20,
    inlined from 'constexpr _ForwardIterator
std::__uninitialized_default_n_a(_ForwardIterator, _Size, allocator<_Tp>&)
[with _ForwardIterator = int**; _Size = long unsigned int; _Tp = int*]' at
/usr/include/c++/13/bits/stl_uninitialized.h:773:44,
    inlined from 'constexpr void std::vector<_Tp,
_Alloc>::_M_default_append(size_type) [with _Tp = int*; _Alloc =
std::allocator<int*>]' at /usr/include/c++/13/bits/vector.tcc:668:41,
    inlined from 'constexpr void std::vector<_Tp, _Alloc>::resize(size_type)
[with _Tp = int*; _Alloc = std::allocator<int*>]' at
/usr/include/c++/13/bits/stl_vector.h:1013:21,
    inlined from 'void foo(std::vector<int*>&)' at /tmp/toto.cpp:7:13:
/usr/include/c++/13/bits/stl_construct.h:119:7: error: array subscript
'int*[0]' is partly outside array bounds of 'unsigned char [8]'
[-Werror=array-bounds=]
  119 |       ::new((void*)__p) _Tp(std::forward<_Args>(__args)...);
      |       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from
/usr/include/c++/13/x86_64-redhat-linux/bits/c++allocator.h:33,
                 from /usr/include/c++/13/bits/allocator.h:46,
                 from /usr/include/c++/13/vector:63:
In member function '_Tp* std::__new_allocator<_Tp>::allocate(size_type, const
void*) [with _Tp = int*]',
    inlined from 'constexpr _Tp* std::allocator< <template-parameter-1-1>
>::allocate(std::size_t) [with _Tp = int*]' at
/usr/include/c++/13/bits/allocator.h:198:40,
    inlined from 'static constexpr _Tp*
std::allocator_traits<std::allocator<_Up> >::allocate(allocator_type&,
size_type) [with _Tp = int*]' at
/usr/include/c++/13/bits/alloc_traits.h:482:28,
    inlined from 'constexpr std::_Vector_base<_Tp, _Alloc>::pointer
std::_Vector_base<_Tp, _Alloc>::_M_allocate(std::size_t) [with _Tp = int*;
_Alloc = std::allocator<int*>]' at
/usr/include/c++/13/bits/stl_vector.h:378:33,
    inlined from 'constexpr void std::vector<_Tp,
_Alloc>::_M_default_append(size_type) [with _Tp = int*; _Alloc =
std::allocator<int*>]' at /usr/include/c++/13/bits/vector.tcc:663:45,
    inlined from 'constexpr void std::vector<_Tp, _Alloc>::resize(size_type)
[with _Tp = int*; _Alloc = std::allocator<int*>]' at
/usr/include/c++/13/bits/stl_vector.h:1013:21,
    inlined from 'void foo(std::vector<int*>&)' at /tmp/toto.cpp:7:13:
/usr/include/c++/13/bits/new_allocator.h:147:55: note: at offset [1, 8] into
object of size 8 allocated by 'operator new'
  147 |         return static_cast<_Tp*>(_GLIBCXX_OPERATOR_NEW(__n *
sizeof(_Tp)));
      |                                                       ^
cc1plus: all warnings being treated as errors
[...]

[Bug tree-optimization/107004] [12 Regression] GCC12 warning in OOB access: array subscript is partly outside array bounds

[sbouchex at infovista dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107004

--- Comment #7 from sbouchex <sbouchex at infovista dot com> ---
(In reply to sbouchex from comment #6)
> The same testcase is failing on :
> 
> [...]
> g++ --version
> g++ (GCC) 13.1.1 20230614 (Red Hat 13.1.1-4)
> [...]
> 
> [...]
> [root@dev-sbo-eva-ol8 CorrCommon]# g++ -std=c++20 -Wall -Wextra -Werror
> -pedantic -Warray-bounds -O3 -o /tmp/toto /tmp/toto.cpp
> In file included from /usr/include/c++/13/bits/stl_iterator.h:85,
>                  from /usr/include/c++/13/bits/stl_algobase.h:67,
>                  from /usr/include/c++/13/vector:62,
>                  from /tmp/toto.cpp:1:
> In function 'constexpr void std::_Construct(_Tp*, _Args&& ...) [with _Tp =
> int*; _Args = {}]',
>     inlined from 'static constexpr _ForwardIterator
> std::__uninitialized_default_n_1<true>::__uninit_default_n(_ForwardIterator,
> _Size) [with _ForwardIterator = int**; _Size = long unsigned int]' at
> /usr/include/c++/13/bits/stl_uninitialized.h:666:23,
>     inlined from 'static constexpr _ForwardIterator
> std::__uninitialized_default_n_1<true>::__uninit_default_n(_ForwardIterator,
> _Size) [with _ForwardIterator = int**; _Size = long unsigned int]' at
> /usr/include/c++/13/bits/stl_uninitialized.h:660:9,
>     inlined from 'constexpr _ForwardIterator
> std::__uninitialized_default_n(_ForwardIterator, _Size) [with
> _ForwardIterator = int**; _Size = long unsigned int]' at
> /usr/include/c++/13/bits/stl_uninitialized.h:706:20,
>     inlined from 'constexpr _ForwardIterator
> std::__uninitialized_default_n_a(_ForwardIterator, _Size, allocator<_Tp>&)
> [with _ForwardIterator = int**; _Size = long unsigned int; _Tp = int*]' at
> /usr/include/c++/13/bits/stl_uninitialized.h:773:44,
>     inlined from 'constexpr void std::vector<_Tp,
> _Alloc>::_M_default_append(size_type) [with _Tp = int*; _Alloc =
> std::allocator<int*>]' at /usr/include/c++/13/bits/vector.tcc:668:41,
>     inlined from 'constexpr void std::vector<_Tp, _Alloc>::resize(size_type)
> [with _Tp = int*; _Alloc = std::allocator<int*>]' at
> /usr/include/c++/13/bits/stl_vector.h:1013:21,
>     inlined from 'void foo(std::vector<int*>&)' at /tmp/toto.cpp:7:13:
> /usr/include/c++/13/bits/stl_construct.h:119:7: error: array subscript
> 'int*[0]' is partly outside array bounds of 'unsigned char [8]'
> [-Werror=array-bounds=]
>   119 |       ::new((void*)__p) _Tp(std::forward<_Args>(__args)...);
>       |       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In file included from
> /usr/include/c++/13/x86_64-redhat-linux/bits/c++allocator.h:33,
>                  from /usr/include/c++/13/bits/allocator.h:46,
>                  from /usr/include/c++/13/vector:63:
> In member function '_Tp* std::__new_allocator<_Tp>::allocate(size_type,
> const void*) [with _Tp = int*]',
>     inlined from 'constexpr _Tp* std::allocator< <template-parameter-1-1>
> >::allocate(std::size_t) [with _Tp = int*]' at
> /usr/include/c++/13/bits/allocator.h:198:40,
>     inlined from 'static constexpr _Tp*
> std::allocator_traits<std::allocator<_Up> >::allocate(allocator_type&,
> size_type) [with _Tp = int*]' at
> /usr/include/c++/13/bits/alloc_traits.h:482:28,
>     inlined from 'constexpr std::_Vector_base<_Tp, _Alloc>::pointer
> std::_Vector_base<_Tp, _Alloc>::_M_allocate(std::size_t) [with _Tp = int*;
> _Alloc = std::allocator<int*>]' at
> /usr/include/c++/13/bits/stl_vector.h:378:33,
>     inlined from 'constexpr void std::vector<_Tp,
> _Alloc>::_M_default_append(size_type) [with _Tp = int*; _Alloc =
> std::allocator<int*>]' at /usr/include/c++/13/bits/vector.tcc:663:45,
>     inlined from 'constexpr void std::vector<_Tp, _Alloc>::resize(size_type)
> [with _Tp = int*; _Alloc = std::allocator<int*>]' at
> /usr/include/c++/13/bits/stl_vector.h:1013:21,
>     inlined from 'void foo(std::vector<int*>&)' at /tmp/toto.cpp:7:13:
> /usr/include/c++/13/bits/new_allocator.h:147:55: note: at offset [1, 8] into
> object of size 8 allocated by 'operator new'
>   147 |         return static_cast<_Tp*>(_GLIBCXX_OPERATOR_NEW(__n *
> sizeof(_Tp)));
>       |                                                       ^
> cc1plus: all warnings being treated as errors
> [...]


But no warning with -O2