[Bug c/109716] New: bogus stringop-overread "reading 4 bytes from a region of size 0"

[Bug c/109716] New: bogus stringop-overread "reading 4 bytes from a region of size 0"

[david at ixit dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109716

            Bug ID: 109716
           Summary: bogus stringop-overread "reading 4 bytes from a region
                    of size 0"
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: david at ixit dot cz
  Target Milestone: ---
              Host: x86_64
            Target: x86_64

Compiler: 12.2.0, 13.0.1 20230315 (experimental) [master r13-6680-ga9ae16db8cb]
Sources: https://gitlab.freedesktop.org/mesa/mesa/ main branch, (commit
b59935e2e77ed6ccf210103b028d671ee277a607 )
Command: CC=/usr/lib/gcc-snapshot/bin/gcc CXX=/usr/lib/gcc-snapshot/bin/g++
meson setup builddir-snapshot -D libdir=lib -D buildtype=release -D
build-tests=false -D enable-glcpp-tests=false -D libunwind=enabled -D glx=dri
-D gbm=enabled -D egl=enabled -D platforms=x11,wayland -D dri3=enabled -D
gallium-extra-hud=true -D gallium-vdpau=disabled -D gallium-omx=disabled -D
gallium-va=disabled -D gallium-xa=disabled -D gallium-nine=false -D
gallium-opencl=disabled -D gallium-rusticl=false -D llvm=enabled -D
gallium-drivers=r300,i915,iris,swrast -D vulkan-drivers=panfrost -D
video-codecs=h264dec,h264enc,h265dec,h265enc -D spirv-to-dxil=false -D
osmesa=true -D intel-clc=disabled -D imagination-srv=false
```
[1447/1646] Compiling C object
src/gallium/drivers/r300/libr300.a.p/r300_state_derived.c.o
../src/gallium/drivers/r300/r300_state_derived.c: In function
'r300_get_border_color':
../src/gallium/drivers/r300/r300_state_derived.c:676:5: warning:
'util_format_unswizzle_4f' reading 4 bytes from a region of size 0
[-Wstringop-overread]
  676 |     util_format_unswizzle_4f(border_swizzled, border, desc->swizzle);
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../src/gallium/drivers/r300/r300_state_derived.c:676:5: note: referencing
argument 3 of type 'const unsigned char[4]'
In file included from ../src/compiler/nir/nir.h:43,
                 from ../src/gallium/auxiliary/draw/draw_context.h:42,
                 from ../src/gallium/drivers/r300/r300_state_derived.c:24:
../src/util/format/u_format.h:1684:6: note: in a call to function
'util_format_unswizzle_4f'
 1684 | void util_format_unswizzle_4f(float *dst, const float *src,
      |      ^~~~~~~~~~~~~~~~~~~~~~~~
```

Our project bug: https://gitlab.freedesktop.org/mesa/mesa/-/issues/8651

[Bug tree-optimization/109716] bogus stringop-overread "reading 4 bytes from a region of size 0"

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109716

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |97048
          Component|c                           |tree-optimization
   Last reconfirmed|                            |2023-05-03
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |WAITING
           Keywords|                            |diagnostic

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Can you attach the preprocessed source as requested on
https://gcc.gnu.org/bugs/ ?


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97048
[Bug 97048] [meta-bug] bogus/missing -Wstringop-overread warnings

[Bug tree-optimization/109716] bogus stringop-overread "reading 4 bytes from a region of size 0"

[david at ixit dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109716

--- Comment #2 from David Heidelberg (okias) <david at ixit dot cz> ---
Created attachment 55001
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55001&action=edit
r300_state_derived.c.i.gz

Appending requested file. Thank you!

[Bug tree-optimization/109716] mesa/r300 bogus stringop-overread "reading 4 bytes from a region of size 0"

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109716

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |UNCONFIRMED
     Ever confirmed|1                           |0

[Bug tree-optimization/109716] mesa/r300 bogus stringop-overread "reading 4 bytes from a region of size 0"

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109716

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The warning comes from:
  <bb 24> [local count: 64057779]:
  util_format_unswizzle_4f (&border_swizzled, _42, 64B);
  goto <bb 38>; [100.00%]


Jump threading and having util_format_description declared as const causes a
null pointer for desc to prograted into the argument of that function.

Some places check the return value of util_format_description to see if it was
non-null whiles others do not. I am not sure if we can assert the return value
of util_format_description is non-null in r300_get_border_color but that
removes the warning.

That is:
static uint32_t r300_get_border_color(enum pipe_format format,
                                      const float border[4],
                                      boolean is_r500)
{
    const struct util_format_description *desc;
    float border_swizzled[4] = {0};
    union util_color uc = {0};

    desc = util_format_description(format);
    if (desc == 0)  __builtin_unreachable();