[Bug c++/109791] New: -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[Bug c++/109791] New: -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[szhong at perforce dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

            Bug ID: 109791
           Summary: -Wstringop-overflow warning with -O3 and
                    _GLIBCXX_USE_CXX11_ABI=0
           Product: gcc
           Version: 12.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: szhong at perforce dot com
  Target Milestone: ---

Created attachment 55033
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55033&action=edit
preprocessed file

It appears -fvect-cost-model=dynamic from the -O3 flag is causing the
-Wstringop-overflow warning.

testcase:

#include <algorithm>
#include <string>

int main()
{
    char str[] = " a";
    do {
        std::string input(str, sizeof(str) / sizeof(*str));
    }
    while (std::next_permutation(str, str + sizeof(str) / sizeof(*str)));

    return 0;
}


$ g++ -v -save-temps -m64 -D_GLIBCXX_USE_CXX11_ABI=0 -O2
-fvect-cost-model=dynamic no_cxx11_abi.cpp
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-redhat-linux
Configured with: ../configure --enable-bootstrap
--enable-languages=c,c++,fortran,lto --prefix=/opt/rh/gcc-toolset-12/root/usr
--mandir=/opt/rh/gcc-toolset-12/root/usr/share/man
--infodir=/opt/rh/gcc-toolset-12/root/usr/share/info
--with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-shared
--enable-threads=posix --enable-checking=release --enable-multilib
--with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions
--enable-gnu-unique-object --enable-linker-build-id
--with-gcc-major-version-only --enable-libstdcxx-backtrace
--with-linker-hash-style=gnu --enable-plugin --enable-initfini-array
--with-isl=/builddir/build/BUILD/gcc-12.1.1-20220628/obj-x86_64-redhat-linux/isl-install
--enable-offload-targets=nvptx-none --without-cuda-driver
--enable-offload-defaulted --enable-gnu-indirect-function --enable-cet
--with-tune=generic --with-arch_64=x86-64-v2 --with-arch_32=x86-64
--build=x86_64-redhat-linux --with-build-config=bootstrap-lto
--enable-link-serialization=1
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.1.1 20220628 (Red Hat 12.1.1-3) (GCC) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m64' '-D' '_GLIBCXX_USE_CXX11_ABI=0'
'-O2' '-fvect-cost-model=dynamic' '-shared-libgcc' '-mtune=generic'
'-march=x86-64-v2' '-dumpdir' 'a-'
 /opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/cc1plus -E
-quiet -v -D_GNU_SOURCE -D _GLIBCXX_USE_CXX11_ABI=0 no_cxx11_abi.cpp -m64
-mtune=generic -march=x86-64-v2 -fvect-cost-model=dynamic -O2 -fpch-preprocess
-o a-no_cxx11_abi.ii
ignoring nonexistent directory
"/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/include-fixed"
ignoring nonexistent directory
"/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../x86_64-redhat-linux/include"
#include "..." search starts here:
#include <...> search starts here:

/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12

/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12/x86_64-redhat-linux

/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12/backward
 /opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/include
 /usr/local/include
 /opt/rh/gcc-toolset-12/root/usr/include
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m64' '-D' '_GLIBCXX_USE_CXX11_ABI=0'
'-O2' '-fvect-cost-model=dynamic' '-shared-libgcc' '-mtune=generic'
'-march=x86-64-v2' '-dumpdir' 'a-'
 /opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/cc1plus
-fpreprocessed a-no_cxx11_abi.ii -quiet -dumpdir a- -dumpbase no_cxx11_abi.cpp
-dumpbase-ext .cpp -m64 -mtune=generic -march=x86-64-v2 -O2 -version
-fvect-cost-model=dynamic -o a-no_cxx11_abi.s
GNU C++17 (GCC) version 12.1.1 20220628 (Red Hat 12.1.1-3)
(x86_64-redhat-linux)
        compiled by GNU C version 12.1.1 20220628 (Red Hat 12.1.1-3), GMP
version 6.2.0, MPFR version 4.1.0-p9, MPC version 1.2.1, isl version
isl-0.18-GMP

GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C++17 (GCC) version 12.1.1 20220628 (Red Hat 12.1.1-3)
(x86_64-redhat-linux)
        compiled by GNU C version 12.1.1 20220628 (Red Hat 12.1.1-3), GMP
version 6.2.0, MPFR version 4.1.0-p9, MPC version 1.2.1, isl version
isl-0.18-GMP

GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: 4fe953bdd6603241811586d9fd73a7cb
In file included from
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_pair.h:61,
                 from
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algobase.h:64,
                 from
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/algorithm:60,
                 from no_cxx11_abi.cpp:1:
In function \u2018std::_Require<std::__not_<std::__is_tuple_like<_Tp> >,
std::is_move_constructible<_Tp>, std::is_move_assignable<_Tp> > std::swap(_Tp&,
_Tp&) [with _Tp = char]\u2019,
    inlined from \u2018void std::iter_swap(_ForwardIterator1,
_ForwardIterator2) [with _ForwardIterator1 = char*; _ForwardIterator2 =
char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algobase.h:182:11,
    inlined from \u2018void std::__reverse(_RandomAccessIterator,
_RandomAccessIterator, random_access_iterator_tag) [with _RandomAccessIterator
= char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:1107:18,
    inlined from \u2018bool std::__next_permutation(_BidirectionalIterator,
_BidirectionalIterator, _Compare) [with _BidirectionalIterator = char*;
_Compare = __gnu_cxx::__ops::_Iter_less_iter]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:2907:22,
    inlined from \u2018bool std::next_permutation(_BIter, _BIter) [with _BIter
= char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:2947:2,
    inlined from \u2018int main()\u2019 at no_cxx11_abi.cpp:10:33:
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/move.h:205:11: warning:
writing 8 bytes into a region of size 2 [-Wstringop-overflow=]
  205 |       __a = _GLIBCXX_MOVE(__b);
      |       ~~~~^~~~~~~~~~~~~~~~
no_cxx11_abi.cpp: In function \u2018int main()\u2019:
no_cxx11_abi.cpp:6:10: note: at offset [1, 2] into destination object
\u2018str\u2019 of size 3
    6 |     char str[] = " a";
      |          ^~~
no_cxx11_abi.cpp:6:10: note: at offset [2, 3] into destination object
\u2018str\u2019 of size 3
In function \u2018std::_Require<std::__not_<std::__is_tuple_like<_Tp> >,
std::is_move_constructible<_Tp>, std::is_move_assignable<_Tp> > std::swap(_Tp&,
_Tp&) [with _Tp = char]\u2019,
    inlined from \u2018void std::iter_swap(_ForwardIterator1,
_ForwardIterator2) [with _ForwardIterator1 = char*; _ForwardIterator2 =
char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algobase.h:182:11,
    inlined from \u2018void std::__reverse(_RandomAccessIterator,
_RandomAccessIterator, random_access_iterator_tag) [with _RandomAccessIterator
= char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:1107:18,
    inlined from \u2018bool std::__next_permutation(_BidirectionalIterator,
_BidirectionalIterator, _Compare) [with _BidirectionalIterator = char*;
_Compare = __gnu_cxx::__ops::_Iter_less_iter]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:2907:22,
    inlined from \u2018bool std::next_permutation(_BIter, _BIter) [with _BIter
= char*]\u2019 at
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/stl_algo.h:2947:2,
    inlined from \u2018int main()\u2019 at no_cxx11_abi.cpp:10:33:
/opt/rh/gcc-toolset-12/root/usr/include/c++/12/bits/move.h:206:11: warning:
writing 8 bytes into a region of size 0 [-Wstringop-overflow=]
  206 |       __b = _GLIBCXX_MOVE(__tmp);
      |       ~~~~^~~~~~~~~~~~~~~~~~
no_cxx11_abi.cpp: In function \u2018int main()\u2019:
no_cxx11_abi.cpp:6:10: note: at offset 9223372036854775803 into destination
object \u2018str\u2019 of size 3
    6 |     char str[] = " a";
      |          ^~~
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m64' '-D' '_GLIBCXX_USE_CXX11_ABI=0'
'-O2' '-fvect-cost-model=dynamic' '-shared-libgcc' '-mtune=generic'
'-march=x86-64-v2' '-dumpdir' 'a-'
 as -v --64 -o a-no_cxx11_abi.o a-no_cxx11_abi.s
GNU assembler version 2.38 (x86_64-redhat-linux) using BFD version version
2.38-16.el9
COMPILER_PATH=/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/:/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/:/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/:/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/:/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/
LIBRARY_PATH=/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/:/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../lib64/:/lib/../lib64/:/usr/lib/../lib64/:/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m64' '-D' '_GLIBCXX_USE_CXX11_ABI=0'
'-O2' '-fvect-cost-model=dynamic' '-shared-libgcc' '-mtune=generic'
'-march=x86-64-v2' '-dumpdir' 'a.'
 /opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/collect2
-plugin
/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/liblto_plugin.so
-plugin-opt=/opt/rh/gcc-toolset-12/root/usr/libexec/gcc/x86_64-redhat-linux/12/lto-wrapper
-plugin-opt=-fresolution=a.res -plugin-opt=-pass-through=-lgcc_s
-plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lc
-plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lgcc --build-id
--no-add-needed --eh-frame-hdr --hash-style=gnu -m elf_x86_64 -dynamic-linker
/lib64/ld-linux-x86-64.so.2 /lib/../lib64/crt1.o /lib/../lib64/crti.o
/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/crtbegin.o
-L/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12
-L/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../../../lib64
-L/lib/../lib64 -L/usr/lib/../lib64
-L/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/../../..
a-no_cxx11_abi.o -lstdc++ -lm -lgcc_s -lgcc -lc -lgcc_s -lgcc
/opt/rh/gcc-toolset-12/root/usr/lib/gcc/x86_64-redhat-linux/12/crtend.o
/lib/../lib64/crtn.o
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m64' '-D' '_GLIBCXX_USE_CXX11_ABI=0'
'-O2' '-fvect-cost-model=dynamic' '-shared-libgcc' '-mtune=generic'
'-march=x86-64-v2' '-dumpdir' 'a.'

$ cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.1 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.1"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.1 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/red_hat_enterprise_linux/9/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.1
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.1"

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The exact command line for a generic x86_64-linux-gnu compiler:
-O2 -fvect-cost-model=dynamic  -Wstringop-overflow -D_GLIBCXX_USE_CXX11_ABI=0
-march=x86-64-v2

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-05-10

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  This is a missed optimization, we fail to optimize the loop guard

<bb 16> [local count: 329643239]:
_4 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
_6 = (unsigned long) __i_14;
_50 = -_6;
_100 = _4 + 18446744073709551615;
_40 = _100 - _6;
_41 = _40 > 13;
if (_41 != 0)

with __i_14 being

<bb 11> [local count: 452186132]:
# __i_14 = PHI <&MEM <char[3]> [(void *)&str + 1B](10), &MEM <char[3]> [(void
*)&str + 2B](9)>

I'll note that the strlen pass runs before VRP (but after DOM), but I'll
also note that likely ranger isn't very good with these kind of
"symbolic" ranges?  How would we handle this?  Using two
relations, __i_14 >= &str + 1 && __i_14 <= &str + 2?

DOM has

Optimizing block #16

1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] ge_expr __i_14
1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] ne_expr __i_14
1>>> STMT 0 = &MEM <char[3]> [(void *)&str + 2B] eq_expr __i_14
1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] gt_expr __i_14
1>>> STMT 0 = &MEM <char[3]> [(void *)&str + 2B] le_expr __i_14
Optimizing statement _4 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
LKUP STMT _4 = nop_expr &MEM <char[3]> [(void *)&str + 2B]
2>>> STMT _4 = nop_expr &MEM <char[3]> [(void *)&str + 2B]
Optimizing statement _6 = (unsigned long) __i_14;
LKUP STMT _6 = nop_expr __i_14
2>>> STMT _6 = nop_expr __i_14
Optimizing statement _50 = -_6;
 Registering value_relation (_6 pe64 __i_14) (bb16) at _6 = (unsigned long)
__i_14;
LKUP STMT _50 = negate_expr _6
2>>> STMT _50 = negate_expr _6
Optimizing statement _100 = _4 + 18446744073709551615;
LKUP STMT _100 = _4 plus_expr 18446744073709551615
2>>> STMT _100 = _4 plus_expr 18446744073709551615
Optimizing statement _40 = _100 - _6;
 Registering value_relation (_100 < _4) (bb16) at _100 = _4 +
18446744073709551615;
LKUP STMT _40 = _100 minus_expr _6
2>>> STMT _40 = _100 minus_expr _6
Optimizing statement _41 = _40 > 13;
LKUP STMT _41 = _40 gt_expr 13
2>>> STMT _41 = _40 gt_expr 13
LKUP STMT _40 le_expr 14
Optimizing statement if (_41 != 0)

Visiting conditional with predicate: if (_41 != 0)

With known ranges
        _41: [irange] bool VARYING

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #2)
> Confirmed.  This is a missed optimization, we fail to optimize the loop guard
> 
> <bb 16> [local count: 329643239]:
> _4 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
> _6 = (unsigned long) __i_14;
> _50 = -_6;
> _100 = _4 + 18446744073709551615;
> _40 = _100 - _6;
> _41 = _40 > 13;
> if (_41 != 0)

Do we even get a non-zero range for _4?  I'm assuming that even if we get that,
we can't see that &str+2B minus 1 is also nonzero?

> 
> with __i_14 being
> 
> <bb 11> [local count: 452186132]:
> # __i_14 = PHI <&MEM <char[3]> [(void *)&str + 1B](10), &MEM <char[3]>
> [(void *)&str + 2B](9)>
> 
> I'll note that the strlen pass runs before VRP (but after DOM), but I'll
> also note that likely ranger isn't very good with these kind of
> "symbolic" ranges?  How would we handle this?  Using two
> relations, __i_14 >= &str + 1 && __i_14 <= &str + 2?

Yeah, we don't do much with that.  Although the pointer equivalency class
should help in VRP's case.  We do some simple pointer tracking and even call
into gimple fold to simplify statements, but it's far from perfect and as you
say, strlen is running before VRP, so it wouldn't help in this case.

> 
> DOM has
> 
> Optimizing block #16
> 
> 1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] ge_expr __i_14
> 1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] ne_expr __i_14
> 1>>> STMT 0 = &MEM <char[3]> [(void *)&str + 2B] eq_expr __i_14
> 1>>> STMT 1 = &MEM <char[3]> [(void *)&str + 2B] gt_expr __i_14
> 1>>> STMT 0 = &MEM <char[3]> [(void *)&str + 2B] le_expr __i_14
> Optimizing statement _4 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
> LKUP STMT _4 = nop_expr &MEM <char[3]> [(void *)&str + 2B]
> 2>>> STMT _4 = nop_expr &MEM <char[3]> [(void *)&str + 2B]
> Optimizing statement _6 = (unsigned long) __i_14;
> LKUP STMT _6 = nop_expr __i_14
> 2>>> STMT _6 = nop_expr __i_14
> Optimizing statement _50 = -_6;
>  Registering value_relation (_6 pe64 __i_14) (bb16) at _6 = (unsigned long)
> __i_14;
> LKUP STMT _50 = negate_expr _6
> 2>>> STMT _50 = negate_expr _6
> Optimizing statement _100 = _4 + 18446744073709551615;
> LKUP STMT _100 = _4 plus_expr 18446744073709551615
> 2>>> STMT _100 = _4 plus_expr 18446744073709551615
> Optimizing statement _40 = _100 - _6;
>  Registering value_relation (_100 < _4) (bb16) at _100 = _4 +
> 18446744073709551615;
> LKUP STMT _40 = _100 minus_expr _6
> 2>>> STMT _40 = _100 minus_expr _6
> Optimizing statement _41 = _40 > 13;
> LKUP STMT _41 = _40 gt_expr 13
> 2>>> STMT _41 = _40 gt_expr 13
> LKUP STMT _40 le_expr 14
> Optimizing statement if (_41 != 0)
> 
> Visiting conditional with predicate: if (_41 != 0)
> 
> With known ranges
>         _41: [irange] bool VARYING

Ranger won't do anything, but can DOM's scoped tables do anything here?  The
hybrid threader in DOM first asks DOM's internal mechanism before asking ranger
(which seems useless in this case):

dom_jt_simplifier::simplify (gimple *stmt, gimple *within_stmt,
                             basic_block bb, jt_state *state)
{
  /* First see if the conditional is in the hash table.  */
  tree cached_lhs =  m_avails->lookup_avail_expr (stmt, false, true);
  if (cached_lhs)
    return cached_lhs;

  /* Otherwise call the ranger if possible.  */
  if (state)
    return hybrid_jt_simplifier::simplify (stmt, within_stmt, bb, state);

  return NULL;
}

Our long term plan for pointers was providing a prange class and separating
pointers from irange.  This class would track zero/nonzero mostly, but it would
also do some pointer equivalence tracking, thus subsuming what we do with
pointer_equiv_analyzer which is currently restricted to VRP and is an
on-the-side hack.

The prototype I had for it last release tracked the equivalence plus an offset,
so we should be able to do arithmetic on a prange of say [&str + X].  I had to
put it aside because the frange work took way longer than expected, plus legacy
got in the way.  Neither of this is an issue now, so we'll see.. but that's the
plan.  I should dust off those patches :-/.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
BTW, another reason I had to drop the prange work was because IPA was doing
their own thing with ranges outside of the irange API, so it was harder to
separate things out.  So really, all this stuff was related to legacy, which is
mostly gone, and my upcoming work on IPA later this cycle should clean up the
rest of IPA.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
DOMs scoped tables do not help.  The crux is really the PHI:

 __i_14 = PHI <&MEM <char[3]> [(void *)&str + 1B](10), &MEM <char[3]>
> [(void *)&str + 2B](9)>

there's no single value that exposes &str + offset.

For

  _4 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];

we might want to go and express it as

  _4' = (unsigned long) &str;
  _4  = _4' + 2;

but the issue with the PHI node remains unless we sink the &str part
(but there's many uses of __i_14).  I guess it's still the "easiest"
way to get rangers help.  Aka make

 # __i_14' = PHI <1(10), 2(9)>
 __i_14 = &str + __i_14'; // would be a POINTER_PLUS_EXPR

it's probably still not a complete fix but maybe a good start.  Of course
it increases the number of stmts - &MEM[&str + 1B] was an 'invariant'
(of course the PHI result isn't).  There's not a good place for this
transform - we never "fold" PHIs (and this would be an un-folding).

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---

> but the issue with the PHI node remains unless we sink the &str part
> (but there's many uses of __i_14).  I guess it's still the "easiest"
> way to get rangers help.  Aka make
> 
>  # __i_14' = PHI <1(10), 2(9)>
>  __i_14 = &str + __i_14'; // would be a POINTER_PLUS_EXPR
> 
> it's probably still not a complete fix but maybe a good start.  Of course
> it increases the number of stmts - &MEM[&str + 1B] was an 'invariant'
> (of course the PHI result isn't).  There's not a good place for this
> transform - we never "fold" PHIs (and this would be an un-folding).

Ughh, that sucks.  Let's see if Andrew has any ideas, but on my end I won't be
able to work on prange until much later this cycle-- assuming I finish what I
have on my plate.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #7 from rguenther at suse dot de <rguenther at suse dot de> ---
On Thu, 11 May 2023, aldyh at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791
> 
> --- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
> 
> > but the issue with the PHI node remains unless we sink the &str part
> > (but there's many uses of __i_14).  I guess it's still the "easiest"
> > way to get rangers help.  Aka make
> > 
> >  # __i_14' = PHI <1(10), 2(9)>
> >  __i_14 = &str + __i_14'; // would be a POINTER_PLUS_EXPR
> > 
> > it's probably still not a complete fix but maybe a good start.  Of course
> > it increases the number of stmts - &MEM[&str + 1B] was an 'invariant'
> > (of course the PHI result isn't).  There's not a good place for this
> > transform - we never "fold" PHIs (and this would be an un-folding).
> 
> Ughh, that sucks.  Let's see if Andrew has any ideas, but on my end I won't be
> able to work on prange until much later this cycle-- assuming I finish what I
> have on my plate.

So the idea with the above is of course that via regular folding
and value-numbering we can simplify the compare to a compare of
just the offsets and for those ranger already works.  The expression
is quite obfuscated of course and as said the strlen pass placement
doesn't help (it's before forwprop and VRP).

That said, the place to transform the PHI node is probably the same
where degenerate PHIs are removed.

For the testcase the PHI is created quite early by cunrolli.

I have a patch splitting the PHI.  We then still have

  # _69 = PHI <1(9), 2(8)>
  __i_44 = &str + _69;
...
  <bb 14> [local count: 402445658]:
  _51 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
  _4 = (unsigned long) __i_44;
  _12 = -_4;
  _119 = _51 + 18446744073709551615;
  _48 = _119 - _4;
  _46 = _48 > 13;
  if (_46 != 0)
    goto <bb 15>; [64.00%]

and also

  _31 = &MEM <char[3]> [(void *)&str + 3B] <= __i_44;

so at least for the latter we are missing a simplification
pattern - it should simplify the compare to

  _31 = 3 <= _69

possibly (unsigned)(p p+ offset) should be changed to
(unsigned)p + offset and thus likewise (unsigned) &MEM[&str + 4B] into
(unsigned)&str + 4.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Created attachment 55047
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55047&action=edit
patch unfolding such PHIs

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
So the first pass that makes things difficult is reassoc which transforms

  _51 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
  _4 = (unsigned long) __i_44;
  _65 = _51 - _4;
  _48 = _65 + 18446744073709551615;
  _46 = _48 > 13;
  if (_46 != 0)

to

  _51 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B];
  _4 = (unsigned long) __i_44;
  _12 = -_4;
  _119 = _51 + 18446744073709551615;
  _48 = _119 - _4;
  _46 = _48 > 13;
  if (_46 != 0)

(also leaving garbage around).  That's probably because of the PHI biasing
and __i_44 being defined by a PHI.  niter analysis produces

    # of iterations (((unsigned long) &MEM <char[3]> [(void *)&str + 2B] -
(unsigned long) __i_44) + 18446744073709551615) / 2, bounded by
9223372036854775807

but doesn't expand __i_44 (not sure if we'd fold the thing then).  The
gimplifier folds stmts w/o following SSA edges when we eventually
re-gimplify those expressions for insertion.  If we expand offsetting of
invariant bases we get instead

# of iterations ((unsigned long) &MEM <char[3]> [(void *)&str + 2B] - (unsigned
long) (&str + (_69 + 1))) / 2, bounded by 9223372036854775807

but that's still not simplified.  I think ptr_difference_const should
handle this - of course the difference here isn't const...

/* Try folding difference of addresses.  */ 
(simplify
 (minus (convert ADDR_EXPR@0) (convert @1))
 (if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
  (with { poly_int64 diff; } 
   (if (ptr_difference_const (@0, @1, &diff))
    { build_int_cst_type (type, diff); }))))
(simplify 
 (minus (convert @0) (convert ADDR_EXPR@1))
 (if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
  (with { poly_int64 diff; }
   (if (ptr_difference_const (@0, @1, &diff))
    { build_int_cst_type (type, diff); })))) 

it works fine when adding

(simplify
 (minus (convert ADDR_EXPR@0) (convert (pointer_plus @1 @2)))
 (if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
  (with { poly_int64 diff; }
   (if (ptr_difference_const (@0, @1, &diff))
    (minus { build_int_cst_type (type, diff); } (convert @2))))))

then we get

    # of iterations (1 - (unsigned long) _69) / 2, bounded by
9223372036854775807

and the diagnostic is gone.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Created attachment 55048
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55048&action=edit
patch for niter expression expansion

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Created attachment 55049
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55049&action=edit
patch for extra pointer difference patterns

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
So let me see if this all works out reasonably.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:560a3e35fe01c499bd5b1e95ddc4c3e958cf5abd

commit r14-785-g560a3e35fe01c499bd5b1e95ddc4c3e958cf5abd
Author: Richard Biener <rguenther@suse.de>
Date:   Thu May 11 14:28:11 2023 +0200

    tree-optimization/109791 - simplify (unsigned)&foo - (unsigned)(&foo + o)

    The following adds another variant of address difference simplification.
    The utility ptr_difference_const only handles constant differences
    (we also cannot code generate anything else), so exposing a possible
    POINTER_PLUS_EXPR in the match and computing the difference on the
    base only makes it possible to handle one case of a variable offset.
    This simplifies

    (unsigned long) &MEM <char[3]> [(void *)&str + 2B] - (unsigned long) (&str
+ (_69 + 1))

    down to (1 - (unsigned long) _69) during niter analysis, allowing
    ranger to eliminate a condition later and avoiding a bogus
    -Wstringop-overflow diagnostic for the testcase in the PR.

            PR tree-optimization/109791
            * match.pd (minus (convert ADDR_EXPR@0) (convert (pointer_plus @1
@2))):
            New pattern.
            (minus (convert (pointer_plus @1 @2)) (convert ADDR_EXPR@0)):
            Likewise.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #14 from Richard Biener <rguenth at gcc dot gnu.org> ---
So one issue with the unfolding of PHIs is that for example
gcc.dg/warn-sprintf-no-nul.c has

const char a2[][3] = {
  "", "1", "12", "123", "123\000"
};

and for

 # str_1 = PHI <&a2[2], &a2[3]>

we can determine bounds on the string length of str_1 by unioning the
string lengths of &a2[2] and &a2[3].  But with

 # off_2 = PHI <6, 9>
 str_1 = &a2 + off_2;

this isn't possible.  In fact get_range_strlen doesn't handle POINTER_PLUS_EXPR
and while it might be possible to handle "foo" + off_2 with looking at the
range of off_2 for example the above case of refering to two different
strings rather than offsetting within one string isn't distinguishable.

I've also figured that when one PHI argument has zero offset (aka plain &a2)
then PRE tends to undo the transform since &a2 + 0 is readily available
on that edge and thus it inserts pointer adjustments on the other edges.

So while it looked like the easy way out on the ranger limitation it's
not a viable solution (because it regresses testcases).

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #55047|0                           |1
        is obsolete|                            |

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> ---
Created attachment 55155
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55155&action=edit
patch unfolding such PHIs

Updated PHI unfolding patch.  Tests fine besides mentioned diagnostic
regressions.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|rguenth at gcc dot gnu.org         |unassigned at gcc dot gnu.org
             Status|ASSIGNED                    |NEW

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #15)
> Created attachment 55155 [details]
> patch unfolding such PHIs
> 
> Updated PHI unfolding patch.  Tests fine besides mentioned diagnostic
> regressions.

I was looking into doing the opposite in forwprop but maybe I can skip
addresses.

[Bug tree-optimization/109791] -Wstringop-overflow warning with -O3 and _GLIBCXX_USE_CXX11_ABI=0

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791

--- Comment #17 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #16)
> (In reply to Richard Biener from comment #15)
> > Created attachment 55155 [details]
> > patch unfolding such PHIs
> > 
> > Updated PHI unfolding patch.  Tests fine besides mentioned diagnostic
> > regressions.
> 
> I was looking into doing the opposite in forwprop but maybe I can skip
> addresses.

Oh yes I see it was mentioned before in PR 102138.