[Bug tree-optimization/109950] New: can array subscripts be assumed to be non-negative?

[Bug tree-optimization/109950] New: can array subscripts be assumed to be non-negative?

[lh_mouse at 126 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950

            Bug ID: 109950
           Summary: can array subscripts be assumed to be non-negative?
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: lh_mouse at 126 dot com
  Target Milestone: ---

There is a lot of historical code which has been using `int` for array indexes:

```
extern int data[];
extern int next;

int
test_function(int* outptr)
  {
    *outptr = data[next];
    return next >= 0;
  }
```

In this example, the value of `next` is used as an array index. Despite the
unknown size, elements in an array can't have negative indexes, so maybe here
`next >= 0` can be optimized to a constant?


Specifically about x86_64, there is some more optimization that we can do: The
value of `next` can be loaded into a 32-bit register, zeroing the upper half
implicitly, without using a sign-extension instruction, as in machine code:

```
48 63 05 IMM32   ; movsxd rax, dword ptr [rip + IMM32]
   8B 05 IMM32   ; mov    eax, dword ptr [rip + IMM32]
```

The former contains an operand size override prefix, takes up one more byte,
and costs an extra cycle to decode.

[Bug tree-optimization/109950] can array subscripts be assumed to be non-negative?

[amonakov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950

Alexander Monakov <amonakov at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amonakov at gcc dot gnu.org

--- Comment #1 from Alexander Monakov <amonakov at gcc dot gnu.org> ---
That's the REX prefix, not an operand size override prefix. It doesn't cause a
decoding stall.

[Bug tree-optimization/109950] can array subscripts be assumed to be non-negative?

[lh_mouse at 126 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950

--- Comment #2 from LIU Hao <lh_mouse at 126 dot com> ---
(In reply to Alexander Monakov from comment #1)
> That's the REX prefix, not an operand size override prefix. It doesn't cause
> a decoding stall.

Thanks for pointing this out. Thought it was 66H.

[Bug tree-optimization/109950] can array subscripts be assumed to be non-negative?

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
a negative 'next' is fine, data[next] is just *(data + next) so we cannot elide
the sign-extension either.

[Bug tree-optimization/109950] can array subscripts be assumed to be non-negative?

[lh_mouse at 126 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950

--- Comment #4 from LIU Hao <lh_mouse at 126 dot com> ---
Given the fact that GCC is already able to warn about out-of-range indexes for
an array, why wouldn't it be possible to infer that `*(data + next)` is always
an element of `data`?

If the result of `data + next` (after array-to-pointer conversion) does not
point to an element of `data` (or the past-the-end position, but that's not the
case, as it's not dereferenceable), then the behavior will be undefined.