public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];`
@ 2023-08-28 10:31 dale.mengli.ming at proton dot me
2023-09-02 14:12 ` [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above dmalcolm at gcc dot gnu.org
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: dale.mengli.ming at proton dot me @ 2023-08-28 10:31 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
Bug ID: 111213
Summary: -Wanalyzer-out-of-bounds false negative with `return
arr[9];`
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dale.mengli.ming at proton dot me
Target Milestone: ---
Hi, this case (https://godbolt.org/z/98PMz1KKz) contains an out-of-bound error
(stmt: `return arr[9];`). At -O0, the analyzer can report this warning.
However, at -O1, -O2, and -O3, the analyzer doesn't report that.
After removing the `static` keyword (https://godbolt.org/z/qKohK3eeY), the
analyzer can report this warning at -O1, -O2, and -O3.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above
2023-08-28 10:31 [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];` dale.mengli.ming at proton dot me
@ 2023-09-02 14:12 ` dmalcolm at gcc dot gnu.org
2023-09-06 21:27 ` dmalcolm at gcc dot gnu.org
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-09-02 14:12 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|-Wanalyzer-out-of-bounds |-Wanalyzer-out-of-bounds
|false negative with `return |false negative with `return
|arr[9];` |arr[9];` at -O1 and above
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to mengli ming from comment #0)
Thanks for filing this bug.
> Hi, this case (https://godbolt.org/z/98PMz1KKz) contains an out-of-bound
> error (stmt: `return arr[9];`). At -O0, the analyzer can report this
> warning. However, at -O1, -O2, and -O3, the analyzer doesn't report that.
This is a side-effect of how late the analyzer runs. Adding
-fdump-ipa-analyzer=stdder
shows that at -O1 and above, the "arr[9]" access is optimized away before the
analyzer "sees" it.
See e.g.:
https://godbolt.org/z/YjffsMYW4
My hypothesis is that the optimizer sees the undefined behavior and optimizes
the function away (but I haven't looked into the details).
If that's the case, that's a strong argument that the analyzer should run
earlier. I'm not sure if we have an existing bug about that.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above
2023-08-28 10:31 [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];` dale.mengli.ming at proton dot me
2023-09-02 14:12 ` [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above dmalcolm at gcc dot gnu.org
@ 2023-09-06 21:27 ` dmalcolm at gcc dot gnu.org
2023-10-25 8:17 ` dale.mengli.ming at proton dot me
2024-02-16 16:33 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2023-09-06 21:27 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Last reconfirmed| |2023-09-06
Ever confirmed|0 |1
--- Comment #2 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to David Malcolm from comment #1)
[...]
> If that's the case, that's a strong argument that the analyzer should run
> earlier. I'm not sure if we have an existing bug about that.
Filed as bug 111312; made this one block that one.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above
2023-08-28 10:31 [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];` dale.mengli.ming at proton dot me
2023-09-02 14:12 ` [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above dmalcolm at gcc dot gnu.org
2023-09-06 21:27 ` dmalcolm at gcc dot gnu.org
@ 2023-10-25 8:17 ` dale.mengli.ming at proton dot me
2024-02-16 16:33 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dale.mengli.ming at proton dot me @ 2023-10-25 8:17 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
--- Comment #3 from mengli ming <dale.mengli.ming at proton dot me> ---
(In reply to David Malcolm from comment #1)
> (In reply to mengli ming from comment #0)
>
> Thanks for filing this bug.
>
> > Hi, this case (https://godbolt.org/z/98PMz1KKz) contains an out-of-bound
> > error (stmt: `return arr[9];`). At -O0, the analyzer can report this
> > warning. However, at -O1, -O2, and -O3, the analyzer doesn't report that.
>
> This is a side-effect of how late the analyzer runs. Adding
> -fdump-ipa-analyzer=stdder
> shows that at -O1 and above, the "arr[9]" access is optimized away before
> the analyzer "sees" it.
>
> See e.g.:
> https://godbolt.org/z/YjffsMYW4
>
> My hypothesis is that the optimizer sees the undefined behavior and
> optimizes the function away (but I haven't looked into the details).
>
> If that's the case, that's a strong argument that the analyzer should run
> earlier. I'm not sure if we have an existing bug about that.
Many thanks!!!
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above
2023-08-28 10:31 [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];` dale.mengli.ming at proton dot me
` (2 preceding siblings ...)
2023-10-25 8:17 ` dale.mengli.ming at proton dot me
@ 2024-02-16 16:33 ` dmalcolm at gcc dot gnu.org
3 siblings, 0 replies; 5+ messages in thread
From: dmalcolm at gcc dot gnu.org @ 2024-02-16 16:33 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111213
David Malcolm <dmalcolm at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |SUSPENDED
--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Marking this one as SUSPENDED since it would require the big rewrite for PR
111312.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-02-16 16:33 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-28 10:31 [Bug analyzer/111213] New: -Wanalyzer-out-of-bounds false negative with `return arr[9];` dale.mengli.ming at proton dot me
2023-09-02 14:12 ` [Bug analyzer/111213] -Wanalyzer-out-of-bounds false negative with `return arr[9];` at -O1 and above dmalcolm at gcc dot gnu.org
2023-09-06 21:27 ` dmalcolm at gcc dot gnu.org
2023-10-25 8:17 ` dale.mengli.ming at proton dot me
2024-02-16 16:33 ` dmalcolm at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).