[Bug c/50624] New: detecting array overflows regressed

[Bug c/50624] New: detecting array overflows regressed

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

             Bug #: 50624
           Summary: detecting array overflows regressed
    Classification: Unclassified
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: andi-gcc@firstfloor.org


Created attachment 25424
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=25424
overflow tester

The attached program tests 5 different array overflows that the compiler
should be able to detect at compile time.

gcc 4.5 detects 2 out of 5 with -O2 -Wall:

overflow.c:14:7: warning: array subscript is above array bounds
overflow.c:22:12: warning: array subscript is above array bounds


Current mainline detects zero.

gcc version 4.7.0 20111002 (experimental) (GCC)

[Bug c/50624] detecting array overflows regressed

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-10-05
                 CC|                            |jakub at gcc dot gnu.org
     Ever Confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-10-05 18:50:04 UTC ---
Regressed with http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=178312

[Bug c/50624] detecting array overflows regressed

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

--- Comment #2 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-05 18:56:24 UTC ---
Thanks.

It's not a pure regression. Even 4.5 misses some easy cases:
especially the local stack array case, which should be in theory really easy.

[Bug c/50624] detecting array overflows regressed

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-10-05 19:22:38 UTC ---
If I remember well this warning isn't very well designed and has many false
positives on the other side.

[Bug c/50624] detecting array overflows regressed

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic

--- Comment #4 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-06 08:30:48 UTC ---
True.  What we miss for easy cases is a general "access outside of object"
case which doesn't need to involve arrays.  The code in VRP needs some serious
TLC (which means, a complete rewrite).

It's on my overly long TODO list, somewhere at the bottom.

OTOH the warning code for some easy cases should be moved to the frontend(s),
which is where diagnostics generally belong (that way you'd also get
the easy cases with automatic arrays which are just optimized away until
we even get to the warning machinery - which unfortunately works only with
-O2 (-ftree-vrp)).

[Bug c/50624] detecting array overflows regressed

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

--- Comment #5 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-10-06 14:49:19 UTC ---
Easy case = constant expressions as index?

Would the frontend be able to handle

short array[1];

i = 1;
array[i]

[Bug c/50624] detecting array overflows regressed

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50624

--- Comment #6 from Richard Guenther <rguenth at gcc dot gnu.org> 2011-10-06 15:10:45 UTC ---
(In reply to comment #5)
> Easy case = constant expressions as index?
> 
> Would the frontend be able to handle
> 
> short array[1];
> 
> i = 1;
> array[i]

Probably not.

It's also the usual trade-off between warnings for dead code or not.