[Bug c/63445] New: request: make -Wstrict-overflow avoid a class of false positives

[Bug c/63445] New: request: make -Wstrict-overflow avoid a class of false positives

[jim at meyering dot net]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

            Bug ID: 63445
           Summary: request: make -Wstrict-overflow avoid a class of false
                    positives
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jim at meyering dot net

Thanks for tending and continually improving gcc.

I see some surprising new warnings when using built-from-git (an hour ago) gcc
to compile coreutils.  Here is a reduced test case:

In this example, the code ensures "j - i" will be positive before assigning
that value to an unsigned int "n".  Can gcc be taught to avoid this obvious
false positive?

$ cat f.c

int
f (int i, int j)
{
  unsigned int c = 0;                                                          
  if (i < j)
    {
      unsigned int n = j - i;
      for (unsigned int i = 0; i < n; i++)
        {
          c++;
        }
    }
  return c;
}
$ gcc -O2 -std=c99 -Wstrict-overflow -c f.c
f.c: In function ‘f’:
f.c:9:7: warning: assuming signed overflow does not occur when simplifying
conditional [-Wstrict-overflow]
       for (unsigned int i = 0; i < n; i++)
       ^
$ gcc -v 2>&1|tail -2
gcc version 5.0.0 20141002 (experimental) (GCC)
>From gcc-bugs-return-463138-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Oct 02 20:30:58 2014
Return-Path: <gcc-bugs-return-463138-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 22750 invoked by alias); 2 Oct 2014 20:30:57 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 22680 invoked by uid 55); 2 Oct 2014 20:30:46 -0000
From: "tejohnson at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/63422] [5.0 Regression] ICE in freqs_to_counts_path, at tree-ssa-threadupdate.c:981
Date: Thu, 02 Oct 2014 20:30:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: tejohnson at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-63422-4-cFtBl71XK9@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63422-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63422-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-10/txt/msg00159.txt.bz2
Content-length: 497

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc422

--- Comment #7 from tejohnson at gcc dot gnu.org ---
Author: tejohnson
Date: Thu Oct  2 20:30:11 2014
New Revision: 215822

URL: https://gcc.gnu.org/viewcvs?rev!5822&root=gcc&view=rev
Log:
2014-10-01  Teresa Johnson  <tejohnson@google.com>

    PR middle-end/63422
    * tree-ssa-threadupdate.c (freqs_to_counts_path): Remove
    asserts to handle incoming insanities.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/tree-ssa-threadupdate.c

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
                 CC|                            |ebotcazou at gcc dot gnu.org,
                   |                            |law at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
          Component|middle-end                  |tree-optimization
      Known to work|                            |4.8.3, 4.9.2
   Target Milestone|---                         |5.0
            Summary|request: make               |[5 Regression] request:
                   |-Wstrict-overflow avoid a   |make -Wstrict-overflow
                   |class of false positives    |avoid a class of false
                   |                            |positives

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The warning is senseless for equality compares.  We are trying to transform
(T) x CMP CST to x CMP (typeof x) CST - for equality compares it only matters
whether CST fits in typeof x.  CCing Jeff who added the warning code last year
(making this a regression).  4.9 doesn't warn even if the warning code is
the same, 4.8 doesn't have the warning code.

Index: gcc/tree-vrp.c
===================================================================
--- gcc/tree-vrp.c      (revision 215917)
+++ gcc/tree-vrp.c      (working copy)
@@ -9189,8 +9189,9 @@ simplify_cond_using_ranges (gimple stmt)
              /* If the range overflowed and the user has asked for warnings
                 when strict overflow semantics were used to optimize code,
                 issue an appropriate warning.  */
-             if ((is_negative_overflow_infinity (vr->min)
-                  || is_positive_overflow_infinity (vr->max))
+             if (cond_code != EQ_EXPR && cond_code != NE_EXPR
+                 && (is_negative_overflow_infinity (vr->min)
+                     || is_positive_overflow_infinity (vr->max))
                  && issue_strict_overflow_warning
(WARN_STRICT_OVERFLOW_CONDITIONAL))
                {
                  location_t location;

_6 has [1, +INF(OVF)] beause of Erics new code handling symbolic ranges better
(CCing Eric):

Found new range for j_9: [i_15 + 1, +INF]

Visiting statement:
_6 = j_9 - i_15;
Found new range for _6: [1, +INF(OVF)]

i_15 could be negative and thus j_9 - i_15 could well overflow the input
range at the +INF side.  (i_15 is [-INF, j_5(D) + -1])

I believe we are just better in propagating the ranges here and 4.9
computed _6 as VARYING (and thus not applying the optimization).

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[manu at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

--- Comment #4 from Manuel López-Ibáñez <manu at gcc dot gnu.org> ---
> i_15 could be negative and thus j_9 - i_15 could well overflow the input
> range at the +INF side.  (i_15 is [-INF, j_5(D) + -1])

Actually, this is a very good point. There is indeed a potential integer
overflow in the original code. Thus, the warning seems valid.

Perhaps the warning message could say that the problem is that "j - i" can
overflow if i is negative. A major problem with the Wstrict-overflow warning is
that it is too cryptic. Even looking at the dump files it is not clear
immediately when and why the warning is given.

Another issue is that the location is off, it should point to j - i.
>From gcc-bugs-return-463445-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Oct 07 13:37:11 2014
Return-Path: <gcc-bugs-return-463445-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 28004 invoked by alias); 7 Oct 2014 13:37:11 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 27972 invoked by uid 48); 7 Oct 2014 13:37:07 -0000
From: "i.palachev at samsung dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug lto/59441] ICE in bitmap_element_allocate
Date: Tue, 07 Oct 2014 13:37:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: lto
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: i.palachev at samsung dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.9.2
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-59441-4-HMowTdxsaH@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59441-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59441-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-10/txt/msg00466.txt.bz2
Content-length: 215

https://gcc.gnu.org/bugzilla/show_bug.cgi?idY441

--- Comment #5 from Ilya Palachev <i.palachev at samsung dot com> ---
Suggested a patch that fixes this.
https://gcc.gnu.org/ml/gcc-patches/2014-10/msg00546.html

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

--- Comment #5 from rguenther at suse dot de <rguenther at suse dot de> ---
On Tue, 7 Oct 2014, manu at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445
> 
> --- Comment #4 from Manuel López-Ibáñez <manu at gcc dot gnu.org> ---
> > i_15 could be negative and thus j_9 - i_15 could well overflow the input
> > range at the +INF side.  (i_15 is [-INF, j_5(D) + -1])
> 
> Actually, this is a very good point. There is indeed a potential integer
> overflow in the original code. Thus, the warning seems valid.
> 
> Perhaps the warning message could say that the problem is that "j - i" can
> overflow if i is negative.

Sure - but we warn about the comparison against zero which doesn't
behave differently if overflow wraps or is undefined.
>From gcc-bugs-return-463448-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Oct 07 14:09:47 2014
Return-Path: <gcc-bugs-return-463448-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 24881 invoked by alias); 7 Oct 2014 14:09:47 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 24841 invoked by uid 48); 7 Oct 2014 14:09:43 -0000
From: "mliska at suse dot cz" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug ipa/63470] New: [5 Regression] lto1: internal compiler error: in estimate_edge_growth, at ipa-inline.h:308
Date: Tue, 07 Oct 2014 14:09:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: ipa
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mliska at suse dot cz
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc
Message-ID: <bug-63470-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-10/txt/msg00469.txt.bz2
Content-length: 3075

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc470

            Bug ID: 63470
           Summary: [5 Regression] lto1: internal compiler error: in
                    estimate_edge_growth, at ipa-inline.h:308
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mliska at suse dot cz
                CC: hubicka at ucw dot cz

Starting from r215794 Firefox produces following error in WPA with -flto and
--enable-checking=all:

lto1: internal compiler error: in estimate_edge_growth, at ipa-inline.h:308
0x7d7fc1 estimate_edge_growth
    ../../gcc/ipa-inline.h:307
0x7d7fc1 estimate_size_after_inlining(cgraph_node*, cgraph_edge*)
    ../../gcc/ipa-inline-analysis.c:3817
0xf388d1 caller_growth_limits
    ../../gcc/ipa-inline.c:186
0xf388d1 can_inline_edge_p
    ../../gcc/ipa-inline.c:363
0xf3acdd update_callee_keys
    ../../gcc/ipa-inline.c:1236
0xf3c9a6 inline_small_functions
    ../../gcc/ipa-inline.c:1818
0xf3c9a6 ipa_inline
    ../../gcc/ipa-inline.c:2182
0xf3c9a6 execute
    ../../gcc/ipa-inline.c:2542

Edge:
caller:
_ZNK12SkRefCntBase16internal_disposeEv/14636955 (internal_dispose)
@0x7f9c1a33d178
  Type: function definition analyzed
  Visibility: virtual
  next sharing asm name: 14636951
  References:
  Referring:
  Read from file:
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/toolkit/library/build/../../../gfx/2d/Unified_cpp_gfx_2d0.o
  Function internal_dispose/14636955 is inline copy in __base_dtor /13594851
  Clone of _ZNK12SkRefCntBase16internal_disposeEv/14636951
  Availability: local
  First run: 0
  Function flags: local
  Called by: _ZNK12SkRefCntBase5unrefEv.part.40/14636954 (inlined)
(indirect_inlining) (0.02 per call)
  Calls: _ZN13SkGPipeCanvasD0Ev/13594853 (indirect_inlining) (0.01 per call)
callee:
_ZN13SkGPipeCanvasD0Ev/13594853 (__deleting_dtor ) @0x7f9c1575d8d0
  Type: function definition analyzed
  Visibility: prevailing_def_ironly virtual
  Address is taken.
  References:
  Referring: _ZTV13SkGPipeCanvas/13595722
(addr)_ZNK12SkRefCntBase16internal_disposeEv/14605659 (addr)
(speculative)_ZNK12SkRefCntBase16internal_disposeEv/14614102 (addr)
(speculative)_ZNK12SkRefCntBase16internal_disposeEv/14636951 (addr)
(speculative)
  Read from file:
/home/marxin/Programming/gecko-dev/obj-x86_64-unknown-linux-gnu/toolkit/library/build/../../../gfx/skia/Unified_cpp_gfx_skia20.o
  Availability: available
  First run: 0
  Function flags:
  Called by: _ZNK12SkRefCntBase16internal_disposeEv/14636955
(indirect_inlining) (0.01 per call)
_ZNK12SkRefCntBase16internal_disposeEv/14636951 (speculative)
(indirect_inlining) (0.03 per call)
_ZNK12SkRefCntBase16internal_disposeEv/14614102 (speculative)
(indirect_inlining) (0.08 per call)
_ZNK12SkRefCntBase16internal_disposeEv/14605659 (speculative)
(indirect_inlining) (0.08 per call)
  Calls: moz_free/1431 (1.00 per call) _ZN13SkGPipeCanvasD1Ev/13594852 (1.00
per call)

Thanks,
Martin

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

--- Comment #6 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> Found new range for j_9: [i_15 + 1, +INF]
> 
> Visiting statement:
> _6 = j_9 - i_15;
> Found new range for _6: [1, +INF(OVF)]
> 
> i_15 could be negative and thus j_9 - i_15 could well overflow the input
> range at the +INF side.  (i_15 is [-INF, j_5(D) + -1])

Yes, the range is as expected here but...

> I believe we are just better in propagating the ranges here and 4.9
> computed _6 as VARYING (and thus not applying the optimization).

...we actually don't apply any optimization to the code:

Value ranges after VRP:

n_1: [1, +INF]  EQUIVALENCES: { n_7 c_8 n_16 } (3 elements)
_2: [1, +INF]  EQUIVALENCES: { n_7 n_16 } (2 elements)
pretmp_3: ~[0, 0]
i_4(D): VARYING
j_5(D): VARYING
_6: [1, +INF(OVF)]
n_7: [0, +INF]

[...]

  <bb 2>:
  if (i_4(D) < j_5(D))
    goto <bb 3>;
  else
    goto <bb 7>;

  <bb 3>:
  _6 = j_5(D) - i_4(D);
  n_7 = (unsigned int) _6;
  if (_6 != 0)
    goto <bb 4>;
  else
    goto <bb 7>;

The range of n_7 is suboptimal and the test on _6 can be eliminated.

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

--- Comment #8 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> The range of n_7 is suboptimal and the test on _6 can be eliminated.

Which turns out to be counter-productive for the testcase because the test is
used to derive information by the sccp pass; as a result, if you eliminate it,
the sccp pass does nothing and the loop is not eliminated in the final code...

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/63445] [5 Regression] request: make -Wstrict-overflow avoid a class of false positives

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63445

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Thu Oct  9 08:20:53 2014
New Revision: 216028

URL: https://gcc.gnu.org/viewcvs?rev=216028&root=gcc&view=rev
Log:
2014-10-09  Richard Biener  <rguenther@suse.de>

    PR tree-optimization/63445
    * tree-vrp.c (simplify_cond_using_ranges): Only warn about
    overflow for non-equality compares.

    * gcc.dg/Wstrict-overflow-26.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/Wstrict-overflow-26.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-vrp.c