[Bug c/63477] New: Bogus warning with -O3 -Warray-bounds: array subscript is above array bounds

[Bug c/63477] New: Bogus warning with -O3 -Warray-bounds: array subscript is above array bounds

[lennox at cs dot columbia.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63477

            Bug ID: 63477
           Summary: Bogus warning with -O3 -Warray-bounds: array subscript
                    is above array bounds
           Product: gcc
           Version: 4.8.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: lennox at cs dot columbia.edu

When compiled with -O3, the following code produces an "array subscript is
above array bounds" warning, which is bogus as far as I can tell:

#define MAX_VAL 16

typedef struct 
{
    int itemList[MAX_VAL+1];
    unsigned int numItems;
} ItemList;

void FrobList(ItemList *l)
{
    unsigned int i;

    for (i=0; i < l->numItems-1; i++) {
        int minVal = l->itemList[i];
        unsigned int minIdx = i;
        unsigned int idx;
        for (idx=i+1; idx < l->numItems; ++idx) {
            if (l->itemList[idx] < minVal) {
                minVal = l->itemList[idx];
                minIdx = idx;
            }
        }
        l->itemList[i] = l->itemList[minIdx];
    }
}


$ gcc -O3 -Warray-bounds -c LmiH264RefPictures-Reduced.c
LmiH264RefPictures-Reduced.c: In function ‘FrobList’:
LmiH264RefPictures-Reduced.c:18:19: warning: array subscript is above array
bounds [-Warray-bounds]
    if (l->itemList[idx] < minVal) {
                   ^

The warning occurs on compilers targeted to x86_64 and armhf, but not i686.  It
does not occur with -O2 or lower.  Tested on both Linux and Cygwin.

This is a regression from GCC 4.6.3, at least. Have not tested 4.7.x.

Clearly it would be an out-of-bounds access if l->numItems were >= MAX_VAL+1,
but (in the actual application this testcase is reduced from), it's an
invariant that it won't be, and the compiler shouldn't be making range
assumptions to the contrary.

Verbose compiler output:

$ gcc -v -O3 -Warray-bounds -c LmiH264RefPictures-Reduced.c
Using built-in specs.
COLLECT_GCC=gcc
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.8.2-19ubuntu1'
--with-bugurl=file:///usr/share/doc/gcc-4.8/README.Bugs
--enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr
--program-suffix=-4.8 --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--with-gxx-include-dir=/usr/include/c++/4.8 --libdir=/usr/lib --enable-nls
--with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-libmudflap
--enable-plugin --with-system-zlib --disable-browser-plugin
--enable-java-awt=gtk --enable-gtk-cairo
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64/jre --enable-java-home
--with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64
--with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.8-amd64
--with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar
--enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --with-tune=generic
--enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=x86_64-linux-gnu
Thread model: posix
gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) 
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.8/cc1 -quiet -v -imultiarch x86_64-linux-gnu
LmiH264RefPictures-Reduced.c -quiet -dumpbase LmiH264RefPictures-Reduced.c
-mtune=generic -march=x86-64 -auxbase LmiH264RefPictures-Reduced -O3
-Warray-bounds -version -fstack-protector -Wformat -Wformat-security -o
/tmp/ccXMNHkF.s
GNU C (Ubuntu 4.8.2-19ubuntu1) version 4.8.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.2, GMP version 5.1.3, MPFR version 3.1.2-p3,
MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include-fixed
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
GNU C (Ubuntu 4.8.2-19ubuntu1) version 4.8.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.2, GMP version 5.1.3, MPFR version 3.1.2-p3,
MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: dc75e0628c9356affcec059d0c81cc01
LmiH264RefPictures-Reduced.c: In function ‘FrobList’:
LmiH264RefPictures-Reduced.c:18:19: warning: array subscript is above array
bounds [-Warray-bounds]
    if (l->itemList[idx] < minVal) {
                   ^
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'
 as -v --64 -o LmiH264RefPictures-Reduced.o /tmp/ccXMNHkF.s
GNU assembler version 2.24 (x86_64-linux-gnu) using BFD version (GNU Binutils
for Ubuntu) 2.24
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../lib/:/lib/x86_64-linux-gnu/:/lib/../lib/:/usr/lib/x86_64-linux-gnu/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'
>From gcc-bugs-return-463495-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Wed Oct 08 00:26:12 2014
Return-Path: <gcc-bugs-return-463495-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 10128 invoked by alias); 8 Oct 2014 00:26:11 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 10090 invoked by uid 48); 8 Oct 2014 00:26:07 -0000
From: "jason at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/63362] The c++11 triviality-traits need front-end help
Date: Wed, 08 Oct 2014 00:26:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: rejects-valid
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jason at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-63362-4-GH54OKbZWE@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63362-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63362-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-10/txt/msg00516.txt.bz2
Content-length: 455

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc362

--- Comment #21 from Jason Merrill <jason at gcc dot gnu.org> ---
(In reply to Ville Voutilainen from comment #20)
> template <bool b> struct bool_
> {
> };
>
> template <typename T, class... Args>
> struct mytrait : bool_<__is_trivially_constructible(T, Args...)>
> {
> };
>
> template <typename T, class... Args>
> struct mytrait2 : bool_<__is_trivially_constructible(T, Args...)>
> {
> };

Fixed.