[Bug c/66422] New: -Warray-bounds false positive with -O3

[Bug c/66422] New: -Warray-bounds false positive with -O3

[gajjanagadde at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

            Bug ID: 66422
           Summary: -Warray-bounds false positive with -O3
           Product: gcc
           Version: 5.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gajjanagadde at gmail dot com
  Target Milestone: ---

Created attachment 35698
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35698&action=edit
test

Compiling the following code on GCC 5.1.0 produces a bogus out of bounds
warning:

-------

#include <inttypes.h>
// Simple test file to trigger this bug
// Two things noticed:
// 1. commenting out const char* bar results in no warning
// 2. Changing the "loop" in run_foo to a single, direct control
// results in no warning
// (These were done independently of each other, starting with this file)

typedef struct foo {
    uint8_t foo_size;
    int buf[4];
    const char* bar;
} foo;

const foo *get_foo(int index);

static int foo_loop(const foo *myfoo) {
    int i;
    if (myfoo->foo_size < 3)
        return 0;
    for (i = 0; i < myfoo->foo_size; i++) {
        if (myfoo->buf[i] != 1)
            return 0;
    }

    return 1;
}

static int run_foo(void) {
    int i;
    for (i = 0; i < 1; i++) {
        const foo *myfoo = get_foo(i);
        if (foo_loop(myfoo))
            return 0;
    }
    return -1;
}

// To suppress "unused run_foo" warning
typedef struct hack {
    int (*func)(void);
} hack;

hack myhack = {
    .func = run_foo,
};

----------------------
%gcc -Warray-bounds -O3 -c test.c

test.c: In function ‘run_foo’:
test.c:22:23: warning: array subscript is above array bounds [-Warray-bounds]
         if (myfoo->buf[i] != 1)

-----------------------

config:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-unknown-linux-gnu/5.1.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: /build/gcc/src/gcc-5-20150519/configure --prefix=/usr
--libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++ --enable-shared
--enable-threads=posix --enable-libmpx --with-system-zlib --with-isl
--enable-__cxa_atexit --disable-libunwind-exceptions --enable-clocale=gnu
--disable-libstdcxx-pch --disable-libssp --enable-gnu-unique-object
--enable-linker-build-id --enable-lto --enable-plugin
--enable-install-libiberty --with-linker-hash-style=gnu
--enable-gnu-indirect-function --disable-multilib --disable-werror
--enable-checking=release --with-default-libstdcxx-abi=c++98
Thread model: posix
gcc version 5.1.0 (GCC)
>From gcc-bugs-return-488125-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jun 04 22:10:01 2015
Return-Path: <gcc-bugs-return-488125-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 66656 invoked by alias); 4 Jun 2015 22:10:01 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 66633 invoked by uid 48); 4 Jun 2015 22:09:57 -0000
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/66422] -Warray-bounds false positive with -O3
Date: Thu, 04 Jun 2015 22:10:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 5.1.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-66422-4-BHNf5rp0eG@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-66422-4@http.gcc.gnu.org/bugzilla/>
References: <bug-66422-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-06/txt/msg00457.txt.bz2
Content-length: 277

https://gcc.gnu.org/bugzilla/show_bug.cgi?idf422

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I don't think this is a false warning as you are saying the size is at least 4
which means if buf[ does not contain 1, you will access past the loop bounds.

[Bug c/66422] -Warray-bounds false positive with -O3

[gajjanagadde at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

--- Comment #2 from Ganesh Ajjanagadde <gajjanagadde at gmail dot com> ---
But myfoo->foo_size is not set within the foo_loop function.
For instance, myfoo->foo_size could be set outside the function boundary,
and then the function could be called (say foo_size = 3 or 4).
This is represented by the get_foo() function.
Then, as long as the programmer guarantees that when this function is called,
myfoo->foo_size is always <= 4, there is certainly no error.

Furthermore, note that I put a < 3 condition as opposed to a <= 3.

[Bug c/66422] -Warray-bounds false positive with -O3

[gajjanagadde at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

Ganesh Ajjanagadde <gajjanagadde at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #35698|0                           |1
        is obsolete|                            |

--- Comment #3 from Ganesh Ajjanagadde <gajjanagadde at gmail dot com> ---
Created attachment 35699
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35699&action=edit
testv2

[Bug c/66422] -Warray-bounds false positive with -O3

[gajjanagadde at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

--- Comment #4 from Ganesh Ajjanagadde <gajjanagadde at gmail dot com> ---
Updated attachment that compiles to standalone executable (invoked with similar
flags for with/without warning as before: gcc -Warray-bounds -O3 test.c,
gcc -Warray-bounds test.c respectively).

[Bug tree-optimization/66422] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2015-06-08
                 CC|                            |hubicka at gcc dot gnu.org
          Component|c                           |tree-optimization
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Ok, so we peeled the loop like

run_foo ()
{
...
  <bb 10>:
  _33 = myfoo_28->buf[3];
  if (_33 != 1)
    goto <bb 13>;
  else
    goto <bb 11>;

  <bb 11>:
  _34 = (int) _27;
  if (_34 > 4)
    goto <bb 12>;
  else
    goto <bb 13>;

  <bb 12>:
  __builtin_unreachable ();
  _35 = myfoo_28->buf[4];

  <bb 13>:
  # _36 = PHI <0(2), 1(3), 0(4), 1(5), 0(6), 1(7), 0(8), 1(9), 0(10), 1(11),
0(12)>
  if (_36 != 0)
    goto <bb 15>;
  else
    goto <bb 14>;

  <bb 14>:
  i_37 = 1;

  <bb 15>:
  # _2 = PHI <0(13), -1(14)>
  return _2;

and the unreachable () remains in the CFG.

Honza - it seems that remove_exits_and_undefined_stmts inserts these
unreachable calls but fails to split the BBs.

I have a patch.

[Bug tree-optimization/66422] [5/6 Regression] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.9.2
   Target Milestone|---                         |5.2
            Summary|-Warray-bounds false        |[5/6 Regression]
                   |positive with -O3           |-Warray-bounds false
                   |                            |positive with -O3

[Bug tree-optimization/66422] [5/6 Regression] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Jun  8 14:53:19 2015
New Revision: 224235

URL: https://gcc.gnu.org/viewcvs?rev=224235&root=gcc&view=rev
Log:
2015-06-08  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66422
        * tree-ssa-loop-ivcanon.c (remove_exits_and_undefined_stmts): Split
        block after inserted gcc_unreachable.

        * gcc.dg/Warray-bounds-16.c: New testcase.

Added:
    trunk/gcc/testsuite/gcc.dg/Warray-bounds-16.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-loop-ivcanon.c

[Bug tree-optimization/66422] [5 Regression] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |6.0
            Summary|[5/6 Regression]            |[5 Regression]
                   |-Warray-bounds false        |-Warray-bounds false
                   |positive with -O3           |positive with -O3
      Known to fail|                            |5.1.0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/66422] [5 Regression] -Warray-bounds false positive with -O3

[hubicka at ucw dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

--- Comment #8 from Jan Hubicka <hubicka at ucw dot cz> ---
> 
> run_foo ()
> {
> ...
>   <bb 10>:
>   _33 = myfoo_28->buf[3];
>   if (_33 != 1)
>     goto <bb 13>;
>   else
>     goto <bb 11>;
> 
>   <bb 11>:
>   _34 = (int) _27;
>   if (_34 > 4)
>     goto <bb 12>;
>   else
>     goto <bb 13>;
> 
>   <bb 12>:
>   __builtin_unreachable ();
>   _35 = myfoo_28->buf[4];
> 
>   <bb 13>:
>   # _36 = PHI <0(2), 1(3), 0(4), 1(5), 0(6), 1(7), 0(8), 1(9), 0(10), 1(11),
> 0(12)>
>   if (_36 != 0)
>     goto <bb 15>;
>   else
>     goto <bb 14>;
> 
>   <bb 14>:
>   i_37 = 1;
> 
>   <bb 15>:
>   # _2 = PHI <0(13), -1(14)>
>   return _2;
> 
> and the unreachable () remains in the CFG.
> 
> Honza - it seems that remove_exits_and_undefined_stmts inserts these
> unreachable calls but fails to split the BBs.
> 
> I have a patch.

Hmm, Indeed. I have expected cleanup_cfg to get rid of _35 = myfoo_28->buf[4];.
I suppose this changed with your compile time work for GCC 5?

Honza

[Bug tree-optimization/66422] [5 Regression] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/66422] [5 Regression] -Warray-bounds false positive with -O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Author: rguenth
Date: Mon Jun 22 14:12:24 2015
New Revision: 224732

URL: https://gcc.gnu.org/viewcvs?rev=224732&root=gcc&view=rev
Log:
2015-06-22  Richard Biener  <rguenther@suse.de>

        Backport from mainline
        2015-06-08  Richard Biener  <rguenther@suse.de>

        PR tree-optimization/66422
        * tree-ssa-loop-ivcanon.c (remove_exits_and_undefined_stmts): Split
        block after inserted gcc_unreachable.

        * gcc.dg/Warray-bounds-16.c: New testcase.

Added:
    branches/gcc-5-branch/gcc/testsuite/gcc.dg/Warray-bounds-16.c
Modified:
    branches/gcc-5-branch/gcc/ChangeLog
    branches/gcc-5-branch/gcc/testsuite/ChangeLog
    branches/gcc-5-branch/gcc/tree-ssa-loop-ivcanon.c