[Bug c/66422] New: -Warray-bounds false positive with -O3

["gajjanagadde at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66422

            Bug ID: 66422
           Summary: -Warray-bounds false positive with -O3
           Product: gcc
           Version: 5.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gajjanagadde at gmail dot com
  Target Milestone: ---

Created attachment 35698
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35698&action=edit
test

Compiling the following code on GCC 5.1.0 produces a bogus out of bounds
warning:

-------

#include <inttypes.h>
// Simple test file to trigger this bug
// Two things noticed:
// 1. commenting out const char* bar results in no warning
// 2. Changing the "loop" in run_foo to a single, direct control
// results in no warning
// (These were done independently of each other, starting with this file)

typedef struct foo {
    uint8_t foo_size;
    int buf[4];
    const char* bar;
} foo;

const foo *get_foo(int index);

static int foo_loop(const foo *myfoo) {
    int i;
    if (myfoo->foo_size < 3)
        return 0;
    for (i = 0; i < myfoo->foo_size; i++) {
        if (myfoo->buf[i] != 1)
            return 0;
    }

    return 1;
}

static int run_foo(void) {
    int i;
    for (i = 0; i < 1; i++) {
        const foo *myfoo = get_foo(i);
        if (foo_loop(myfoo))
            return 0;
    }
    return -1;
}

// To suppress "unused run_foo" warning
typedef struct hack {
    int (*func)(void);
} hack;

hack myhack = {
    .func = run_foo,
};

----------------------
%gcc -Warray-bounds -O3 -c test.c

test.c: In function ‘run_foo’:
test.c:22:23: warning: array subscript is above array bounds [-Warray-bounds]
         if (myfoo->buf[i] != 1)

-----------------------

config:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-unknown-linux-gnu/5.1.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: /build/gcc/src/gcc-5-20150519/configure --prefix=/usr
--libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++ --enable-shared
--enable-threads=posix --enable-libmpx --with-system-zlib --with-isl
--enable-__cxa_atexit --disable-libunwind-exceptions --enable-clocale=gnu
--disable-libstdcxx-pch --disable-libssp --enable-gnu-unique-object
--enable-linker-build-id --enable-lto --enable-plugin
--enable-install-libiberty --with-linker-hash-style=gnu
--enable-gnu-indirect-function --disable-multilib --disable-werror
--enable-checking=release --with-default-libstdcxx-abi=c++98
Thread model: posix
gcc version 5.1.0 (GCC)
>From gcc-bugs-return-488125-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jun 04 22:10:01 2015
Return-Path: <gcc-bugs-return-488125-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 66656 invoked by alias); 4 Jun 2015 22:10:01 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 66633 invoked by uid 48); 4 Jun 2015 22:09:57 -0000
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/66422] -Warray-bounds false positive with -O3
Date: Thu, 04 Jun 2015 22:10:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 5.1.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: pinskia at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-66422-4-BHNf5rp0eG@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-66422-4@http.gcc.gnu.org/bugzilla/>
References: <bug-66422-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-06/txt/msg00457.txt.bz2
Content-length: 277

https://gcc.gnu.org/bugzilla/show_bug.cgi?idf422

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I don't think this is a false warning as you are saying the size is at least 4
which means if buf[ does not contain 1, you will access past the loop bounds.