[Bug tree-optimization/66974] -Warray-bounds false positive with -O3

["manu at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66974

Manuel López-Ibáñez <manu at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
                 CC|                            |manu at gcc dot gnu.org

--- Comment #3 from Manuel López-Ibáñez <manu at gcc dot gnu.org> ---
The reason seems to be that GCC unrolls the inner loop completely to something
like:

if (i / 2 != 0) {
  // i > 1
      c[0] += c[i] * c[i-1];
      c[i-1] += c[i] * c[0];
      if (i / 2 > 1) {
        // i > 3
        c[1] += c[i] * c[i-2];
        c[i-2] += c[i] * c[1];
        if (i / 2 > 2) {
        // i > 5
          c[2] += c[i] * c[i-3];
          c[i-3] += c[i] * c[2];
        }
      }
 }

by reasoning that j < 3. However, it is not able to remove the two inner
conditions by reasoning that i < 3  Since i's upper-bound depends on order and
order is a parameter, it should be able to assume it (or at least say "may be
above").

Interestingly, if one changes the function to:

int foo(unsigned order) {
  int c[3] = {1, 2, 3};
  if (order >= 5) return 0;
  unsigned i, j;
  for (i = 1; i < order; i++) {
    for (j = 0; j < i / 2; j++) {
      c[j] += c[i] * c[i-j-1];
      c[i-j-1] += c[i] * c[j];
    }
  }
  return c[0];
}

There is an out-of-bounds access that is not detected by -Warray-bounds, but it
is detected by -Wuninitialized:

test.c:7:16: warning: ‘c[3u]’ may be used uninitialized in this function
[-Wmaybe-uninitialized]
       c[j] += c[i] * c[i-j-1];
                ^
>From gcc-bugs-return-493074-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jul 23 09:43:31 2015
Return-Path: <gcc-bugs-return-493074-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 112927 invoked by alias); 23 Jul 2015 09:43:30 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 112867 invoked by uid 48); 23 Jul 2015 09:43:27 -0000
From: "dwmw2 at infradead dot org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/50818] va_list is filled incorrectly in functions with ms_abi attribute on amd64
Date: Thu, 23 Jul 2015 09:43:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.4.5
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dwmw2 at infradead dot org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-50818-4-B8XYOgnXzk@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-50818-4@http.gcc.gnu.org/bugzilla/>
References: <bug-50818-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-07/txt/msg01964.txt.bz2
Content-length: 1016

https://gcc.gnu.org/bugzilla/show_bug.cgi?idP818

David Woodhouse <dwmw2 at infradead dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dwmw2 at infradead dot org

--- Comment #2 from David Woodhouse <dwmw2 at infradead dot org> ---
Still broken in 5.1.1.

Note that if you contrive to build it with -mabi=ms on the command line (by
splitting the two functions into separate files and building them separately),
it works fine.

It also works fine if you explicitly use __builtin_ms_va_{list,start,end}.

The problem seems to be that GCC is using the *global* ABI setting to decide
what to do when it sees a plain __builtin_va_list, rather the ABI for the
*current* function.

This is hurting us for UEFI builds too, where only public functions are marked
with __attribute__((ms_abi)) but we need *some* way to make va_list do the
right thing in the general case.