[Bug tree-optimization/92539] [8/9/10/11 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[Bug tree-optimization/92539] [8/9/10/11 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10/11 Regression]      |[8/9/10/11 Regression]
                   |-Warray-bounds false        |-Warray-bounds false
                   |positive (loop unroll?)     |positive with -O3 (loop
                   |                            |unroll?)
      Known to fail|                            |10.2.0, 11.0
   Last reconfirmed|2019-11-19 00:00:00         |2020-8-20

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
No change in GCC 10 or 11.

[Bug tree-optimization/92539] [8/9/10/11 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
>From the vrp1 dump it seems that it should be possible to determine that bb 8
and later are unreachable.  Might the predicate analysis help here as well?

int main ()
{
  const char * last;
  int i;
  const char * local_iterator;
  const char * in;
  int _3;
  char _5;
  bool iftmp.0_13;

  <bb 2> [local count: 118111600]:
  goto <bb 4>; [100.00%]

  <bb 3> [local count: 955630225]:
  last_4 = last_2 + 1;

  <bb 4> [local count: 1073741824]:
  # last_2 = PHI <"aa"(2), last_4(3)>
  _5 = *last_2;
  if (_5 != 0)
    goto <bb 3>; [89.00%]
  else
    goto <bb 5>; [11.00%]                                    <<< *last_2 ==
'\0' implies last_2 == "aa" + 2

  <bb 5> [local count: 118111600]:
  # last_12 = PHI <last_2(4)>
  if (last_12 != "aa")                                       <<< true
    goto <bb 6>; [54.59%]
  else
    goto <bb 12>; [45.41%]

  <bb 6> [local count: 64477123]:
  if (last_12 != &MEM <const char[3]> [(void *)"aa" + 1B])   <<< true
    goto <bb 7>; [54.59%]
  else
    goto <bb 12>; [45.41%]

  <bb 7> [local count: 55926445]:
  if (last_12 != &MEM <const char> [(void *)"aa" + 2B])      <<< false
    goto <bb 8>; [54.59%]
  else
    goto <bb 12>; [45.41%]

  <bb 8> [local count: 30530247]:
  if (last_12 != &MEM <const char> [(void *)"aa" + 3B])
    goto <bb 9>; [54.59%]
  else
    goto <bb 12>; [45.41%]


  <bb 10> [local count: 14456228]:
  if (last_12 != &MEM <const char> [(void *)"aa" + 5B])
    goto <bb 11>; [54.59%]
  else
    goto <bb 12>; [45.41%]

  <bb 11> [local count: 59055800]:
  if (last_12 == &MEM <const char> [(void *)"aa" + 6B])
    goto <bb 13>; [30.00%]
  else
    goto <bb 12>; [70.00%]

  <bb 12> [local count: 100394860]:

  <bb 13> [local count: 118111600]:
  # iftmp.0_13 = PHI <0(12), 1(11)>
  _3 = (int) iftmp.0_13;
  return _3;

}

[Bug tree-optimization/92539] [8/9/10/11 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

--- Comment #6 from Jeffrey A. Law <law at redhat dot com> ---
I wonder if we're looking at this the wrong way.

We have several blocks with this kind of structure:

  <bb 8> [local count: 30530247]:
  if (last_12 != &MEM <const char> [(void *)"aa" + 3B])
    goto <bb 9>; [54.59%]
  else
    goto <bb 12>; [45.41%]


The key point being that the RHS of the conditional is a bogus pointer. 
Nothing can ever be equal to that pointer.  So we should be able to determine
the result of the conditional in all those blocks.

I suspect that alone is sufficient to make the false positive go away.

[Bug tree-optimization/92539] [9/10/11/12 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|8.5                         |9.4

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 8 branch is being closed.

[Bug tree-optimization/92539] [9/10/11/12 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.4                         |9.5

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9.4 is being released, retargeting bugs to GCC 9.5.

[Bug tree-optimization/92539] [10/11/12/13 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|9.5                         |10.4

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 9 branch is being closed

[Bug tree-optimization/92539] [10/11/12/13 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug tree-optimization/92539] [11/12/13/14 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug tree-optimization/92539] [11/12/13/14/15 Regression] -Warray-bounds false positive with -O3 (loop unroll?)

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92539

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #12 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Just to save it for the future.  I think this patch I've got lying around
implements the idea in c#6.

diff --git a/gcc/vr-values.cc b/gcc/vr-values.cc
index 3ccb77d28be..cc753e79a8a 100644
--- a/gcc/vr-values.cc
+++ b/gcc/vr-values.cc
@@ -325,6 +325,34 @@ simplify_using_ranges::fold_cond_with_ops (enum tree_code
code,
       if (res == range_false (type))
        return boolean_false_node;
     }
+
+  /* If we're comparing pointers and one of the pointers is
+     not a valid pointer (say &MEM <const char> [(void *)"aa" + 4B)
+     return true for EQ and false for NE.  */
+  if ((code == EQ_EXPR || code == NE_EXPR)
+      && POINTER_TYPE_P (type)
+      && TREE_CODE (op1) == ADDR_EXPR
+      && TREE_CODE (TREE_OPERAND (op1, 0)) == MEM_REF)
+    {
+      tree mem_ref = TREE_OPERAND (op1, 0);
+      if (TREE_CODE (TREE_OPERAND (mem_ref, 0)) == ADDR_EXPR)
+       {
+         tree addr_expr = TREE_OPERAND (mem_ref, 0);
+         if (TREE_CODE (TREE_OPERAND (addr_expr, 0)) == STRING_CST)
+           {
+             tree string = TREE_OPERAND (addr_expr, 0);
+
+             if (TREE_CODE (TREE_OPERAND (mem_ref, 1)) == INTEGER_CST)
+               {
+                 HOST_WIDE_INT len = TREE_STRING_LENGTH (string);
+                 HOST_WIDE_INT offset = tree_to_uhwi (TREE_OPERAND (mem_ref,
1));
+                 if (offset > len)
+                   return code == EQ_EXPR ? boolean_false_node :
boolean_true_node;
+               }
+           }
+       }
+    }
+
   return NULL;
 }