[Bug middle-end/95072] New: -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[Bug middle-end/95072] New: -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[eggert at cs dot ucla.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

            Bug ID: 95072
           Summary: -Warray-bounds false positive with flexible array
                    bounds (regression from GCC 9)
           Product: gcc
           Version: 10.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: eggert at cs dot ucla.edu
  Target Milestone: ---

Created attachment 48514
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48514&action=edit
Test program illustrating the -Warray-bounds=2 false alarm

I ran into several false alarms when building GNU Emacs master with GCC 10.1.0
x86-64, which I compiled from source under RHEL 7.7. To reproduce one of them,
compile the attached file xx3.i (a drastic simplification of the Emacs
original) with:

gcc -S -Warray-bounds=2 -O2 xx3.i

The output I get is:

xx3.i: In function 'set_frame_menubar':
xx3.i:17:5: warning: 'memcpy' offset 3 from the object at 'menu_bar_vector' is
\
out of the bounds of referenced subobject 'contents' with type 'union Lisp_X
*[\
]' at offset 3 [-Warray-bounds]
   17 |     memcpy (previous_items,
      |     ^~~~~~~~~~~~~~~~~~~~~~~
   18 |      ((struct Lisp_Vector *) ((char *) menu_bar_vector - 5))->contents,
      |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   19 |      previous_menu_items_used);
      |      ~~~~~~~~~~~~~~~~~~~~~~~~~
xx3.i:9:17: note: subobject 'contents' declared here
    9 |     Lisp_Object contents[];
      |                 ^~~~~~~~

In the Emacs original, menu_bar_vector is a tagged pointer; subtracting 5 gives
you the true pointer to the struct. Somehow the subtraction of 5 confuses GCC
and it incorrectly claims that the flexible array member has an upper bound of
at most 3.

I do not observe the problem with GCC 9.3.0 on the same platform.

[Bug middle-end/95072] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
             Status|UNCONFIRMED                 |ASSIGNED
                 CC|                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2020-05-12
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
     Ever confirmed|0                           |1
      Known to fail|                            |10.1.0
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=94985

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
Confirmed.  Possibly related to or duplicate of pr94985, or simply a bug in
level 2 of the warning when it uses the size of the accessed member even for
raw memory functions for memcpy (as opposed to using the whole object) but
neglects to take flexible array members into consideration.

[Bug middle-end/95072] [10/11 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|-Warray-bounds false        |[10/11 Regression]
                   |positive with flexible      |-Warray-bounds false
                   |array bounds (regression    |positive with flexible
                   |from GCC 9)                 |array bounds (regression
                   |                            |from GCC 9)
           Priority|P3                          |P2
   Target Milestone|---                         |10.2

[Bug middle-end/95072] [10/11 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.2                        |10.3

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.2 is released, adjusting target milestone.

[Bug middle-end/95072] [10/11 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug middle-end/95072] [10/11/12 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|msebor at gcc dot gnu.org          |unassigned at gcc dot gnu.org
                 CC|msebor at gcc dot gnu.org          |
             Status|ASSIGNED                    |NEW

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
The warning is still present in GCC 12.  I'm no longer working on it.

[Bug middle-end/95072] [10/11/12/13 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug middle-end/95072] [11/12/13/14 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.5

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 branch is being closed.

[Bug middle-end/95072] [11/12/13 Regression] -Warray-bounds false positive with flexible array bounds (regression from GCC 9)

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95072

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12/13/14 Regression]    |[11/12/13 Regression]
                   |-Warray-bounds false        |-Warray-bounds false
                   |positive with flexible      |positive with flexible
                   |array bounds (regression    |array bounds (regression
                   |from GCC 9)                 |from GCC 9)
                 CC|                            |law at gcc dot gnu.org

--- Comment #7 from Jeffrey A. Law <law at gcc dot gnu.org> ---
No longer triggers on the trunk.  Not sure about gcc-13.