[Bug middle-end/96384] [11 Regression] bogus -Wstringop-overflow= storing into multidimensional array with index in range

["msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96384

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
It looks like a false positive caused by the weirdo signed vs unsigned
conversions between wide_int and offset_int.  It happens in this piece of code
in compute_objsize:

      offset_int orng[2];
      tree off = TREE_OPERAND (ptr, 1);
      if (!get_range (off, SIGNED, orng, rvals))
    /* Fail unless the size of the object is zero.  */
    return pref->sizrng[0] == 0 && pref->sizrng[0] == pref->sizrng[1];
      ...

      if (ostype && TREE_CODE (eltype) == ARRAY_TYPE)
        {
          /* Execpt for the permissive raw memory functions which
         use the size of the whole object determined above,
         use the size of the referenced array.  */
          pref->sizrng[0] = pref->offrng[0] + orng[0] + sz;
          pref->sizrng[1] = pref->offrng[1] + orng[1] + sz;
        }
    }

We get orng indirectly by converting the get_range_info() result in get_range()
in tree-ssa-strlen.c to wide_int first, and then converting it to offset_int. 
We do this dance because some clients use wide_int and others offset_int.

We get vr->max ():

  <integer_cst 0x7fffe8f3bbe8 type <integer_type 0x7fffea0f7d20 guint> constant
4294967294>

the result of converting it to wide_int:

      minmax[1] = wi::to_wide (vr->max ());
is

(gdb) p minmax[1]
$39 = {<wide_int_storage> = {val = {-2, 24874380, 0}, len = 1, precision = 32},
static is_sign_extended = true}

We then take it and convert it to offset_int in the get_range() helper in
builtins.c:

  r[1] = offset_int::from (wr[1], sgn);

Because it's an offset, sgn is SIGNED so we end up with -2 instead of the
original positive 4294967294.

We use that -2 to compute the upper bound on the size of the object and store
it in pref->sizrng[1], which becomes negative.  In the end, we compare the
lower bound of the overall offset into the object (it's 0) to the upper bound
of the size (which is -6) to see if it's less.  It's not so the result is zero
bytes of space.