[Bug middle-end/98465] Bogus warning stringop-overread wuth -std=gnu++20 -O2 and std::string::insert

["msebor at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98465

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org
           Keywords|                            |diagnostic,
                   |                            |missed-optimization
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
             Blocks|                            |97048
   Last reconfirmed|                            |2020-12-28
      Known to fail|                            |10.2.0, 11.0

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
I'm not sure why I don't see the warning for the test case in my build but I
can reproduce it (as well as a -Warray-bounds) by compiling the translation
unit obtained from the test case and with system header markers removed with
either GCC 10 or 11:

$ g++ -O2 -S -Wall -std=gnu++20 pr98465.C
pr98465.C: In function ‘void f(std::string&)’:
pr98465.C:22316:20: warning: offset ‘2’ outside bounds of constant string
[-Warray-bounds]
22316 |       this->_S_copy(__p, __s + __len2 - __len1, __len2);
      |       ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
pr98465.C:22843:12: note: ‘constantString’ declared here
22843 | const char constantString[] = {42, 53};
      |            ^~~~~~~~~~~~~~
In static member function ‘static constexpr std::char_traits<char>::char_type*
std::char_traits<char>::copy(std::char_traits<char>::char_type*, const
char_type*, std::size_t)’,
    inlined from ‘void f(std::string&)’ at pr98465.C:19983:21:
pr98465.C:9051:49: warning: ‘void* __builtin_memcpy(void*, const void*, long
unsigned int)’ reading 2 bytes from a region of size 0 [-Wstringop-overread]
 9051 |  return static_cast<char_type*>(__builtin_memcpy(__s1, __s2, __n));
      |                                 ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
pr98465.C: In function ‘void f(std::string&)’:
pr98465.C:22843:12: note: at offset 2 into source object ‘constantString’ of
size 2
22843 | const char constantString[] = {42, 53};
      |            ^~~~~~~~~~~~~~

The -Warray-bounds instance comes from a call to c_strlen() made during the
ccp2 pass for the following IL:

void f (struct string & s)
{
  _14 = MEM[(const struct basic_string *)s_2(D)]._M_dataplus._M_p;
  ...
  <bb 22> [local count: 179779816]:
  if (_14 >= &MEM <const char[2]> [(void *)&constantString + 2B])
    goto <bb 23>; [50.00%]
  else
    goto <bb 24>; [50.00%]
  ...
  <bb 24> [local count: 44944954]:
  if (_14 <= &constantString)
    goto <bb 25>; [50.00%]
  else
    goto <bb 26>; [50.00%]

  <bb 25> [local count: 22472477]:
  __builtin_memcpy (_14, &MEM <const char[2]> [(void *)&constantString + 2B],
2);   <<< -Warray-bounds
  goto <bb 55>; [100.00%]
  ...
}

The warning is correct: the call is invalid.  It results from the following
transformations:

Folding statement: _45 = 2 - _6;
Queued stmt for removal.  Folds to: 2
Folding statement: _46 = &constantString + _45;
Queued stmt for removal.  Folds to: &MEM <const char[2]> [(void
*)&constantString + 2B]
Folding statement: __builtin_memcpy (__p_18, _46, 2);
Folded into: __builtin_memcpy (_14, &MEM <const char[2]> [(void
*)&constantString + 2B], 2);

The invalid call survives until expansion which is when the -Wstringop-overread
is issued.  I suspect the default -Wno-system-headers setting has something to
do with the warning being masked.

In the IL above, the pointer inequalities that lead to the transformation are
the result of the call to _M_disjunct(__s) in std::string::_M_replace,
presumably done to identify and cope with self-insertion.  Since constantString
is a distinct object, the invalid call is unreachable, but without more context
GCC can't figure that out.  Annotating the std::string::_M_dataplus._M_p
pointer as one that cannot alias a declared object (other than the _M_local_buf
member) would be one way to avoid the warning (and improve the codegen at the
same time).  IIRC, I suggested something like that in the past but no nothing
has materialized yet.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97048
[Bug 97048] [meta-bug] bogus/missing -Wstringop-overread warnings