[Bug c/98503] New: [11 regression] -Warray-bounds false positive with global variables at -O2

["w at 1wt dot eu" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98503

            Bug ID: 98503
           Summary: [11 regression] -Warray-bounds false positive with
                    global variables at -O2
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: w at 1wt dot eu
  Target Milestone: ---

First, please note that I saw a handful of related reports but couldn't judge
if this one might be merged with another one; if you think it can, feel free to
do so!

We've had build errors reported on haproxy with gcc-11 due to walking over a 
list whose head is in a global variable. We could simplify the reproducer to
this and confirm it on godbolt.org:

  #include <stddef.h>

  struct list {
    struct list *n;
    struct list *p;
  };

  struct list head;

  struct ref {
        struct list list;
        char *filename;
  };

  struct list *first(void)
  {
        struct ref *tmp;

        /*tmp = (struct ref *)((char *)&head - (size_t)&((struct ref
*)0)->list);*/
        tmp = (struct ref *)&head;
        //asm("" : "+rm"(tmp)); // hide tmp's origin to shut the warning.
        //asm("" : "=rm"(tmp) : "0"(&head)); // discretely assign tmp from head
        return tmp->list.n;
  }

Note that only the "ref->list" part is accessed here, hence it exactly matches
"head" (both of type struct list). But since gcc 11 (and only this one, 1.27 to
10.2 are OK), we're getting this:

  <source>: In function 'first':
  <source>:22:19: warning: array subscript 'struct ref[0]' is partly outside
array bounds of 'struct list[1]' [-Warray-bounds]
     22 |         return tmp->list.n;
        |                   ^~
  <source>:8:13: note: while referencing 'head'
      8 | struct list head;
        |             ^~~~
  Compiler returned: 0

Changing "head" to a function argument makes the warning disappear, building at
-O1 as well, and obviously, cheating with the asm statement to hide "tmp"
solves it (though it degrades the code quality).

Removing the unused "filename" from struct "ref" removes the warning. It looks
to me as if the compiler doesn't know what part of a structure is being
dereferenced when we access any member, making the warning systematically bogus
for embedded members accessed via container_of() and friends when the list's
head is global.

For now we can disable the warning, I've confirmed the generated code is
correct, but since it's the first time we have a false positive on this one,
I'd prefer if we can keep it as much as possible as it's one which can
definitely help spot real bugs.

I've just verified the version used on godbolt.org, it's "gcc version 11.0.0
20210101 (experimental) (Compiler-Explorer-Build)". I haven't rebuilt the trunk
locally so it might be possible this bug got solved since as part of one of the
few related ones.

Thanks!
Willy