[Bug middle-end/100477] New: Bogus -Wstringop-overflow warning on memset

[andysem at mail dot ru via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100477

            Bug ID: 100477
           Summary: Bogus -Wstringop-overflow warning on memset
           Product: gcc
           Version: 10.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: andysem at mail dot ru
  Target Milestone: ---

Consider the following test case:

#include <cstddef>
#include <cstring>

class Container
{
public:
    typedef unsigned char value_type;
    typedef value_type* pointer;
    typedef std::size_t size_type;

    Container();

    void clear();
    void reserve(size_type);

    size_type size() const { return _size; }

    void resize(size_type n)
    {
        if(n == 0)
        {
            clear();
            return;
        }

        if(n > _capacity)
        {
            reserve(n);
        }
        else if(_owned && n < _size)
        {
            std::memset(_buf + n, 0, (_size - n) * sizeof(value_type));
        }
        _size = n;
    }

private:
    pointer _buf;
    size_type _size;
    size_type _capacity;
    int _shrinkCounter;
    bool _owned;
};

void test(Container& c, int v)
{
    Container::size_type position = c.size();
    c.resize(position + sizeof(int));
}

$ g++ -Wall -O3 -o memset_warning.o -c memset_warning.cpp 
In file included from /usr/include/string.h:519,
                 from /usr/include/c++/10/cstring:42,
                 from memset_warning.cpp:2:
In function ‘void* memset(void*, int, size_t)’,
    inlined from ‘void Container::resize(Container::size_type)’ at
memset_warning.cpp:32:24,
    inlined from ‘void test(Container&, int)’ at memset_warning.cpp:48:13:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:59:33: warning: ‘void*
__builtin_memset(void*, int, long unsigned int)’ specified bound
18446744073709551612 exceeds maximum object size 9223372036854775807
[-Wstringop-overflow=]
   59 |   return __builtin___memset_chk (__dest, __ch, __len,
      |          ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
   60 |      __glibc_objsize0 (__dest));
      |      ~~~~~~~~~~~~~~~~~~~~~~~~~~

Here, the reported constant 18446744073709551612 is -4, which implies the
compiler is ignoring the `n < _size` check and calculates `(_size - n)` for
memset even though it will never be called.

$ g++ -v
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/10/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa:hsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 10.3.0-1ubuntu1'
--with-bugurl=file:///usr/share/doc/gcc-10/README.Bugs
--enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr
--with-gcc-major-version-only --program-suffix=-10
--program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu
--enable-libstdcxx-debug --enable-libstdcxx-time=yes
--with-default-libstdcxx-abi=new --enable-gnu-unique-object
--disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib
--enable-libphobos-checking=release --with-target-system-zlib=auto
--enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib
--with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-10-gDeRY6/gcc-10-10.3.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-10-gDeRY6/gcc-10-10.3.0/debian/tmp-gcn/usr,hsa
--without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu
--host=x86_64-linux-gnu --target=x86_64-linux-gnu
--with-build-config=bootstrap-lto-lean --enable-link-mutex
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 10.3.0 (Ubuntu 10.3.0-1ubuntu1)