[Bug tree-optimization/48795] New: -Warray-bounds false positive

[niko.lecam at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48795

   Summary: -Warray-bounds false positive
   Product: gcc
   Version: 4.6.0
Status: UNCONFIRMED
  Severity: normal
  Priority: P3
 Component: tree-optimization
AssignedTo: unassig...@gcc.gnu.org
ReportedBy: niko.le...@gmail.com


$ gcc -v
Utilisation des specs internes.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-unknown-linux-gnu/4.6.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configuré avec: /build/src/gcc-4.6-20110415/configure --prefix=/usr
--libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++ --enable-shared
--enable-threads=posix --with-system-zlib --enable-__cxa_atexit
--disable-libunwind-exceptions --enable-clocale=gnu --enable-gnu-unique-object
--enable-linker-build-id --with-ppl --enable-cloog-backend=isl --enable-lto
--enable-gold --enable-ld=default --enable-plugin --with-plugin-ld=ld.gold
--enable-multilib --disable-libstdcxx-pch --enable-checking=release
Modèle de thread: posix
gcc version 4.6.0 20110415 (prerelease) (GCC)

$ cat t.c 
/* testcase (derived from wine) */
typedef struct
{
  int len;
  char data[1];
} rec;

int
p(rec *r, int len);

int
f (char prm1, char prm2)
{
  char buf[10];

  rec *r1 = (rec *)&buf;

  r1->len = 10;
  r1->data[0] = prm1;
  r1->data[1] = prm2;

  return p(r1, r1->len);
}

$ gcc -S -O2 -Wall t.c -save-temps
t.c: In function ‘f’:
t.c:19:11: attention : array subscript is above array bounds [-Warray-bounds]

[Bug tree-optimization/48795] -Warray-bounds false positive

[niko.lecam at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48795

--- Comment #1 from Nicolas Le Cam  2011-04-27 
23:42:35 UTC ---
Removing the call to p avoid the warning. Also tested by replacing p with a
call to memcpy for example, which also triggers the warning.

[Bug tree-optimization/48795] -Warray-bounds false positive

[niko.lecam at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=48795

--- Comment #3 from Nicolas Le Cam  2011-05-01 
10:11:47 UTC ---
(In reply to comment #2)
> "r1->data[1] = prm2" goes above "char data[1]" bounds. How it's a false
> positive?

Because the structure is a kind of flexible array (code has to follow C89/C90
standard) and is big enough to handle a second member.

(Or the warning has to be emitted even if you remove the call to p, which is
not the case actually)

This example is a deliberate use of overflow to circumvent the absence of
flexible arrays in C89/C90, disabling Warray-bounds to avoid the flood it
generates isn't the right solution IMHO.