https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96384
--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
It looks like a false positive caused by the weirdo signed vs unsigned
conversions between wide_int and offset_int. It happens in this piece of code
in compute_objsize:
offset_int orng[2];
tree off = TREE_OPERAND (ptr, 1);
if (!get_range (off, SIGNED, orng, rvals))
/* Fail unless the size of the object is zero. */
return pref->sizrng[0] == 0 && pref->sizrng[0] == pref->sizrng[1];
...
if (ostype && TREE_CODE (eltype) == ARRAY_TYPE)
{
/* Execpt for the permissive raw memory functions which
use the size of the whole object determined above,
use the size of the referenced array. */
pref->sizrng[0] = pref->offrng[0] + orng[0] + sz;
pref->sizrng[1] = pref->offrng[1] + orng[1] + sz;
}
}
We get orng indirectly by converting the get_range_info() result in get_range()
in tree-ssa-strlen.c to wide_int first, and then converting it to offset_int.
We do this dance because some clients use wide_int and others offset_int.
We get vr->max ():
<integer_cst 0x7fffe8f3bbe8 type <integer_type 0x7fffea0f7d20 guint> constant
4294967294>
the result of converting it to wide_int:
minmax[1] = wi::to_wide (vr->max ());
is
(gdb) p minmax[1]
$39 = {<wide_int_storage> = {val = {-2, 24874380, 0}, len = 1, precision = 32},
static is_sign_extended = true}
We then take it and convert it to offset_int in the get_range() helper in
builtins.c:
r[1] = offset_int::from (wr[1], sgn);
Because it's an offset, sgn is SIGNED so we end up with -2 instead of the
original positive 4294967294.
We use that -2 to compute the upper bound on the size of the object and store
it in pref->sizrng[1], which becomes negative. In the end, we compare the
lower bound of the overall offset into the object (it's 0) to the upper bound
of the size (which is -6) to see if it's less. It's not so the result is zero
bytes of space.
