https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107561
Bug ID: 107561
Summary: g++.dg/pr17488.C regression due to -Wstringop-overflow
problem
Product: gcc
Version: 12.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: aldyh at gcc dot gnu.org
Target Milestone: ---
g++.dg/pr17488.C fails after commit r13-3761 with:
warning: ‘void* __builtin_memcpy(void*, const void*, long unsigned int)’
writing 8 or more bytes into a region of size 0 overflows the destination
[-Wstringop-overflow=]
...
...
note: destination object of size 0 allocated by ‘operator new’
There is no difference in the IL the -Wstringop-overflow pass sees. For
that matter, there is no difference in the entire IL across through
the *.optimized dump. However, there are different ranges for two SSA
names.
In the *.waccess1 pass we see:
--- /tmp/a.ii.025t.waccess1.orig.787460 2022-11-07 19:43:41.341855227 +0100
+++ /tmp/a.ii.025t.waccess1.new.787460 2022-11-07 19:43:41.344855238 +0100
@@ -331,8 +331,8 @@
max_depth: 3
pointer_query cache contents:
- 5.0[1]: _5 = _5 (base0); size: unknown
- 6.0[3]: _6 = _5 (base0); size: unknown
+ 5.0[1]: _5 = _5 (base0); size: [16, 9223372036854775807]
+ 6.0[3]: _6 = _5 (base0); size: [16, 9223372036854775807]
__attribute__((malloc))
struct valarray * std::__valarray_get_storage<std::valarray<long long int> >
(size_t __n)
@@ -364,8 +364,8 @@
max_depth: 3
pointer_query cache contents:
- 5.0[1]: _5 = _5 (base0); size: unknown
- 6.0[3]: _6 = _5 (base0); size: unknown
+ 5.0[1]: _5 = _5 (base0); size: [8, 9223372036854775807]
+ 6.0[3]: _6 = _5 (base0); size: [8, 9223372036854775807]
__attribute__((malloc))
long long int * std::__valarray_get_storage<long long int> (size_t __n)
This coincides with two unsigned multiplications by 16 and 8, where we
correctly restrict the range. This is from the evrp dump:
-Global Exported: _2 = [irange] long unsigned int [0, +INF] NONZERO
0xfffffffffffffff0
+Global Exported: _2 = [irange] long unsigned int [0, 0][16, +INF] NONZERO
0xfffffffffffffff0
-Global Exported: _2 = [irange] long unsigned int [0, +INF] NONZERO
0xfffffffffffffff8
+Global Exported: _2 = [irange] long unsigned int [0, 0][8, +INF] NONZERO
0xfffffffffffffff8
This is correct as we know the ranges cannot be [1,15] and [1,7] respectively.
