[Bug tree-optimization/65461] -Warray-bounds due to loop unrolling in the linux kernel (free_area_init_nodes)

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65461

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|-Warray-bounds warnings in  |-Warray-bounds due to loop
                   |the linux kernel            |unrolling in the linux
                   |(free_area_init_nodes)      |kernel
                   |                            |(free_area_init_nodes)
      Known to fail|                            |10.1.0, 11.0, 9.2.0
   Last reconfirmed|2017-09-28 00:00:00         |2020-6-1

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Reconfirmed with GCC 10.1 and trunk:

$ gcc -O2 -S -Wall -fdump-tree-vrp=/dev/stdout pr65461.c
int f (void)
{
  int a[10] = { 0 };
  int i = 0;
  return i ? a[11] : 0;
}

;; Function func (func, funcdef_no=0, decl_uid=1934, cgraph_uid=1,
symbol_order=0)

;; 2 loops found
;;
;; Loop 0
;;  header 0, latch 1
;;  depth 0, outer -1
;;  nodes: 0 1 2 3 4 5 6 7
;;
;; Loop 1
;;  header 6, latch 5
;;  depth 1, outer 0
;;  nodes: 6 5 3 4
;; 2 succs { 6 }
;; 3 succs { 5 4 }
;; 4 succs { 5 }
;; 5 succs { 6 }
;; 6 succs { 3 7 }
;; 7 succs { 1 }

SSA replacement table
N_i -> { O_1 ... O_j } means that N_i replaces O_1, ..., O_j

i.3_12 -> { i.3_3 }
i.3_13 -> { i.3_3 }
i.3_14 -> { i.3_3 }
Incremental SSA update started at block: 6
Number of blocks in CFG: 9
Number of blocks to update: 5 ( 56%)



Value ranges after VRP:

_1: int [-INF, -1]
_2: int [-2147483647, 2]
i.3_3: int VARYING
.MEM_4: <<< error >>> VARYING
.MEM_5: <<< error >>> VARYING
i.3_12: int [-INF, 1]  EQUIVALENCES: { i.3_3 } (1 elements)
i.3_13: int [-INF, 0]  EQUIVALENCES: { i.3_3 i.3_12 } (2 elements)
i.3_14: int [1, 1]  EQUIVALENCES: { i.3_3 i.3_12 } (2 elements)


pr65461.c: In function ‘func’:
pr65461.c:10:14: warning: array subscript -1 is below array bounds of ‘int[2]’
[-Warray-bounds]
   10 |         array[i-1] = 0;
      |         ~~~~~^~~~~
pr65461.c:3:12: note: while referencing ‘array’
    3 | extern int array[2];
      |            ^~~~~
Removing basic block 8
func ()
{
  int i;
  int _1;
  int _2;
  int i.3_3;

  <bb 2> [local count: 118111600]:
  i = 1;
  goto <bb 6>; [100.00%]

  <bb 3> [local count: 955630225]:
  if (i.3_3 == 1)
    goto <bb 5>; [20.24%]
  else
    goto <bb 4>; [79.76%]

  <bb 4> [local count: 762210669]:
  _1 = i.3_3 + -1;
  array[_1] = 0;

  <bb 5> [local count: 955630227]:
  _2 = i.3_3 + 1;
  i = _2;

  <bb 6> [local count: 1073741824]:
  i.3_3 = i;
  if (i.3_3 <= 1)
    goto <bb 3>; [89.00%]
  else
    goto <bb 7>; [11.00%]

  <bb 7> [local count: 118111600]:
  foo (&i);
  i ={v} {CLOBBER};
  return;

}



;; Function func (func, funcdef_no=0, decl_uid=1934, cgraph_uid=1,
symbol_order=0)

;; 2 loops found
;;
;; Loop 0
;;  header 0, latch 1
;;  depth 0, outer -1
;;  nodes: 0 1 2
;; 2 succs { 1 }

Value ranges after VRP:



func ()
{
  int i;

  <bb 2> [local count: 118111600]:
  i = 2;
  foo (&i);
  i ={v} {CLOBBER};
  return;

}