https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71690
--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> --- In addition to the data in comment #4, the script below extracts VRP ranges for an argument passed via the ellipsis to __builtin_snprintf. The script output shows that despite the same bounds on a variable, VRP exposes different ranges for different types of the variable, and the ranges sometimes differ between C and C++. Unfortunately, the ranges only correspond to the actual bounds in the relatively rare cases of char and short in C, and only in the signed forms of those types in C++. Cells with anything but [0, 9] in them indicate a suboptimal result. That the correct range be made available is important to me because of a patch for bug 49905 I'm testing because it would help reduce false positives. $ (cat vrp.c && for t in signed unsigned; do for u in char short int long 'long long'; do printf "%-20s " "$t $u"; for l in c c++; do /build/gcc-6-branch/gcc/xgcc -B/build/gcc-6-branch/gcc -DT="$t $u" -O2 -S -Wall -Wextra -Wpedantic -fdump-tree-vrp=vrp.out -x$l vrp.c 2>/dev/null; v=$(sed -n "s/ *__builtin_snprintf.*, *\([^ ,]*\));/\1/p" vrp.out); r=$(sed -n "s/^$v: *\(.*\)/\1/p" vrp.out | tail -n1); printf "%-20s" "$r"; done; echo; done; done) char d [10]; char s [10]; void f (T n) { if (n < 0 || n >= 10) return; __builtin_snprintf (d, 10, "%i", n); } signed char [0, 9] [0, 9] signed short [0, 9] [0, 9] signed int VARYING VARYING signed long VARYING VARYING signed long long VARYING VARYING unsigned char [0, 9] [0, 255] unsigned short [0, 9] [0, 65535] unsigned int VARYING VARYING unsigned long VARYING VARYING unsigned long long VARYING VARYING