[Bug c/47418] warning: array subscript is above array bounds at O2 with sin6_addr

2011-01-25 Thread rguenth at gcc dot gnu.org
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47418

Richard Guenther rguenth at gcc dot gnu.org changed:

   What|Removed |Added

 Status|UNCONFIRMED |NEW
   Last reconfirmed||2011.01.25 11:24:58
 Ever Confirmed|0   |1

--- Comment #4 from Richard Guenther rguenth at gcc dot gnu.org 2011-01-25 
11:24:58 UTC ---
VRP sees

bb 2:
  D.2725_3 = u.sa_data[15];
  D.2726_4 = (int) D.2725_3;
  D.2728_6 = u.sa_data[14];
  D.2729_7 = (int) D.2728_6;
...
  D.2769_47 = u.sa_data[0];
  D.2770_48 = (int) D.2769_47;
  test_func (0, D.2770_48, D.2768_46, D.2765_43, D.2762_40, D.2759_37,
D.2756_34, D.2753_31, D.2750_28, D.2747_25, D.2744_22, D.2741_19, D.2738_16,
D.2735_13, D.2732_10, D.2729_7, D.2726_4);
  return 0;

because of our fancy way of re-building non-addressed components.

With 4.6 the warning is gone and we instead have (thanks to MEM-REF):

bb 2:
  D.2695_3 = MEM[(char *)u + 15B];
  D.2696_4 = (int) D.2695_3;
  D.2698_6 = MEM[(char *)u + 14B];
  D.2699_7 = (int) D.2698_6;
...
  D.2740_48 = (int) D.2739_47;
  test_func (0, D.2740_48, D.2738_46, D.2735_43, D.2732_40, D.2729_37,
D.2726_34, D.2723_31, D.2720_28, D.2717_25, D.2714_22, D.2711_19, D.2708_16,
D.2705_13, D.2702_10, D.2699_7, D.2696_4);
  return 0;

thus, no more array access and still non-address-taken u.  4.4 also warns
about

small-test.c: In function 'main':
small-test.c:18: warning: array subscript is above array bounds
small-test.c:18: warning: array subscript is above array bounds
small-test.c:18: warning: array subscript is above array bounds
small-test.c:18: warning: 'u' is used uninitialized in this function

4.3 doesn't warn at all.

Confirmed.  I'd close it as fixed in 4.6 and add a testcase (no time for
that right now).


[Bug c/47418] warning: array subscript is above array bounds at O2 with sin6_addr

2011-01-22 Thread dpmcgee at gmail dot com
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47418

--- Comment #1 from Dan McGee dpmcgee at gmail dot com 2011-01-23 00:15:29 
UTC ---
Also of note is the commented bit in the test case- if you instead dereference
the s6_addr bit of the union, it all works without warnings.

In the preprocessed source, replace
  ap = (char *)u.sin6.sin6_addr;

with:
  ap = (char *)u.sin6.sin6_addr.__in6_u.__u6_addr8;


[Bug c/47418] warning: array subscript is above array bounds at O2 with sin6_addr

2011-01-22 Thread chantry.xavier at gmail dot com
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47418

Xavier chantry.xavier at gmail dot com changed:

   What|Removed |Added

 CC||chantry.xavier at gmail dot
   ||com

--- Comment #2 from Xavier chantry.xavier at gmail dot com 2011-01-23 
02:02:18 UTC ---
(In reply to comment #1)
 Also of note is the commented bit in the test case- if you instead dereference
 the s6_addr bit of the union, it all works without warnings.
 
 In the preprocessed source, replace
   ap = (char *)u.sin6.sin6_addr;
 
 with:
   ap = (char *)u.sin6.sin6_addr.__in6_u.__u6_addr8;

Actually it works with any member from __in6.u union.

It seems gcc gets confused with the other anonymous union, and use the size of
struct sockaddr instead of struct sockaddr_in6.

I've got a simpler testcase which shows another interesting information : gcc
gets confused when the sign of ap is the same as the size of the smallest
struct/array of the union, and different from the sign of the big member that
should be used.


[Bug c/47418] warning: array subscript is above array bounds at O2 with sin6_addr

2011-01-22 Thread chantry.xavier at gmail dot com
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47418

--- Comment #3 from Xavier chantry.xavier at gmail dot com 2011-01-23 
02:06:35 UTC ---
Created attachment 23084
  -- http://gcc.gnu.org/bugzilla/attachment.cgi?id=23084
simpler testcase

$ gcc -O3 -Wall -c small-test.c 
small-test.c: In function 'main':
small-test.c:18:51: warning: array subscript is above array bounds
small-test.c:18:43: warning: array subscript is above array bounds
small-test.c:18:35: warning: array subscript is above array bounds

so gcc seems to think that the size of ap is 13 instead of 16.
It's important that ap and sa_data are both char, and u6_addr8 is unsigned
char.
Same warning if ap and sa_data are unsigned char and u6_addr8 is char.
But other combinations apparently do not give any warning.