[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277 --- Comment #14 from Richard Biener rguenth at gcc dot gnu.org --- Author: rguenth Date: Tue Jan 27 09:49:29 2015 New Revision: 220157 URL: https://gcc.gnu.org/viewcvs?rev=220157root=gccview=rev Log: 2015-01-27 Richard Biener rguent...@suse.de PR tree-optimization/56273 PR tree-optimization/59124 PR tree-optimization/64277 * tree-vrp.c (vrp_finalize): Emit array-bound warnings only from the first VRP pass. * g++.dg/warn/Warray-bounds-6.C: New testcase. * gcc.dg/Warray-bounds-12.c: Likewise. * gcc.dg/Warray-bounds-13.c: Likewise. Added: trunk/gcc/testsuite/g++.dg/warn/Warray-bounds-6.C trunk/gcc/testsuite/gcc.dg/Warray-bounds-12.c trunk/gcc/testsuite/gcc.dg/Warray-bounds-13.c Modified: trunk/gcc/ChangeLog trunk/gcc/testsuite/ChangeLog trunk/gcc/tree-vrp.c
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277 Richard Biener rguenth at gcc dot gnu.org changed: What|Removed |Added Keywords||diagnostic Priority|P3 |P2 --- Comment #10 from Richard Biener rguenth at gcc dot gnu.org --- Ick - that will also paper over good warnings so I'd rather not do that.
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277
Richard Biener rguenth at gcc dot gnu.org changed:
What|Removed |Added
Status|UNCONFIRMED |NEW
Last reconfirmed||2015-01-26
Ever confirmed|0 |1
--- Comment #11 from Richard Biener rguenth at gcc dot gnu.org ---
Confirmed btw. I believe we have plenty of dups of this report - it is usually
the last peeled iteration we warn for.
The interesting thing is that we have
# RANGE [1, 11] NONZERO 15
i_385 = i_369 + 1;
...
bb 52:
# RANGE [1, 11] NONZERO 15
i_461 = ASSERT_EXPR i_385, i_385 prephitmp_422;
...
bb 20:
# RANGE [0, 10] NONZERO 15
# i_82 = PHI i_461(52)
still we compute
i_461: [14, 32766] EQUIVALENCES: { i_385 } (1 elements)
so sth is bogus here (the above ranges are simply copied in unrolling
but that's ok - they are conservatively correct).
We should be able to rely on the previous ranges and use them to our advantage,
like with
Index: gcc/tree-vrp.c
===
--- gcc/tree-vrp.c (revision 220107)
+++ gcc/tree-vrp.c (working copy)
@@ -847,6 +847,23 @@ update_value_range (const_tree var, valu
value_range_t *old_vr;
bool is_new;
+ /* If there is a value-range on the SSA name from earlier analysis
+ factor that in. */
+ if (INTEGRAL_TYPE_P (TREE_TYPE (var)))
+{
+ wide_int min, max;
+ value_range_type rtype = get_range_info (var, min, max);
+ if (rtype == VR_RANGE || rtype == VR_ANTI_RANGE)
+ {
+ value_range_d nr;
+ nr.type = rtype;
+ nr.min = wide_int_to_tree (TREE_TYPE (var), min);
+ nr.max = wide_int_to_tree (TREE_TYPE (var), max);
+ nr.equiv = NULL;
+ vrp_intersect_ranges (new_vr, nr);
+ }
+}
+
/* Update the value range, if necessary. */
old_vr = get_value_range (var);
is_new = old_vr-type != new_vr-type
which cuts down the number of warnings to
t.c: In function 'foo':
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
a[i] = f1[i];
^
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
t.c:12:14: warning: 'f1' may be used uninitialized in this function
[-Wmaybe-uninitialized]
f1[i] = f1[i] + 1;
^
from
t.c: In function 'foo':
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
a[i] = f1[i];
^
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
t.c:18:16: warning: array subscript is above array bounds [-Warray-bounds]
t.c:12:14: warning: 'f1' may be used uninitialized in this function
[-Wmaybe-uninitialized]
f1[i] = f1[i] + 1;
^
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277 --- Comment #12 from Ilya Enkovich enkovich.gnu at gmail dot com --- (In reply to Richard Biener from comment #10) Ick - that will also paper over good warnings so I'd rather not do that. I'm also worried about possible good warnings removal. Thus I disable them only in case cunroll speculates about iterations number and never disable them for the first loop iteration. I agree warnings disabling looks like a workaround. But it doesn't seem correct to complain on code generated by compiler and probably never executed. Each time maxiter is used for complete unroll following optimizations may improve maxiter estimation and thus we get a compiler generated dead code which still may produce warnings.
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277 --- Comment #8 from Ilya Enkovich enkovich.gnu at gmail dot com --- Created attachment 34569 -- https://gcc.gnu.org/bugzilla/attachment.cgi?id=34569action=edit patch to disable warnings for array references generated by cunroll
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277
--- Comment #13 from Ilya Enkovich enkovich.gnu at gmail dot com ---
Ranges have to be used for maxiter computations to have consistent analysis in
complete unroll and vrp. Following patch allows to refine maxiter estimation
using ranges and avoid warnings.
diff --git a/gcc/tree-ssa-loop-niter.c b/gcc/tree-ssa-loop-niter.c
index 919f5c0..14cce2a 100644
--- a/gcc/tree-ssa-loop-niter.c
+++ b/gcc/tree-ssa-loop-niter.c
@@ -2754,6 +2754,7 @@ record_nonwrapping_iv (struct loop *loop, tree base, tree
step, gimple stmt,
{
tree niter_bound, extreme, delta;
tree type = TREE_TYPE (base), unsigned_type;
+ tree orig_base = base;
if (TREE_CODE (step) != INTEGER_CST || integer_zerop (step))
return;
@@ -2777,7 +2778,14 @@ record_nonwrapping_iv (struct loop *loop, tree base,
tree step, gimple stmt,
if (tree_int_cst_sign_bit (step))
{
+ wide_int min, max, highwi = high;
extreme = fold_convert (unsigned_type, low);
+ if (TREE_CODE (orig_base) == SSA_NAME
+ !POINTER_TYPE_P (TREE_TYPE (orig_base))
+ SSA_NAME_RANGE_INFO (orig_base)
+ get_range_info (orig_base, min, max) == VR_RANGE
+ wi::gts_p (highwi, max))
+ base = wide_int_to_tree (unsigned_type, max);
if (TREE_CODE (base) != INTEGER_CST)
base = fold_convert (unsigned_type, high);
delta = fold_build2 (MINUS_EXPR, unsigned_type, base, extreme);
@@ -2785,8 +2793,15 @@ record_nonwrapping_iv (struct loop *loop, tree base,
tree step, gimple stmt,
}
else
{
+ wide_int min, max, lowwi = low;
extreme = fold_convert (unsigned_type, high);
- if (TREE_CODE (base) != INTEGER_CST)
+ if (TREE_CODE (orig_base) == SSA_NAME
+ !POINTER_TYPE_P (TREE_TYPE (orig_base))
+ SSA_NAME_RANGE_INFO (orig_base)
+ get_range_info (orig_base, min, max) == VR_RANGE
+ wi::gts_p (min, lowwi))
+ base = wide_int_to_tree (unsigned_type, min);
+ else if (TREE_CODE (base) != INTEGER_CST)
base = fold_convert (unsigned_type, low);
delta = fold_build2 (MINUS_EXPR, unsigned_type, extreme, base);
}
diff --git a/gcc/testsuite/gcc.dg/pr64277.c b/gcc/testsuite/gcc.dg/pr64277.c
new file mode 100644
index 000..0d5ef11
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr64277.c
@@ -0,0 +1,21 @@
+/* PR tree-optimization/64277 */
+/* { dg-do compile } */
+/* { dg-options -O3 -Wall -Werror } */
+
+
+int f1[10];
+void test1 (short a[], short m, unsigned short l)
+{
+ int i = l;
+ for (i = i + 5; i m; i++)
+f1[i] = a[i]++;
+}
+
+void test2 (short a[], short m, short l)
+{
+ int i;
+ if (m 5)
+m = 5;
+ for (i = m; i l; i--)
+f1[i] = a[i]++;
+}
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277 --- Comment #9 from Ilya Enkovich enkovich.gnu at gmail dot com --- Nice solution for this problem would be to have a better estimation of maximum loop iterations number. Currently array size and index step are used to get the maximum ignoring starting index value range. Another way to solve the problem is to disable warnings for code generated by cunroll in case it cannot compute exact number of iterations. I attach a patch which does it. This bug is hit multiple times on Android build with GCC 4.9. With this fix we have a clean Android build with GCC 4.9.
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277
Ilya Enkovich enkovich.gnu at gmail dot com changed:
What|Removed |Added
CC||enkovich.gnu at gmail dot com
--- Comment #7 from Ilya Enkovich enkovich.gnu at gmail dot com ---
Here is a reduced test case:
cat test.c
int f1[10];
void foo(short a[], short m, unsigned short l)
{
int i = l;
for (i = i + 5; i m; i++)
f1[i] = a[i]++;
}
gcc test.c -O3 -c -Wall
test.c: In function 'foo':
test.c:6:7: warning: array subscript is above array bounds [-Warray-bounds]
f1[i] = a[i]++;
^
test.c:6:7: warning: array subscript is above array bounds [-Warray-bounds]
test.c:6:7: warning: array subscript is above array bounds [-Warray-bounds]
test.c:6:7: warning: array subscript is above array bounds [-Warray-bounds]
test.c:6:7: warning: array subscript is above array bounds [-Warray-bounds]
Here we have complete unroll of the loop by 10 due to f1 size. Later vrp
complains of last five produced iterations accessing above array bounds.
Used GCC 5.0.
[Bug tree-optimization/64277] [4.9/5 Regression] Incorrect warning array subscript is above array bounds
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64277
--- Comment #6 from Igor Zamyatin izamyatin at gmail dot com ---
cunroll phase 7 times completely unrolls post-loop that was generated by
vectorizer.
And later vrp complains on those unrolled iterations.
Note that for the test without if (nc 3), i.e.
void foo(short a[], short m)
{
int i,j;
int f1[10];
short nc;
nc = m + 1;
for (i = 0, j = m; i nc; i++, j--)
{
a[i] = f1[i];
a[j] = i;
}
return;
}
vrp doesn't complain while cunroll still performs 7 times complete unroll.
Most probably merge block generated for the original testcase affects vrp's
work:
bb 14:
# prephitmp_39 = PHI pretmp_40(3), _450(13), _451(40)
j_18 = (int) m_7(D);
if (prephitmp_39 0)
goto bb 16;
else
goto bb 15;
