This is the mail archive of the
gcc-patches@gcc.gnu.org
mailing list for the GCC project.
Re: [PATCH] c/67882 - improve -Warray-bounds for invalid offsetof
- From: Segher Boessenkool <segher at kernel dot crashing dot org>
- To: Joseph Myers <joseph at codesourcery dot com>
- Cc: Bernd Schmidt <bschmidt at redhat dot com>, Martin Sebor <msebor at gmail dot com>, Gcc Patch List <gcc-patches at gcc dot gnu dot org>
- Date: Sat, 7 Nov 2015 17:38:04 -0600
- Subject: Re: [PATCH] c/67882 - improve -Warray-bounds for invalid offsetof
- Authentication-results: sourceware.org; auth=none
- References: <56172C8C dot 2070202 at gmail dot com> <5620ED47 dot 2090009 at redhat dot com> <56215158 dot 5040404 at gmail dot com> <56263F80 dot 1090203 at t-online dot de> <56265E51 dot 4070009 at gmail dot com> <alpine dot DEB dot 2 dot 10 dot 1510201650350 dot 7944 at digraph dot polyomino dot org dot uk> <5626A5A0 dot 7040003 at redhat dot com> <alpine dot DEB dot 2 dot 10 dot 1510202200590 dot 9787 at digraph dot polyomino dot org dot uk>
On Tue, Oct 20, 2015 at 10:10:44PM +0000, Joseph Myers wrote:
> > typedef struct FA5_7 {
> > int i;
> > char a5_7 [5][7];
> > } FA5_7;
> >
> > __builtin_offsetof (FA5_7, a5_7 [0][7]), // { dg-warning "index" }
> > __builtin_offsetof (FA5_7, a5_7 [1][7]), // { dg-warning "index" }
> > __builtin_offsetof (FA5_7, a5_7 [5][0]), // { dg-warning "index" }
> > __builtin_offsetof (FA5_7, a5_7 [5][7]), // { dg-warning "index" }
> >
> > Here I think the last one of these is most likely invalid (being 8 bytes past
> > the end of the object, rather than just one) and the others valid. Can you
> > confirm this? (If the &a.v[2].a example is considered invalid, then I think
> > the a5_7[5][0] test would be the equivalent and ought to also be considered
> > invalid).
>
> The last one is certainly invalid. The one before is arguably invalid as
> well (in the unary '&' equivalent, &a5_7[5][0] which is equivalent to
> a5_7[5] + 0, the questionable operation is implicit conversion of a5_7[5]
> from array to pointer - an array expression gets converted to an
> expression "that points to the initial element of the array object", but
> there is no array object a5_7[5] here).
C11, 6.5.2.1/3:
Successive subscript operators designate an element of a
multidimensional array object. If E is an n-dimensional array (n >= 2)
with dimensions i x j x . . . x k, then E (used as other than an lvalue)
is converted to a pointer to an (n - 1)-dimensional array with
dimensions j x . . . x k. If the unary * operator is applied to this
pointer explicitly, or implicitly as a result of subscripting, the
result is the referenced (n - 1)-dimensional array, which itself is
converted into a pointer if used as other than an lvalue. It follows
from this that arrays are stored in row-major order (last subscript
varies fastest).
As far as I see, a5_7[5] here is never treated as an array, just as a
pointer, and &a5_7[5][0] is valid.
Segher