[Bug c/63477] New: Bogus warning with -O3 -Warray-bounds: array subscript is above array bounds

["lennox at cs dot columbia.edu" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63477

            Bug ID: 63477
           Summary: Bogus warning with -O3 -Warray-bounds: array subscript
                    is above array bounds
           Product: gcc
           Version: 4.8.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: lennox at cs dot columbia.edu

When compiled with -O3, the following code produces an "array subscript is
above array bounds" warning, which is bogus as far as I can tell:

#define MAX_VAL 16

typedef struct 
{
    int itemList[MAX_VAL+1];
    unsigned int numItems;
} ItemList;

void FrobList(ItemList *l)
{
    unsigned int i;

    for (i=0; i < l->numItems-1; i++) {
        int minVal = l->itemList[i];
        unsigned int minIdx = i;
        unsigned int idx;
        for (idx=i+1; idx < l->numItems; ++idx) {
            if (l->itemList[idx] < minVal) {
                minVal = l->itemList[idx];
                minIdx = idx;
            }
        }
        l->itemList[i] = l->itemList[minIdx];
    }
}


$ gcc -O3 -Warray-bounds -c LmiH264RefPictures-Reduced.c
LmiH264RefPictures-Reduced.c: In function âFrobListâ:
LmiH264RefPictures-Reduced.c:18:19: warning: array subscript is above array
bounds [-Warray-bounds]
    if (l->itemList[idx] < minVal) {
                   ^

The warning occurs on compilers targeted to x86_64 and armhf, but not i686.  It
does not occur with -O2 or lower.  Tested on both Linux and Cygwin.

This is a regression from GCC 4.6.3, at least. Have not tested 4.7.x.

Clearly it would be an out-of-bounds access if l->numItems were >= MAX_VAL+1,
but (in the actual application this testcase is reduced from), it's an
invariant that it won't be, and the compiler shouldn't be making range
assumptions to the contrary.

Verbose compiler output:

$ gcc -v -O3 -Warray-bounds -c LmiH264RefPictures-Reduced.c
Using built-in specs.
COLLECT_GCC=gcc
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.8.2-19ubuntu1'
--with-bugurl=file:///usr/share/doc/gcc-4.8/README.Bugs
--enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr
--program-suffix=-4.8 --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--with-gxx-include-dir=/usr/include/c++/4.8 --libdir=/usr/lib --enable-nls
--with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-libmudflap
--enable-plugin --with-system-zlib --disable-browser-plugin
--enable-java-awt=gtk --enable-gtk-cairo
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64/jre --enable-java-home
--with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64
--with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.8-amd64
--with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar
--enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --with-tune=generic
--enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=x86_64-linux-gnu
Thread model: posix
gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) 
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'
 /usr/lib/gcc/x86_64-linux-gnu/4.8/cc1 -quiet -v -imultiarch x86_64-linux-gnu
LmiH264RefPictures-Reduced.c -quiet -dumpbase LmiH264RefPictures-Reduced.c
-mtune=generic -march=x86-64 -auxbase LmiH264RefPictures-Reduced -O3
-Warray-bounds -version -fstack-protector -Wformat -Wformat-security -o
/tmp/ccXMNHkF.s
GNU C (Ubuntu 4.8.2-19ubuntu1) version 4.8.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.2, GMP version 5.1.3, MPFR version 3.1.2-p3,
MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.8/include-fixed
 /usr/include/x86_64-linux-gnu
 /usr/include
End of search list.
GNU C (Ubuntu 4.8.2-19ubuntu1) version 4.8.2 (x86_64-linux-gnu)
    compiled by GNU C version 4.8.2, GMP version 5.1.3, MPFR version 3.1.2-p3,
MPC version 1.0.1
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: dc75e0628c9356affcec059d0c81cc01
LmiH264RefPictures-Reduced.c: In function âFrobListâ:
LmiH264RefPictures-Reduced.c:18:19: warning: array subscript is above array
bounds [-Warray-bounds]
    if (l->itemList[idx] < minVal) {
                   ^
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'
 as -v --64 -o LmiH264RefPictures-Reduced.o /tmp/ccXMNHkF.s
GNU assembler version 2.24 (x86_64-linux-gnu) using BFD version (GNU Binutils
for Ubuntu) 2.24
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.8/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../../lib/:/lib/x86_64-linux-gnu/:/lib/../lib/:/usr/lib/x86_64-linux-gnu/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.8/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-O3' '-Warray-bounds' '-c' '-mtune=generic'
'-march=x86-64'