[Bug c++/56698] New: "array subscript is above array bounds" triggered on code that doesn't have that problem

[mh+gcc at glandium dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56698

             Bug #: 56698
           Summary: "array subscript is above array bounds" triggered on
                    code that doesn't have that problem
    Classification: Unclassified
           Product: gcc
           Version: 4.7.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: mh+gcc@glandium.org


I've been trying to get Firefox building with gcc 4.7 on the Mozilla build
slaves, and with PGO enabled, I'm getting an "array subscript is above array
bounds" error (we do uses -Werror in some places) on code that doesn't look
like it would have the problem. It doesn't happen without PGO.

The line of code it happens on is:
https://hg.mozilla.org/mozilla-central/file/bcf09432affd/netwerk/cache/nsDiskCacheMap.cpp#l1028

mBlockFile is defined here:
https://hg.mozilla.org/mozilla-central/file/bcf09432affd/netwerk/cache/nsDiskCacheMap.h#l570

kNumBlockFiles is defined here:
https://hg.mozilla.org/mozilla-central/file/bcf09432affd/netwerk/cache/nsDiskCacheMap.h#l59

and CalculateFileIndex here.
https://hg.mozilla.org/mozilla-central/file/bcf09432affd/netwerk/cache/nsDiskCacheMap.cpp#l1028/

With these, I see no way "fileIndex - 1" can be "above array bounds" of
mBlockFile[3], when fileIndex can only be 0, 1, 2 or 3. (and yes, there might
be a problem when fileIndex is 0, but that's not "above array bounds")