gcc/gimple-array-bounds.cc

   1 /* Array bounds checking.
   2    Copyright (C) 2005-2021 Free Software Foundation, Inc.
   3
   4 This file is part of GCC.
   5
   6 GCC is free software; you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation; either version 3, or (at your option)
   9 any later version.
  10
  11 GCC is distributed in the hope that it will be useful,
  12 but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 GNU General Public License for more details.
  15
  16 You should have received a copy of the GNU General Public License
  17 along with GCC; see the file COPYING3.  If not see
  18 <http://www.gnu.org/licenses/>.  */
  19
  20 #include "config.h"
  21 #include "system.h"
  22 #include "coretypes.h"
  23 #include "backend.h"
  24 #include "tree.h"
  25 #include "gimple.h"
  26 #include "ssa.h"
  27 #include "gimple-array-bounds.h"
  28 #include "gimple-iterator.h"
  29 #include "gimple-walk.h"
  30 #include "tree-dfa.h"
  31 #include "fold-const.h"
  32 #include "diagnostic-core.h"
  33 #include "intl.h"
  34 #include "tree-vrp.h"
  35 #include "alloc-pool.h"
  36 #include "vr-values.h"
  37 #include "domwalk.h"
  38 #include "tree-cfg.h"
  39 #include "attribs.h"
  40 #include "pointer-query.h"
  41
  42 // This purposely returns a value_range, not a value_range_equiv, to
  43 // break the dependency on equivalences for this pass.
  44
  45 const value_range *
  46 array_bounds_checker::get_value_range (const_tree op, gimple *stmt)
  47 {
  48   return ranges->get_value_range (op, stmt);
  49 }
  50
  51 /* Try to determine the DECL that REF refers to.  Return the DECL or
  52    the expression closest to it.  Used in informational notes pointing
  53    to referenced objects or function parameters.  */
  54
  55 static tree
  56 get_base_decl (tree ref)
  57 {
  58   tree base = get_base_address (ref);
  59   if (DECL_P (base))
  60     return base;
  61
  62   if (TREE_CODE (base) == MEM_REF)
  63     base = TREE_OPERAND (base, 0);
  64
  65   if (TREE_CODE (base) != SSA_NAME)
  66     return base;
  67
  68   do
  69     {
  70       gimple *def = SSA_NAME_DEF_STMT (base);
  71       if (gimple_assign_single_p (def))
  72         {
  73           base = gimple_assign_rhs1 (def);
  74           if (TREE_CODE (base) != ASSERT_EXPR)
  75             return base;
  76
  77           base = TREE_OPERAND (base, 0);
  78           if (TREE_CODE (base) != SSA_NAME)
  79             return base;
  80
  81           continue;
  82         }
  83
  84       if (!gimple_nop_p (def))
  85         return base;
  86
  87       break;
  88     } while (true);
  89
  90   tree var = SSA_NAME_VAR (base);
  91   if (TREE_CODE (var) != PARM_DECL)
  92     return base;
  93
  94   return var;
  95 }
  96
  97 /* Return the constant byte size of the object or type referenced by
  98    the MEM_REF ARG.  On success, set *PREF to the DECL or expression
  99    ARG refers to.  Otherwise return null.  */
 100
 101 static tree
 102 get_ref_size (tree arg, tree *pref)
 103 {
 104   if (TREE_CODE (arg) != MEM_REF)
 105     return NULL_TREE;
 106
 107   arg = TREE_OPERAND (arg, 0);
 108   tree type = TREE_TYPE (arg);
 109   if (!POINTER_TYPE_P (type))
 110     return NULL_TREE;
 111
 112   type = TREE_TYPE (type);
 113   if (TREE_CODE (type) != ARRAY_TYPE)
 114     return NULL_TREE;
 115
 116   tree nbytes = TYPE_SIZE_UNIT (type);
 117   if (!nbytes || TREE_CODE (nbytes) != INTEGER_CST)
 118     return NULL_TREE;
 119
 120   *pref = get_base_decl (arg);
 121   return nbytes;
 122 }
 123
 124 /* Return true if REF is (likely) an ARRAY_REF to a trailing array member
 125    of a struct.  It refines array_at_struct_end_p by detecting a pointer
 126    to an array and an array parameter declared using the [N] syntax (as
 127    opposed to a pointer) and returning false.  Set *PREF to the decl or
 128    expression REF refers to.  */
 129
 130 static bool
 131 trailing_array (tree arg, tree *pref)
 132 {
 133   tree ref = arg;
 134   tree base = get_base_decl (arg);
 135   while (TREE_CODE (ref) == ARRAY_REF || TREE_CODE (ref) == MEM_REF)
 136     ref = TREE_OPERAND (ref, 0);
 137
 138   if (TREE_CODE (ref) == COMPONENT_REF)
 139     {
 140       *pref = TREE_OPERAND (ref, 1);
 141       tree type = TREE_TYPE (*pref);
 142       if (TREE_CODE (type) == ARRAY_TYPE)
 143         {
 144           /* A multidimensional trailing array is not considered special
 145              no matter what its major bound is.  */
 146           type = TREE_TYPE (type);
 147           if (TREE_CODE (type) == ARRAY_TYPE)
 148             return false;
 149         }
 150     }
 151   else
 152     *pref = base;
 153
 154   tree basetype = TREE_TYPE (base);
 155   if (TREE_CODE (base) == PARM_DECL
 156       && POINTER_TYPE_P (basetype))
 157     {
 158       tree ptype = TREE_TYPE (basetype);
 159       if (TREE_CODE (ptype) == ARRAY_TYPE)
 160         return false;
 161     }
 162
 163   return array_at_struct_end_p (arg);
 164 }
 165
 166 /* Checks one ARRAY_REF in REF, located at LOCUS. Ignores flexible
 167    arrays and "struct" hacks. If VRP can determine that the array
 168    subscript is a constant, check if it is outside valid range.  If
 169    the array subscript is a RANGE, warn if it is non-overlapping with
 170    valid range.  IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside
 171    a ADDR_EXPR.  Return  true if a warning has been issued or if
 172    no-warning is set.  */
 173
 174 bool
 175 array_bounds_checker::check_array_ref (location_t location, tree ref,
 176                                        gimple *stmt, bool ignore_off_by_one)
 177 {
 178   if (warning_suppressed_p (ref, OPT_Warray_bounds))
 179     /* Return true to have the caller prevent warnings for enclosing
 180        refs.  */
 181     return true;
 182
 183   tree low_sub = TREE_OPERAND (ref, 1);
 184   tree up_sub = low_sub;
 185   tree up_bound = array_ref_up_bound (ref);
 186
 187   /* Referenced decl if one can be determined.  */
 188   tree decl = NULL_TREE;
 189
 190   /* Set for accesses to interior zero-length arrays.  */
 191   special_array_member sam{ };
 192
 193   tree up_bound_p1;
 194
 195   if (!up_bound
 196       || TREE_CODE (up_bound) != INTEGER_CST
 197       || (warn_array_bounds < 2 && trailing_array (ref, &decl)))
 198     {
 199       /* Accesses to trailing arrays via pointers may access storage
 200          beyond the types array bounds.  For such arrays, or for flexible
 201          array members, as well as for other arrays of an unknown size,
 202          replace the upper bound with a more permissive one that assumes
 203          the size of the largest object is PTRDIFF_MAX.  */
 204       tree eltsize = array_ref_element_size (ref);
 205
 206       if (TREE_CODE (eltsize) != INTEGER_CST
 207           || integer_zerop (eltsize))
 208         {
 209           up_bound = NULL_TREE;
 210           up_bound_p1 = NULL_TREE;
 211         }
 212       else
 213         {
 214           tree ptrdiff_max = TYPE_MAX_VALUE (ptrdiff_type_node);
 215           tree maxbound = ptrdiff_max;
 216           tree arg = TREE_OPERAND (ref, 0);
 217
 218           const bool compref = TREE_CODE (arg) == COMPONENT_REF;
 219           if (compref)
 220             {
 221               /* Try to determine the size of the trailing array from
 222                  its initializer (if it has one).  */
 223               if (tree refsize = component_ref_size (arg, &sam))
 224                 if (TREE_CODE (refsize) == INTEGER_CST)
 225                   maxbound = refsize;
 226             }
 227
 228           if (maxbound == ptrdiff_max)
 229             {
 230               /* Try to determine the size of the base object.  Avoid
 231                  COMPONENT_REF already tried above.  Using its DECL_SIZE
 232                  size wouldn't necessarily be correct if the reference is
 233                  to its flexible array member initialized in a different
 234                  translation unit.  */
 235               poly_int64 off;
 236               if (tree base = get_addr_base_and_unit_offset (arg, &off))
 237                 {
 238                   if (TREE_CODE (base) == MEM_REF)
 239                     {
 240                       /* Try to determine the size from a pointer to
 241                          an array if BASE is one.  */
 242                       if (tree size = get_ref_size (base, &decl))
 243                         maxbound = size;
 244                     }
 245                   else if (!compref && DECL_P (base))
 246                     if (tree basesize = DECL_SIZE_UNIT (base))
 247                       if (TREE_CODE (basesize) == INTEGER_CST)
 248                         {
 249                           maxbound = basesize;
 250                           decl = base;
 251                         }
 252
 253                   if (known_gt (off, 0))
 254                     maxbound = wide_int_to_tree (sizetype,
 255                                                  wi::sub (wi::to_wide (maxbound),
 256                                                           off));
 257                 }
 258             }
 259           else
 260             maxbound = fold_convert (sizetype, maxbound);
 261
 262           up_bound_p1 = int_const_binop (TRUNC_DIV_EXPR, maxbound, eltsize);
 263
 264           if (up_bound_p1 != NULL_TREE)
 265             up_bound = int_const_binop (MINUS_EXPR, up_bound_p1,
 266                                         build_int_cst (ptrdiff_type_node, 1));
 267           else
 268             up_bound = NULL_TREE;
 269         }
 270     }
 271   else
 272     up_bound_p1 = int_const_binop (PLUS_EXPR, up_bound,
 273                                    build_int_cst (TREE_TYPE (up_bound), 1));
 274
 275   tree low_bound = array_ref_low_bound (ref);
 276
 277   tree artype = TREE_TYPE (TREE_OPERAND (ref, 0));
 278
 279   bool warned = false;
 280
 281   /* Empty array.  */
 282   if (up_bound && tree_int_cst_equal (low_bound, up_bound_p1))
 283     warned = warning_at (location, OPT_Warray_bounds,
 284                          "array subscript %E is outside array bounds of %qT",
 285                          low_sub, artype);
 286
 287   const value_range *vr = NULL;
 288   if (TREE_CODE (low_sub) == SSA_NAME)
 289     {
 290       vr = get_value_range (low_sub, stmt);
 291       if (!vr->undefined_p () && !vr->varying_p ())
 292         {
 293           low_sub = vr->kind () == VR_RANGE ? vr->max () : vr->min ();
 294           up_sub = vr->kind () == VR_RANGE ? vr->min () : vr->max ();
 295         }
 296     }
 297
 298   if (warned)
 299     ; /* Do nothing.  */
 300   else if (vr && vr->kind () == VR_ANTI_RANGE)
 301     {
 302       if (up_bound
 303           && TREE_CODE (up_sub) == INTEGER_CST
 304           && (ignore_off_by_one
 305               ? tree_int_cst_lt (up_bound, up_sub)
 306               : tree_int_cst_le (up_bound, up_sub))
 307           && TREE_CODE (low_sub) == INTEGER_CST
 308           && tree_int_cst_le (low_sub, low_bound))
 309         warned = warning_at (location, OPT_Warray_bounds,
 310                              "array subscript [%E, %E] is outside "
 311                              "array bounds of %qT",
 312                              low_sub, up_sub, artype);
 313     }
 314   else if (up_bound
 315            && TREE_CODE (up_sub) == INTEGER_CST
 316            && (ignore_off_by_one
 317                ? !tree_int_cst_le (up_sub, up_bound_p1)
 318                : !tree_int_cst_le (up_sub, up_bound)))
 319     warned = warning_at (location, OPT_Warray_bounds,
 320                          "array subscript %E is above array bounds of %qT",
 321                          up_sub, artype);
 322   else if (TREE_CODE (low_sub) == INTEGER_CST
 323            && tree_int_cst_lt (low_sub, low_bound))
 324     warned = warning_at (location, OPT_Warray_bounds,
 325                          "array subscript %E is below array bounds of %qT",
 326                          low_sub, artype);
 327
 328   if (!warned && sam == special_array_member::int_0)
 329     warned = warning_at (location, OPT_Wzero_length_bounds,
 330                          (TREE_CODE (low_sub) == INTEGER_CST
 331                           ? G_("array subscript %E is outside the bounds "
 332                                "of an interior zero-length array %qT")
 333                           : G_("array subscript %qE is outside the bounds "
 334                                "of an interior zero-length array %qT")),
 335                          low_sub, artype);
 336
 337   if (warned)
 338     {
 339       if (dump_file && (dump_flags & TDF_DETAILS))
 340         {
 341           fprintf (dump_file, "Array bound warning for ");
 342           dump_generic_expr (MSG_NOTE, TDF_SLIM, ref);
 343           fprintf (dump_file, "\n");
 344         }
 345
 346       /* Avoid more warnings when checking more significant subscripts
 347          of the same expression.  */
 348       ref = TREE_OPERAND (ref, 0);
 349       suppress_warning (ref, OPT_Warray_bounds);
 350
 351       if (decl)
 352         ref = decl;
 353
 354       tree rec = NULL_TREE;
 355       if (TREE_CODE (ref) == COMPONENT_REF)
 356         {
 357           /* For a reference to a member of a struct object also mention
 358              the object if it's known.  It may be defined in a different
 359              function than the out-of-bounds access.  */
 360           rec = TREE_OPERAND (ref, 0);
 361           if (!VAR_P (rec))
 362             rec = NULL_TREE;
 363           ref = TREE_OPERAND (ref, 1);
 364         }
 365
 366       if (DECL_P (ref))
 367         inform (DECL_SOURCE_LOCATION (ref), "while referencing %qD", ref);
 368       if (rec && DECL_P (rec))
 369         inform (DECL_SOURCE_LOCATION (rec), "defined here %qD", rec);
 370     }
 371
 372   return warned;
 373 }
 374
 375 /* Checks one MEM_REF in REF, located at LOCATION, for out-of-bounds
 376    references to string constants.  If VRP can determine that the array
 377    subscript is a constant, check if it is outside valid range.
 378    If the array subscript is a RANGE, warn if it is non-overlapping
 379    with valid range.
 380    IGNORE_OFF_BY_ONE is true if the MEM_REF is inside an ADDR_EXPR
 381    (used to allow one-past-the-end indices for code that takes
 382    the address of the just-past-the-end element of an array).
 383    Returns true if a warning has been issued.  */
 384
 385 bool
 386 array_bounds_checker::check_mem_ref (location_t location, tree ref,
 387                                      bool ignore_off_by_one)
 388 {
 389   if (warning_suppressed_p (ref, OPT_Warray_bounds))
 390     return false;
 391
 392   /* The statement used to allocate the array or null.  */
 393   gimple *alloc_stmt = NULL;
 394   /* For an allocation statement, the low bound of the size range.  */
 395   offset_int minbound = 0;
 396   /* The type and size of the access.  */
 397   tree axstype = TREE_TYPE (ref);
 398   offset_int axssize = 0;
 399   if (tree access_size = TYPE_SIZE_UNIT (axstype))
 400     if (TREE_CODE (access_size) == INTEGER_CST)
 401       axssize = wi::to_offset (access_size);
 402
 403   access_ref aref;
 404   if (!compute_objsize (ref, m_stmt, 0, &aref, ranges))
 405     return false;
 406
 407   if (aref.offset_in_range (axssize))
 408     return false;
 409
 410   if (TREE_CODE (aref.ref) == SSA_NAME)
 411     {
 412       gimple *def = SSA_NAME_DEF_STMT (aref.ref);
 413       if (is_gimple_call (def))
 414         {
 415           /* Save the allocation call and the low bound on the size.  */
 416           alloc_stmt = def;
 417           minbound = aref.sizrng[0];
 418         }
 419     }
 420
 421   /* The range of the byte offset into the reference.  Adjusted below.  */
 422   offset_int offrange[2] = { aref.offrng[0], aref.offrng[1] };
 423
 424   /* The type of the referenced object.  */
 425   tree reftype = TREE_TYPE (aref.ref);
 426   /* The size of the referenced array element.  */
 427   offset_int eltsize = 1;
 428   if (POINTER_TYPE_P (reftype))
 429     reftype = TREE_TYPE (reftype);
 430
 431   if (TREE_CODE (reftype) == FUNCTION_TYPE)
 432     /* Restore the original (pointer) type and avoid trying to create
 433        an array of functions (done below).  */
 434     reftype = TREE_TYPE (aref.ref);
 435   else
 436     {
 437       /* The byte size of the array has already been determined above
 438          based on a pointer ARG.  Set ELTSIZE to the size of the type
 439          it points to and REFTYPE to the array with the size, rounded
 440          down as necessary.  */
 441       if (TREE_CODE (reftype) == ARRAY_TYPE)
 442         reftype = TREE_TYPE (reftype);
 443       if (tree refsize = TYPE_SIZE_UNIT (reftype))
 444         if (TREE_CODE (refsize) == INTEGER_CST)
 445           eltsize = wi::to_offset (refsize);
 446
 447       const offset_int nelts = aref.sizrng[1] / eltsize;
 448       reftype = build_printable_array_type (reftype, nelts.to_uhwi ());
 449     }
 450
 451   /* Compute the more permissive upper bound when IGNORE_OFF_BY_ONE
 452      is set (when taking the address of the one-past-last element
 453      of an array) but always use the stricter bound in diagnostics. */
 454   offset_int ubound = aref.sizrng[1];
 455   if (ignore_off_by_one)
 456     ubound += eltsize;
 457
 458   /* Set if the lower bound of the subscript is out of bounds.  */
 459   const bool lboob = (aref.sizrng[1] == 0
 460                       || offrange[0] >= ubound
 461                       || offrange[1] < 0);
 462   /* Set if only the upper bound of the subscript is out of bounds.
 463      This can happen when using a bigger type to index into an array
 464      of a smaller type, as is common with unsigned char.  */
 465   const bool uboob = !lboob && offrange[0] + axssize > ubound;
 466   if (lboob || uboob)
 467     {
 468       /* Treat a reference to a non-array object as one to an array
 469          of a single element.  */
 470       if (TREE_CODE (reftype) != ARRAY_TYPE)
 471         reftype = build_printable_array_type (reftype, 1);
 472
 473       /* Extract the element type out of MEM_REF and use its size
 474          to compute the index to print in the diagnostic; arrays
 475          in MEM_REF don't mean anything.  A type with no size like
 476          void is as good as having a size of 1.  */
 477       tree type = strip_array_types (TREE_TYPE (ref));
 478       if (tree size = TYPE_SIZE_UNIT (type))
 479         {
 480           offrange[0] = offrange[0] / wi::to_offset (size);
 481           offrange[1] = offrange[1] / wi::to_offset (size);
 482         }
 483     }
 484
 485   bool warned = false;
 486   if (lboob)
 487     {
 488       if (offrange[0] == offrange[1])
 489         warned = warning_at (location, OPT_Warray_bounds,
 490                              "array subscript %wi is outside array bounds "
 491                              "of %qT",
 492                              offrange[0].to_shwi (), reftype);
 493       else
 494         warned = warning_at (location, OPT_Warray_bounds,
 495                              "array subscript [%wi, %wi] is outside "
 496                              "array bounds of %qT",
 497                              offrange[0].to_shwi (),
 498                              offrange[1].to_shwi (), reftype);
 499     }
 500   else if (uboob && !ignore_off_by_one)
 501     {
 502       tree backtype = reftype;
 503       if (alloc_stmt)
 504         /* If the memory was dynamically allocated refer to it as if
 505            it were an untyped array of bytes.  */
 506         backtype = build_array_type_nelts (unsigned_char_type_node,
 507                                            aref.sizrng[1].to_uhwi ());
 508
 509       warned = warning_at (location, OPT_Warray_bounds,
 510                            "array subscript %<%T[%wi]%> is partly "
 511                            "outside array bounds of %qT",
 512                            axstype, offrange[0].to_shwi (), backtype);
 513     }
 514
 515   if (warned)
 516     {
 517       /* TODO: Determine the access from the statement and use it.  */
 518       aref.inform_access (access_none);
 519       suppress_warning (ref, OPT_Warray_bounds);
 520       return true;
 521     }
 522
 523   if (warn_array_bounds < 2)
 524     return false;
 525
 526   /* At level 2 check also intermediate offsets.  */
 527   int i = 0;
 528   if (aref.offmax[i] < -aref.sizrng[1] || aref.offmax[i = 1] > ubound)
 529     {
 530       HOST_WIDE_INT tmpidx = aref.offmax[i].to_shwi () / eltsize.to_shwi ();
 531
 532       if (warning_at (location, OPT_Warray_bounds,
 533                       "intermediate array offset %wi is outside array bounds "
 534                       "of %qT", tmpidx, reftype))
 535         {
 536           suppress_warning (ref, OPT_Warray_bounds);
 537           return true;
 538         }
 539     }
 540
 541   return false;
 542 }
 543
 544 /* Searches if the expr T, located at LOCATION computes
 545    address of an ARRAY_REF, and call check_array_ref on it.  */
 546
 547 void
 548 array_bounds_checker::check_addr_expr (location_t location, tree t,
 549                                        gimple *stmt)
 550 {
 551   /* For the most significant subscript only, accept taking the address
 552      of the just-past-the-end element.  */
 553   bool ignore_off_by_one = true;
 554
 555   /* Check each ARRAY_REF and MEM_REF in the reference chain. */
 556   do
 557     {
 558       bool warned = false;
 559       if (TREE_CODE (t) == ARRAY_REF)
 560         {
 561           warned = check_array_ref (location, t, stmt, ignore_off_by_one);
 562           ignore_off_by_one = false;
 563         }
 564       else if (TREE_CODE (t) == MEM_REF)
 565         warned = check_mem_ref (location, t, ignore_off_by_one);
 566
 567       if (warned)
 568         suppress_warning (t, OPT_Warray_bounds);
 569
 570       t = TREE_OPERAND (t, 0);
 571     }
 572   while (handled_component_p (t) || TREE_CODE (t) == MEM_REF);
 573
 574   if (TREE_CODE (t) != MEM_REF
 575       || TREE_CODE (TREE_OPERAND (t, 0)) != ADDR_EXPR
 576       || warning_suppressed_p (t, OPT_Warray_bounds))
 577     return;
 578
 579   tree tem = TREE_OPERAND (TREE_OPERAND (t, 0), 0);
 580   tree low_bound, up_bound, el_sz;
 581   if (TREE_CODE (TREE_TYPE (tem)) != ARRAY_TYPE
 582       || TREE_CODE (TREE_TYPE (TREE_TYPE (tem))) == ARRAY_TYPE
 583       || !TYPE_DOMAIN (TREE_TYPE (tem)))
 584     return;
 585
 586   low_bound = TYPE_MIN_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
 587   up_bound = TYPE_MAX_VALUE (TYPE_DOMAIN (TREE_TYPE (tem)));
 588   el_sz = TYPE_SIZE_UNIT (TREE_TYPE (TREE_TYPE (tem)));
 589   if (!low_bound
 590       || TREE_CODE (low_bound) != INTEGER_CST
 591       || !up_bound
 592       || TREE_CODE (up_bound) != INTEGER_CST
 593       || !el_sz
 594       || TREE_CODE (el_sz) != INTEGER_CST)
 595     return;
 596
 597   offset_int idx;
 598   if (!mem_ref_offset (t).is_constant (&idx))
 599     return;
 600
 601   bool warned = false;
 602   idx = wi::sdiv_trunc (idx, wi::to_offset (el_sz));
 603   if (idx < 0)
 604     {
 605       if (dump_file && (dump_flags & TDF_DETAILS))
 606         {
 607           fprintf (dump_file, "Array bound warning for ");
 608           dump_generic_expr (MSG_NOTE, TDF_SLIM, t);
 609           fprintf (dump_file, "\n");
 610         }
 611       warned = warning_at (location, OPT_Warray_bounds,
 612                            "array subscript %wi is below "
 613                            "array bounds of %qT",
 614                            idx.to_shwi (), TREE_TYPE (tem));
 615     }
 616   else if (idx > (wi::to_offset (up_bound)
 617                   - wi::to_offset (low_bound) + 1))
 618     {
 619       if (dump_file && (dump_flags & TDF_DETAILS))
 620         {
 621           fprintf (dump_file, "Array bound warning for ");
 622           dump_generic_expr (MSG_NOTE, TDF_SLIM, t);
 623           fprintf (dump_file, "\n");
 624         }
 625       warned = warning_at (location, OPT_Warray_bounds,
 626                            "array subscript %wu is above "
 627                            "array bounds of %qT",
 628                            idx.to_uhwi (), TREE_TYPE (tem));
 629     }
 630
 631   if (warned)
 632     {
 633       if (DECL_P (t))
 634         inform (DECL_SOURCE_LOCATION (t), "while referencing %qD", t);
 635
 636       suppress_warning (t, OPT_Warray_bounds);
 637     }
 638 }
 639
 640 /* Return true if T is a reference to a member of a base class that's within
 641    the bounds of the enclosing complete object.  The function "hacks" around
 642    problems discussed in pr98266 and pr97595.  */
 643
 644 static bool
 645 inbounds_memaccess_p (tree t, gimple *stmt)
 646 {
 647   if (TREE_CODE (t) != COMPONENT_REF)
 648     return false;
 649
 650   tree mref = TREE_OPERAND (t, 0);
 651   if (TREE_CODE (mref) != MEM_REF)
 652     return false;
 653
 654   /* Consider the access if its type is a derived class.  */
 655   tree mreftype = TREE_TYPE (mref);
 656   if (!RECORD_OR_UNION_TYPE_P (mreftype)
 657       || !TYPE_BINFO (mreftype))
 658     return false;
 659
 660   /* Compute the size of the referenced object (it could be dynamically
 661      allocated).  */
 662   access_ref aref;   // unused
 663   tree refop = TREE_OPERAND (mref, 0);
 664   tree refsize = compute_objsize (refop, stmt, 1, &aref);
 665   if (!refsize || TREE_CODE (refsize) != INTEGER_CST)
 666     return false;
 667
 668   /* Compute the byte offset of the member within its enclosing class.  */
 669   tree fld = TREE_OPERAND (t, 1);
 670   tree fldpos = byte_position (fld);
 671   if (TREE_CODE (fldpos) != INTEGER_CST)
 672     return false;
 673
 674   /* Compute the byte offset of the member with the outermost complete
 675      object by adding its offset computed above to the MEM_REF offset.  */
 676   tree refoff = TREE_OPERAND (mref, 1);
 677   tree fldoff = int_const_binop (PLUS_EXPR, fldpos, refoff);
 678   /* Return false if the member offset is greater or equal to the size
 679      of the complete object.  */
 680   if (!tree_int_cst_lt (fldoff, refsize))
 681     return false;
 682
 683   tree fldsiz = DECL_SIZE_UNIT (fld);
 684   if (!fldsiz || TREE_CODE (fldsiz) != INTEGER_CST)
 685     return false;
 686
 687   /* Return true if the offset just past the end of the member is less
 688      than or equal to the size of the complete object.  */
 689   tree fldend = int_const_binop (PLUS_EXPR, fldoff, fldsiz);
 690   return tree_int_cst_le (fldend, refsize);
 691 }
 692
 693 /* Callback for walk_tree to check a tree for out of bounds array
 694    accesses.  The array_bounds_checker class is passed in DATA.  */
 695
 696 tree
 697 array_bounds_checker::check_array_bounds (tree *tp, int *walk_subtree,
 698                                           void *data)
 699 {
 700   tree t = *tp;
 701   struct walk_stmt_info *wi = (struct walk_stmt_info *) data;
 702
 703   location_t location;
 704
 705   if (EXPR_HAS_LOCATION (t))
 706     location = EXPR_LOCATION (t);
 707   else
 708     location = gimple_location (wi->stmt);
 709
 710   *walk_subtree = TRUE;
 711
 712   bool warned = false;
 713   array_bounds_checker *checker = (array_bounds_checker *) wi->info;
 714   gcc_assert (checker->m_stmt == wi->stmt);
 715
 716   if (TREE_CODE (t) == ARRAY_REF)
 717     warned = checker->check_array_ref (location, t, wi->stmt,
 718                                        false/*ignore_off_by_one*/);
 719   else if (TREE_CODE (t) == MEM_REF)
 720     warned = checker->check_mem_ref (location, t,
 721                                      false /*ignore_off_by_one*/);
 722   else if (TREE_CODE (t) == ADDR_EXPR)
 723     {
 724       checker->check_addr_expr (location, t, wi->stmt);
 725       *walk_subtree = false;
 726     }
 727   else if (inbounds_memaccess_p (t, wi->stmt))
 728     /* Hack: Skip MEM_REF checks in accesses to a member of a base class
 729        at an offset that's within the bounds of the enclosing object.
 730        See pr98266 and pr97595.  */
 731     *walk_subtree = false;
 732
 733   /* Propagate the no-warning bit to the outer statement to avoid also
 734      issuing -Wstringop-overflow/-overread for the out-of-bounds accesses.  */
 735   if (warned)
 736     suppress_warning (wi->stmt, OPT_Warray_bounds);
 737
 738   return NULL_TREE;
 739 }
 740
 741 /* A dom_walker subclass for use by check_all_array_refs, to walk over
 742    all statements of all reachable BBs and call check_array_bounds on
 743    them.  */
 744
 745 class check_array_bounds_dom_walker : public dom_walker
 746 {
 747 public:
 748   check_array_bounds_dom_walker (array_bounds_checker *checker)
 749     : dom_walker (CDI_DOMINATORS,
 750                   /* Discover non-executable edges, preserving EDGE_EXECUTABLE
 751                      flags, so that we can merge in information on
 752                      non-executable edges from vrp_folder .  */
 753                   REACHABLE_BLOCKS_PRESERVING_FLAGS),
 754     checker (checker) { }
 755   ~check_array_bounds_dom_walker () {}
 756
 757   edge before_dom_children (basic_block) FINAL OVERRIDE;
 758
 759 private:
 760   array_bounds_checker *checker;
 761 };
 762
 763 /* Implementation of dom_walker::before_dom_children.
 764
 765    Walk over all statements of BB and call check_array_bounds on them,
 766    and determine if there's a unique successor edge.  */
 767
 768 edge
 769 check_array_bounds_dom_walker::before_dom_children (basic_block bb)
 770 {
 771   gimple_stmt_iterator si;
 772   for (si = gsi_start_bb (bb); !gsi_end_p (si); gsi_next (&si))
 773     {
 774       gimple *stmt = gsi_stmt (si);
 775       if (!gimple_has_location (stmt)
 776           || is_gimple_debug (stmt))
 777         continue;
 778
 779       struct walk_stmt_info wi{ };
 780       wi.info = checker;
 781       checker->m_stmt = stmt;
 782
 783       walk_gimple_op (stmt, array_bounds_checker::check_array_bounds, &wi);
 784     }
 785
 786   /* Determine if there's a unique successor edge, and if so, return
 787      that back to dom_walker, ensuring that we don't visit blocks that
 788      became unreachable during the VRP propagation
 789      (PR tree-optimization/83312).  */
 790   return find_taken_edge (bb, NULL_TREE);
 791 }
 792
 793 void
 794 array_bounds_checker::check ()
 795 {
 796   check_array_bounds_dom_walker w (this);
 797   w.walk (ENTRY_BLOCK_PTR_FOR_FN (fun));
 798 }