Beagle SCM

ABC-022: gcc 15.2 Release -Warray-bounds false positive on the MSET sift-down

Release build of jab is no longer warning-clean on gcc 15.2: the inlined MSETu64_DownZ child probe h[right][0] is flagged as OOB when instantiated from test/MSET.c's 2-slot runs. The read is short-circuit-guarded by right < n and dead at runtime, so this is a diagnostic bug, not a memory bug. It matters because ABC-017 bought a 0-warning build and the same class was already papered over twice in test code (MSETl, PAGEtest) by padding local arrays — padding does not generalize to a genuinely 2-run heap.

Input

Context

• gcc 15.2.0, cmake -GNinja -DCMAKE_BUILD_TYPE=Release, target dog/abc/test/MSETtest, build otherwise clean (383/383):
• MSETx.h:17:36: warning: array subscript 4 is outside array bounds of 'const u64 *[2][2]', inlined MSETu64TopZ (MSETx.h:78) ← MSETk (test/MSET.c:459); note "at offset 32 into object 'runs' of size 32" (test/MSET.c:452).
• Decode: the subscript is in const u64 * units, so offset 32 = h[right][0] with right == 2 — the first sift-down (i=0, left=1, right=2) one past u64cs runs[2].
• Guarded: MSETx.h:17 reads h[right] only under right < n, n = $len(heap) = the live run count; every other index (j, left) is bounded the same way. Nothing can read past n.
• Why gcc loses it: MSETu64AdvZ writes heap[1] (MSETx.h:116) inside MSETk's loop, killing the value range for n at the inlined use; the object size stays known (32 B), so the guarded path is not provably dead.
• Prior art, same class, already worked around in tests: test/MSET.c:471-475 (MSETl pads runs[2] for a 1-run heap) and test/PAGE.c:213-218 (u8b wrapped in a full page).
• Warning flags come from dog/abc/CMakeLists.txt:10 (-Wall -Wextra), landed by ABC-017; MSETx.h was last reworked by ABC-021 (Yx/SORT tie loop).

Goals

• gcc 15.2 Release builds MSETtest with zero warnings, with no change to MSETx.h runtime semantics and no test rewritten to hide the diagnostic behind fake array padding.

Constraints

• Do NOT "fix" it by widening runs[2] in MSETk — the heap genuinely holds 2 runs; padding lies about the fixture.
• Must stay clean on clang Release/ASAN too (see ABC-017 lanes).
• Repro first (meta/work.mkd §3): a build of MSETtest at -O2 that emits the warning, and the same build silent after the fix.

WIP

Design decisions

• Open — pick one, needs a ruling:
  1. #pragma GCC diagnostic ignored "-Warray-bounds" around the sift in MSETx.h + a 2-line ABC-022 comment (narrow, but puts a pragma in a hot template header).
  2. -Wno-array-bounds on the MSETtest target only in dog/abc/test/CMakeLists.txt (keeps the header clean, but blinds one test target to real OOB).
  3. Restructure _DownZ so the child index is not a compile- time constant on the inlined path (e.g. hoist the right probe behind an explicitly range-limited n) — preferred if it works without pessimizing the sift.
• Verify whichever option on gcc 15.2 AND clang before landing; option 3 must be confirmed to actually silence gcc, not assumed.

TODOs

• repro: minimal -O2 build of MSETtest emitting the warning
• ruling on 1/2/3 above
• fix + re-verify Debug/Release x gcc/clang, suites green
• revisit the MSETl/PAGEtest paddings if 3 lands (they may become unnecessary — remove the fake slots then)

Blockers and bummers

• None; test-only fallout, no runtime defect implied.

Outcome

• Not started.