[Bug c++/105077] New: The std::bad_array_new_length is not thrown for some new array scenarios.

[Bug c++/105077] New: The std::bad_array_new_length is not thrown for some new array scenarios.

[chumarshal at foxmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

            Bug ID: 105077
           Summary: The std::bad_array_new_length is not thrown for some
                    new array scenarios.
           Product: gcc
           Version: 11.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: chumarshal at foxmail dot com
  Target Milestone: ---

The std::bad_array_new_length is not thrown for the following three scenarios.
These scenarios do not follow C++ spec:"std::bad_array_new_length is the type
of the object thrown as exceptions by the new-expressions to report invalid
array lengths if array length is negative."


case1  using g++ -O0
==========================================================================
#include <new>
#include <stdexcept>
int main()  
{
  try 
  {
    int negative = -1;
    new char[negative];
  } 
  catch(const std::bad_array_new_length &e) 
  {
  }
  return 0;
}

terminate called after throwing an instance of 'std::bad_alloc'
what():  std::bad_alloc


case2   using g++ -O0
==========================================================================
#include <new>
#include <stdexcept>

struct s_char
{ 
  char ch;
};

int main()  
{
  try 
  {
        int negative = -1;
        new s_char[negative];
  } 
  catch(const std::bad_array_new_length &e) 
  {
  }
  return 0;
}

terminate called after throwing an instance of 'std::bad_alloc'
what():  std::bad_alloc


case3  using g++ -O0
==========================================================================
#include <new>
#include <stdexcept>

struct s_char_with_new 
{
  char ch;
  void *operator new[] (std::size_t sz)
  {
    abort();
  }
};

int main()  
{
  try 
  {
    int negative = -1;
    new char[negative];
  } 
  catch(const std::bad_array_new_length &e) 
  {
  }
  return 0;
}

terminate called after throwing an instance of 'std::bad_alloc'
what():  std::bad_alloc

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Looks like a dup of PR 85795

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I've added the first example there. The other two examples are exactly the same
scenario.

*** This bug has been marked as a duplicate of bug 85795 ***

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[chumarshal at foxmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

--- Comment #3 from marshal <chumarshal at foxmail dot com> ---
(In reply to Jonathan Wakely from comment #2)
> I've added the first example there. The other two examples are exactly the
> same scenario.
> 
> *** This bug has been marked as a duplicate of bug 85795 ***


But why "new int[negative];" throws std::bad_array_new_length as following
case?

I think "new int[negative]" and "new char[negative]" should both throw
std::bad_array_new_length when "int negative = -1;". 



new int[negative]
==========================================================================
#include <new>
#include <stdexcept>

int main()  
{
  int negative = -1;
  new int[negative];
  return 0;
}

terminate called after throwing an instance of 'std::bad_array_new_length'
  what():  std::bad_array_new_length

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to marshal from comment #3)
> But why "new int[negative];" throws std::bad_array_new_length as following
> case?

Because that case requires size_t(-1) * sizeof(int) and the compiler detects
that it's out of range. It fails to detect that size_t(-1) is already
incorrect.

> I think "new int[negative]" and "new char[negative]" should both throw
> std::bad_array_new_length when "int negative = -1;". 

Yes, it's a bug.

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[chumarshal at foxmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

--- Comment #5 from marshal <chumarshal at foxmail dot com> ---
(In reply to Jonathan Wakely from comment #4)
> (In reply to marshal from comment #3)
> > But why "new int[negative];" throws std::bad_array_new_length as following
> > case?
> 
> Because that case requires size_t(-1) * sizeof(int) and the compiler detects
> that it's out of range. It fails to detect that size_t(-1) is already
> incorrect.
> 
> > I think "new int[negative]" and "new char[negative]" should both throw
> > std::bad_array_new_length when "int negative = -1;". 
> 
> Yes, it's a bug.

Please modify "Status：RESOLVED DUPLICATE of bug 8579", because it's a new bug
and it's not same with bug 8579.

[Bug c++/105077] The std::bad_array_new_length is not thrown for some new array scenarios.

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105077

--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
It's the same. In both cases the compiler fails to check if the size expression
is erroneous, and calls operator new(n) with a bad value that causes a
std::bad_alloc exception. I'm both cases, the compiler should be checking the
expression first and throwing the correct exception.