public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34 Date: Thu, 27 Oct 2022 18:11:04 +0000 [thread overview] Message-ID: <bug-107379-4-4F3RM1uQbk@http.gcc.gnu.org/bugzilla/> (raw) In-Reply-To: <bug-107379-4@http.gcc.gnu.org/bugzilla/> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379 --- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>: https://gcc.gnu.org/g:a33d623d2d3a78f5ef6f9e854946303e063eef63 commit r13-3528-ga33d623d2d3a78f5ef6f9e854946303e063eef63 Author: Jakub Jelinek <jakub@redhat.com> Date: Thu Oct 27 20:10:18 2022 +0200 c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379] As mentioned in the PR, apparently my r13-2887 P1467R9 changes regressed these tests on powerpc64le-linux with IEEE quad by default. I believe my changes just uncovered a latent bug. The problem is that push_namespace calls find_namespace_slot, which does: tree *slot = DECL_NAMESPACE_BINDINGS (ns) ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0, create_p ? INSERT : NO_INSERT); In the <identifier_node 0x7fffe9f55ac0 details> ns case, slot is non-NULL above with a binding_vector in it. Then pushdecl is called and this does: slot = find_namespace_slot (ns, name, ns == current_namespace); where ns == current_namespace (ns is :: and name is details) is true. So this again calls tree *slot = DECL_NAMESPACE_BINDINGS (ns) ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0, create_p ? INSERT : NO_INSERT); but this time with create_p and so INSERT. At this point we reach if (insert == INSERT && m_size * 3 <= m_n_elements * 4) expand (); and when we are unlucky and the occupancy of the hash table just reached 3/4, expand () is called and the hash table is reallocated. But when that happens, it means the slot pointer in the pushdecl caller (push_namespace) points to freed memory and so any accesses to it in make_namespace_finish will be UB. The following patch fixes it by calling find_namespace_slot again even if it was non-NULL, just doesn't assert it is *slot == ns in that case (because it often is not). 2022-10-27 Jakub Jelinek <jakub@redhat.com> PR c++/107379 * name-lookup.cc (push_namespace): Call find_namespace_slot again after pushdecl as the hash table might be expanded during pushdecl.
next prev parent reply other threads:[~2022-10-27 18:11 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-10-24 16:48 [Bug other/107379] New: " seurer at gcc dot gnu.org 2022-10-24 16:50 ` [Bug other/107379] " pinskia at gcc dot gnu.org 2022-10-26 10:04 ` jakub at gcc dot gnu.org 2022-10-26 10:17 ` jakub at gcc dot gnu.org 2022-10-27 18:11 ` cvs-commit at gcc dot gnu.org [this message] 2022-12-21 13:52 ` [Bug c++/107379] " rguenth at gcc dot gnu.org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-107379-4-4F3RM1uQbk@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).