From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 19ECD384641B; Thu, 27 Oct 2022 18:11:05 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 19ECD384641B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1666894267; bh=wwsrsgILYzQMToJ1ibadSXIFgGzvTHUleSMty0S83vo=; h=From:To:Subject:Date:In-Reply-To:References:From; b=dzH8GVcVSexmW7vCX4fhP471X75NPmCzP13OLqbNGbeMSTkulsd2MITqmtTD88vgY jxQtRxVvkBY8W43wzQYtc+8foRGle/LIidquhnyPCM0UU7poUmG6ptXJrmd7wFg76x JhamlYGQGG7skRJGAc0iYm7kLqokZKKqeMNKNt1Y= From: "cvs-commit at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34 Date: Thu, 27 Oct 2022 18:11:04 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c++ X-Bugzilla-Version: 13.0 X-Bugzilla-Keywords: ice-on-valid-code, testsuite-fail X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 13.0 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D107379 --- Comment #3 from CVS Commits --- The master branch has been updated by Jakub Jelinek : https://gcc.gnu.org/g:a33d623d2d3a78f5ef6f9e854946303e063eef63 commit r13-3528-ga33d623d2d3a78f5ef6f9e854946303e063eef63 Author: Jakub Jelinek Date: Thu Oct 27 20:10:18 2022 +0200 c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379] As mentioned in the PR, apparently my r13-2887 P1467R9 changes regressed these tests on powerpc64le-linux with IEEE quad by default. I believe my changes just uncovered a latent bug. The problem is that push_namespace calls find_namespace_slot, which does: tree *slot =3D DECL_NAMESPACE_BINDINGS (ns) ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : = 0, create_p ? INSERT : NO_INSERT); In the ns case, slot is non-NU= LL above with a binding_vector in it. Then pushdecl is called and this does: slot =3D find_namespace_slot (ns, name, ns =3D=3D current_namespace); where ns =3D=3D current_namespace (ns is :: and name is details) is tru= e. So this again calls tree *slot =3D DECL_NAMESPACE_BINDINGS (ns) ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0, create_p ? INSERT : NO_INSERT); but this time with create_p and so INSERT. At this point we reach if (insert =3D=3D INSERT && m_size * 3 <=3D m_n_elements * 4) expand (); and when we are unlucky and the occupancy of the hash table just reached 3/4, expand () is called and the hash table is reallocated. But when that happens, it means the slot pointer in the pushdecl caller (push_namespace) point= s to freed memory and so any accesses to it in make_namespace_finish will be= UB. The following patch fixes it by calling find_namespace_slot again even = if it was non-NULL, just doesn't assert it is *slot =3D=3D ns in that case (b= ecause it often is not). 2022-10-27 Jakub Jelinek PR c++/107379 * name-lookup.cc (push_namespace): Call find_namespace_slot aga= in after pushdecl as the hash table might be expanded during pushd= ecl.=