[Bug other/107379] New: [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[Bug other/107379] New: [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[seurer at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

            Bug ID: 107379
           Summary: [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C
                    break as of r13-2887-gb04208895fed34
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: other
          Assignee: unassigned at gcc dot gnu.org
          Reporter: seurer at gcc dot gnu.org
  Target Milestone: ---

g:b04208895fed34171eac6bafb60c90048eb1cb0c, r13-2887-gb04208895fed34

These failures occur on a powerpc64 system that is using IEEE128.  Note that
this commit is also the one that broke trunk for powerpc64 and some later
patches are needed to get the compiler to build.  It does still fail with
current trunk where the compiler builds OK.

FAIL: g++.dg/modules/adl-3_c.C -std=c++2a  (test for errors, line 28)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2a  (test for warnings, line 32)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2a  dg-regexp 31 not found:
"\n[^\n]*adl-3_b.C:8:13: error: 'fn' was not declared in this scope$"
FAIL: g++.dg/modules/adl-3_c.C -std=c++2a (internal compiler error:
Segmentation fault)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2a (test for excess errors)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2b  (test for errors, line 28)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2b  (test for warnings, line 32)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2b  dg-regexp 31 not found:
"\n[^\n]*adl-3_b.C:8:13: error: 'fn' was not declared in this scope$"
FAIL: g++.dg/modules/adl-3_c.C -std=c++2b (internal compiler error:
Segmentation fault)
FAIL: g++.dg/modules/adl-3_c.C -std=c++2b (test for excess errors)
FAIL: g++.dg/modules/adl-4_b.C -std=c++2a  dg-regexp 36 not found:
"[^\n]*/adl-4_a.C:14:[0-9]*: error: 'fn' was not declared in this scope\n"
FAIL: g++.dg/modules/adl-4_b.C -std=c++2a (internal compiler error:
Segmentation fault)
FAIL: g++.dg/modules/adl-4_b.C -std=c++2a (test for excess errors)
FAIL: g++.dg/modules/adl-4_b.C -std=c++2b  dg-regexp 36 not found:
"[^\n]*/adl-4_a.C:14:[0-9]*: error: 'fn' was not declared in this scope\n"
FAIL: g++.dg/modules/adl-4_b.C -std=c++2b (internal compiler error:
Segmentation fault)
FAIL: g++.dg/modules/adl-4_b.C -std=c++2b (test for excess errors)


commit b04208895fed34171eac6bafb60c90048eb1cb0c (HEAD)
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Sep 27 08:04:06 2022 +0200

    c++: Implement P1467R9 - Extended floating-point types and standard names
compiler part except for bfloat16 [PR106652]


Excess errors:
/home/seurer/gcc/git/gcc-regress/gcc/testsuite/g++.dg/modules/adl-3_c.C:6:11:
internal compiler error: Segmentation fault
0x10fed563 crash_signal
        /home/seurer/gcc/git/gcc-regress/gcc/toplev.cc:314
0x104f91dc get_fixed_binding_slot
        /home/seurer/gcc/git/gcc-regress/gcc/cp/name-lookup.cc:242
0x10508ca7 make_namespace_finish
        /home/seurer/gcc/git/gcc-regress/gcc/cp/name-lookup.cc:8454
0x1051ae53 push_namespace(tree_node*, bool)
        /home/seurer/gcc/git/gcc-regress/gcc/cp/name-lookup.cc:8600
0x105ad147 cp_parser_namespace_definition
        /home/seurer/gcc/git/gcc-regress/gcc/cp/parser.cc:21524
0x105ae0fb cp_parser_declaration
        /home/seurer/gcc/git/gcc-regress/gcc/cp/parser.cc:15090
0x105aeabb cp_parser_toplevel_declaration
        /home/seurer/gcc/git/gcc-regress/gcc/cp/parser.cc:15131
0x105aeabb cp_parser_translation_unit
        /home/seurer/gcc/git/gcc-regress/gcc/cp/parser.cc:5069
0x105aeabb c_parse_file()
        /home/seurer/gcc/git/gcc-regress/gcc/cp/parser.cc:48615
0x107d6c7f c_common_parse_file()
        /home/seurer/gcc/git/gcc-regress/gcc/c-family/c-opts.cc:1255

[Bug other/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |13.0

[Bug other/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nathan at gcc dot gnu.org,
                   |                            |ppalka at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I can reproduce, but I think this has really nothing to do with the changes
except bad luck.
The bug is in
      tree *slot = find_namespace_slot (current_namespace, name, false);
      if (slot)
        ns = reuse_namespace (slot, current_namespace, name);
      if (!ns)
        ns = make_namespace (current_namespace, name,
                             input_location, make_inline);

      if (pushdecl (ns) == error_mark_node)
        ns = NULL_TREE;
      else
        {
          /* Finish up making the namespace.  */
          add_decl_to_level (NAMESPACE_LEVEL (current_namespace), ns);
          if (!slot)
            {
              slot = find_namespace_slot (current_namespace, name);
              /* This should find the slot created by pushdecl.  */
              gcc_checking_assert (slot && *slot == ns);
            }
          make_namespace_finish (ns, slot);
find_namespace_slot will
  tree *slot = DECL_NAMESPACE_BINDINGS (ns)
    ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
                           create_p ? INSERT : NO_INSERT);
In the <identifier_node 0x7fffe9f55ac0 details> ns case, slot is non-NULL above
with a binding_vector in it.
Then pushdecl is called and this does:
3659              slot = find_namespace_slot (ns, name, ns ==
current_namespace);
where ns == current_namespace (ns is :: and name is details) is true.
So this again calls
122       tree *slot = DECL_NAMESPACE_BINDINGS (ns)
123         ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) :
0,
124                                create_p ? INSERT : NO_INSERT);
but this time with create_p and so INSERT.
At this point we reach
966       if (insert == INSERT && m_size * 3 <= m_n_elements * 4)
967         expand ();
and when we are unlucky and the occupancy of the hash table just reached 3/4,
expand () is called and the hash table is reallocated.  But when that happens,
it means the slot pointer in the pushdecl caller points to freed memory and so
any accesses to it in make_namespace_finish will be UB.
Perhaps a fix would be to do else slot = find_namespace_slot
(current_namespace, name); again before make_namespace_finish (with some
assertion that at least slot is non-NULL)?

[Bug other/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
In (untested) patch form:
--- gcc/cp/name-lookup.cc.jj    2022-10-12 17:51:00.912944731 +0200
+++ gcc/cp/name-lookup.cc       2022-10-26 12:06:38.177590655 +0200
@@ -8596,6 +8596,13 @@ push_namespace (tree name, bool make_inl
              /* This should find the slot created by pushdecl.  */
              gcc_checking_assert (slot && *slot == ns);
            }
+         else
+           {
+             /* pushdecl could have expanded the hash table, so
+                slot might be invalid.  */
+             slot = find_namespace_slot (current_namespace, name);
+             gcc_checking_assert (slot);
+           }
          make_namespace_finish (ns, slot);

          /* Add the anon using-directive here, we don't do it in
which fixes the ICE for me on the cross-compiler.

[Bug c++/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:a33d623d2d3a78f5ef6f9e854946303e063eef63

commit r13-3528-ga33d623d2d3a78f5ef6f9e854946303e063eef63
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Oct 27 20:10:18 2022 +0200

    c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379]

    As mentioned in the PR, apparently my r13-2887 P1467R9 changes
    regressed these tests on powerpc64le-linux with IEEE quad by default.

    I believe my changes just uncovered a latent bug.
    The problem is that push_namespace calls find_namespace_slot,
    which does:
      tree *slot = DECL_NAMESPACE_BINDINGS (ns)
        ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
                               create_p ? INSERT : NO_INSERT);
    In the <identifier_node 0x7fffe9f55ac0 details> ns case, slot is non-NULL
    above with a binding_vector in it.
    Then pushdecl is called and this does:
                      slot = find_namespace_slot (ns, name, ns ==
current_namespace);
    where ns == current_namespace (ns is :: and name is details) is true.
    So this again calls
              tree *slot = DECL_NAMESPACE_BINDINGS (ns)
                ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE
(name) : 0,
                                       create_p ? INSERT : NO_INSERT);
    but this time with create_p and so INSERT.
    At this point we reach
              if (insert == INSERT && m_size * 3 <= m_n_elements * 4)
                expand ();
    and when we are unlucky and the occupancy of the hash table just reached
3/4,
    expand () is called and the hash table is reallocated.  But when that
happens,
    it means the slot pointer in the pushdecl caller (push_namespace) points to
    freed memory and so any accesses to it in make_namespace_finish will be UB.

    The following patch fixes it by calling find_namespace_slot again even if
it
    was non-NULL, just doesn't assert it is *slot == ns in that case (because
    it often is not).

    2022-10-27  Jakub Jelinek  <jakub@redhat.com>

            PR c++/107379
            * name-lookup.cc (push_namespace): Call find_namespace_slot again
            after pushdecl as the hash table might be expanded during pushdecl.

[Bug c++/107379] [13 regression] g++.dg/modules/adl-3_c.C and adl-4_b.C break as of r13-2887-gb04208895fed34

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107379

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.