[Bug libstdc++/113761] New: Abnormal program termination using libstdc++

[Bug libstdc++/113761] New: Abnormal program termination using libstdc++

[arakawamasahiro at jp dot fujitsu.com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

            Bug ID: 113761
           Summary: Abnormal program termination using libstdc++
           Product: gcc
           Version: 12.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: arakawamasahiro at jp dot fujitsu.com
  Target Milestone: ---

If you compile the following program with g++-11.4.0 and run it using libstdc++
12.3.0, the executable program will terminate abnormally.

[program(test.cpp)]
#include <iostream>

#include <random>
#include <cassert>

double f(double x)
{
    return x*2;
}

int main()
{
    typedef std::piecewise_constant_distribution<> D;
    D d({}, f);
    std::vector<double> iv = d.intervals();

    return 0;
}

[Compile and execute log]
$ g++ test.cpp
$ LANG=C; ./a.out
terminate called after throwing an instance of 'std::length_error'
  what():  vector::reserve
Aborted (core dumped)

The {} specified in the first argument of variable d in the std::
piecewise_constant_distribution<> class reduces the list size to 0.
Given the constraints of the constructor of the std::
piecewise_constant_distribution<> class, you should expect a pattern where the
list size is zero.

[Bug libstdc++/113761] Abnormal program termination using libstdc++

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Looks like libstdc++ miss:
If 
bl.size()
<
2
, let 
n
=
1
, 
w
0
=
1
, 
b
0
=
0
, and 
b
1
=
1
.

[Bug libstdc++/113761] Abnormal program termination using libstdc++

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
https://eel.is/c++draft/rand.dist.samp.pconst#8

It seems like libstdc++ miss that part, I wonder if it changed ...

[Bug libstdc++/113761] piecewise_constant_distribution's initializer_list constructor is not correct for `size < 2`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Abnormal program            |piecewise_constant_distribu
                   |termination using libstdc++ |tion's initializer_list
                   |                            |constructor is not correct
                   |                            |for `size < 2`
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-05
             Status|UNCONFIRMED                 |NEW

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.  Note the version of libstdc++ used here is not the issue.

[Bug libstdc++/113761] piecewise_constant_distribution's initializer_list constructor is not correct for `size < 2`

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #2)
> It seems like libstdc++ miss that part, I wonder if it changed ...

No, it didn't change. We've just always had that bug. Well, not quite always,
looks like it was a regression in r0-94140-gf8dd9e0de06aef which added the
reserve call.

It's easy enough to fix:


--- a/libstdc++-v3/include/bits/random.tcc
+++ b/libstdc++-v3/include/bits/random.tcc
@@ -2877,10 +2877,10 @@ namespace __detail
       param_type(initializer_list<_RealType> __bl, _Func __fw)
       : _M_int(), _M_den(), _M_cp()
       {
-       _M_int.reserve(__bl.size());
-       for (auto __biter = __bl.begin(); __biter != __bl.end(); ++__biter)
-         _M_int.push_back(*__biter);
+       if (__bl.size() < 2)
+         return;

+       _M_int = __bl;
        _M_den.reserve(_M_int.size() - 1);
        for (size_t __k = 0; __k < _M_int.size() - 1; ++__k)
          _M_den.push_back(__fw(0.5 * (_M_int[__k + 1] + _M_int[__k])));


But I don't understand why piecewise_constant_distribution is implemented this
way:

  template<typename _RealType>
    void
    piecewise_constant_distribution<_RealType>::param_type::
    _M_initialize()
    {
      if (_M_int.size() < 2
          || (_M_int.size() == 2
              && _M_int[0] == _RealType(0)
              && _M_int[1] == _RealType(1)))
        {
          _M_int.clear();
          _M_den.clear();
          return;
        }

And then:

        std::vector<_RealType>
        intervals() const
        {
          if (_M_int.empty())
            {
              std::vector<_RealType> __tmp(2);
              __tmp[1] = _RealType(1);
              return __tmp;
            }
          else
            return _M_int;
        }

        std::vector<double>
        densities() const
        { return _M_den.empty() ? std::vector<double>(1, 1.0) : _M_den; }

This seems incredibly wasteful, why keep reallocating a new vector instead of
just populating _M_int with {1} and _M_den with {0,1}? Paolo did that in
r0-103705-g879b9073c87cea and it makes no sense to me, I'll see if the mailing
list has any clues.

Also, we're missing https://cplusplus.github.io/LWG/issue1439 which fixed the
return type of densities()

[Bug libstdc++/113761] piecewise_constant_distribution's initializer_list constructor is not correct for `size < 2`

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #4)
> Also, we're missing https://cplusplus.github.io/LWG/issue1439 which fixed
> the return type of densities()

Which requires changing param_type::_M_den which is an ABI break.

What a mess.

[Bug libstdc++/113761] piecewise_constant_distribution's initializer_list constructor is not correct for `size < 2`

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113761

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=82749

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #4)
> 
> Also, we're missing https://cplusplus.github.io/LWG/issue1439 which fixed
> the return type of densities()

That is recorded as PR 82749