[Bug c++/114935] New: Miscompilation of initializer_list<std::string> in presence of exceptions

[Bug c++/114935] New: Miscompilation of initializer_list<std::string> in presence of exceptions

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

            Bug ID: 114935
           Summary: Miscompilation of initializer_list<std::string> in
                    presence of exceptions
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jamborm at gcc dot gnu.org
                CC: jason at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-linux-gnu
            Target: x86_64-linux-gnu

The following testcase:

#include <string>
#include <initializer_list>

void __attribute__((noipa))
tata(std::initializer_list<std::string> init)
{
  throw 1;
}

int
main()
{
  try
    {
      tata({ "0123456789012346" }); // using shorter string or "..."s works
    }
  catch (...)
    {
    }
}

aborts when compiled with GCC 14 even when not optimizing.

I have bisected the failure to r14-1705-g2764335bd336f2 (Jason
Merrill: c++: build initializer_list<string> in a loop [PR105838])

This has been extracted from libstorage-ng testsuite and originally
filed as https://bugzilla.opensuse.org/show_bug.cgi?id=1223820

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
           Assignee|unassigned at gcc dot gnu.org      |jason at gcc dot gnu.org
   Last reconfirmed|                            |2024-05-03
   Target Milestone|---                         |14.0
            Summary|Miscompilation of           |[14/15 regression]
                   |initializer_list<std::strin |Miscompilation of
                   |g> in presence of           |initializer_list<std::strin
                   |exceptions                  |g> in presence of
                   |                            |exceptions
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions since r14-1705-g2764335bd336f2

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

--- Comment #1 from Jason Merrill <jason at gcc dot gnu.org> ---
Without <string>:

#include <initializer_list>

int as;
struct A {
  A(const char *) { ++as; }
  A(const A&) { ++as; }
  ~A() { --as; }
};

void __attribute__((noipa))
tata(std::initializer_list<A> init)
{
  throw 1;
}

int
main()
{
  try { tata({ "foo","bar" }); }
  catch (...) { }

  if (as != 0) __builtin_abort ();
}



The problem is with the array EH cleanup handling: when we initialize an array
of a type with a non-trivial destructor, such as the backing array for the
initializer_list, we have a cleanup to destroy any constructed elements if a
later constructor throws.  But in this case the call to tata is still in that
region.  Without the r14-1705 change, we deal with that by disabling the array
cleanup in split_nonconstant_init, but with the change we don't go through
split_nonconstant_init and so we miss disabling the cleanup.

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions since r14-1705-g2764335bd336f2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:8f3afb83c879f1bfa722a963a07c06aaf174ef72

commit r15-138-g8f3afb83c879f1bfa722a963a07c06aaf174ef72
Author: Jason Merrill <jason@redhat.com>
Date:   Fri May 3 09:52:46 2024 -0400

    c++: initializer_list<string> and EH [PR114935]

    When we initialize an array of a type with a non-trivial destructor, such
as
    the backing array for the initializer_list, we have a cleanup to destroy
any
    constructed elements if a later constructor throws.  When the array being
    created is a variable, the end of that EH region naturally coincides with
    the beginning of the EH region for the cleanup for the variable as a whole.

    But if the array is a temporary, or a subobject of one, the array cleanup
    region lasts for the rest of the full-expression, along with the normal
    cleanup for the TARGET_EXPR.  As a result, when tata throws we clean it up
    twice.  Before r14-1705 we avoided this by disabling the array cleanup in
    split_nonconstant_init, but after that we don't go through
    split_nonconstant_init, so let's handle it in cp_genericize_target_expr.

            PR c++/114935

    gcc/cp/ChangeLog:

            * cp-gimplify.cc (cp_genericize_init): Add flags parm.
            (cp_genericize_init_expr): Pass nullptr.
            (cp_genericize_target_expr): Handle cleanup flags.
            * typeck2.cc (build_disable_temp_cleanup): Factor out of...
            (split_nonconstant_init): ...here.
            * cp-tree.h (build_disable_temp_cleanup): Declare.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp0x/initlist-eh1.C: New test.

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions since r14-1705-g2764335bd336f2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-14 branch has been updated by Jason Merrill
<jason@gcc.gnu.org>:

https://gcc.gnu.org/g:3b4d6b6ecd79df790bf0938dab1f51094f94d777

commit r14-10165-g3b4d6b6ecd79df790bf0938dab1f51094f94d777
Author: Jason Merrill <jason@redhat.com>
Date:   Fri May 3 09:52:46 2024 -0400

    c++: initializer_list<string> and EH [PR114935]

    When we initialize an array of a type with a non-trivial destructor, such
as
    the backing array for the initializer_list, we have a cleanup to destroy
any
    constructed elements if a later constructor throws.  When the array being
    created is a variable, the end of that EH region naturally coincides with
    the beginning of the EH region for the cleanup for the variable as a whole.

    But if the array is a temporary, or a subobject of one, the array cleanup
    region lasts for the rest of the full-expression, along with the normal
    cleanup for the TARGET_EXPR.  As a result, when tata throws we clean it up
    twice.  Before r14-1705 we avoided this by disabling the array cleanup in
    split_nonconstant_init, but after that we don't go through
    split_nonconstant_init, so let's handle it in cp_genericize_target_expr.

            PR c++/114935

    gcc/cp/ChangeLog:

            * cp-gimplify.cc (cp_genericize_init): Add flags parm.
            (cp_genericize_init_expr): Pass nullptr.
            (cp_genericize_target_expr): Handle cleanup flags.
            * typeck2.cc (build_disable_temp_cleanup): Factor out of...
            (split_nonconstant_init): ...here.
            * cp-tree.h (build_disable_temp_cleanup): Declare.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp0x/initlist-eh1.C: New test.

    (cherry picked from commit 8f3afb83c879f1bfa722a963a07c06aaf174ef72)

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions since r14-1705-g2764335bd336f2

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Jason Merrill <jason at gcc dot gnu.org> ---
Fixed.

[Bug c++/114935] [14/15 regression] Miscompilation of initializer_list<std::string> in presence of exceptions since r14-1705-g2764335bd336f2

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935

--- Comment #5 from Jason Merrill <jason at gcc dot gnu.org> ---
Created attachment 58210
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58210&action=edit
attempt to reduce redundancy

A failed attempt to avoid duplicate array cleanups in this case.