[Bug c++/115476] New: __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[Bug c++/115476] New: __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mital at mitalashok dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

            Bug ID: 115476
           Summary: __has_unique_object_representation ICE with array of
                    uninstantiated type of unknown bound
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mital at mitalashok dot co.uk
  Target Milestone: ---

Discovered when libc++ removed the `remove_extent_t` from the standard type
trait: https://github.com/llvm/llvm-project/issues/95311 /
https://github.com/llvm/llvm-project/pull/69241

https://gcc.godbolt.org/z/e136MGrG1

    template <int>
    class Foo {
      int x;
    };
    static_assert(__has_unique_object_representations(Foo<0>[]));

With this error:

./test.cpp:6:59: internal compiler error: Segmentation fault
    6 | static_assert(__has_unique_object_representations(Foo<0>[]));
      |                                                           ^
0x13b4fb3 crash_signal
        ../../gcc/gcc/toplev.cc:319
0x7fb3eb34451f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0xd16bb0 contains_struct_check(tree_node const*, tree_node_structure_enum, char
const*, int, char const*)
        ../../gcc/gcc/tree.h:4065
0xd16bb0 wi::extended_tree<128>::extended_tree(tree_node const*)
        ../../gcc/gcc/tree.h:6477
0xd16bb0 generic_wide_int<wi::extended_tree<128> >::generic_wide_int<tree_node
const*>(tree_node const* const&)
        ../../gcc/gcc/wide-int.h:847
0xd16bb0 wi::to_offset(tree_node const*)
        ../../gcc/gcc/tree.h:6429
0xd16bb0 record_has_unique_obj_representations
        ../../gcc/gcc/cp/tree.cc:4836
0xd165a0 type_has_unique_obj_representations(tree_node const*)
        ../../gcc/gcc/cp/tree.cc:4751
0xcf620d finish_trait_expr(unsigned int, cp_trait_kind, tree_node*, tree_node*)
        ../../gcc/gcc/cp/semantics.cc:13088
0xc59ee7 cp_parser_trait
        ../../gcc/gcc/cp/parser.cc:11314
0xc4bba9 cp_parser_postfix_expression
        ../../gcc/gcc/cp/parser.cc:7954
0xc244cf cp_parser_binary_expression
        ../../gcc/gcc/cp/parser.cc:10413
0xc25492 cp_parser_assignment_expression
        ../../gcc/gcc/cp/parser.cc:10757
0xc2754d cp_parser_constant_expression
        ../../gcc/gcc/cp/parser.cc:11047
0xc29fce cp_parser_static_assert
        ../../gcc/gcc/cp/parser.cc:17105
0xc6f2d4 cp_parser_declaration
        ../../gcc/gcc/cp/parser.cc:15715
0xc6fdda cp_parser_toplevel_declaration
        ../../gcc/gcc/cp/parser.cc:15736
0xc6fdda cp_parser_translation_unit
        ../../gcc/gcc/cp/parser.cc:5299
0xc6fdda c_parse_file()
        ../../gcc/gcc/cp/parser.cc:51933
0xdc6629 c_common_parse_file()
        ../../gcc/gcc/c-family/c-opts.cc:1322

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
           Keywords|                            |ice-on-valid-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2024-06-13
            Summary|__has_unique_object_represe |[13/14/15 Regression]
                   |ntation ICE with array of   |__has_unique_object_represe
                   |uninstantiated type of      |ntation ICE with array of
                   |unknown bound               |uninstantiated type of
                   |                            |unknown bound
      Known to work|                            |12.3.0
      Known to fail|                            |13.1.0
   Target Milestone|---                         |13.4

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. full backtrace:
```
t.cc:6:59: internal compiler error: Segmentation fault
    6 |     auto t = (__has_unique_object_representations(Foo<0>[]));
      |                                                           ^
0x137448f crash_signal
        /home/apinski/src/upstream-gcc-new/gcc/gcc/toplev.cc:319
0xce7df0 contains_struct_check(tree_node const*, tree_node_structure_enum, char
const*, int, char const*)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/tree.h:4065
0xce7df0 wi::extended_tree<128>::extended_tree(tree_node const*)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/tree.h:6477
0xce7df0 generic_wide_int<wi::extended_tree<128> >::generic_wide_int<tree_node
const*>(tree_node const* const&)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/wide-int.h:847
0xce7df0 wi::to_offset(tree_node const*)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/tree.h:6429
0xce7df0 record_has_unique_obj_representations
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/tree.cc:4832
0xce77bb type_has_unique_obj_representations(tree_node const*)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/tree.cc:4747
0xcc782e finish_trait_expr(unsigned int, cp_trait_kind, tree_node*, tree_node*)
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/semantics.cc:13074
0xc2db09 cp_parser_trait
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:11314
0xc1de71 cp_parser_postfix_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:7954
0xbf4c10 cp_parser_binary_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:10413
0xbf59f4 cp_parser_assignment_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:10757
0xbf5fa4 cp_parser_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:10924
0xc08ebd cp_parser_primary_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:5945
0xc1de71 cp_parser_postfix_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:7954
0xbf4c10 cp_parser_binary_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:10413
0xbf59f4 cp_parser_assignment_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:10757
0xbf7b8e cp_parser_constant_expression
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:11047
0xbf97c6 cp_parser_initializer_clause
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:26369
0xbfcfd4 cp_parser_initializer
        /home/apinski/src/upstream-gcc-new/gcc/gcc/cp/parser.cc:26308
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

```

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org,
                   |                            |mpolacek at gcc dot gnu.org
           Keywords|needs-bisection             |

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r13-25:

commit fcff9a464cc10eadc60616990c128717ba5ac9eb
Author: Jason Merrill <jason@redhat.com>
Date:   Wed Mar 23 12:25:18 2022 -0400

    c++: traits, array of unknown bound of incomplete

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
In check_trait_type, we do

  if (kind == 1 && TREE_CODE (type) == ARRAY_TYPE && !TYPE_DOMAIN (type))
    return true; // Array of unknown bound. Don't care about completeness.

and then end up crashing in record_has_unique_obj_representations:

4836      if (cur != wi::to_offset (sz))

because sz is null.

https://en.cppreference.com/w/cpp/types/has_unique_object_representations says
"The behavior is undefined if T is an incomplete type other than (possibly
cv-qualified) void or array of unknown bound."

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mital at mitalashok dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #4 from Mital Ashok <mital at mitalashok dot co.uk> ---
cppreference is wrong

https://eel.is/c++draft/type.traits#tab:meta.unary.prop-row-47-column-2-sentence-1

> For an array type `T`, the same result as `has_unique_object_representations_v<remove_all_extents_t<T>>`, otherwise see below.

So `__has_unique_object_representations(T[])` should be exactly equivalent to
`__has_unique_object_representations(T)`, even though `T[]` is incomplete (as
long as `T` is complete).

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mital at mitalashok dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #5 from Mital Ashok <mital at mitalashok dot co.uk> ---
Sorry, I misread the cppreference quote. Though it should be ill-formed instead
of UB I think.

GCC also crashes on this invalid code:

    class Foo;
    static_assert(__has_unique_object_representations(Foo[]));

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Aha, so

  static_assert(__has_unique_object_representations(Foo<0>[]));

is valid and should be treated just like

  static_assert(__has_unique_object_representations(Foo<0>));

but

    class Foo;
    static_assert(__has_unique_object_representations(Foo[]));

is invalid, because 'Foo' is not a complete type.

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Keywords|                            |ice-on-invalid-code
           Priority|P3                          |P2
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mital at mitalashok dot co.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #7 from Mital Ashok <mital at mitalashok dot co.uk> ---
I think the issue is the same as it was in Clang

The preconditions for `has_unique_object_representations` is
https://eel.is/c++draft/type.traits#tab:meta.unary.prop-row-47-column-3-sentence-1

> T shall be a complete type, cv void, or an array of unknown bound.

Which is implemented in GCC as `check_trait_type (type1, /* kind = */ 1)`
https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/cp/semantics.cc;h=08f5f245e7d11a76b975bb04c0075ded1b3ca8ba;hb=609764a42f0cd3f6358562cab98fc220d3d2d9fd#l12969

However, unlike the other traits with the same preconditions (like
`__is_assignable(T, U)` for both of its type arguments), instead of simply
being `false` when given an array with unknown bounds, it recurses in, so it
implicitly has a precondition that "T is cv void or
std::remove_all_extents_t<T> is complete", which should be checked with
`check_trait_type (type1, /* kind = */ 2)`.

`__has_trivial_destructor` also seems to be miscategorized as kind = 1 too,
leading to this unintended result:

    struct Foo;
    static_assert(__has_trivial_destructor(Foo[]));
    struct Foo { ~Foo(); };
    static_assert(!__has_trivial_destructor(Foo[]));

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #8 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Patch posted:
https://gcc.gnu.org/pipermail/gcc-patches/2024-June/654985.html
but I'm not changing __has_trivial_destructor in that patch.  That and its kin
are extensions:
https://gcc.gnu.org/onlinedocs/gcc/Type-Traits.html
and I'm not sure I should be changing them.  (It appears some of the __has_*
built-ins may be deprecated: bug 106085.)

[Bug c++/115476] [13/14/15 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Marek Polacek <mpolacek@gcc.gnu.org>:

https://gcc.gnu.org/g:fc382a373e6824bb998007d1dcb0805b0cf4b8e8

commit r15-1625-gfc382a373e6824bb998007d1dcb0805b0cf4b8e8
Author: Marek Polacek <polacek@redhat.com>
Date:   Mon Jun 17 17:53:12 2024 -0400

    c++: ICE with __has_unique_object_representations [PR115476]

    Here we started to ICE with r13-25: in check_trait_type, for "X[]" we
    return true here:

      if (kind == 1 && TREE_CODE (type) == ARRAY_TYPE && !TYPE_DOMAIN (type))
        return true; // Array of unknown bound. Don't care about completeness.

    and then end up crashing in record_has_unique_obj_representations:

    4836      if (cur != wi::to_offset (sz))

    because sz is null.

   
https://eel.is/c++draft/type.traits#tab:meta.unary.prop-row-47-column-3-sentence-1
    says that the preconditions for __has_unique_object_representations are:
    "T shall be a complete type, cv void, or an array of unknown bound" and
    that "For an array type T, the same result as
    has_unique_object_representations_v<remove_all_extents_t<T>>" so T[]
    should be treated as T.  So we should use kind==2 for the trait.

            PR c++/115476

    gcc/cp/ChangeLog:

            * semantics.cc (finish_trait_expr)
            <case CPTK_HAS_UNIQUE_OBJ_REPRESENTATIONS>: Move below to call
            check_trait_type with kind==2.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp1z/has-unique-obj-representations4.C: New test.

[Bug c++/115476] [13/14 Regression] __has_unique_object_representation ICE with array of uninstantiated type of unknown bound

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115476

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14/15 Regression]       |[13/14 Regression]
                   |__has_unique_object_represe |__has_unique_object_represe
                   |ntation ICE with array of   |ntation ICE with array of
                   |uninstantiated type of      |uninstantiated type of
                   |unknown bound               |unknown bound

--- Comment #10 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed on trunk, I plan to backport it.