[Bug c++/116572] New: Using a std::string passed to a virtual member function of a side-casted pointer spuriously triggers UBSan on 14.2.0, and ICEs on trunk

[Bug c++/116572] New: Using a std::string passed to a virtual member function of a side-casted pointer spuriously triggers UBSan on 14.2.0, and ICEs on trunk

[eddiejnolan at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116572

            Bug ID: 116572
           Summary: Using a std::string passed to a virtual member
                    function of a side-casted pointer spuriously triggers
                    UBSan on 14.2.0, and ICEs on trunk
           Product: gcc
           Version: 14.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: eddiejnolan at gmail dot com
  Target Milestone: ---

Given the following code, built with -std=c++20 -O3 -fsanitize=undefined:

#include <string>

int main()
{
    struct VirtualBase {
      virtual ~VirtualBase() {}
    };
    struct VirtualBase2 {
      virtual void foo(std::string s) const = 0;
    };
    struct MultiBase : VirtualBase, VirtualBase2 {
      void foo(std::string s) const override {
        (void)s.find("X");
      }
    } multibase{};
    VirtualBase* p{&multibase};
    dynamic_cast<VirtualBase2*>(p)->foo("Y");
}

GCC 14.2.0 compiles the program but produces the following UBSan report:

p\x13@:4203136: runtime error: execution reached an unreachable program point

(I'm using \x13 to substitute for an unprintable ASCII character in the
original output).

GCC trunk fails to compile entirely with the following internal compiler error:

<source>:18:1: internal compiler error: in release_body, at cgraph.cc:1865
   18 | }
      | ^
0x27ccba5 diagnostic_context::diagnostic_impl(rich_location*,
diagnostic_metadata const*, int, char const*, __va_list_tag (*) [1],
diagnostic_t)
        ???:0
0x27e0145 internal_error(char const*, ...)
        ???:0
0xa7fe58 fancy_abort(char const*, int, char const*)
        ???:0
0xeb4b4b symbol_table::finalize_compilation_unit()
        ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1

Compiler explorer link: https://godbolt.org/z/Gcc48qEMn

[Bug c++/116572] [14/15 Regression] Using a std::string passed to a virtual member function of a side-casted pointer spuriously ICEs (wrong code with checking disable)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116572

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code,
                   |                            |wrong-code
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
            Summary|Using a std::string passed  |[14/15 Regression] Using a
                   |to a virtual member         |std::string passed to a
                   |function of a side-casted   |virtual member function of
                   |pointer spuriously triggers |a side-casted pointer
                   |UBSan on 14.2.0, and ICEs   |spuriously ICEs (wrong code
                   |on trunk                    |with checking disable)
   Target Milestone|---                         |14.3
   Last reconfirmed|                            |2024-09-02

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed. The ICE happens also with -fchecking which I had expected.

I moved the classes into an anonymous namespace instead of being local to the
function and we still get the ICE:
```
#include <string>
namespace {
    struct VirtualBase {
      virtual ~VirtualBase() {}
    };
    struct VirtualBase2 {
      virtual void foo(std::string s) const = 0;
    };
    struct MultiBase : VirtualBase, VirtualBase2 {
      void foo(std::string s) const override {
        (void)s.find("X");
      }
    } multibase{};
}
int main()
{
    VirtualBase* p{&multibase};
    dynamic_cast<VirtualBase2*>(p)->foo("Y");
}
```

I have not reduced it further yet.

[Bug c++/116572] [14/15 Regression] Using a std::string passed to a virtual member function of a side-casted pointer spuriously ICEs (wrong code with checking disable)

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116572

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
                 CC|                            |mpolacek at gcc dot gnu.org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Looks like it started with r14-2152:

commit 7198573f44fb579843bff8deda695107858d8cff
Author: Jan Hubicka <jh@suse.cz>
Date:   Wed Jun 28 09:34:53 2023 +0200

    Enable ranger for ipa-prop

[Bug c++/116572] [14/15 Regression] Using a std::string passed to a virtual member function of a side-casted pointer spuriously ICEs (wrong code with checking disable)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116572

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Reduced testcase:
long v;
template <class> struct A;
template <typename C, typename = A<C>, typename = C>
class B;
template <>
struct A<char>
{
  static int foo(char *s, const char *t, long n) { return __builtin_memcmp(s,
t, n); }
};
template <typename C, typename, typename>
struct B {
  long b;
  B(const C *);
  C *bar() const;
  constexpr unsigned long baz(const C *, unsigned long, unsigned long) const
noexcept;
  void baz() { C c; baz(&c, 0, v); }
};
template <typename C, typename D, typename E>
constexpr unsigned long
B<C, D, E>::baz(const C *s, unsigned long, unsigned long n) const noexcept
{
  C *x = bar(); if (!x) return b; D::foo(x, s, n); return 0;
}
namespace {
struct F { virtual ~F() {} };
struct F2 { virtual void foo(B<char>) const; };
struct F3 : F, F2 { void foo(B<char> s) const { s.baz(); } } f;
}
int
main()
{
  F *p;
  dynamic_cast<F2 *>(p)->foo("");
}

Started with r14-2152-g7198573f44fb579843bff8deda695107858d8cff