[Bug libstdc++/62196] running time segment fault with valarray

[Bug libstdc++/62196] running time segment fault with valarray

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62196

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to baoshan from comment #0)
>   x[vmask] = vm6;

This program has a bug here. The statement above will assign the 6 elements of
vm6 to the elements of x selected by the mask. But the mask only has 3 true
elements. You cannot assign 6 elements from vm6 to 3 elements of x.

[Bug libstdc++/62196] running time segment fault with valarray

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62196

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:abb958ada1e4d195f31740659cd8af8bebce7bfd

commit r13-6656-gabb958ada1e4d195f31740659cd8af8bebce7bfd
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Mon Mar 6 14:41:59 2023 +0000

    libstdc++: Add assertions to std::mask_array operations [PR62196]

    Add assertions to diagnose incorrect uses of valarray masks.

    The assignment operators of std::mask_array do not have any explicit
    preconditions in the standard, but the assignment operator
    valarray<T>::operator=(const mask_array<T>&) requires the lengths to
    match, so it seems consistent to also require that when the operands are
    reversed.  In support of that interpretation, libstdc++ has undefined
    behaviour if the right-hand operand has more elements than are selected
    by the mask, and libc++ has undefined behaviour if it has fewer
    elements. Our std::mask_array stores the number of selected elements as
    _M_sz so it's easy to add an assertion that checks it.

    For the valarray::operator[] that takes a valarray<bool> mask,
    [valarray.sub] in the standard says: "In each case the selected
    element(s) shall exist." This makes it undefined to have a mask that
    refers to out-of-range elements. We can easily check this too.

    libstdc++-v3/ChangeLog:

            PR libstdc++/62196
            * include/bits/mask_array.h (mask_array): Add assertions to
            assignment operators.
            * include/std/valarray (valarray::operator[](valarray<bool>)):
            Add assertions.
            * testsuite/26_numerics/valarray/mask-1_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-2_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-3_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-4_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-5_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-6_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-7_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask-8_neg.cc: New test.
            * testsuite/26_numerics/valarray/mask.cc: New test.

[Bug libstdc++/62196] running time segment fault with valarray

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62196

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I've added some additional precondition checks to <valarray>. If you compile
the original testcase with -D_GLIBCXX_ASSERTIONS it will abort at runtime now:

$ ./a.out
abcdefghijklmnopqrstuvwxyz
/home/jwakely/gcc/13/include/c++/13.0.1/bits/mask_array.h:171: void
std::mask_array<_Tp>::operator=(const std::valarray<_Tp>&) const [with _Tp =
char]: Assertion '__v.size() == _M_sz' failed.
Aborted (core dumped)