[Bug libstdc++/96766] New: std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[Bug libstdc++/96766] New: std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[kndevl at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

            Bug ID: 96766
           Summary: std::swap(std::variant, std::variant) triggers
                    undefined behavior sanitizer
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kndevl at outlook dot com
  Target Milestone: ---

Created attachment 49113
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49113&action=edit
preprocessed source

This snippet 

```

#include <variant>

class Foo {
};
class Bar {
};

using T = std::variant<Foo, Bar>;

int main()
{
    T t1 { Foo {} };
    T t2 { Bar {} };
    std::swap(t1, t2);
    return 0;
}

```

triggers the following warning

```

/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:444:20:
runtime error: implicit conversion from type 'std::size_t' (aka 'unsigned
long') of value 18446744073709551615 (64-bit, unsigned) to type
'std::__detail::__variant::_Variant_storage<true, Foo, Bar>::__index_type' (aka
'unsigned char') changed the value to 255 (8-bit, unsigned)
    #0 0x55c00ff464ea in std::__detail::__variant::_Variant_storage<true, Foo,
Bar>::_M_reset()
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:444
    #1 0x55c00ff476a4 in void std::__detail::__variant::_Move_ctor_base<true,
Foo, Bar>::_M_destructive_move<Bar>(unsigned short, Bar&&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:564
    #2 0x55c00ff472fb in auto std::variant<Foo, Bar>::swap(std::variant<Foo,
Bar>&)::{lambda(auto:1&&, auto:2)#1}::operator()<Bar&,
std::integral_constant<unsigned long, 1ul> >(Bar&,
std::integral_constant<unsigned long, 1ul>)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:1588
    #3 0x55c00ff4701e in void std::__invoke_impl<void, std::variant<Foo,
Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&, auto:2)#1}, Bar&,
std::integral_constant<unsigned long, 1ul> >(std::__invoke_other,
std::variant<Foo, Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&,
auto:2)#1}&&, Bar&, std::integral_constant<unsigned long, 1ul>&&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/invoke.h:60
    #4 0x55c00ff46e3f in std::__invoke_result<std::variant<Foo,
Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&, auto:2)#1}, Bar&,
std::integral_constant<unsigned long, 1ul> >::type
std::__invoke<std::variant<Foo, Bar>::swap(std::variant<Foo,
Bar>&)::{lambda(auto:1&&, auto:2)#1}, Bar&, std::integral_constant<unsigned
long, 1ul> >(std::variant<Foo, Bar>::swap(std::variant<Foo,
Bar>&)::{lambda(auto:1&&, auto:2)#1}&&, (std::__invoke_result&&)...)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/invoke.h:95
    #5 0x55c00ff458e3 in
std::__detail::__variant::__gen_vtable_impl<std::__detail::__variant::_Multi_array<std::__detail::__variant::__variant_idx_cookie
(*)(std::variant<Foo, Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&,
auto:2)#1}&&, std::variant<Foo, Bar>&)>, std::integer_sequence<unsigned long,
1ul> >::__visit_invoke(std::variant<Foo, Bar>::swap(std::variant<Foo,
Bar>&)::{lambda(auto:1&&, auto:2)#1}, std::variant<Foo, Bar>&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:1001
    #6 0x55c00ff4537c in decltype(auto)
std::__do_visit<std::__detail::__variant::__variant_idx_cookie,
std::variant<Foo, Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&,
auto:2)#1}, std::variant<Foo, Bar>&>(std::variant<Foo,
Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&, auto:2)#1}&&,
std::variant<Foo, Bar>&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:1694
    #7 0x55c00ff45188 in void
std::__detail::__variant::__raw_idx_visit<std::variant<Foo,
Bar>::swap(std::variant<Foo, Bar>&)::{lambda(auto:1&&, auto:2)#1},
std::variant<Foo, Bar>&>(std::variant<Foo, Bar>::swap(std::variant<Foo,
Bar>&)::{lambda(auto:1&&, auto:2)#1}&&, std::variant<Foo, Bar>&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:201
    #8 0x55c00ff4505a in std::variant<Foo, Bar>::swap(std::variant<Foo, Bar>&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:1570
    #9 0x55c00ff44451 in std::enable_if<(((is_move_constructible_v<Foo,
Bar>)&&...))&&(((is_swappable_v<Foo, Bar>)&&...)), void>::type std::swap<Foo,
Bar>(std::variant<Foo, Bar>&, std::variant<Foo, Bar>&)
/usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/variant:1240
    #10 0x55c00ff44278 in main ../ubsan.cpp:14
    #11 0x7f7f64b19151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
    #12 0x55c00ff4414d in _start
(/home/user/main/cmake-build-debug-clang/ubsan-test+0x514d)

```

Is this a bug in libstdc++ or clang's sanitizer?

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[kndevl at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #1 from Karthik Nishanth <kndevl at outlook dot com> ---
Reproducer

https://www.godbolt.org/z/Whz6ab

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
This is clang's stupid "unsigned overflow" sanitizer, which complains about
correct code. The conversion here is intended, and does exactly the right
thing, converting numeric_limits<size_t>::max() to numeric_limits<unsigned
char>::max().

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |redi at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-08-24
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
I'll use static_cast to suppress the bogus errors.

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:074436cf8cdd2a9ce75cadd36deb8301f00e55b9

commit r11-2822-g074436cf8cdd2a9ce75cadd36deb8301f00e55b9
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Mon Aug 24 16:10:07 2020 +0100

    libstdc++: Make variant_npos conversions explicit [PR 96766]

    libstdc++-v3/ChangeLog:

            PR libstdc++/96766
            * include/std/variant (_Variant_storage): Replace implicit
            conversions from size_t to __index_type with explicit casts.

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:4b6366f24890e25a07f9a045d15633c5b1fb80cb

commit r10-8675-g4b6366f24890e25a07f9a045d15633c5b1fb80cb
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Mon Aug 24 16:10:07 2020 +0100

    libstdc++: Make variant_npos conversions explicit [PR 96766]

    libstdc++-v3/ChangeLog:

            PR libstdc++/96766
            * include/std/variant (_Variant_storage): Replace implicit
            conversions from size_t to __index_type with explicit casts.

    (cherry picked from commit 074436cf8cdd2a9ce75cadd36deb8301f00e55b9)

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:9def04578cca8a0850e835eb095d9ff60097f691

commit r9-8832-g9def04578cca8a0850e835eb095d9ff60097f691
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Mon Aug 24 16:10:07 2020 +0100

    libstdc++: Make variant_npos conversions explicit [PR 96766]

    libstdc++-v3/ChangeLog:

            PR libstdc++/96766
            * include/std/variant (_Variant_storage): Replace implicit
            conversions from size_t to __index_type with explicit casts.

    (cherry picked from commit 074436cf8cdd2a9ce75cadd36deb8301f00e55b9)

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |9.4
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Fixed for 9.4 and 10.3, but I'm not going to bother changing it on the gcc-8
branch.

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jonathan Wakely <redi@gcc.gnu.org>:

https://gcc.gnu.org/g:20ab3972240aff596a3fa98e9fb09ddc0658fbb3

commit r13-1749-g20ab3972240aff596a3fa98e9fb09ddc0658fbb3
Author: Marco Falke <falke.marco@gmail.com>
Date:   Tue Jul 19 10:10:39 2022 +0100

    libstdc++: Make __from_chars_alnum_to_val conversion explicit

    The optimizations from commit r12-8175-ga54137c88061c7 introduced a
    clang integer sanitizer error.

    Fix this with an explicit static_cast, similar to the fix for PR 96766.

    libstdc++-v3/ChangeLog:

            * include/std/charconv (__from_chars_alnum_to_val): Replace
            implicit conversion from int to unsigned char with explicit
            cast.

[Bug libstdc++/96766] std::swap(std::variant, std::variant) triggers undefined behavior sanitizer

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96766

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:0bb30f94ace6be68bd315d03f36b24bbaec2bee7

commit r12-8591-g0bb30f94ace6be68bd315d03f36b24bbaec2bee7
Author: Marco Falke <falke.marco@gmail.com>
Date:   Tue Jul 19 10:10:39 2022 +0100

    libstdc++: Make __from_chars_alnum_to_val conversion explicit

    The optimizations from commit r12-8175-ga54137c88061c7 introduced a
    clang integer sanitizer error.

    Fix this with an explicit static_cast, similar to the fix for PR 96766.

    libstdc++-v3/ChangeLog:

            * include/std/charconv (__from_chars_alnum_to_val): Replace
            implicit conversion from int to unsigned char with explicit
            cast.

    (cherry picked from commit 20ab3972240aff596a3fa98e9fb09ddc0658fbb3)