From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id DF6FD3857C42; Thu,  7 Apr 2022 20:10:15 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DF6FD3857C42
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/99479] [modules] ICE Aborted signal terminated program
 cc1plus
Date: Thu, 07 Apr 2022 20:10:15 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 11.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-99479-4-mY43RhxLc2@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-99479-4@http.gcc.gnu.org/bugzilla/>
References: <bug-99479-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Apr 2022 20:10:16 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D99479

--- Comment #22 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:7e7a96f774ed892e5cef53fcb68297cd0d513820

commit r12-8051-g7e7a96f774ed892e5cef53fcb68297cd0d513820
Author: Patrick Palka <ppalka@redhat.com>
Date:   Thu Apr 7 16:09:52 2022 -0400

    c++: use after free during name lookup w/ modules [PR99479]

    name_lookup::search_unqualified uses a statically allocated vector
    in order to avoid repeated reallocation, under the assumption that
    the function can't be called recursively.  With modules however,
    this assumption turns out to be false, and search_unqualified can
    be called recursively as demonstrated by the testcase in comment #19
    of PR99479[1] where the recursive call causes the vector to get
    reallocated which invalidates the reference to queue[ix] held by the
    parent call.

    This patch makes search_unqualified instead use an auto_vec with 16
    elements of internal storage.  In turn we can simplify the API of some
    member functions to take the vector by reference and return void.

    [1]: https://gcc.gnu.org/PR99479#c19

            PR c++/99479

    gcc/cp/ChangeLog:

            * name-lookup.cc (name_lookup::using_queue): Change to an
            auto_vec (with 16 elements of internal storage).
            (name_lookup::queue_namespace): Change return type to void,
            take queue parameter by reference and adjust function body
            accordingly.
            (name_lookup::do_queue_usings): Inline into ...
            (name_lookup::queue_usings): ... here.  As in queue_namespace.
            (name_lookup::search_unqualified): Don't make queue static,
            remove length variable, and adjust function body accordingly.=