* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
@ 2021-03-31 9:40 ` rguenth at gcc dot gnu.org
2021-03-31 9:46 ` jakub at gcc dot gnu.org
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-03-31 9:40 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Last reconfirmed| |2021-03-31
Status|UNCONFIRMED |NEW
--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
allocbuf(uint32_t nelems) {
return new(std::nothrow) T[static_cast<size_t>(nelems)];
}
expands to
<<cleanup_point return <retval> = TARGET_EXPR <D.7342, SAVE_EXPR <(sizetype)
nelems> <= 1152921504606846975 ? (size_t) ((SAVE_EXPR <(sizetype) nelems> + 1)
* 8) : (size_t) __cxa_throw_bad_array_new_length ()>;, TARGET_EXPR <D.7341,
MyType::operator new [] (NON_LVALUE_EXPR <D.7342>, (const struct nothrow_t &)
¬hrow)>;;, *(sizetype *) NON_LVALUE_EXPR <D.7341> = SAVE_EXPR <(sizetype)
nelems>;, try
{
...
which calls MyType::operator new[] and then stores 'nelems' at the beginning
of the allocated storage for some reason (ABI?).
That makes using new[] (std::nothrow) "unsafe" to call it seems?
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
2021-03-31 9:40 ` [Bug c++/99845] " rguenth at gcc dot gnu.org
@ 2021-03-31 9:46 ` jakub at gcc dot gnu.org
2021-03-31 9:50 ` rguenth at gcc dot gnu.org
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: jakub at gcc dot gnu.org @ 2021-03-31 9:46 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jakub at gcc dot gnu.org
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #1)
> allocbuf(uint32_t nelems) {
> return new(std::nothrow) T[static_cast<size_t>(nelems)];
> }
>
> expands to
>
> <<cleanup_point return <retval> = TARGET_EXPR <D.7342, SAVE_EXPR <(sizetype)
> nelems> <= 1152921504606846975 ? (size_t) ((SAVE_EXPR <(sizetype) nelems> +
> 1) * 8) : (size_t) __cxa_throw_bad_array_new_length ()>;, TARGET_EXPR
> <D.7341, MyType::operator new [] (NON_LVALUE_EXPR <D.7342>, (const struct
> nothrow_t &) ¬hrow)>;;, *(sizetype *) NON_LVALUE_EXPR <D.7341> =
> SAVE_EXPR <(sizetype) nelems>;, try
> {
> ...
>
> which calls MyType::operator new[] and then stores 'nelems' at the beginning
> of the allocated storage for some reason (ABI?).
Yes
https://itanium-cxx-abi.github.io/cxx-abi/abi.html#array-cookies
(not just ABI but also for the reason the ABI talks about).
>
> That makes using new[] (std::nothrow) "unsafe" to call it seems?
I guess for the nothrow versions we should wrap that nelems store into a
COND_EXPR based on whether operator new returned non-NULL.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
2021-03-31 9:40 ` [Bug c++/99845] " rguenth at gcc dot gnu.org
2021-03-31 9:46 ` jakub at gcc dot gnu.org
@ 2021-03-31 9:50 ` rguenth at gcc dot gnu.org
2021-03-31 10:47 ` redi at gcc dot gnu.org
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: rguenth at gcc dot gnu.org @ 2021-03-31 9:50 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The interesting thing is that doing
#include <new>
struct X
{
~X(){}
};
int main(int argc, char **argv)
{
X *p = new (std::nothrow) X[argc];
}
properly conditionalizes this store:
TARGET_EXPR <D.6173, operator new [] (NON_LVALUE_EXPR <D.6174>, (const struct
nothrow_t &) ¬hrow)>;;, (struct X *) D.6173 != 0B ? *(sizetype *)
NON_LVALUE_EXPR <D.6173> = SAVE_EXPR <(sizetype) argc>;, (struct X *) (D.6173 +
8); : (struct X *) D.6173;)
so something in the wrapping triggers the error.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (2 preceding siblings ...)
2021-03-31 9:50 ` rguenth at gcc dot gnu.org
@ 2021-03-31 10:47 ` redi at gcc dot gnu.org
2021-03-31 11:40 ` redi at gcc dot gnu.org
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 10:47 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://gcc.gnu.org/bugzill
| |a/show_bug.cgi?id=98798
--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Maybe related to Bug 98798 comment 4, where G++ fails to store a cookie when
required to. If not related, it's probably worth fixing them together.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (3 preceding siblings ...)
2021-03-31 10:47 ` redi at gcc dot gnu.org
@ 2021-03-31 11:40 ` redi at gcc dot gnu.org
2021-03-31 11:52 ` redi at gcc dot gnu.org
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 11:40 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Reduced:
namespace std {
using size_t = decltype(sizeof(0));
struct nothrow_t { } const nothrow = { };
}
void* operator new(std::size_t);
void* operator new[](std::size_t);
void operator delete(void*) noexcept;
void operator delete[](void*) noexcept;
void operator delete(void*, std::size_t) noexcept;
void operator delete[](void*, std::size_t) noexcept;
void* operator new(std::size_t, const std::nothrow_t&) noexcept;
void* operator new[](std::size_t, const std::nothrow_t&) noexcept;
void operator delete(void*, const std::nothrow_t&) noexcept;
void operator delete[](void*, const std::nothrow_t&) noexcept;
extern "C" int printf(const char* ...);
using std::size_t;
struct X
{
void* operator new[](size_t sz, const std::nothrow_t& nt) {
return ::operator new(sz, nt);
}
unsigned data = 0;
};
struct Y
{
static X* alloc(unsigned n) { return new(std::nothrow) X[n]; }
};
int main()
{
Y::alloc(-1u);
}
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (4 preceding siblings ...)
2021-03-31 11:40 ` redi at gcc dot gnu.org
@ 2021-03-31 11:52 ` redi at gcc dot gnu.org
2021-03-31 11:53 ` redi at gcc dot gnu.org
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 11:52 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Keith Halligan from comment #0)
> class MemAlloc {
> public:
> MemAlloc() {}
> void* operator new[](size_t sz, const std::nothrow_t& nt) {
> return ::operator new(sz, nt);
> }
Why is this function written as an overloaded operator new?
You never use it for new-expressions like `new MemAlloc[n]` so why isn't it
just a normal named member function that allocates memory?
It isn't the cause of the bug, but it is confusing to have this extra operator
new[] involved that is a red herring.
It should probably be something like:
struct MemAlloc {
static void* alloc(size_t sz) {
return ::operator new(sz, std::nothrow);
}
};
and then just call it as a normal static member function:
void* operator new[](size_t sz, const std::nothrow_t&) {
return MemAlloc::alloc(sz);
}
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (5 preceding siblings ...)
2021-03-31 11:52 ` redi at gcc dot gnu.org
@ 2021-03-31 11:53 ` redi at gcc dot gnu.org
2021-03-31 12:02 ` redi at gcc dot gnu.org
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 11:53 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |INVALID
Status|NEW |RESOLVED
--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Keith Halligan from comment #0)
> class MyType {
> public:
> void* operator new[](size_t sz, const std::nothrow_t& nt) {
Your bug is here. This need to be noexcept.
Passing std::nothrow_t doesn't tell the compiler that this is a nothrow-new,
only making it noexcept does that. So the compiler assumes this will throw on
failure, and so a non-exceptional return is always non-null.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (6 preceding siblings ...)
2021-03-31 11:53 ` redi at gcc dot gnu.org
@ 2021-03-31 12:02 ` redi at gcc dot gnu.org
2021-03-31 16:36 ` msebor at gcc dot gnu.org
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 12:02 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
--- Comment #8 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Alternatively, compile with -fcheck-new to tell the compiler that *all*
operator new overloads can return a null pointer. That means it always checks
for null, even for overloads that are declared as potentially-throwing. This is
probably not what you want to do, you probably just need to use 'noexcept' in
the right places.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (7 preceding siblings ...)
2021-03-31 12:02 ` redi at gcc dot gnu.org
@ 2021-03-31 16:36 ` msebor at gcc dot gnu.org
2021-03-31 17:23 ` redi at gcc dot gnu.org
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: msebor at gcc dot gnu.org @ 2021-03-31 16:36 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Martin Sebor <msebor at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |msebor at gcc dot gnu.org
--- Comment #9 from Martin Sebor <msebor at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #7)
> (In reply to Keith Halligan from comment #0)
> > class MyType {
> > public:
> > void* operator new[](size_t sz, const std::nothrow_t& nt) {
>
> Your bug is here. This need to be noexcept.
This seems like it might be worth warning about.
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (8 preceding siblings ...)
2021-03-31 16:36 ` msebor at gcc dot gnu.org
@ 2021-03-31 17:23 ` redi at gcc dot gnu.org
2021-04-06 7:35 ` keith.halligan at microfocus dot com
2021-04-06 11:35 ` redi at gcc dot gnu.org
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-03-31 17:23 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://gcc.gnu.org/bugzill
| |a/show_bug.cgi?id=99851
--- Comment #10 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Martin Sebor from comment #9)
> This seems like it might be worth warning about.
Requested as PR 99851
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (9 preceding siblings ...)
2021-03-31 17:23 ` redi at gcc dot gnu.org
@ 2021-04-06 7:35 ` keith.halligan at microfocus dot com
2021-04-06 11:35 ` redi at gcc dot gnu.org
11 siblings, 0 replies; 13+ messages in thread
From: keith.halligan at microfocus dot com @ 2021-04-06 7:35 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Keith Halligan <keith.halligan at microfocus dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |---
--- Comment #11 from Keith Halligan <keith.halligan at microfocus dot com> ---
I am re-opening this issue as there seems to be a bug with the 32-bit code
generation that I'm after noticing.
While adding noexcept to the "opeator new[]()" overloaded functions does stop
the crash on 64-bit, it does nothing for the 32-bit code, with the compiler
attempting to throw a std::bad_alloc.
Below is a version of Jonathan Wakeley's modified testcase that has noexcept on
the "operator new[]()".
$ cat bug99845.cpp && g++ -m32 -O1 -o bug99845 bug99845.cpp
namespace std {
using size_t = decltype(sizeof(0));
struct nothrow_t { } const nothrow = { };
}
void* operator new(std::size_t);
void* operator new[](std::size_t);
void operator delete(void*) noexcept;
void operator delete[](void*) noexcept;
void operator delete(void*, std::size_t) noexcept;
void operator delete[](void*, std::size_t) noexcept;
void* operator new(std::size_t, const std::nothrow_t&) noexcept;
void* operator new[](std::size_t, const std::nothrow_t&) noexcept;
void operator delete(void*, const std::nothrow_t&) noexcept;
void operator delete[](void*, const std::nothrow_t&) noexcept;
extern "C" int printf(const char* ...);
using std::size_t;
struct X
{
void* operator new[](size_t sz, const std::nothrow_t& nt) noexcept {
return ::operator new(sz, nt);
}
unsigned data = 0;
};
struct Y
{
static X* alloc(unsigned n) { return new(std::nothrow) X[n]; }
};
int main()
{
Y::alloc(-1u);
}
==
$ ./bug99845
terminate called after throwing an instance of 'std::bad_array_new_length'
what(): std::bad_array_new_length
Aborted (core dumped)
^ permalink raw reply [flat|nested] 13+ messages in thread* [Bug c++/99845] gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails
2021-03-31 9:00 [Bug c++/99845] New: gcc8: Overloaded operator new[](size_t, const std::nothrow_t&) is seg faulting when the allocation fails keith.halligan at microfocus dot com
` (10 preceding siblings ...)
2021-04-06 7:35 ` keith.halligan at microfocus dot com
@ 2021-04-06 11:35 ` redi at gcc dot gnu.org
11 siblings, 0 replies; 13+ messages in thread
From: redi at gcc dot gnu.org @ 2021-04-06 11:35 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99845
Jonathan Wakely <redi at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INVALID
--- Comment #12 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Keith Halligan from comment #11)
> While adding noexcept to the "opeator new[]()" overloaded functions does
> stop the crash on 64-bit, it does nothing for the 32-bit code, with the
Clearly not "does nothing" since the behaviour changes.
> compiler attempting to throw a std::bad_alloc.
No, not bad_alloc:
> terminate called after throwing an instance of 'std::bad_array_new_length'
> what(): std::bad_array_new_length
You've asked for an array of -1u objects of size 4, which is four times larger
than the entire address space on 32-bit x86. That makes the new-expression
erroneous, and what GCC does is exactly what the C++14 standard requires.
C++17 was changed by https://wg21.link/cwg1992 but GCC doesn't implement that
yet, which I've reported as Bug 99934.
^ permalink raw reply [flat|nested] 13+ messages in thread