[gcc r10-10696] c++: Fix up constexpr evaluation of new with zero sized types [PR104568]

[gcc r10-10696] c++: Fix up constexpr evaluation of new with zero sized types [PR104568]

[Jakub Jelinek]

https://gcc.gnu.org/g:d7b94c407a2720955927d501c5a67821c010aeed

commit r10-10696-gd7b94c407a2720955927d501c5a67821c010aeed
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri Mar 18 18:49:23 2022 +0100

    c++: Fix up constexpr evaluation of new with zero sized types [PR104568]
    
    The new expression constant expression evaluation right now tries to
    deduce how many elts the array it uses for the heap or heap [] vars
    should have (or how many elts should its trailing array have if it has
    cookie at the start).  As new is lowered at that point to
    (some_type *) ::operator new (size)
    or so, it computes it by subtracting cookie size if any from size, then
    divides the result by sizeof (some_type).
    This works fine for most types, except when sizeof (some_type) is 0,
    then we divide by zero; size is then equal to cookie_size (or if there
    is no cookie, to 0).
    The following patch special cases those cases so that we don't divide
    by zero and also recover the original outer_nelts from the expression
    by forcing the size not to be folded in that case but be explicit
    0 * outer_nelts or cookie_size + 0 * outer_nelts.
    
    Note, we have further issues, we accept-invalid various cases, for both
    zero sized elt_type and even non-zero sized elts, we aren't able to
    diagnose out of bounds POINTER_PLUS_EXPR like:
    constexpr bool
    foo ()
    {
      auto p = new int[2];
      auto q1 = &p[0];
      auto q2 = &p[1];
      auto q3 = &p[2];
      auto q4 = &p[3];
      delete[] p;
      return true;
    }
    constexpr bool a = foo ();
    That doesn't look like a regression so I think we should resolve that for
    GCC 13, but there are 2 problems.  Figure out why
    cxx_fold_pointer_plus_expression doesn't deal with the &heap []
    etc. cases, and for the zero sized arrays, I think we really need to preserve
    whether user wrote an array ref or pointer addition, because in the
    &p[3] case if sizeof(p[0]) == 0 we know that if it has 2 elements it is
    out of bounds, while if we see p p+ 0 the information if it was
    p + 2 or p + 3 in the source is lost.
    clang++ seems to handle it fine even in the zero sized cases or with
    new expressions.
    
    2022-03-18  Jakub Jelinek  <jakub@redhat.com>
    
            PR c++/104568
            * init.c (build_new_constexpr_heap_type): Remove FULL_SIZE
            argument and its handling, instead add ITYPE2 argument.  Only
            support COOKIE_SIZE != NULL.
            (build_new_1): If size is 0, change it to 0 * outer_nelts if
            outer_nelts is non-NULL.  Pass type rather than elt_type to
            maybe_wrap_new_for_constexpr.
            * constexpr.c (build_new_constexpr_heap_type): New function.
            (cxx_eval_constant_expression) <case CONVERT_EXPR>:
            If elt_size is zero sized type, try to recover outer_nelts from
            the size argument to operator new/new[] and pass that as
            arg_size to build_new_constexpr_heap_type.  Pass ctx,
            non_constant_p and overflow_p to that call too.
    
            * g++.dg/cpp2a/constexpr-new22.C: New test.
    
    (cherry picked from commit 0a0c2c3f06227d46b5e9542dfdd4e0fd2d67d894)

Diff:
---
 gcc/cp/constexpr.c                           | 95 +++++++++++++++++++++++++++-
 gcc/cp/init.c                                | 38 ++++-------
 gcc/testsuite/g++.dg/cpp2a/constexpr-new22.C | 42 ++++++++++++
 3 files changed, 149 insertions(+), 26 deletions(-)

diff --git a/gcc/cp/constexpr.c b/gcc/cp/constexpr.c
index 93268cab9f3..8e193edeff8 100644
--- a/gcc/cp/constexpr.c
+++ b/gcc/cp/constexpr.c
@@ -5618,6 +5618,84 @@ inline_asm_in_constexpr_error (location_t loc)
 	  "%<constexpr%> function in C++2a");
 }
 
+/* For element type ELT_TYPE, return the appropriate type of the heap object
+   containing such element(s).  COOKIE_SIZE is NULL or the size of cookie
+   in bytes.  If COOKIE_SIZE is NULL, return array type
+   ELT_TYPE[FULL_SIZE / sizeof(ELT_TYPE)], otherwise return
+   struct { size_t[COOKIE_SIZE/sizeof(size_t)]; ELT_TYPE[N]; }
+   where N is is computed such that the size of the struct fits into FULL_SIZE.
+   If ARG_SIZE is non-NULL, it is the first argument to the new operator.
+   It should be passed if ELT_TYPE is zero sized type in which case FULL_SIZE
+   will be also 0 and so it is not possible to determine the actual array
+   size.  CTX, NON_CONSTANT_P and OVERFLOW_P are used during constant
+   expression evaluation of subexpressions of ARG_SIZE.  */
+
+static tree
+build_new_constexpr_heap_type (const constexpr_ctx *ctx, tree elt_type,
+			       tree cookie_size, tree full_size, tree arg_size,
+			       bool *non_constant_p, bool *overflow_p)
+{
+  gcc_assert (cookie_size == NULL_TREE || tree_fits_uhwi_p (cookie_size));
+  gcc_assert (tree_fits_uhwi_p (full_size));
+  unsigned HOST_WIDE_INT csz = cookie_size ? tree_to_uhwi (cookie_size) : 0;
+  if (arg_size)
+    {
+      STRIP_NOPS (arg_size);
+      if (cookie_size)
+	{
+	  if (TREE_CODE (arg_size) != PLUS_EXPR)
+	    arg_size = NULL_TREE;
+	  else if (TREE_CODE (TREE_OPERAND (arg_size, 0)) == INTEGER_CST
+		   && tree_int_cst_equal (cookie_size,
+					  TREE_OPERAND (arg_size, 0)))
+	    {
+	      arg_size = TREE_OPERAND (arg_size, 1);
+	      STRIP_NOPS (arg_size);
+	    }
+	  else if (TREE_CODE (TREE_OPERAND (arg_size, 1)) == INTEGER_CST
+		   && tree_int_cst_equal (cookie_size,
+					  TREE_OPERAND (arg_size, 1)))
+	    {
+	      arg_size = TREE_OPERAND (arg_size, 0);
+	      STRIP_NOPS (arg_size);
+	    }
+	  else
+	    arg_size = NULL_TREE;
+	}
+      if (arg_size && TREE_CODE (arg_size) == MULT_EXPR)
+	{
+	  tree op0 = TREE_OPERAND (arg_size, 0);
+	  tree op1 = TREE_OPERAND (arg_size, 1);
+	  if (integer_zerop (op0))
+	    arg_size
+	      = cxx_eval_constant_expression (ctx, op1, false, non_constant_p,
+					      overflow_p);
+	  else if (integer_zerop (op1))
+	    arg_size
+	      = cxx_eval_constant_expression (ctx, op0, false, non_constant_p,
+					      overflow_p);
+	  else
+	    arg_size = NULL_TREE;
+	}
+      else
+	arg_size = NULL_TREE;
+    }
+
+  unsigned HOST_WIDE_INT fsz = tree_to_uhwi (arg_size ? arg_size : full_size);
+  if (!arg_size)
+    {
+      unsigned HOST_WIDE_INT esz = int_size_in_bytes (elt_type);
+      gcc_assert (fsz >= csz);
+      fsz -= csz;
+      if (esz)
+	fsz /= esz;
+    }
+  tree itype2 = build_index_type (size_int (fsz - 1));
+  if (!cookie_size)
+    return build_cplus_array_type (elt_type, itype2);
+  return build_new_constexpr_heap_type (elt_type, cookie_size, itype2);
+}
+
 /* Attempt to reduce the expression T to a constant value.
    On failure, issue diagnostic and return error_mark_node.  */
 /* FIXME unify with c_fully_fold */
@@ -6406,6 +6484,7 @@ cxx_eval_constant_expression (const constexpr_ctx *ctx, tree t,
 	    tree var_size = TYPE_SIZE_UNIT (TREE_TYPE (var));
 	    tree elt_type = TREE_TYPE (type);
 	    tree cookie_size = NULL_TREE;
+	    tree arg_size = NULL_TREE;
 	    if (TREE_CODE (elt_type) == RECORD_TYPE
 		&& TYPE_NAME (elt_type) == heap_identifier)
 	      {
@@ -6415,9 +6494,21 @@ cxx_eval_constant_expression (const constexpr_ctx *ctx, tree t,
 		cookie_size = TYPE_SIZE_UNIT (TREE_TYPE (fld1));
 	      }
 	    DECL_NAME (var) = heap_identifier;
+	    /* For zero sized elt_type, try to recover how many outer_nelts
+	       it should have.  */
+	    if ((cookie_size ? tree_int_cst_equal (var_size, cookie_size)
+			     : integer_zerop (var_size))
+		&& !int_size_in_bytes (elt_type)
+		&& TREE_CODE (oldop) == CALL_EXPR
+		&& call_expr_nargs (oldop) >= 1)
+	      if (tree fun = get_function_named_in_call (oldop))
+		if (cxx_replaceable_global_alloc_fn (fun)
+		    && IDENTIFIER_NEW_OP_P (DECL_NAME (fun)))
+		  arg_size = CALL_EXPR_ARG (oldop, 0);
 	    TREE_TYPE (var)
-	      = build_new_constexpr_heap_type (elt_type, cookie_size,
-					       var_size);
+	      = build_new_constexpr_heap_type (ctx, elt_type, cookie_size,
+					       var_size, arg_size,
+					       non_constant_p, overflow_p);
 	    TREE_TYPE (TREE_OPERAND (op, 0))
 	      = build_pointer_type (TREE_TYPE (var));
 	  }
diff --git a/gcc/cp/init.c b/gcc/cp/init.c
index e4a92e26e3b..0036ab60bb1 100644
--- a/gcc/cp/init.c
+++ b/gcc/cp/init.c
@@ -2875,33 +2875,17 @@ std_placement_new_fn_p (tree alloc_fn)
 }
 
 /* For element type ELT_TYPE, return the appropriate type of the heap object
-   containing such element(s).  COOKIE_SIZE is NULL or the size of cookie
-   in bytes.  FULL_SIZE is NULL if it is unknown how big the heap allocation
-   will be, otherwise size of the heap object.  If COOKIE_SIZE is NULL,
-   return array type ELT_TYPE[FULL_SIZE / sizeof(ELT_TYPE)], otherwise return
+   containing such element(s).  COOKIE_SIZE is the size of cookie in bytes.
+   Return
    struct { size_t[COOKIE_SIZE/sizeof(size_t)]; ELT_TYPE[N]; }
-   where N is nothing (flexible array member) if FULL_SIZE is NULL, otherwise
-   it is computed such that the size of the struct fits into FULL_SIZE.  */
+   where N is nothing (flexible array member) if ITYPE2 is NULL, otherwise
+   the array has ITYPE2 as its TYPE_DOMAIN.  */
 
 tree
-build_new_constexpr_heap_type (tree elt_type, tree cookie_size, tree full_size)
+build_new_constexpr_heap_type (tree elt_type, tree cookie_size, tree itype2)
 {
-  gcc_assert (cookie_size == NULL_TREE || tree_fits_uhwi_p (cookie_size));
-  gcc_assert (full_size == NULL_TREE || tree_fits_uhwi_p (full_size));
-  unsigned HOST_WIDE_INT csz = cookie_size ? tree_to_uhwi (cookie_size) : 0;
-  tree itype2 = NULL_TREE;
-  if (full_size)
-    {
-      unsigned HOST_WIDE_INT fsz = tree_to_uhwi (full_size);
-      gcc_assert (fsz >= csz);
-      fsz -= csz;
-      fsz /= int_size_in_bytes (elt_type);
-      itype2 = build_index_type (size_int (fsz - 1));
-      if (!cookie_size)
-	return build_cplus_array_type (elt_type, itype2);
-    }
-  else
-    gcc_assert (cookie_size);
+  gcc_assert (tree_fits_uhwi_p (cookie_size));
+  unsigned HOST_WIDE_INT csz = tree_to_uhwi (cookie_size);
   csz /= int_size_in_bytes (sizetype);
   tree itype1 = build_index_type (size_int (csz - 1));
   tree atype1 = build_cplus_array_type (sizetype, itype1);
@@ -3347,6 +3331,12 @@ build_new_1 (vec<tree, va_gc> **placement, tree type, tree nelts,
 	    outer_nelts_check = NULL_TREE;
 	}
 
+      /* If size is zero e.g. due to type having zero size, try to
+	 preserve outer_nelts for constant expression evaluation
+	 purposes.  */
+      if (integer_zerop (size) && outer_nelts)
+	size = build2 (MULT_EXPR, TREE_TYPE (size), size, outer_nelts);
+
       alloc_call = build_operator_new_call (fnname, placement,
 					    &size, &cookie_size,
 					    align_arg, outer_nelts_check,
@@ -3426,7 +3416,7 @@ build_new_1 (vec<tree, va_gc> **placement, tree type, tree nelts,
     CALL_FROM_NEW_OR_DELETE_P (alloc_call_expr) = 1;
 
   if (cookie_size)
-    alloc_call = maybe_wrap_new_for_constexpr (alloc_call, elt_type,
+    alloc_call = maybe_wrap_new_for_constexpr (alloc_call, type,
 					       cookie_size);
 
   /* In the simple case, we can stop now.  */
diff --git a/gcc/testsuite/g++.dg/cpp2a/constexpr-new22.C b/gcc/testsuite/g++.dg/cpp2a/constexpr-new22.C
new file mode 100644
index 00000000000..9af9c9f93ae
--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp2a/constexpr-new22.C
@@ -0,0 +1,42 @@
+// PR c++/104568
+// { dg-do compile { target c++20 } }
+// { dg-options "" }
+
+struct S { int s; constexpr S () : s (0) {} constexpr ~S () {} };
+typedef int T[0];
+typedef int U[0];
+
+constexpr bool
+foo ()
+{
+  auto p = new T[2];
+  auto q1 = &p[0];
+  auto q2 = &p[1];
+  auto q3 = &p[2];
+  delete[] p;
+  return true;
+}
+
+constexpr bool
+bar ()
+{
+  auto p = new U[2];
+  auto q1 = &p[0];
+  auto q2 = &p[1];
+  auto q3 = &p[2];
+  delete[] p;
+  return true;
+}
+
+constexpr bool
+baz ()
+{
+  auto p = new T[0];
+  auto q1 = &p[0];
+  delete[] p;
+  return true;
+}
+
+constexpr bool a = foo ();
+constexpr bool b = bar ();
+constexpr bool c = baz ();