About the "compiler bomb"

About the "compiler bomb"

[Xi Ruoyao]

Hi all,

Today we had a discussion about a "compiler bomb":

    int a[-1u] = {1};

One of my collegues suggests that the compiler should "optimize" it into
something like

    int a[-1u] = {};
    static void __init_a __attribute__((constructor)) {a[0] = 1;}

Is there some reason preventing this kind of translation?
-- 
Xi Ruoyao <xry111@mengyan1223.wang>
School of Aerospace Science and Technology, Xidian University

Re: About the "compiler bomb"

[Alexander Monakov]

On Sat, 1 Aug 2020, Xi Ruoyao via Gcc-help wrote:

> Hi all,
> 
> Today we had a discussion about a "compiler bomb":
> 
>     int a[-1u] = {1};
> 
> One of my collegues suggests that the compiler should "optimize" it into
> something like
> 
>     int a[-1u] = {};
>     static void __init_a __attribute__((constructor)) {a[0] = 1;}
> 
> Is there some reason preventing this kind of translation?

This seems to match the intended use of constructors, with the (usual) caveat
that as order of constructors is not completely specified, it's possible for
another constructor to execute earlier than __init_a, in which case it will
see a[0]==0.

Another issue arises if you consider what needs to happen if your example had
'const int' rather than 'int'. The toolchain normally wants to put global const
objects to .rodata section which later becomes part of a not writable segment.
With the constructor, it either needs to give up on runtime memory protection
and emit the array in a writable section, or arrange for special section similar
to .data.rel.ro that can be modified early on by constructors and then changed
to become read-only.

Alexander