* [PATCH] c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379]
@ 2022-10-27 8:17 Jakub Jelinek
2022-10-27 10:21 ` Nathan Sidwell
0 siblings, 1 reply; 2+ messages in thread
From: Jakub Jelinek @ 2022-10-27 8:17 UTC (permalink / raw)
To: Nathan Sidwell, Jason Merrill; +Cc: gcc-patches
Hi!
As mentioned in the PR, apparently my r13-2887 P1467R9 changes
regressed these tests on powerpc64le-linux with IEEE quad by default.
I believe my changes just uncovered a latent bug.
The problem is that push_namespace calls find_namespace_slot,
which does:
tree *slot = DECL_NAMESPACE_BINDINGS (ns)
->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
create_p ? INSERT : NO_INSERT);
In the <identifier_node 0x7fffe9f55ac0 details> ns case, slot is non-NULL
above with a binding_vector in it.
Then pushdecl is called and this does:
slot = find_namespace_slot (ns, name, ns == current_namespace);
where ns == current_namespace (ns is :: and name is details) is true.
So this again calls
tree *slot = DECL_NAMESPACE_BINDINGS (ns)
->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
create_p ? INSERT : NO_INSERT);
but this time with create_p and so INSERT.
At this point we reach
if (insert == INSERT && m_size * 3 <= m_n_elements * 4)
expand ();
and when we are unlucky and the occupancy of the hash table just reached 3/4,
expand () is called and the hash table is reallocated. But when that happens,
it means the slot pointer in the pushdecl caller (push_namespace) points to
freed memory and so any accesses to it in make_namespace_finish will be UB.
The following patch fixes it by calling find_namespace_slot again even if it
was non-NULL, just doesn't assert it is *slot == ns in that case (because
it often is not).
Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?
2022-10-27 Jakub Jelinek <jakub@redhat.com>
PR c++/107379
* name-lookup.cc (push_namespace): Call find_namespace_slot again
after pushdecl as the hash table might be expanded during pushdecl.
--- gcc/cp/name-lookup.cc.jj 2022-10-12 17:51:00.912944731 +0200
+++ gcc/cp/name-lookup.cc 2022-10-26 12:06:38.177590655 +0200
@@ -8596,6 +8596,13 @@ push_namespace (tree name, bool make_inl
/* This should find the slot created by pushdecl. */
gcc_checking_assert (slot && *slot == ns);
}
+ else
+ {
+ /* pushdecl could have expanded the hash table, so
+ slot might be invalid. */
+ slot = find_namespace_slot (current_namespace, name);
+ gcc_checking_assert (slot);
+ }
make_namespace_finish (ns, slot);
/* Add the anon using-directive here, we don't do it in
Jakub
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379]
2022-10-27 8:17 [PATCH] c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379] Jakub Jelinek
@ 2022-10-27 10:21 ` Nathan Sidwell
0 siblings, 0 replies; 2+ messages in thread
From: Nathan Sidwell @ 2022-10-27 10:21 UTC (permalink / raw)
To: Jakub Jelinek, Jason Merrill; +Cc: gcc-patches
On 10/27/22 04:17, Jakub Jelinek wrote:
> Hi!
>
> As mentioned in the PR, apparently my r13-2887 P1467R9 changes
> regressed these tests on powerpc64le-linux with IEEE quad by default.
>
> I believe my changes just uncovered a latent bug.
> The problem is that push_namespace calls find_namespace_slot,
> which does:
> tree *slot = DECL_NAMESPACE_BINDINGS (ns)
> ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
> create_p ? INSERT : NO_INSERT);
> In the <identifier_node 0x7fffe9f55ac0 details> ns case, slot is non-NULL
> above with a binding_vector in it.
> Then pushdecl is called and this does:
> slot = find_namespace_slot (ns, name, ns == current_namespace);
> where ns == current_namespace (ns is :: and name is details) is true.
> So this again calls
> tree *slot = DECL_NAMESPACE_BINDINGS (ns)
> ->find_slot_with_hash (name, name ? IDENTIFIER_HASH_VALUE (name) : 0,
> create_p ? INSERT : NO_INSERT);
> but this time with create_p and so INSERT.
> At this point we reach
> if (insert == INSERT && m_size * 3 <= m_n_elements * 4)
> expand ();
> and when we are unlucky and the occupancy of the hash table just reached 3/4,
> expand () is called and the hash table is reallocated. But when that happens,
> it means the slot pointer in the pushdecl caller (push_namespace) points to
> freed memory and so any accesses to it in make_namespace_finish will be UB.
that's unfortunate, oh well.
> The following patch fixes it by calling find_namespace_slot again even if it
> was non-NULL, just doesn't assert it is *slot == ns in that case (because
> it often is not).
>
> Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?
ok. thanks
nathan
--
Nathan Sidwell
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-27 10:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-27 8:17 [PATCH] c++: Fix ICE on g++.dg/modules/adl-3_c.C [PR107379] Jakub Jelinek
2022-10-27 10:21 ` Nathan Sidwell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).