Re: [PATCH] Fix struct expression regression

[Tom Tromey <tom@tromey.com>]

>>>>> "Tom" == Tom de Vries <tdevries@suse.de> writes:

Tom>   memmove (exp->elts + new_op_end, exp->elts + orig_op_end,
Tom>            EXP_ELEM_TO_BYTES (orig_nelts - orig_op_end));
Tom> ...
Tom> at which point I realized that in theory extra_elts could be negative,
Tom> in which case the resize might reduce the amount of memory for
Tom> exp->elts, after which memmove would read out of bounds.  Not sure if
Tom> that is realistic or not.

It seems to me that this must be a pre-existing latent bug, because the
new patch just reuses the existing rewriting logic -- it just changes it
to work in-place.

I suspect the bug can't occur in practice, because
replace_operator_with_call is only called for certain opcodes, and I
think none of these can be as long as the replacement:

    case OP_VAR_VALUE:
[...]
    case BINOP_ADD:
    case BINOP_SUB:
    case BINOP_MUL:
    case BINOP_DIV:
    case BINOP_REM:
    case BINOP_MOD:
    case BINOP_CONCAT:
    case BINOP_BITWISE_AND:
    case BINOP_BITWISE_IOR:
    case BINOP_BITWISE_XOR:
    case BINOP_EQUAL:
    case BINOP_NOTEQUAL:
    case BINOP_LESS:
    case BINOP_GTR:
    case BINOP_LEQ:
    case BINOP_GEQ:
    case BINOP_EXP:
    case UNOP_NEG:
    case UNOP_PLUS:
    case UNOP_LOGICAL_NOT:
    case UNOP_ABS:

Tom