Bug 28573 - [4.1 Regression] incorrectly allowing non-constant expression to offsetof()
Summary: [4.1 Regression] incorrectly allowing non-constant expression to offsetof()
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: c++ (show other bugs)
Version: 4.1.1
: P2 normal
Target Milestone: 4.2.0
Assignee: Paolo Bonzini
URL: http://gcc.gnu.org/ml/gcc-patches/200...
Keywords: accepts-invalid, ice-on-invalid-code, patch
Depends on:
Blocks: 35321
  Show dependency treegraph
 
Reported: 2006-08-02 15:14 UTC by karl.corbin
Modified: 2008-07-04 15:46 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work: 3.4.0 4.2.0
Known to fail: 3.3.3 4.0.0 4.0.4 4.1.1 4.1.3
Last reconfirmed: 2006-08-07 07:38:41


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description karl.corbin 2006-08-02 15:14:27 UTC
The following code incorrectly compiles, and worse returns incorrect result.
on i686-pc-linux-gnu, both 4.1.0 and 4.1.1

-- start snip
#include <stddef.h>

// (incomplete) template class that encapsulates an array of chars
template<int i> class CharArray
{
public:
   char d[i];
   char& operator [] ( int indx )
   {
      return d[indx];
   }
};

struct Foo
{
   int i;
   CharArray<44> caCharArray;
};


int main( int argc, char* argv[] )
{
   Foo foo;
   int i;

// Shouldn't compile, and worse results in incorrect offset.
   i = offsetof(Foo, caCharArray[0]);

}

-- end snip
variables as an array index correctly give an error, but unfortunatly not everything that looks like an constant array index is.
Comment 1 Wolfgang Bangerth 2006-08-06 22:12:50 UTC
For some reason, this also passes icc. Interestingly, it isn't even the
case that offsetof manages to look through operator[] -- removing the
body of operator[] doesn't affect the result.

W.
Comment 2 Paolo Bonzini 2006-08-07 07:38:41 UTC
This gives an ICE-on-invalid.

  template<int i> struct A
  {
    char d[i];
    char &operator [] ( int indx ) { return d[indx]; }
  };

  struct B
  {
    A<44> a;
  };

  int main()
  {
    return __builtin_offsetof(B, a[0]);
  }

Here, fold_offsetof_1 does not expect a CALL_EXPR to be there and dies.

The reason for the reporter's bug is similar but we do not ICE because we have another INDIRECT_REF because of dereferencing the "char&" reference, and the tree is like

INDIRECT_REF( CALL_EXPR ( operator[], INDIRECT_REF(null), 0 ) )

fold_offsetof_1 does not expect anything inside the INDIRECT_REF, and blindly returns 0.

Testing a patch.
Comment 3 patchapp@dberlin.org 2006-08-07 11:50:20 UTC
Subject: Bug number PR28573

A patch for this bug has been added to the patch tracker.
The mailing list url for the patch is http://gcc.gnu.org/ml/gcc-patches/2006-08/msg00170.html
Comment 4 Paolo Bonzini 2006-08-17 07:03:17 UTC
Subject: Bug 28573

Author: bonzini
Date: Thu Aug 17 07:02:55 2006
New Revision: 116208

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=116208
Log:
2006-08-17  Paolo Bonzini <bonzini@gnu.org>

	PR c++/28573
	* c-common.c (fold_offsetof_1): Add an argument and recurse down to it
	or the INTEGER_CST.  Fail on a CALL_EXPR. 
	(fold_offsetof): Pass new argument to fold_offsetof_1.
	* c-parser.c (c_parser_postfix_expression): Don't include a NULL
	operand into an INDIRECT_REF. 
	* c-typeck.c (build_unary_op): Adjust call to fold_offsetof.

cp:
2006-08-17  Paolo Bonzini  <bonzini@gnu.org>

	PR c++/28573
	* semantics.c (finish_offsetof): Add new argument to fold_offsetof.

testsuite:
2006-08-17  Paolo Bonzini  <bonzini@gnu.org>

	PR c++/28573
	* g++.dg/parse/offsetof6.C: New test.
	* g++.dg/parse/offsetof7.C: New test.


Added:
    trunk/gcc/testsuite/g++.dg/parse/offsetof6.C
    trunk/gcc/testsuite/g++.dg/parse/offsetof7.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/c-common.c
    trunk/gcc/c-common.h
    trunk/gcc/c-parser.c
    trunk/gcc/c-typeck.c
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/semantics.c
    trunk/gcc/testsuite/ChangeLog

Comment 5 Gabriel Dos Reis 2007-02-03 18:42:09 UTC
won't fix in GCC-4.0.x.  Adjustine milestone.
Comment 6 Joseph S. Myers 2008-07-04 15:46:40 UTC
Closing 4.1 branch.