Re: [BUG] valarray_copy, with mask_array, libstdc++-v3

[Luke Kenneth Casson Leighton <lkcl at samba-tng dot org>]

On Fri, Jul 05, 2002 at 11:51:56AM -0400, Ben Elliston wrote:
> >>>>> "Luke" == Luke Kenneth Casson Leighton <lkcl@samba-tng.org> writes:
> 
>   Luke> a mask array is intermediately-defined as part of the j = i[b]
>   Luke> operator overload on a boolean valarray.
> 
> Let's see if we can agree on this first point: You are trying to
> assign a mask_array of dimension 2 to a valarray, j, whose dimension
> is zero because it was constructed using the default constructor.
 
 i am using the valarray and the standard template library in
 the way in which it is intended, otherwise there wouldn't _be_
 the code in the valarray library.

 let's see if i can track the code and do your job for you to see
 if your statement is correct.


> This behaviour is undefined.
 
 please try not to talk such rubbish, and actually follow the plot.

 i'll try to spell it out for you.


this is from valarray:

    valarray<_Tp>     	 operator[](const valarray<bool>&) const;
    mask_array<_Tp>     operator[](const valarray<bool>&);

this is the function i'm using, which is called by the j = i[b]
where b is a valarray of bool, i is a valarray of int/whatever.


template<typename _Tp>
inline valarray<_Tp>
valarray<_Tp>::operator[] (const valarray<bool>& __m) const
{
    size_t __s (0);
    size_t __e (__m.size ());
    for (size_t __i=0; __i<__e; ++__i)
        if (__m[__i]) ++__s;
    return valarray<_Tp> (mask_array<_Tp> (_Array<_Tp>(_M_data), __s,
                                           _Array<bool> (__m)));
}

so, in reference to "let's see if we can agree on this first point",
if you had actually looked at the code, you would see that your
point is not valid.

the number of items set to true in the bool valarray is counted.

a mask array constructor is called,  with the number of items (__s).

followed by another constructor of valarray, which copies those
items for you.

the point is that the count, __s (=2), is ignored, at the point
demonstrated by my patch, and the size of the valarray (=4) is
used instead.

however, the size of the valarray is used to re-count the number
of items to copy (valarray_copy, valarray_meta.tcc line 60),
which is where you end up with a buffer over-run.


if you can't be bothered to track this properly, instead trying
to fob me off with stupid quotes of "it's undefined behaviour",
and quotes from the c++ standards, you don't deserve to be
working for and be paid by redhat, _that's_ for sure.

cc'd to some mailing lists to hopefully get some sensible
answers.

l.