Rust-GCC / Rust-GCC/gccrs

crash with shifts inside array length

Open
#3,962 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
2.9k
Forks
231
Avg merge
19h 55m
Merged PRs (30d)
67

Description

auto-reduced (treereduce-rust):

//@compile-flags: -frust-incomplete-and-experimental-compiler-do-not-use
static FOO2: () = {
    let x = [47; (1 << 47) - 1];
};

original:

//@ only-64bit
// on 32bit and 16bit platforms it is plausible that the maximum allocation size will succeed
// FIXME (#135952) In some cases on AArch64 Linux the diagnostic does not trigger
//@ ignore-aix
// AIX will allow the allocation to go through, and get SIGKILL when zero initializing
// on 32bit and 16bit platforms it is plausible that the maximum allocation size will succeed
//@ ignore-aix

const FOO: () = {
    let x = [0_u8; (1 << 47) - 1];
    //~^ ERROR tried to allocate more memory than available to compiler
};

static FOO2: () = {
    let x = [47; (1 << 47) - 1];
    //~^ ERROR tried to allocate more memory than available to compiler
};

fn main() {
    let x = [0_u8; (1 << 47) - 1];
    //~^ ERROR tried to allocate more memory than available to compiler
}

Version information:

5dc8c4d20d62462ebce137c6e5146235ab9e9e2e

Command:
/home/matthias/vcs/github/gccrs/gccrs-build/gcc/crab1 -frust-incomplete-and-experimental-compiler-do-not-use

Program output

terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc
crab1: internal compiler error: Aborted
0x2fecaf8 internal_error(char const*, ...)
	../../gcc/diagnostic-global-context.cc:517
0x196d57f crash_signal
	../../gcc/toplev.cc:321
0x11650a6 std::__new_allocator<unsigned long>::allocate(unsigned long, void const*)
	/usr/include/c++/15.1.1/bits/new_allocator.h:151
0x11650a6 std::allocator_traits<std::allocator<unsigned long> >::allocate(std::allocator<unsigned long>&, unsigned long)
	/usr/include/c++/15.1.1/bits/alloc_traits.h:614
0x11650a6 std::_Vector_base<unsigned long, std::allocator<unsigned long> >::_M_allocate(unsigned long)
	/usr/include/c++/15.1.1/bits/stl_vector.h:387
0x11650a6 std::vector<unsigned long, std::allocator<unsigned long> >::reserve(unsigned long)
	/usr/include/c++/15.1.1/bits/vector.tcc:79
0x11650a6 Rust::Compile::CompileExpr::array_copied_expr(unsigned long, Rust::TyTy::ArrayType const&, tree_node*, Rust::HIR::ArrayElemsCopied&)
	../../gcc/rust/backend/rust-compile-expr.cc:1997
0x116580b ???
	../../gcc/rust/backend/rust-compile-expr.h:42
0x1162c76 Rust::Compile::CompileExpr::Compile(Rust::HIR::Expr&, Rust::Compile::Context*)
	../../gcc/rust/backend/rust-compile-expr.cc:48
0x11599c6 Rust::Compile::CompileStmt::visit(Rust::HIR::LetStmt&)
	../../gcc/rust/backend/rust-compile-stmt.cc:71
0x1159b7c Rust::Compile::CompileStmt::Compile(Rust::HIR::Stmt*, Rust::Compile::Context*)
	../../gcc/rust/backend/rust-compile-stmt.cc:36
0x118a9fc Rust::Compile::HIRCompileBase::compile_function_body(tree_node*, Rust::HIR::BlockExpr&, Rust::TyTy::BaseType*)
	../../gcc/rust/backend/rust-compile-base.cc:613
0x118eb94 Rust::Compile::HIRCompileBase::compile_constant_item(unsigned int, Rust::TyTy::BaseType*, Rust::TyTy::BaseType*, Rust::Resolver::CanonicalPath const&, Rust::HIR::Expr&, unsigned long, unsigned long)
	../../gcc/rust/backend/rust-compile-base.cc:865
0x115782c Rust::Compile::CompileItem::visit(Rust::HIR::StaticItem&)
	../../gcc/rust/backend/rust-compile-item.cc:61
0xdbeeeb Rust::Compile::CompileItem::compile(Rust::HIR::Item*, Rust::Compile::Context*, Rust::TyTy::BaseType*, unsigned long)
	../../gcc/rust/backend/rust-compile-item.h:37
0xdbeeeb Rust::Compile::CompileCrate::go()
	../../gcc/rust/backend/rust-compile.cc:48
0xdbeeeb Rust::Compile::CompileCrate::Compile(Rust::HIR::Crate&, Rust::Compile::Context*)
	../../gcc/rust/backend/rust-compile.cc:41
0xdb9970 Rust::Session::compile_crate(char const*)
	../../gcc/rust/rust-session-manager.cc:732
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reduced Rust case and the backtrace entry at gcc/rust/backend/rust-compile-expr.cc:1997, in array_copied_expr. Run crab1 with the reported compile flag and confirm the bad_alloc crash. Done means the large shifted array produces the expected allocation diagnostic instead of aborting the compiler.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, rust
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.