Constant evaluation of GNU vector objects [GH #224]

src/interpret.c

@@ -4439,6 +4439,23 @@ given number of bytes.
   (((n_bytes)+CHAR_BIT-1)/CHAR_BIT)
 
 
+static EXPAND a_boolean has_tracked_subobjects(a_type_ptr tp)
+/*
+Return TRUE if type tp has subobjects whose initialization is tracked
+individually (i.e., if a complete object of that type needs an initialization
+bitmap in its prefix).
+*/
+{
+  a_boolean  result = is_immediate_class_type(tp) || type_is(tp, tk_array);
+#if GNU_VECTOR_TYPES_ALLOWED
+  if (type_is(tp, tk_vector)) {
+    result = TRUE;
+  }  /* if */
+#endif /* GNU_VECTOR_TYPES_ALLOWED */
+  return result;
+}  /* has_tracked_subobjects */
+
+
 /*
 Given a type utp and the size n_bytes required to represent its value, compute
 the number of bytes needed as a bookkeeping prefix for a complete object of
@@ -4447,8 +4464,7 @@ that type.
 #define compute_prefix_size_for_type(utp, n_bytes, prefix_size)              \
 {                                                                            \
   a_byte_count  bitmap_size;                                                 \
-  if (is_immediate_class_type(utp) ||                                        \
-      utp->kind == (a_type_kind)tk_array) {                                  \
+  if (has_tracked_subobjects(utp)) {                                         \
     bitmap_size = compute_bitmap_size(n_bytes);                              \
   } else {                                                                   \
     bitmap_size = 0;                                                         \
@@ -4617,11 +4633,11 @@ static void mark_whole_subobject_initialized(
                                           a_byte                *complete_obj)
 /*
 If tp is a scalar type, this routine does the same work as
-mark_subobject_initialized.  If tp is a class or array type, it marks the
-indicated subobject and all its subobject as initialized.
+mark_subobject_initialized.  If tp is a class, array, or vector type, it marks
+the indicated subobject and all its subobjects as initialized.
 */
 {
-  if (is_immediate_class_type(tp) || tp->kind == (a_type_kind)tk_array) {
+  if (has_tracked_subobjects(tp)) {
     a_boolean     result = TRUE;
     a_byte_count  n_bytes = value_bytes_for_type(ips, tp, &result);
     a_byte_count  off = (a_byte_count)(subobj - complete_obj);
@@ -4668,15 +4684,15 @@ static a_boolean mark_whole_subobject_uninitialized(
                                           a_byte                *complete_obj)
 /*
 If tp is a scalar type, this routine does the same work as
-mark_subobject_uninitialized.  If tp is a class or array type, it marks the
-indicated subobject and all its subobjects as uninitialized.  Return TRUE if
-successful, FALSE if not (e.g., if the subobject type included a member with
-an error type).
+mark_subobject_uninitialized.  If tp is a class, array, or vector type, it
+marks the indicated subobject and all its subobjects as uninitialized.  Return
+TRUE if successful, FALSE if not (e.g., if the subobject type included a member
+with an error type).
 */
 {
   a_boolean  result = TRUE;
 
-  if (is_immediate_class_type(tp) || tp->kind == (a_type_kind)tk_array) {
+  if (has_tracked_subobjects(tp)) {
     a_byte_count  n_bytes = value_bytes_for_type(ips, tp, &result);
     if (result) {
       a_byte_count  off = (a_byte_count)(subobj - complete_obj);
@@ -7580,14 +7596,16 @@ END_DISABLE_GCC_WARNING_STR_OVERFLOW
           for (k = 0; k<n_elems; k += 1) {
             if (elem_con == NULL) {
               /* Not all elements are covered.  Zero the remainder. */
-              memzero(elem_addr.address, size_t_arg((n_elems-k)*elem_size));
-              break;
-            }  /* if */
-            if (!extract_value_from_constant(ips, elem_con, elem_addr)) {
-              do_constexpr_fail(result);
-              break;
+              init_subobject_to_zero(ips, elem_addr.address, etp,
+                                     complete_object);
+            } else {
+              if (!extract_value_from_constant(ips, elem_con, elem_addr)) {
+                do_constexpr_fail(result);
+                break;
+              }  /* if */
+              elem_con = elem_con->next;
+              mark_subobject_initialized(elem_addr.address, complete_object);
             }  /* if */
-            elem_con = elem_con->next;
             elem_addr.address += elem_size;
           }  /* for */
 #endif /* GNU_VECTOR_TYPES_ALLOWED */

src/pending_changes/gh-224-constexpr-vector-init-bitmap.txt

@@ -0,0 +1,22 @@
+[GH #224]
+Constant evaluation of GNU vector objects
+
+The constexpr interpreter tracks the initialization of each element of a GNU
+vector, but did not reserve space for that bookkeeping in complete objects of
+vector type.  Evaluating such an object (e.g., zero-initializing a 64-byte
+vector) could therefore corrupt memory and crash the front end.  In addition,
+initializing (by assignment or as part of aggregate initialization) or
+destroying a whole vector subobject only updated the state of its first
+element, so that reading another element could give a spurious "access to
+uninitialized object" error (or fail to diagnose an access after
+destruction).  For example, with --g++ --c++20:
+
+  typedef char V64 __attribute__((vector_size(64)));
+  typedef int V4 __attribute__((vector_size(16)));
+  int main() {
+    V64 a = V64();  // Could previously crash.
+    return (int)a[0];
+  }
+  struct T { V4 v; };
+  constexpr int f() { T t; t.v = V4{1, 2, 3, 4}; return t.v[3]; }
+  static_assert(f() == 4, "");  // Previously a spurious error.

tests/tests/regressions/.gh-224-diag.rto/default.1.1.txt

@@ -0,0 +1,23 @@
+fe_only -DTEST_NUMBER=1 --c++20 --g++ --gnu_version=150200 Test_name.c
+"Test_name.c", line 12: error: expression must have a constant value
+  static_assert(d1() == 4, "");  // Error.
+                ^
+"Test_name.c", line 11: note: access to uninitialized object
+  constexpr int d1() { vi4 a = {1, 2, 3, 4}; a.~vi4(); return a[3]; }
+                                                               ^
+
+"Test_name.c", line 15: error: expression must have a constant value
+  static_assert(d2() == 0, "");  // Error.
+                ^
+"Test_name.c", line 14: note: access to uninitialized object
+  constexpr int d2() { vl8 a = vl8(); a.~vl8(); return (int)a[7]; }
+                                                             ^
+
+"Test_name.c", line 19: error: expression must have a constant value
+  static_assert(d3() == 0, "");  // Error.
+                ^
+"Test_name.c", line 18: note: access to uninitialized object
+  constexpr int d3() { S s{}; s.v.~vl8(); return (int)s.v[7]; }
+                                                         ^
+
+3 errors detected in the compilation of "Test_name.c".

tests/tests/regressions/.gh-224-diag.rto/default.2.1.txt

@@ -0,0 +1,23 @@
+fe_only -DTEST_NUMBER=2 --c++20 --clang --clang_version=220100 Test_name.c
+"Test_name.c", line 12: error: expression must have a constant value
+  static_assert(d1() == 4, "");  // Error.
+                ^
+"Test_name.c", line 11: note: access to uninitialized object
+  constexpr int d1() { vi4 a = {1, 2, 3, 4}; a.~vi4(); return a[3]; }
+                                                               ^
+
+"Test_name.c", line 15: error: expression must have a constant value
+  static_assert(d2() == 0, "");  // Error.
+                ^
+"Test_name.c", line 14: note: access to uninitialized object
+  constexpr int d2() { vl8 a = vl8(); a.~vl8(); return (int)a[7]; }
+                                                             ^
+
+"Test_name.c", line 19: error: expression must have a constant value
+  static_assert(d3() == 0, "");  // Error.
+                ^
+"Test_name.c", line 18: note: access to uninitialized object
+  constexpr int d3() { S s{}; s.v.~vl8(); return (int)s.v[7]; }
+                                                         ^
+
+3 errors detected in the compilation of "Test_name.c".

tests/tests/regressions/.gh-224.rto/default.1.1.txt

@@ -0,0 +1 @@
+fe_only -DTEST_NUMBER=1 --c++20 --g++ --gnu_version=150200 Test_name.c

tests/tests/regressions/.gh-224.rto/default.2.1.txt

@@ -0,0 +1 @@
+fe_only -DTEST_NUMBER=2 --c++20 --clang --clang_version=220100 Test_name.c

tests/tests/regressions/gh-224-diag.sft.cpp

@@ -0,0 +1,19 @@
+//type:fn
+//options:--c++20 --g++ --gnu_version=150200:--c++20 --clang --clang_version=220100
+//remark:Reading an element of a destroyed GNU vector is not constant.
+
+// Destroying a vector subobject used to mark only its first element as
+// uninitialized, so reading a later element was accepted (d3).
+
+typedef int vi4 __attribute__((vector_size(16)));
+typedef long long vl8 __attribute__((vector_size(64)));
+
+constexpr int d1() { vi4 a = {1, 2, 3, 4}; a.~vi4(); return a[3]; }
+static_assert(d1() == 4, "");  // Error.
+
+constexpr int d2() { vl8 a = vl8(); a.~vl8(); return (int)a[7]; }
+static_assert(d2() == 0, "");  // Error.
+
+struct S { vl8 v; };
+constexpr int d3() { S s{}; s.v.~vl8(); return (int)s.v[7]; }
+static_assert(d3() == 0, "");  // Error.

tests/tests/regressions/gh-224.sft.cpp

@@ -0,0 +1,81 @@
+//type:fp
+//options:--c++20 --g++ --gnu_version=150200:--c++20 --clang --clang_version=220100
+//remark:Constant evaluation of GNU vector objects and their elements.
+
+// The interpreter did not reserve an initialization bitmap for complete
+// objects of GNU vector type, so tracking the initialization of their elements
+// wrote past the object's bookkeeping prefix (a 64-byte vector suffices).
+// Assigning a whole vector subobject also marked only its first element as
+// initialized.
+
+typedef char vc64 __attribute__((vector_size(64)));
+typedef int vi4 __attribute__((vector_size(16)));
+typedef long long vl8 __attribute__((vector_size(64)));
+
+int main() {
+  vc64 a = vc64();
+  return (int)a[0];
+}
+
+constexpr int f1() { vc64 a = vc64(); return a[63]; }
+static_assert(f1() == 0, "");
+
+constexpr int f2() { vc64 a{}; return a[0] + a[63]; }
+static_assert(f2() == 0, "");
+
+constexpr int f3() { vl8 a = vl8(); vl8 b = a; return (int)b[7]; }
+static_assert(f3() == 0, "");
+
+constexpr int f4() {
+  vl8 a = vl8();
+  a[7] = 3;
+  vl8 b;
+  b = a;
+  return (int)b[7];
+}
+static_assert(f4() == 3, "");
+
+constexpr vc64 g5() { return vc64(); }
+constexpr int f5() { return g5()[63]; }
+static_assert(f5() == 0, "");
+
+constexpr vl8 v6 = vl8();
+static_assert(v6[7] == 0, "");
+
+struct S { vl8 v; };
+struct T { vi4 v; int i; };
+
+constexpr int f7() { S s{}; return (int)s.v[7]; }
+static_assert(f7() == 0, "");
+
+constexpr int f8() { S s; s.v = vl8(); return (int)s.v[7]; }
+static_assert(f8() == 0, "");
+
+constexpr int f9() { T t; t.v = vi4{1, 2, 3, 4}; t.i = 0; return t.v[3]; }
+static_assert(f9() == 4, "");
+
+constexpr int f10() { vi4 a[2]; a[1] = vi4{1, 2, 3, 4}; return a[1][3]; }
+static_assert(f10() == 4, "");
+
+// Aggregate initialization of a vector subobject.
+constexpr int f11() { T t{{1, 2, 3, 4}, 5}; return t.v[3]; }
+static_assert(f11() == 4, "");
+
+constexpr int f12() { T t{vi4{1, 2, 3, 4}, 5}; return t.v[3]; }
+static_assert(f12() == 4, "");
+
+constexpr int f13() {
+  constexpr vi4 w{1, 2, 3, 4};
+  T t{w, 5};
+  return t.v[3];
+}
+static_assert(f13() == 4, "");
+
+constexpr int f14() { T t{{1, 2}, 5}; return t.v[1] + t.v[3]; }
+static_assert(f14() == 2, "");
+
+constexpr T t15{{1, 2, 3, 4}, 5};
+static_assert(t15.v[3] == 4, "");
+
+constexpr int f16() { vi4 a[2] = {{1, 2, 3, 4}, {5, 6, 7, 8}}; return a[1][3]; }
+static_assert(f16() == 8, "");