Memory corruption in constexpr interpreter with GNU vector types

[dkolsen-pgi]

Issue Summary

When the constexpr interpreter (interpret.c) is processing objects of GNU vector types, an out-of-bounds write may result in memory corruption and unpredictable results. I have seen the symptom be a front end seg fault or a failed assertion.

When the test program below is compiled with a debug build, ASan catches the out-of-bounds write:

=================================================================
==1176646==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000f7e at pc 0x56112c15bb93 bp 0x7ffd791daa80 sp 0x7ffd791daa70
READ of size 1 at 0x619000000f7e thread T0
    #0 0x56112c15bb92 in init_subobject_to_zero /home/dolsen/work/edg/github/compiler/src/interpret.c:4756
    #1 0x56112c15af32 in init_subobject_to_zero /home/dolsen/work/edg/github/compiler/src/interpret.c:4680
    #2 0x56112c27c1cf in process_expr_work /home/dolsen/work/edg/github/compiler/src/interpret.c:32511
    #3 0x56112c165558 in process_work_item /home/dolsen/work/edg/github/compiler/src/interpret.c:6248
    #4 0x56112c165838 in run_pushed_work /home/dolsen/work/edg/github/compiler/src/interpret.c:6297
    #5 0x56112c27ed4b in do_constexpr_expr /home/dolsen/work/edg/github/compiler/src/interpret.c:32772
    #6 0x56112c16474d in do_constexpr_expression /home/dolsen/work/edg/github/compiler/src/interpret.c:5956
[... snip the rest of the report ...]

The bug is in the definition of the macro compute_prefix_size_for_type in interpret.c. Any object that contains subobjects needs to reserve space for a bitmap to keep track of which subobjects have been initialized. The problem is that GNU vector types (tk_vector) are not considered to be types with subobjects, so no space is reserved for the bitmap. But code elsewhere in the interpreter assumes that the bitmap is present, hence the memory corruption.

I plan to provide a fix for this.

Reproducing Source Code

typedef char vc64 __attribute__((vector_size(64)));
int main() {
  vc64 a = vc64();
  return (int)a[0];
}

Command-line Options

eccp --g++ vec64.cpp

Type of Issue

[Front End] I do not care but this code CRASHES the compiler.

Additional Details

Since the failure is triggered by GNU vector types, GNU extensions need to be enabled.

Reproducing (Standard) Configuration(s)

linux-gcc-debug

Reproducing (Non-standard) Configuration

No response

I acknowledge that:

• I have checked open issues and existing discussions before filing this report.
• The reproducing source code that I have provided does not depend on headers that I have not included with my submission.
• I have reduced the reproducing source code to the best of my ability.
• I have selected at least one standard configuration or uploaded a non-standard configuration dump.
• I understand code shared via this form is NOT confidential.
• I have permission to share the reproducing source code and grant permission for the project to use the source code (or derivatives of the source code) to create tests.
• I agree that any tests created using the reproducing source code (or deriatives of it) will be licensed under project license unless I included a LICENSE.txt file in my .zip or .tar.gz upload. If I included a LICENSE.txt file, any tests created using the reproducing source code will be governed by the terms of the license I provided instead.

[wchilders-nvidia]

Confirmed as #224