https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88261

Bernd Edlinger <bernd.edlinger at hotmail dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bernd.edlinger at hotmail dot 
de

--- Comment #8 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
Interesting: above patch adds an error in 
gcc/testsuite/g++.dg/warn/Wplacement-new-size-1.C

where this is no ICE but only wrong code (I modified the test case
a bit to demonstrate the Problem):

$ cat Wplacement-new-size-1.C
// PR c++/69662 - -Wplacement-new on allocated one element array members
// Exercising the more permissive -Wplacement-new=1.  The difference
// between -Wplacement-new=1 is denoted by "no warning at level 1" in
// the comments below.
// { dg-do compile }
// { dg-options "-Wno-pedantic -Wplacement-new=1" }

typedef __typeof__ (sizeof 0) size_t;

void* operator new (size_t, void *p) { return p; }
void* operator new[] (size_t, void *p) { return p; }

struct Ax { char n, a []; };

typedef __INT16_TYPE__ Int16;

char xx[3];
void fAx2 ()
{
  Ax ax2 = { 1, { 2, 3 } };

  new (ax2.a) Int16(123);
  __builtin_memcpy(xx, &ax2, 3);
}

int main()
{
  fAx2 ();
}

$ g++ -O2 Wplacement-new-size-1.C
$ ./a.out
Segmentation fault (core dumped)
$ g++ -S -O2 Wplacement-new-size-1.C
$ cat  Wplacement-new-size-1.s
        .file   "Wplacement-new-size-1.C"
        .text
        .p2align 4
        .globl  _ZnwmPv
        .type   _ZnwmPv, @function
_ZnwmPv:
.LFB0:
        .cfi_startproc
        movq    %rsi, %rax
        ret
        .cfi_endproc
.LFE0:
        .size   _ZnwmPv, .-_ZnwmPv
        .p2align 4
        .globl  _ZnamPv
        .type   _ZnamPv, @function
_ZnamPv:
.LFB5:
        .cfi_startproc
        movq    %rsi, %rax
        ret
        .cfi_endproc
.LFE5:
        .size   _ZnamPv, .-_ZnamPv
        .section        .rodata
.LC0:
        .byte   1
        .byte   2
        .byte   3
        .text
        .p2align 4
        .globl  _Z4fAx2v
        .type   _Z4fAx2v, @function
_Z4fAx2v:
.LFB2:
        .cfi_startproc
        movzbl  .LC0(%rip), %eax
        movb    %al, -1(%rsp)
        movl    $123, %eax
        movw    %ax, (%rsp)
        movzwl  -1(%rsp), %eax
        movw    %ax, xx(%rip)
        movzbl  1(%rsp), %eax
        movb    %al, xx+2(%rip)
        ret
        .cfi_endproc
.LFE2:
        .size   _Z4fAx2v, .-_Z4fAx2v
        .section        .text.startup,"ax",@progbits
        .p2align 4
        .globl  main
        .type   main, @function
main:
.LFB3:
        .cfi_startproc
        movzbl  .LC0(%rip), %eax
        movb    %al, -1(%rsp)
        movl    $123, %eax
        movw    %ax, (%rsp)
        movzwl  -1(%rsp), %eax
        movw    %ax, xx(%rip)
        movzbl  1(%rsp), %eax
        movb    %al, xx+2(%rip)
        xorl    %eax, %eax
        ret
        .cfi_endproc
.LFE3:
        .size   main, .-main
        .globl  xx
        .bss
        .type   xx, @object
        .size   xx, 3
xx:
        .zero   3
        .ident  "GCC: (GNU) 9.0.0 20181209 (experimental)"
        .section        .note.GNU-stack,"",@progbits



So Ax2 has actually only 1 Byte space on the stack,
and "new (ax2.a) Int16(123);"
overwrites the return stack

Reply via email to