https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88261
Bernd Edlinger <bernd.edlinger at hotmail dot de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bernd.edlinger at hotmail dot de --- Comment #8 from Bernd Edlinger <bernd.edlinger at hotmail dot de> --- Interesting: above patch adds an error in gcc/testsuite/g++.dg/warn/Wplacement-new-size-1.C where this is no ICE but only wrong code (I modified the test case a bit to demonstrate the Problem): $ cat Wplacement-new-size-1.C // PR c++/69662 - -Wplacement-new on allocated one element array members // Exercising the more permissive -Wplacement-new=1. The difference // between -Wplacement-new=1 is denoted by "no warning at level 1" in // the comments below. // { dg-do compile } // { dg-options "-Wno-pedantic -Wplacement-new=1" } typedef __typeof__ (sizeof 0) size_t; void* operator new (size_t, void *p) { return p; } void* operator new[] (size_t, void *p) { return p; } struct Ax { char n, a []; }; typedef __INT16_TYPE__ Int16; char xx[3]; void fAx2 () { Ax ax2 = { 1, { 2, 3 } }; new (ax2.a) Int16(123); __builtin_memcpy(xx, &ax2, 3); } int main() { fAx2 (); } $ g++ -O2 Wplacement-new-size-1.C $ ./a.out Segmentation fault (core dumped) $ g++ -S -O2 Wplacement-new-size-1.C $ cat Wplacement-new-size-1.s .file "Wplacement-new-size-1.C" .text .p2align 4 .globl _ZnwmPv .type _ZnwmPv, @function _ZnwmPv: .LFB0: .cfi_startproc movq %rsi, %rax ret .cfi_endproc .LFE0: .size _ZnwmPv, .-_ZnwmPv .p2align 4 .globl _ZnamPv .type _ZnamPv, @function _ZnamPv: .LFB5: .cfi_startproc movq %rsi, %rax ret .cfi_endproc .LFE5: .size _ZnamPv, .-_ZnamPv .section .rodata .LC0: .byte 1 .byte 2 .byte 3 .text .p2align 4 .globl _Z4fAx2v .type _Z4fAx2v, @function _Z4fAx2v: .LFB2: .cfi_startproc movzbl .LC0(%rip), %eax movb %al, -1(%rsp) movl $123, %eax movw %ax, (%rsp) movzwl -1(%rsp), %eax movw %ax, xx(%rip) movzbl 1(%rsp), %eax movb %al, xx+2(%rip) ret .cfi_endproc .LFE2: .size _Z4fAx2v, .-_Z4fAx2v .section .text.startup,"ax",@progbits .p2align 4 .globl main .type main, @function main: .LFB3: .cfi_startproc movzbl .LC0(%rip), %eax movb %al, -1(%rsp) movl $123, %eax movw %ax, (%rsp) movzwl -1(%rsp), %eax movw %ax, xx(%rip) movzbl 1(%rsp), %eax movb %al, xx+2(%rip) xorl %eax, %eax ret .cfi_endproc .LFE3: .size main, .-main .globl xx .bss .type xx, @object .size xx, 3 xx: .zero 3 .ident "GCC: (GNU) 9.0.0 20181209 (experimental)" .section .note.GNU-stack,"",@progbits So Ax2 has actually only 1 Byte space on the stack, and "new (ax2.a) Int16(123);" overwrites the return stack