[Bug c++/109883] New: Stack Overflow in functions with types

[matt at mattborland dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109883

Bug ID: 109883
   Summary: Stack Overflow in  functions with 
types
   Product: gcc
   Version: 13.1.0
Status: UNCONFIRMED
  Severity: normal
  Priority: P3
 Component: c++
  Assignee: unassigned at gcc dot gnu.org
  Reporter: matt at mattborland dot com
  Target Milestone: ---

The two or more argument functions in  cause a stack overflow when
called with an  type and any integer type. Running with ASAN yields
"AddressSanitizer: nested bug in the same thread". I am able to reproduce this
bug on Fedora 38 with GCC 13.1.1 on x86_64, and macOS 13.3.1 with GCC 13.1.0 on
M1.

A minimal reproducer:

#include 
#include 

int main()
{
std::pow(0.5F64, 2);
}

[Bug libstdc++/109883] Stack Overflow in functions with types

[matt at mattborland dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109883

--- Comment #2 from Matt Borland  ---
(In reply to Xi Ruoyao from comment #1)
> Cannot reproduce for me.  Note that in this case GCC optimizes the entire
> function call away (see https://godbolt.org/z/968bPTvh9) even with -O0 so I
> can see no way how this will lead to a runtime error.

Here is an updated reproducer:

#include 
#include 
#include 

int main()
{
auto val = std::pow(0.5F64, 2);
std::cout << val << std::endl;
}

The failure can be seen godbolt here: https://godbolt.org/z/ej5nPn7o4. Running
this same snippet locally with ASAN yields:

AddressSanitizer:DEADLYSIGNAL
=
==110879==ERROR: AddressSanitizer: stack-overflow on address 0x7fff6e2e7ff8 (pc
0x0040126e bp 0x7fff6e2e8010 sp 0x7fff6e2e8000 T0)

#0 0x40126e in __gnu_cxx::__promote_2::__value>::__type)(0))+((__gnu_cxx::__promote_2<_Float64,
std::__is_integer<_Float64>::__value>::__type)(0))), std::__is_integer::__value>::__type)(0))+((__gnu_cxx::__promote_2<_Float64,
std::__is_integer<_Float64>::__value>::__type)(0)))>::__value>::__type
std::pow<_Float64, _Float64>(_Float64, _Float64)
(/home/mborland/Documents/boost/libs/math/test/so+0x40126e) (BuildId:
6f720390f8d2a24a6dabec3c85e9cf5bb4c192ea)

SUMMARY: AddressSanitizer: stack-overflow
(/home/mborland/Documents/boost/libs/math/test/so+0x40126e) (BuildId:
6f720390f8d2a24a6dabec3c85e9cf5bb4c192ea) in __gnu_cxx::__promote_2::__value>::__type)(0))+((__gnu_cxx::__promote_2<_Float64,
std::__is_integer<_Float64>::__value>::__type)(0))), std::__is_integer::__value>::__type)(0))+((__gnu_cxx::__promote_2<_Float64,
std::__is_integer<_Float64>::__value>::__type)(0)))>::__value>::__type
std::pow<_Float64, _Float64>(_Float64, _Float64)
==110879==ABORTING

For brevity I snipped out 245 more instances of the message next to #0.

> And GCC for aarch64-darwin target (i. e. "macOS 13.3.1 on M1") is not a part
> of this project, so are you using another fork?

It is provided by homebrew as gcc@13. For this reply I am using my Fedora 38
system with "gcc version 13.1.1 20230511 (Red Hat 13.1.1-2) (GCC)"

[Bug libstdc++/109883] Stack Overflow in functions with types and -std=c++23

[matt at mattborland dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109883

--- Comment #6 from Matt Borland  ---
(In reply to Xi Ruoyao from comment #4)
> It seems the function
> 
> __gnu_cxx::__promote_2 std::__is_integer<_Float64>::__value>::__type)(0))+((__gnu_cxx::
> __promote_2<_Float64, std::__is_integer<_Float64>::__value>::__type)(0))),
> std::__is_integer std::__is_integer<_Float64>::__value>::__type)(0))+((__gnu_cxx::
> __promote_2<_Float64,
> std::__is_integer<_Float64>::__value>::__type)(0)))>::__value>::__type
> std::pow<_Float64, _Float64>(_Float64, _Float64)
> 
> is recursing infinitely.

For Boost.Math's implementation of promote_2 we found template specializations
to be effective:
https://github.com/boostorg/math/pull/978/files#diff-2463d99030329b154489b8b34ce1068a34e736cab268c3421b058ca0e516680cR189.