Re: Possible GCC optimization bug
Anubis 1101 via Gcc-help <[email protected]> Thu, 12 Feb 2026 17:42:10 +0000
| Newsgroups | gmane.comp.gcc.help |
|---|---|
| Message-ID | <SgxN4IRRepkaAyAsFRpE2IcnhZkEUzJYqq6DSY8kRMF5XaTHHfdpnJihVpVlqO_zCUGUVMuTxgaS1r5E0VqXgi1vEkQ414JK_CfNEnffAVU=@pm.me> |
Forgive me, I just woke up. "available" is actually Capacity-length(), or the number of chars between the last valid string character and the capacity of the string. On Thursday, February 12th, 2026 at 10:39 AM, Anubis 1101 <[email protected]> wrote: > That's some good insight, but that's not what's happening here. > You can manually verify for yourself that the terminator does in fact exist directly after the string. > Even if it isn't guaranteed, it's not the bug here. > > "X", as you call it, is a constant named "available", initialized with the value of length(), which is basically strlen(). > It takes the length at call time, stores it, and then uses it for if-statements. Problem is, the value > appears to change. You can see this easily in the code, where it checks "available > 0", which passes, > and then prints out "available", which is 0. > > The "10 < 10" comes from the subscript operator overload, where it checks the index against the Capacity, > which is known at compile time. The "if(i < Capacity)" statement passes, and then prints out both i and Capacity, which > are both 10. > > No matter how you look at it, something is very wrong here. > > > > On Thursday, February 12th, 2026 at 10:28 AM, Arsen Arsenović <[email protected]> wrote: > > > Anubis 1101 <[email protected]> writes: > > > > > That does appear to "fix" it, but it doesn't tell me what was actually > > > wrong. It just corrects the bad addressing and additionally prints > > > out "runtime error: index 10 out of bounds for type 'char > > > [10]'"... which, yea, I know that. That's half of why I'm here. If > > > there's something specific I'm doing that's causing it, that's what > > > I'd like to know. As far as I can tell, there's no flaw in my code > > > itself. > > > > It doesn't fix it. It demonstrates why your code is incorrect (at least > > in this instance). > > > > GCC deduced that the "10 < 10" condition, as you named it, holds true, > > because GCC deduced that the former 10 comes from a variable that is > > used to access a loop of length 10. I didn't track down what variable > > this is, so let's call it X for posterity. > > > > The language rules state that, for an array access expression a[i] where > > 'a' is an array of length N, 'i' must be such that 0 <= i < N. > > > > Here, 'a' is 'data' and 'i' is X on lines 166 and 177 (fn:1). As a > > result, GCC is allowed to assume that X < N. As N here was 10, X < 10, > > leading to the 10 < 10 condition being "true". > > > > This is properly fixed by not allowing the loops in length and size > > overrun the array; something like this: > > > > while (i < Capacity && data[i] != '\0'){i++;} > > > > Indeed, this fixes the UBSan warnings (note that the capacity check must > > come first so that data[i] is not executed when i=Capacity). > > > > C and C++ are high-level programming languages. What you did here is > > assume that term immediately follows data, and data[Capacity] is the > > same as term. But, the language does not actually specify this, so you > > can't do that. The ABI does specify this. But you're writing C++ > > abstract machine code, so that doesn't matter. data[Capacity] is, in > > fact, not a valid expression. > > > > The bug here is that GCC didn't catch and report this in a warning. > > There's supposed to be a warning for this case. Not sure why it didn't > > trigger. But definitely not incorrect codegen (and I can't debug the > > warning at this exact moment, sorry). > > > > I recommend not separating 'term' out. Reserve Capacity+1, and write > > logic that ensures there's always a terminator. > > > > Have a lovely day! > > > > [fn:1] Note that X here is not the 'i' used inside those loops. It is > > whatever was downstream from the 'i' returned from those > > functions. That's why I'm giving it the name X. > > -- > > Arsen Arsenović > >