Re: [Tinycc-devel] Fwd: TCC VLA bug?

[Michael Matz]

Hey,

On Sun, 5 Dec 2021, Herman ten Brugge via Tinycc-devel wrote:

> On 12/1/21 15:18, grischka wrote:
>       Got this report on private email.  Not sure what it means ...
>       ---------------------------------------------------------->>
>
>       Output of the code below if compiled with TCC is pretty messy:
>       array values are "misplaced" and overwrite each other.
>       But everything's ok if compiled with GCC.
>
>
> The patch below seems to fix it. Can I push it?
>
>     Herman
>
> diff --git a/tccgen.c b/tccgen.c
> index e0b5fd6..67e205b 100644
> --- a/tccgen.c
> +++ b/tccgen.c
> @@ -3494,7 +3494,7 @@ redo:
>                 gen_cast_s(VT_INT);
> #endif
>             type1 = vtop[-1].type;
> -            if (vtop[-1].type.t & VT_VLA)
> +            if (vtop[-1].type.ref->type.t & VT_VLA)
>                 vla_runtime_pointed_size(&vtop[-1].type);

Hmm, that would mean the VT_VLA flags are wrongly set.  The invariant of 
vla_runtime_pointed_size(type...) is that type->t has VT_VLA (and that 
type->ref is meaningful).  If your patch helps in this situation that 
means the flag setting is going wrong somewhere.  I see that the testcase 
has doubly-vla types, maybe only the innermost level is marked, but a 
variable length type is of course variably length if any of the referred 
types is, so maybe that's the problem.  Just speculation, though.

So, the problematic type was:

  int (*)[a][b]

That's pointer to an vla-array of an vla-array of int.  All three (inner 
array, outer array and pointer, but not the int) should be marked VT_VLA. 
In TCC we collapse the outer array+pointer into one type (a pointer that 
also has VT_ARRAY/VT_VLA set), so there actually should be two levels: the 
inner level a VT_VLA pointing to the VT_INT (with its VLA runtime length 
being evaluated to sizeof(int) * b) and the outer level a VT_VLA pointing 
to the inner VT_VLA (and its VLA runtime length being evaluated to inner 
length * a).

I'm surprised that your patch didn't cause other problems, it seems 
either the testsuite isn't testing VLAs very much, or that the VT_VLA 
flag is set on types where it shouldn't have been (e.g. on the VT_INT type 
that is in the type->ref of the 'int [n]' array type).


Ciao,
Michael.