Hi Jonathan,
Thanks for fixing the tests and the guidance regarding the patch! I rebased the
patch on top of that commit (b6b66006787b0991e94f15c7b5c56403f1eb85fb) and
fixed all issues (I believe) which you pointed out. I also added the original
reproducer to the test case as you suggested.
I configured as before with
../configure -prefix=/usr --enable-languages=c,c++ --enable-multiarch
--host=x86_64-linux-gnu --build=x86_64-linux-gnu --target=x86_64-linux-gnu
--enable-cxx-flags=-fno-rtti
and an additional configuration with -frtti instead to check nothing else
breaks.
Now the test results look much clearer:
Without RTTI before applying patch:
=== libstdc++ Summary ===
# of expected passes 14560
# of unexpected failures 5
# of expected failures 95
# of unsupported tests 702
Without RTTI after applying patch:
=== libstdc++ Summary ===
# of expected passes 14562
# of unexpected failures 5
# of expected failures 95
# of unsupported tests 702
With RTTI before applying patch:
=== libstdc++ Summary ===
# of expected passes 14598
# of unexpected failures 2
# of expected failures 95
# of unsupported tests 683
With RTTI after applying patch:
=== libstdc++ Summary ===
# of expected passes 14600
# of unexpected failures 2
# of expected failures 95
# of unsupported tests 683
That looks logical to me.
I think ideally a test for the pointer-to-member case should also be added...
From c9271f834d6e01cc269412a02cdb0d9d26dcdb1c Mon Sep 17 00:00:00 2001
From: Jakob Hasse <0xja...@users.noreply.github.com>
Date: Tue, 26 Apr 2022 12:03:47 +0800
Subject: [PATCH] [PATCH] libstdc++: fix pointer type exception catch (no RTTI)
[PR105387]
PR libstdc++/105387
__pbase_type_info::__do_catch(), used to catch pointer type exceptions,
did not check if the type info object to compare against is a pointer
type info object before doing a static down-cast to a pointer type info
object. If RTTI is disabled, this leads to the following situation:
Since a pointer type info object has additional fields, they would
end up being undefined if the actual type info object was not a pointer
type info object.
A simple check has been added before the down-cast happens.
Note that a consequence of this check is that exceptions of type
pointer-to-member cannot be caught anymore.
In case RTTI is enabled, this does not seem to be a problem because
RTTI-based checks would run before and prevent running into the bad
down-cast. Hence, the fix is disabled if RTTI is enabled and exceptions
of type pointer-to-member can still be caught.
libstdc++-v3/ChangeLog:
* libsupc++/pbase_type_info.cc (__do_catch):
* testsuite/18_support/105387.cc: New test.
Signed-off-by: Jakob Hasse <jakob.ha...@espressif.com>
---
libstdc++-v3/libsupc++/pbase_type_info.cc | 7 ++-
libstdc++-v3/testsuite/18_support/105387.cc | 61 +++++++++++++++++++++
2 files changed, 67 insertions(+), 1 deletion(-)
create mode 100644 libstdc++-v3/testsuite/18_support/105387.cc
diff --git a/libstdc++-v3/libsupc++/pbase_type_info.cc b/libstdc++-v3/libsupc++/pbase_type_info.cc
index 7e5720b84a3..934e049a4e0 100644
--- a/libstdc++-v3/libsupc++/pbase_type_info.cc
+++ b/libstdc++-v3/libsupc++/pbase_type_info.cc
@@ -74,7 +74,12 @@ __do_catch (const type_info *thr_type,
// Therefore there must at least be a qualification conversion involved
// But for that to be valid, our outer pointers must be const qualified.
return false;
-
+
+#if !__cpp_rtti
+ if (!thr_type->__is_pointer_p ())
+ return false;
+#endif
+
const __pbase_type_info *thrown_type =
static_cast <const __pbase_type_info *> (thr_type);
diff --git a/libstdc++-v3/testsuite/18_support/105387.cc b/libstdc++-v3/testsuite/18_support/105387.cc
new file mode 100644
index 00000000000..5cec222c334
--- /dev/null
+++ b/libstdc++-v3/testsuite/18_support/105387.cc
@@ -0,0 +1,61 @@
+#include <stdexcept>
+#include <cxxabi.h>
+#include <testsuite_hooks.h>
+
+// Test cases for PR libstdc++/105387
+
+// This test is to trigger undefined behavior if the bug 105387 is present
+// in the code. Note, however, given that the bug is present, this test runs
+// into undefined behavior which can also mean that it passes.
+// It has been observed to fail quite reliably on x86_64-linux-gnu but only
+// fail sporadically on Xtensa, depending on the code placement.
+void portable_test()
+{
+ bool exception_thrown = false;
+ try {
+ throw std::runtime_error("test");
+ } catch (const char *e) {
+ VERIFY(false);
+ } catch (const std::exception &e) {
+ exception_thrown = true;
+ }
+ VERIFY(exception_thrown);
+}
+
+// This test relies on the types defined in the files typeinfo and cxxabi.h
+// It is therefore less portable then the test case above but should be
+// guaranteed to fail if the implementation has the bug 105387.
+//
+// This test case checks that __pbase_type_info::__do_catch() behaves
+// correctly when called with a non-pointer type info object as argument.
+// In particular, __pbase_type_info::__do_catch() should not cast
+// the given type object into a pointer type and try to access the
+// extended fields.
+
+void non_portable_test()
+{
+ // Create a zero-initialized buffer for allocation of the type object
+ unsigned char buffer [sizeof(__cxxabiv1::__fundamental_type_info) * 2] = {};
+
+ // Use placement-new to create the fundamental type info object in the
+ // first half of the buffer. Whenever that type info object will be
+ // casted to a pointer type info object, the extended fields of the
+ // pointer type info object will be in the second half of the buffer
+ // and hence be guaranteed zero.
+ __cxxabiv1::__fundamental_type_info *p_fund_info =
+ new(buffer) __cxxabiv1::__fundamental_type_info("fund_type");
+
+ __cxxabiv1::__pointer_type_info ptr_info("ptr_type", 0, p_fund_info);
+
+ // __do_catch is declared protected in __pointer_type_info, but public in
+ // type_info, so we upcast it here
+ std::type_info *abstract_ptr_info = static_cast<std::type_info*>(&ptr_info);
+ VERIFY(abstract_ptr_info->__do_catch(p_fund_info, nullptr, 1) == false);
+}
+
+int main()
+{
+ portable_test();
+ non_portable_test();
+ return 0;
+}
--
2.25.1
