Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rustc_codegen_ssa: fix range check in codegen_get_discr. #62584

Merged
merged 2 commits into from
Jul 14, 2019

Conversation

eddyb
Copy link
Member

@eddyb eddyb commented Jul 11, 2019

Fixes #61696, see #61696 (comment) for more details.

In short, I had wanted to use x - a <= b - a to check whether x is in a..=b (as it's 1 comparison instead of 2 and b - a is guaranteed to fit in the same data type, while b itself might not), but I ended up with x - a + c <= b - a + c instead, because x - a + c was the final value needed.

That latter comparison is equivalent to checking that x is in (a - c)..=b, i.e. it also includes (a - c)..a, not just a..=b, so if c is not 0, it will cause false positives.

This presented itself as the non-niche ("dataful") variant sometimes being treated like a niche variant, in the presence of uninhabited variants (which made c, aka the index of the first niche variant, arbitrarily large).

r? @nagisa, @rkruppe or @oli-obk

@rust-highfive rust-highfive added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Jul 11, 2019
@pnkfelix
Copy link
Member

This looks good, r=me once the test has been added (for the case where the niche would not be able to represent the uninhabited variants if they were actually assigned distinct discriminant values).

bx.cx().const_uint_big(niche_llty, niche_start)
bx.cx().const_uint(niche_llty, relative_max as u64)
};
bx.icmp(IntPredicate::IntULE, relative_discr, relative_max)
Copy link
Member

@nagisa nagisa Jul 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If relative_discr is re-projected to 0..=n, doesn’t this actually compute is_proper_variant rather than is_niche (the variable name this gets assigned to)? That is, I would expect any niche discriminant to be in n+1..niche_llty::max_value() and this appears to check 0..=n <= n.

This appears to be reinforced by the bx.select below, which selects niche_discr when is_niche == 0.

Copy link
Member Author

@eddyb eddyb Jul 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

select(c, a, b) is c ? a : b I'm pretty sure.

In 0..=n, n is the number of niche(-using) variants, i.e. relative_discr == 0 is the first niche-using variant, and it goes up from there.

Copy link
Contributor

@Centril Centril left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits (typos)

src/test/run-pass/issues/issue-61696.rs Outdated Show resolved Hide resolved
src/test/run-pass/issues/issue-61696.rs Outdated Show resolved Hide resolved
@eddyb
Copy link
Member Author

eddyb commented Jul 12, 2019

@bors r=pnkfelix

@bors
Copy link
Contributor

bors commented Jul 12, 2019

📌 Commit c063057 has been approved by pnkfelix

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 12, 2019
@Centril
Copy link
Contributor

Centril commented Jul 13, 2019

@bors p=1 rollup=never -- I want this tested alone since it is sensitive (soundness) and I want bisection to be easier.

@bors
Copy link
Contributor

bors commented Jul 13, 2019

⌛ Testing commit c063057 with merge d32a725...

bors added a commit that referenced this pull request Jul 13, 2019
 rustc_codegen_ssa: fix range check in codegen_get_discr.

Fixes #61696, see #61696 (comment) for more details.

In short, I had wanted to use `x - a <= b - a` to check whether `x` is in `a..=b` (as it's 1 comparison instead of 2 *and* `b - a` is guaranteed to fit in the same data type, while `b` itself might not), but I ended up with `x - a + c <= b - a + c` instead, because `x - a + c` was the final value needed.

That latter comparison is equivalent to checking that `x` is in `(a - c)..=b`, i.e. it also includes `(a - c)..a`, not just `a..=b`, so if `c` is not `0`, it will cause false positives.

This presented itself as the non-niche ("dataful") variant sometimes being treated like a niche variant, in the presence of uninhabited variants (which made `c`, aka the index of the first niche variant, arbitrarily large).

r? @nagisa, @rkruppe or @oli-obk
@Mark-Simulacrum
Copy link
Member

@bors p=5

@bors
Copy link
Contributor

bors commented Jul 14, 2019

☀️ Test successful - checks-azure, checks-travis, status-appveyor
Approved by: pnkfelix
Pushing d32a725 to master...

@bors bors added the merged-by-bors This PR was explicitly merged by bors. label Jul 14, 2019
@bors bors merged commit c063057 into rust-lang:master Jul 14, 2019
@eddyb eddyb deleted the circular-math-is-hard branch July 15, 2019 12:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
merged-by-bors This PR was explicitly merged by bors. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Soundness hole in pattern matching on enums with an uninhabited variant
7 participants