diff --git a/src/test/run-fail/bug-2470-bounds-check-overflow-2.rs b/src/test/run-fail/bug-2470-bounds-check-overflow-2.rs new file mode 100644 index 00000000000..215fd53ce5e --- /dev/null +++ b/src/test/run-fail/bug-2470-bounds-check-overflow-2.rs @@ -0,0 +1,17 @@ +// xfail-test +// error-pattern:bounds check + +fn main() { + let x = [1u,2u,3u]; + + // This should cause a bounds-check failure, but may not if we do our + // bounds checking by comparing a scaled index value to the vector's + // length (in bytes), because the scaling of the index will cause it to + // wrap around to a small number. + + let idx = uint::max_value & !(uint::max_value >> 1u); + #error("ov2 idx = 0x%x", idx); + + // This should fail. + #error("ov2 0x%x", x[idx]); +} \ No newline at end of file diff --git a/src/test/run-fail/bug-2470-bounds-check-overflow-3.rs b/src/test/run-fail/bug-2470-bounds-check-overflow-3.rs new file mode 100644 index 00000000000..26737f8a9fa --- /dev/null +++ b/src/test/run-fail/bug-2470-bounds-check-overflow-3.rs @@ -0,0 +1,28 @@ +// xfail-test +// error-pattern:bounds check + +#[cfg(target_arch="x86")] +fn main() { + let x = [1u,2u,3u]; + + // This should cause a bounds-check failure, but may not if we do our + // bounds checking by truncating the index value to the size of the + // machine word, losing relevant bits of the index value. + + // This test is only meaningful on 32-bit hosts. + + let idx = u64::max_value & !(u64::max_value >> 1u); + #error("ov3 idx = 0x%8.8x%8.8x", + (idx >> 32) as uint, + idx as uint); + + // This should fail. + #error("ov3 0x%x", x[idx]); +} + +#[cfg(target_arch="x86_64")] +fn main() { + // This version just fails anyways, for symmetry on 64-bit hosts. + let x = [1u,2u,3u]; + #error("ov3 0x%x", x[200]); +} diff --git a/src/test/run-fail/bug-2470-bounds-check-overflow.rs b/src/test/run-fail/bug-2470-bounds-check-overflow.rs new file mode 100644 index 00000000000..84bd9ab5c76 --- /dev/null +++ b/src/test/run-fail/bug-2470-bounds-check-overflow.rs @@ -0,0 +1,24 @@ +// error-pattern:bounds check + +fn main() { + + // This should cause a bounds-check failure, but may not if we do our + // bounds checking by comparing the scaled index to the vector's + // address-bounds, since we've scaled the index to wrap around to the + // address of the 0th cell in the array (even though the index is + // huge). + + let x = [1u,2u,3u]; + vec::unpack_slice(x) {|p, _len| + let base = p as uint; // base = 0x1230 say + let idx = base / sys::size_of::(); // idx = 0x0246 say + #error("ov1 base = 0x%x", base); + #error("ov1 idx = 0x%x", idx); + #error("ov1 sizeof::() = 0x%x", sys::size_of::()); + #error("ov1 idx * sizeof::() = 0x%x", + idx * sys::size_of::()); + + // This should fail. + #error("ov1 0x%x", x[idx]); + } +} \ No newline at end of file