Skip to content

Add a smoke test for non-empty nullptr Span #107444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 12, 2025

Conversation

Ivorforce
Copy link
Member

@Ivorforce Ivorforce commented Jun 12, 2025

The above bug occurred because a Span was created from nullptr with a size > 0. This is incorrect, because it's promising access to a memory region that does not exist.

We can catch this, at least for the nullptr case, by adding a smoke test. This should help us catch such bugs early in the future. The above bug could only have occurred in DEBUG builds, so it would have been prevented by this test.

The test is pretty cheap, so it shouldn't create performance problems for DEBUG. I'd still hesitate to add it to RELEASE because correct code should not need it, and in hot loops, it may actually prevent vectorization. Plus, setting _len = 0 is unlikely to be the correct fix anyway (though it should be better than nothing).

Note: Unfortunately, this change requires the function to be non-constexpr, because ERR_PRINT isn't constexpr. This can be fixed in c++20 with std::is_constant_evaluated. Fortunately, we do not use this property yet, so for Godot 4.5 we can give it up. In 4.6, we're planning to upgrade to C++20, so we can re-add constexpr then.

@Ivorforce Ivorforce added this to the 4.5 milestone Jun 12, 2025
@Ivorforce Ivorforce requested a review from a team as a code owner June 12, 2025 09:51
@Ivorforce Ivorforce force-pushed the smoke-test-span branch 3 times, most recently from 08bb1b9 to 2ef2ea4 Compare June 12, 2025 09:55
@Ivorforce Ivorforce requested a review from a team as a code owner June 12, 2025 10:19
_len = 0;
}
#endif
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we do this, or is too risky of having things compile in release but not debug? (and vice versa) 🤔

The CI checks should be pretty good at catching any problems as they do editor and template builds.

#ifdef DEBUG_ENABLED
	_FORCE_INLINE_ Span(const T *p_ptr, uint64_t p_len) :
			_ptr(p_ptr), _len(p_len) {
		// TODO In c++20, make this check run only in non-consteval, and make this constructor constexpr.
		if (_ptr == nullptr && _len > 0) {
			ERR_PRINT("Internal bug, please report: Span was created from nullptr with size > 0. Recovering by using size = 0.");
			_len = 0;
		}
	}
#else
	_FORCE_INLINE_ constexpr Span(const T *p_ptr, uint64_t p_len) :
			_ptr(p_ptr), _len(p_len) {}
#endif

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would work, but i think since it's effectively constexpr anyway, it should be compiled as such with or without the constexpr modifier. The only difference being that we won't be able to use it in constexpr contexts, which is also the case with separate DEBUG and RELEASE definitions.

@akien-mga akien-mga merged commit e90fd0b into godotengine:master Jun 12, 2025
20 checks passed
@akien-mga
Copy link
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants