2011283 - [Linux] GCC throws various nsTArray warnings for widget/gtk

Status: NEW

(Core :: Widget: Gtk, defect)

Description

[Martin Stránský [:stransky] (ni? me)]

[Linux] GCC throws various nsTArray warnings for widget/gtk.

Comment 1

[Martin Stránský [:stransky] (ni? me)]

Attachment: gcc-warnings.txt

Comment 2

[Martin Stránský [:stransky] (ni? me)]

/raid/src3/objdir-opt-gcc/dist/include/nsTArray.h:3589:22: warning: array subscript 1 is outside array bounds of ‘nsTArray<regiondetails::Band>::self_type [1]’ {aka ‘nsTArray<regiondetails::Band> [1]’} [-Warray-bounds=]
 3589 |     autoHdr->mLength = 0;

/raid/src3/objdir-opt-gcc/dist/include/nsRegion.h: In function ‘bool moz_container_wayland_ensure_surface(MozContainer*, mozilla::DesktopIntPoint*)’:
/raid/src3/objdir-opt-gcc/dist/include/nsRegion.h:1908:34: note: at offset 8 into object ‘<anonymous>’ of size 8
 1908 |     mBands = aRegion.mBands.Clone();
      |              ~~~~~~~~~~~~~~~~~~~~^~

/raid/src3/objdir-opt-gcc/dist/include/nsTArray.h:3288:21: warning: array subscript 1 is outside array bounds of ‘nsTArray<mozilla::WaylandVsyncSource*> [1]’ [-Warray-bounds=]
 3288 |     newHdr->mLength = 0;
      |     ~~~~~~~~~~~~~~~~^~~
/raid/src3/widget/gtk/WaylandVsyncSource.cpp: In destructor ‘mozilla::WaylandVsyncSource::~WaylandVsyncSource()’:
/raid/src3/widget/gtk/WaylandVsyncSource.cpp:44:48: note: at offset 8 into object ‘mozilla::gWaylandVsyncSources’ of size 8
   44 | constinit static nsTArray<WaylandVsyncSource*> gWaylandVsyncSources;
      |                                                ^~~~~~~~~~~~~~~~~~~~

Not sure if they're real ones or just false positive.

Comment 3

[Nika Layzell [:nika] (ni? for response)]

I am not 100% sure on this, but based on my current parsing of this warning, it appears that this might be gcc (accurately) noting that if we get confused and consider a nsTArray<...> to be an AutoTArray when it is not, we'll do an out-of-bounds read on the storage of that array. This type check is being done just a bit above the line the warning is being reported at (https://searchfox.org/firefox-main/rev/897ad323744cc6d3afe39845cfb94b015e9f65a0/xpcom/ds/nsTArray.h#3581-3584), based on a flag in the mHdr buffer, and it's probably not clear to the static analysis that this is a thing.

I suppose that makes this a false positive, though I don't love needing to silence warnings for something like this :-/

Comment 4

[Martin Stránský [:stransky] (ni? me)]

Unfortunately we see such nsTArray/AutoTArray crashes on GCC 15.x builds only (Fedora builds - Bug 1999029).