VC6/VC2003编译器有严重bug!

[kwing]

// VC6/VC2003 使用/O2编译(默认的release模式), 输出结果有"impossible!!!" 

#include <stdio.h> 

int main() 
{ 
	static const int T[1] = {0}; 
	int n = 0; 

	for(int i = 536000000; i < 536000004; ++i) 
	{ 
		if(i < 0) { printf("impossible!!!\n"); break; } 
		if(i >= 0 && i < 1) n += T[i]; 
	} 

	printf("end\n"); 
	getchar(); 
	return n; 
} 

已测试过VC6加SP6补丁, VC2003加SP1补丁都没解决
看来最好改用VC2005以上版本,用低版本的一定要小心!

[汪宁宇]

http://www.codeproject.com/Messages/3288523/Re-What-does-this-mean-about-the-VC6-VS2003-compil.aspx

VC6/VS2003 are old compilers and so I don't think the bug is "new".

[maple_zhj]

。。。不是吧，编译器还有这Bug。。。

[xuxingok]

这都能测出来啊

[guolihui112]

强烈要求lz发布发现过程

[kwing]

我是LZ,这个问题我当时在国外的stackoverflow上询问过:

http://stackoverflow.com/questions/1801449/serious-bug-of-visual-c-6-0-2003-compiler

其中有高手详细说明了是什么原因导致这种编译器bug:

What it's doing is replacing the i index with a pointer to T[536000000] (or equivalently T[0x1FF2B600]). Since ints are 4 bytes and ((0x1FF2B600 * 4) == 0x7FCAD800), as a byte offset from the start of T[] the pointer becomes (((char*) &T[0]) + 0x7FCAD800). 0x7FCAD800 is very close to where values become negative (0x8000000), and once the linker fixes the base address of T[0] the pointer 'overflows' and the compiler compares that pointer to the base of T[] using a signed compare. Which is a mistake/bug.

I think that this bug is probably rarely seen in the wild because it requires indexing arrays using rather huge indexes (or in your case 'potentially' indexing the array with a huge index).

[kwing]

[Quote=引用 53 楼 guolihui112 的回复:]
强烈要求lz发布发现过程
[/Quote]

当然不可能是随手就写出编译器的致命点,也不会没事测试编译器玩.
是编译一个正常无错程序,运行时却莫名其妙出现内存访问错误,然后一点点简化出1楼的程序.

[嬴政爱天下]

友情绑定一下下！！
·

[gmsgms]

学习了

[56625079]

我用VS2003+SP1 试过，DEBUG和Release都正常。大家打一下SP1试试。

[56625079]

D:\My Documents\Visual Studio Projects\VCBUG>cl /O2 /Fa vcbug.cpp
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 13.10.6030 for 80x86
Copyright (C) Microsoft Corporation 1984-2002. All rights reserved.

vcbug.cpp
Microsoft (R) Incremental Linker Version 7.10.6030
Copyright (C) Microsoft Corporation. All rights reserved.

/out:vcbug.exe
vcbug.obj

D:\My Documents\Visual Studio Projects\VCBUG>vcbug.exe
end

[你妹的特盗不]

这也叫bug?
明显是数字溢出了嘛

[dianhui]

无意中闯入了仙人洞，发现一群神仙在开会！

[你妹的特盗不]

再仔细看下，学习了......


爆汗

[dianhui]

引用 7 楼 w_anthony 的回复:

Assembly code00401000push esi00401001xor esi,esi00401003mov eax,800B5514h
00401008cmp eax,offset string L"\0" (407D14h)
0040100Djl main+24h (401024h)
0040100Fcmp eax,407D18h00401014jge main+18h (401018h)00401016add esi,dword ptr [eax]
00401018add eax,4
0040101Bcmp eax,800B5524h00401020jl main+8 (401008h)00401022jmp main+31h (401031h)00401024push offset string"impossible!!!\n" (407104h)
00401029call printf (4011FEh)
0040102Eadd esp,400401031push offset string"end\n" (4070FCh)00401036call printf (4011FEh)
0040103Bmov eax,dword ptr [__iob+4 (409044h)]00401040add esp,400401043dec eax00401044mov dword ptr [__iob+4 (409044h)],eax
00401049js main+55h (401055h)
0040104Binc dword ptr [__iob (409040h)]00401051mov eax,esi00401053pop esi00401054ret00401055push offset __iob (409040h)
0040105Acall _filbuf (401066h)
0040105Fadd esp,400401062mov eax,esi00401064pop esi00401065ret
LZ这都被你发现了，太强了。
不知道为什么i <0会被优化成0x800B5514 <0x00407D14，接下来自然就错了。
另外如果i是volatile的，就不会出现问题。这BUG本身倒没什么，不过带来的对2003的不信任感到是非常严重……

请问一下：这段汇编代码是如何取得的！VC下还能有方法取得这段代码吗？

[lwd4210]

标记一下，确实让人一身冷汗。

[密斯刘]

潜力贴 一定要顶一下 好好学习

[wang_fang]

不会吧...............................

[kkmqj]

受教了，找资料研习中。

[iloveyoummb]

是生产的问题 生成 Debug 和 Release 是不一样的 路过 请谢谢我

[onlinestar]

此bug在vc++ 2005中已经解决。。。