frontend crashes pointer casting a comptime packed struct #30180

unplanned commented 2025年12月13日 19:57:48 +01:00

Zig Version

0.16.0-dev.1484+d0ba6642b

Steps to Reproduce and Observed Behavior

Minimal reproduction:

pubfnmain()void{constT=packedstruct{x:u17};consta:u32=0;constb:*constT=@ptrCast(&a);constc=b.x;_=c;}

Observed behavior: compiler hangs indefinitely
Compiles successfully using the x86_64 backend.

Expected Behavior

Should compile and run.

Also, is this ptrCast considered "legal" (ptrcast from int to packed struct of lower bit size) ?

### Zig Version 0.16.0-dev.1484+d0ba6642b ### Steps to Reproduce and Observed Behavior Minimal reproduction: ```zig pub fn main() void { const T = packed struct { x: u17 }; const a: u32 = 0; const b: *const T = @ptrCast(&a); const c = b.x; _ = c; } ``` Observed behavior: compiler hangs indefinitely Compiles successfully using the x86_64 backend. ### Expected Behavior Should compile and run. Also, is this `ptrCast` considered "legal" (ptrcast from int to packed struct of lower bit size) ?

alexrp commented 2025年12月14日 01:14:53 +01:00

With a debug compiler:

Compiler crash context:
Analyzing 'test.zig'
 %2 = dbg_stmt(2, 5)
 %3 = extended(struct_decl(hash(1fbd38fdff4253824ca903f5740f415f) dbg_var, {}, packed, {}, {
 x: {%4, %5},
 }) 
 %6 = validate_const(%3) 
 %7 = dbg_var_val(%3, "T")
 %8 = dbg_stmt(3, 5)
 %9 = as_node(@u32_type, @zero) 
 %16 = ref(%9) 
 %10 = validate_const(%9) 
 %11 = dbg_var_val(%9, "a")
 %12 = dbg_stmt(4, 5)
 %13 = block_comptime(reason=type, {
 %14 = break_inline(%13, %3)
 }) 
 %15 = ptr_type(%13, const, one) 
 %17 = dbg_stmt(4, 25)
 %18 = ptr_cast(%15, %16) 
 %19 = as_node(%15, %18) 
 %23 = ref(%19) 
 %20 = validate_const(%19) 
 %21 = dbg_var_val(%19, "b")
 %22 = dbg_stmt(5, 16)
 > %24 = field_ptr_load(%23, "x") 
 %25 = validate_const(%24) 
 %26 = dbg_var_val(%24, "c")
 %27 = save_err_ret_index(%24)
 %28 = dbg_stmt(6, 5)
 %29 = ensure_result_non_error(%24) 
 %30 = restore_err_ret_index_unconditional(.none) 
 %31 = ret_implicit(@void_value) 
 For full context, use the command
 zig4 ast-check -t test.zig
thread 61367 panic: integer overflow
/home/alexrp/Sources/ziglang/zig/src/Sema/bitcast.zig:88:59: 0x4d7803b in bitCastInner (main.zig)
 .{ val_ty.abiSize(zcu) * 8 - host_bits, host_bits - val_ty.bitSize(zcu) }
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema/bitcast.zig:27:24: 0x452c4d2 in bitCast (main.zig)
 return bitCastInner(sema, val, dest_ty, byte_offset, host_bits, bit_offset) catch |err| switch (err) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema/comptime_ptr_access.zig:503:43: 0x3beca61 in loadComptimePtrInner (main.zig)
 const result_val = try sema.bitCastVal(
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema/comptime_ptr_access.zig:37:32: 0x3bee7bb in loadComptimePtr (main.zig)
 return loadComptimePtrInner(sema, block, src, ptr, bit_offset, host_bits, Type.fromInterned(ptr_info.child), 0);
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:36525:37: 0x549284c in pointerDerefExtra (main.zig)
 switch (try sema.loadComptimePtr(block, src, ptr_val)) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:36497:39: 0x4c02a84 in pointerDeref (main.zig)
 switch (try sema.pointerDerefExtra(block, src, coerced_ptr_val)) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:31491:34: 0x4507ba3 in analyzeLoad (main.zig)
 if (try sema.pointerDeref(block, src, ptr_val, ptr_ty)) |elem_val| {
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:26953:36: 0x4c3e31a in fieldVal (main.zig)
 return sema.analyzeLoad(block, src, field_ptr, object_src);
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:26784:28: 0x4c451c4 in fieldPtrLoad (main.zig)
 return fieldVal(sema, block, src, object, field_name, field_name_src);
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:9792:24: 0x43b57e6 in zirFieldPtrLoad (main.zig)
 return fieldPtrLoad(sema, block, src, object_ptr, field_name, field_name_src);
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:1217:70: 0x3bba150 in analyzeBodyInner (main.zig)
 .field_ptr_load => try sema.zirFieldPtrLoad(block, inst),
 ^
/home/alexrp/Sources/ziglang/zig/src/Sema.zig:1046:26: 0x30a6261 in analyzeFnBody (main.zig)
 sema.analyzeBodyInner(block, body) catch |err| switch (err) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:2960:23: 0x30aa1f4 in analyzeFnBodyInner (main.zig)
 sema.analyzeFnBody(&inner_block, fn_info.body) catch |err| switch (err) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:1734:40: 0x2a8e222 in analyzeFuncBody (main.zig)
 var air = try pt.analyzeFnBodyInner(func_index);
 ^
/home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:1653:66: 0x2529cee in ensureFuncBodyUpToDate (main.zig)
 const ies_outdated, const new_failed = if (pt.analyzeFuncBody(func_index)) |result|
 ^
/home/alexrp/Sources/ziglang/zig/src/Compilation.zig:5138:38: 0x22f957e in processOneJob (main.zig)
 pt.ensureFuncBodyUpToDate(func) catch |err| switch (err) {
 ^
/home/alexrp/Sources/ziglang/zig/src/Compilation.zig:5008:30: 0x216c6b4 in performAllTheWork (main.zig)
 try processOneJob(@intFromEnum(Zcu.PerThread.Id.main), comp, job);
 ^
/home/alexrp/Sources/ziglang/zig/src/Compilation.zig:3069:31: 0x205ab5c in update (main.zig)
 try comp.performAllTheWork(main_progress_node);
 ^
/home/alexrp/Sources/ziglang/zig/src/main.zig:4608:20: 0x206b78b in updateModule (main.zig)
 try comp.update(prog_node);
 ^
/home/alexrp/Sources/ziglang/zig/src/main.zig:3690:21: 0x1f5b2a4 in buildOutputType (main.zig)
 updateModule(comp, color, root_prog_node) catch |err| switch (err) {
 ^
/home/alexrp/Sources/ziglang/zig/src/main.zig:248:31: 0x1fa73bd in mainArgs (main.zig)
 return buildOutputType(gpa, arena, io, args, .{ .build = .Exe });
 ^
/home/alexrp/Sources/ziglang/zig/src/main.zig:196:20: 0x1f025fe in main (main.zig)
 return mainArgs(gpa, arena, args);
 ^
/home/alexrp/Sources/ziglang/zig/lib/std/start.zig:714:37: 0x1f008b2 in callMain (std.zig)
 const result = root.main() catch |err| {
 ^
../sysdeps/nptl/libc_start_call_main.h:58:16: 0x7ab695c2a574 in __libc_start_call_main (../sysdeps/x86/libc-start.c)
../csu/libc-start.c:360:3: 0x7ab695c2a627 in __libc_start_main_impl (../sysdeps/x86/libc-start.c)
???:?:?: 0x6a235a4 in ??? (???)

With a debug compiler: ``` Compiler crash context: Analyzing 'test.zig' %2 = dbg_stmt(2, 5) %3 = extended(struct_decl(hash(1fbd38fdff4253824ca903f5740f415f) dbg_var, {}, packed, {}, { x: {%4, %5}, }) %6 = validate_const(%3) %7 = dbg_var_val(%3, "T") %8 = dbg_stmt(3, 5) %9 = as_node(@u32_type, @zero) %16 = ref(%9) %10 = validate_const(%9) %11 = dbg_var_val(%9, "a") %12 = dbg_stmt(4, 5) %13 = block_comptime(reason=type, { %14 = break_inline(%13, %3) }) %15 = ptr_type(%13, const, one) %17 = dbg_stmt(4, 25) %18 = ptr_cast(%15, %16) %19 = as_node(%15, %18) %23 = ref(%19) %20 = validate_const(%19) %21 = dbg_var_val(%19, "b") %22 = dbg_stmt(5, 16) > %24 = field_ptr_load(%23, "x") %25 = validate_const(%24) %26 = dbg_var_val(%24, "c") %27 = save_err_ret_index(%24) %28 = dbg_stmt(6, 5) %29 = ensure_result_non_error(%24) %30 = restore_err_ret_index_unconditional(.none) %31 = ret_implicit(@void_value) For full context, use the command zig4 ast-check -t test.zig thread 61367 panic: integer overflow /home/alexrp/Sources/ziglang/zig/src/Sema/bitcast.zig:88:59: 0x4d7803b in bitCastInner (main.zig) .{ val_ty.abiSize(zcu) * 8 - host_bits, host_bits - val_ty.bitSize(zcu) } ^ /home/alexrp/Sources/ziglang/zig/src/Sema/bitcast.zig:27:24: 0x452c4d2 in bitCast (main.zig) return bitCastInner(sema, val, dest_ty, byte_offset, host_bits, bit_offset) catch |err| switch (err) { ^ /home/alexrp/Sources/ziglang/zig/src/Sema/comptime_ptr_access.zig:503:43: 0x3beca61 in loadComptimePtrInner (main.zig) const result_val = try sema.bitCastVal( ^ /home/alexrp/Sources/ziglang/zig/src/Sema/comptime_ptr_access.zig:37:32: 0x3bee7bb in loadComptimePtr (main.zig) return loadComptimePtrInner(sema, block, src, ptr, bit_offset, host_bits, Type.fromInterned(ptr_info.child), 0); ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:36525:37: 0x549284c in pointerDerefExtra (main.zig) switch (try sema.loadComptimePtr(block, src, ptr_val)) { ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:36497:39: 0x4c02a84 in pointerDeref (main.zig) switch (try sema.pointerDerefExtra(block, src, coerced_ptr_val)) { ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:31491:34: 0x4507ba3 in analyzeLoad (main.zig) if (try sema.pointerDeref(block, src, ptr_val, ptr_ty)) |elem_val| { ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:26953:36: 0x4c3e31a in fieldVal (main.zig) return sema.analyzeLoad(block, src, field_ptr, object_src); ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:26784:28: 0x4c451c4 in fieldPtrLoad (main.zig) return fieldVal(sema, block, src, object, field_name, field_name_src); ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:9792:24: 0x43b57e6 in zirFieldPtrLoad (main.zig) return fieldPtrLoad(sema, block, src, object_ptr, field_name, field_name_src); ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:1217:70: 0x3bba150 in analyzeBodyInner (main.zig) .field_ptr_load => try sema.zirFieldPtrLoad(block, inst), ^ /home/alexrp/Sources/ziglang/zig/src/Sema.zig:1046:26: 0x30a6261 in analyzeFnBody (main.zig) sema.analyzeBodyInner(block, body) catch |err| switch (err) { ^ /home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:2960:23: 0x30aa1f4 in analyzeFnBodyInner (main.zig) sema.analyzeFnBody(&inner_block, fn_info.body) catch |err| switch (err) { ^ /home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:1734:40: 0x2a8e222 in analyzeFuncBody (main.zig) var air = try pt.analyzeFnBodyInner(func_index); ^ /home/alexrp/Sources/ziglang/zig/src/Zcu/PerThread.zig:1653:66: 0x2529cee in ensureFuncBodyUpToDate (main.zig) const ies_outdated, const new_failed = if (pt.analyzeFuncBody(func_index)) |result| ^ /home/alexrp/Sources/ziglang/zig/src/Compilation.zig:5138:38: 0x22f957e in processOneJob (main.zig) pt.ensureFuncBodyUpToDate(func) catch |err| switch (err) { ^ /home/alexrp/Sources/ziglang/zig/src/Compilation.zig:5008:30: 0x216c6b4 in performAllTheWork (main.zig) try processOneJob(@intFromEnum(Zcu.PerThread.Id.main), comp, job); ^ /home/alexrp/Sources/ziglang/zig/src/Compilation.zig:3069:31: 0x205ab5c in update (main.zig) try comp.performAllTheWork(main_progress_node); ^ /home/alexrp/Sources/ziglang/zig/src/main.zig:4608:20: 0x206b78b in updateModule (main.zig) try comp.update(prog_node); ^ /home/alexrp/Sources/ziglang/zig/src/main.zig:3690:21: 0x1f5b2a4 in buildOutputType (main.zig) updateModule(comp, color, root_prog_node) catch |err| switch (err) { ^ /home/alexrp/Sources/ziglang/zig/src/main.zig:248:31: 0x1fa73bd in mainArgs (main.zig) return buildOutputType(gpa, arena, io, args, .{ .build = .Exe }); ^ /home/alexrp/Sources/ziglang/zig/src/main.zig:196:20: 0x1f025fe in main (main.zig) return mainArgs(gpa, arena, args); ^ /home/alexrp/Sources/ziglang/zig/lib/std/start.zig:714:37: 0x1f008b2 in callMain (std.zig) const result = root.main() catch |err| { ^ ../sysdeps/nptl/libc_start_call_main.h:58:16: 0x7ab695c2a574 in __libc_start_call_main (../sysdeps/x86/libc-start.c) ../csu/libc-start.c:360:3: 0x7ab695c2a627 in __libc_start_main_impl (../sysdeps/x86/libc-start.c) ???:?:?: 0x6a235a4 in ??? (???) ```

enfipy commented 2026年04月07日 21:36:19 +02:00

I'm not sure if it's the best fix, but I reproduced this error on my arm mac and fixed with this patch:

diff --git a/src/Sema/comptime_ptr_access.zig b/src/Sema/comptime_ptr_access.zig
index 63a3caefc9..80094e5160 100644
--- a/src/Sema/comptime_ptr_access.zig
+++ b/src/Sema/comptime_ptr_access.zig
@@ -498,8 +498,16 @@ fn loadComptimePtrInner(
 return .{ .success = cur_val };
 }
 
+ var bitcast_src_val = try cur_val.intern(sema.pt, sema.arena);
+ if (host_bits != 0) {
+ const src_bit_size = bitcast_src_val.typeOf(zcu).bitSize(zcu);
+ if (src_bit_size > host_bits) {
+ const truncate_ty = try pt.intType(.unsigned, @intCast(host_bits));
+ bitcast_src_val = try pt.getCoerced(bitcast_src_val, truncate_ty);
+ }
+ }
 const result_val = try sema.bitCastVal(
- try cur_val.intern(sema.pt, sema.arena),
+ bitcast_src_val,
 load_ty,
 cur_offset,
 host_bits,

and test (added additional extended test with nonzero offset):

diff --git a/test/behavior/ptrcast.zig b/test/behavior/ptrcast.zig
index 7b6e6edbb8..3543b12405 100644
--- a/test/behavior/ptrcast.zig
+++ b/test/behavior/ptrcast.zig
@@ -562,3 +562,20 @@ test "@ptrCast array pointer removing sentinel" {
 comptime assert(out[2] == 3);
 comptime assert(out[3] == 4);
 }
+
+test "@ptrCast larger type to smaller one" {
+ const T = packed struct { x: u17 };
+ const a: u32 = 0;
+ const b: *const T = @ptrCast(&a);
+ comptime assert(b.x == 0);
+}
+
+test "@ptrCast larger type to smaller one with nonzero packed offset" {
+ const T = packed struct {
+ pad: u5,
+ x: u17,
+ };
+ const a: u32 = 0;
+ const b: *const T = @ptrCast(&a);
+ comptime assert(b.x == 0);
+}

@mlugg please, feel free to use/change it as you wish, or throw it

I'm not sure if it's the best fix, but I reproduced this error on my arm mac and fixed with this patch: ``` diff --git a/src/Sema/comptime_ptr_access.zig b/src/Sema/comptime_ptr_access.zig index 63a3caefc9..80094e5160 100644 --- a/src/Sema/comptime_ptr_access.zig +++ b/src/Sema/comptime_ptr_access.zig @@ -498,8 +498,16 @@ fn loadComptimePtrInner( return .{ .success = cur_val }; } + var bitcast_src_val = try cur_val.intern(sema.pt, sema.arena); + if (host_bits != 0) { + const src_bit_size = bitcast_src_val.typeOf(zcu).bitSize(zcu); + if (src_bit_size > host_bits) { + const truncate_ty = try pt.intType(.unsigned, @intCast(host_bits)); + bitcast_src_val = try pt.getCoerced(bitcast_src_val, truncate_ty); + } + } const result_val = try sema.bitCastVal( - try cur_val.intern(sema.pt, sema.arena), + bitcast_src_val, load_ty, cur_offset, host_bits, ``` and test (added additional extended test with nonzero offset): ``` diff --git a/test/behavior/ptrcast.zig b/test/behavior/ptrcast.zig index 7b6e6edbb8..3543b12405 100644 --- a/test/behavior/ptrcast.zig +++ b/test/behavior/ptrcast.zig @@ -562,3 +562,20 @@ test "@ptrCast array pointer removing sentinel" { comptime assert(out[2] == 3); comptime assert(out[3] == 4); } + +test "@ptrCast larger type to smaller one" { + const T = packed struct { x: u17 }; + const a: u32 = 0; + const b: *const T = @ptrCast(&a); + comptime assert(b.x == 0); +} + +test "@ptrCast larger type to smaller one with nonzero packed offset" { + const T = packed struct { + pad: u5, + x: u17, + }; + const a: u32 = 0; + const b: *const T = @ptrCast(&a); + comptime assert(b.x == 0); +} ``` @mlugg please, feel free to use/change it as you wish, or throw it