[mypyc] Fix undefined behavior related to empty vecs (#21094)

We used to use `&vec.buf->items`, which causes undefined behavior for an
empty vec that can be triggered on GCC when using -O3, since `buf` is
NULL for an empty vec. Use `offsetof` instead to calculate struct field
offset, since it doesn't trigger UB if pointer is NULL.

Author: JukkaL

mypyc/codegen/emitfunc.py

@@ -809,9 +809,12 @@ def visit_get_element_ptr(self, op: GetElementPtr) -> None:
         # TODO: support tuple type
         assert isinstance(op.src_type, RStruct), op.src_type
         assert op.field in op.src_type.names, "Invalid field name."
+        # Use offsetof to avoid undefined behavior when src is NULL
+        # (e.g., vec buf pointer for empty vecs). The &((T*)p)->field
+        # pattern is UB when p is NULL, which GCC -O3 can exploit.
         self.emit_line(
-            "{} = ({})&(({} *){})->{};".format(
-                dest, op.type._ctype, op.src_type.name, src, op.field
+            "{} = ({})((CPyPtr){} + offsetof({}, {}));".format(
+                dest, op.type._ctype, src, op.src_type.name, op.field
             )
         )
 

mypyc/irbuild/vec.py

@@ -222,6 +222,11 @@ def vec_len_native(builder: LowLevelIRBuilder, val: Value) -> Value:
 
 
 def vec_items(builder: LowLevelIRBuilder, vecobj: Value) -> Value:
+    """Return pointer to first item in vec's buf.
+
+    Safe to call even when buf is NULL (empty vec), since GetElementPtr
+    uses offsetof-based arithmetic instead of &((T*)p)->field.
+    """
     vtype = cast(RVec, vecobj.type)
     buf = builder.get_element(vecobj, "buf")
     return builder.add(GetElementPtr(buf, vtype.buf_type, "items"))

mypyc/test/test_emitfunc.py

@@ -760,13 +760,16 @@ def test_get_element_ptr(self) -> None:
             "Foo", ["b", "i32", "i64"], [bool_rprimitive, int32_rprimitive, int64_rprimitive]
         )
         self.assert_emit(
-            GetElementPtr(self.o, r, "b"), """cpy_r_r0 = (CPyPtr)&((Foo *)cpy_r_o)->b;"""
+            GetElementPtr(self.o, r, "b"),
+            """cpy_r_r0 = (CPyPtr)((CPyPtr)cpy_r_o + offsetof(Foo, b));""",
         )
         self.assert_emit(
-            GetElementPtr(self.o, r, "i32"), """cpy_r_r0 = (CPyPtr)&((Foo *)cpy_r_o)->i32;"""
+            GetElementPtr(self.o, r, "i32"),
+            """cpy_r_r0 = (CPyPtr)((CPyPtr)cpy_r_o + offsetof(Foo, i32));""",
         )
         self.assert_emit(
-            GetElementPtr(self.o, r, "i64"), """cpy_r_r0 = (CPyPtr)&((Foo *)cpy_r_o)->i64;"""
+            GetElementPtr(self.o, r, "i64"),
+            """cpy_r_r0 = (CPyPtr)((CPyPtr)cpy_r_o + offsetof(Foo, i64));""",
         )
 
     def test_set_element(self) -> None: