Segfault in edge case UnitRange{UInt64}

[sgaure]

julia> versioninfo()
Julia Version 1.11.5
Commit 760b2e5b739 (2025-04-14 06:53 UTC)
Build Info:
  Official https://julialang.org/ release
Platform Info:
  OS: Linux (x86_64-linux-gnu)
  CPU: 16 × AMD Ryzen 7 2700X Eight-Core Processor
  WORD_SIZE: 64
  LLVM: libLLVM-16.0.6 (ORCJIT, znver1)
Threads: 16 default, 0 interactive, 8 GC (on 16 virtual cores)
Environment:

julia> collect(0:typemax(UInt))

[1332714] signal 11 (1): Segmentation fault
in expression starting at REPL[2]:1
setindex! at ./array.jl:987 [inlined]
Array at ./range.jl:1375 [inlined]
Array at ./boot.jl:605 [inlined]
collect at ./range.jl:1380

From https://discourse.julialang.org/t/built-in-binary-search-for-sorted-collections/128374/12?u=sgaure

[christiangnrd]

Also broken with vcat:

julia> vcat(0:typemax(UInt))

[51018] signal 11 (1): Segmentation fault
in expression starting at REPL[5]:1
_setindex! at ./array.jl:991 [inlined]
setindex! at ./array.jl:986 [inlined]
vcat at ./range.jl:1391

[sgaure]

It's likely because length(0:typemax(UInt)) == 0. Ideally, it shouldn't be possible to create a UnitRange for which length returns an incorrect number. Disallowing it is breaking. But it might be viable to let length throw for such cases, it's better than returning an incorrect length.

There's a similar problem with Int:

julia> length(0:typemax(Int))
-9223372036854775808

[christiangnrd]

This may be intentional? #40382

[sgaure]

Ah, of course. A throw in length will mess with optimization. It must be fixed in collect, vcat, and whatever other functions which use length (or size or other functions using length).

[nsajko]

For what that's worth, I think that length returning an incorrect result is a correctness bug, even though it was done intentionally. If someone wants stop - start + 1, they can do that instead of calling length.

FTR, this is the faulty method:

julia/base/range.jl

Lines 778 to 788 in db75908

	function length(r::AbstractUnitRange{T}) where T
	@inline
	start, stop = first(r), last(r)
	a = oneunit(zero(stop) - zero(start))
	if a isa Signed || stop >= start
	a += stop - start # Signed are allowed to go negative
	else
	a = zero(a) # Unsigned don't necessarily underflow
	end
	return Integer(a)
	end

Right above and below it there are also some definitions for a checked_length function, which is presumably what the length method should have been.

[jakobnissen]

If this is changed, we should consider the performance impact - the length of a range is used a LOT. I would expect that, most places where the length call is performance sensitive, the start of the range is known at compile time to be 1, so the compiler will not even emit the throw branch.
However, from quick experimentation, even though LLVM removes the check, Julia is not smart enough to prove the nothrow effect.