[Bug c++/22513] New: [4.0 regression] Miscompilation of std::list code in Boost.

[Bug c++/22513] New: [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

A Boost regression test has been failing for some time with GCC 4.0.x although
it works with GCC 3.4, mainline and several other compilers that run the Boost
tests.

The problem seems to be that a std::list element is not removed correctly,
causing it to be removed twice and crashing on the second attempt.  I think a
list node might have a dangling pointer but haven't figured it out yet.

Creating pre-processed source with mainline and compiling with 4.0 still causes
the bug, pre-processing with 4.0 and compiling with 4.1 doesn't, so it's not a
libstdc++ problem.

The attached .ii file was produced by gcc version 4.0.2 20050716 (prerelease)
from the following code, using the latest ptr_list from Boost's CVS.  Sorry
about the size of the .ii, the ptr_list brings in a lot of code.

#include <iterator>
#include <cassert>
#include <boost/ptr_container/ptr_list.hpp>

struct B { virtual ~B() {} };
struct T : public B {};

int main()
{
    typedef boost::ptr_list<B> C;

    C  c;
    assert( c.size() == 0 );
    c.push_back( new T );
    assert( c.size() == 1 );

    C  c3( c.begin(), c.end() );
    assert( c.size() == c3.size() );

    c.assign( c3.begin(), c3.end() );
    assert( c.size() == c3.size() );

    c.erase( c.begin() );
    assert( c.size() != c3.size() );
    c.clear();
}

This segfaults on the final line when clearing the container.
(Or if mainline is used to produce a .ii which is then compiled with 4.0, then
the assertion on the previous line fails instead.)

-- 
           Summary: [4.0 regression] Miscompilation of std::list code in
                    Boost.
           Product: gcc
           Version: 4.0.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: redi at gcc dot gnu dot org
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-16 19:05 -------
Created an attachment (id=9290)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=9290&action=view)
Pre-processed source


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2005-07-16 19:15 -------
Might be latent in HEAD

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |giovannibajo at libero dot
                   |                            |it


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-07-16 19:47 -------
With -fmudflap, I get errors (many of them but this is with i686-pc-linux):
*******
mudflap violation 1 (check/write): time=1121543018.141782 ptr=0xbfe049c0 size=4
pc=0xed9eb8 location=`/home/data/redi/gcc/bin/4.0/bin/../lib/gcc/x86_64-unknown-linux-gnu/
4.0.2/../../../../include/c++/4.0.2/bits/stl_list.h:203 (std::_List_const_iterator<void*>::
_List_const_iterator)'
      /home/peshtigo/pinskia/linux/lib/libmudflap.so.0(__mf_check+0x48) [0xed9eb8]
      ./a.out(_ZNSt20_List_const_iteratorIPvEC1EPKSt15_List_node_base+0x6f) [0x804f339]
      ./a.out(_ZNKSt4listIPvSaIS0_EE3endEv+0x19) [0x804f35d]
Nearby object 1: checked region begins 12B before and ends 9B before
mudflap object 0x8aa3a10: name=`/home/data/redi/gcc/bin/4.0/bin/../lib/gcc/x86_64-unknown-
linux-gnu/4.0.2/../../../../include/c++/4.0.2/bits/stl_list.h:656 (std::list<void*, std::allocator<void*> 
>::size) <unnamed variable>'
bounds=[0xbfe049cc,0xbfe049cf] size=4 area=stack check=0r/0w liveness=0
alloc time=1121543018.141767 pc=0xed9128
Nearby object 2: checked region begins 16B before and ends 13B before
mudflap object 0x8aa3a60: name=`/home/data/redi/gcc/bin/4.0/bin/../lib/gcc/x86_64-unknown-
linux-gnu/4.0.2/../../../../include/c++/4.0.2/bits/stl_list.h:656 (std::list<void*, std::allocator<void*> 
>::size) <unnamed variable>'
bounds=[0xbfe049d0,0xbfe049d3] size=4 area=stack check=0r/0w liveness=0
alloc time=1121543018.141772 pc=0xed9128
Nearby object 3: checked region begins 29B after and ends 32B after
mudflap dead object 0x8aa3948: name=`/home/data/redi/gcc/bin/4.0/bin/../lib/gcc/x86_64-
unknown-linux-gnu/4.0.2/../../../../include/c++/4.0.2/bits/stl_list.h:327 (std::_List_base<void*, std::
allocator<void*> >::_List_base) <unnamed variable>'
bounds=[0xbfe049a3,0xbfe049a3] size=1 area=stack check=0r/0w liveness=0
alloc time=1121543018.141709 pc=0xed9128
dealloc time=1121543018.141732 pc=0xed8c11
number of nearby objects: 3


Please try with -fmudflap -lmudflap and if you don't get an error then maybe this is a GCC bug but if 
you do get an error then this looks like a boost bug.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu dot
                   |                            |org
 GCC target triplet|                            |x86_64-*


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-17 10:00 -------
With mainline I still get no error.  With 4.0.2 I get some errors and then the
final assertion is triggered (rather than a segfault) so using mudflap changes
the behaviour of the program:

g++40 -g  -static ptr_list.2.cc  -I ~/src/boost/ -fmudflap -lmudflap  && ./a.out
*******
mudflap violation 1 (check/read): time=1121593057.943466 ptr=0x743440 size=8
pc=0x408aec
location=`/home/data/redi/gcc/bin/4.0/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.0.2/../../../../include/c++/4.0.2/bits/stl_list.h:221
(std::_List_const_iterator<void*>::operator++)'
      [0x408aec]
      [0x40274f]
      [0x402841]
Nearby object 1: checked region begins 7337B after and ends 7344B after
mudflap object 0x7417c0: name=`malloc region'
bounds=[0x741780,0x741797] size=24 area=heap check=1r/1w liveness=2
alloc time=1121593057.943182 pc=0x40936c
      [0x40936c]
      [0x409b2c]
      [0x40feb8]
      [0x403ec9]
Nearby object 2: checked region begins 0B into and ends 7B into
mudflap dead object 0x743480: name=`malloc region'
bounds=[0x743440,0x743457] size=24 area=heap check=1r/1w liveness=2
alloc time=1121593057.943321 pc=0x40936c
      [0x40936c]
      [0x409b2c]
      [0x40feb8]
      [0x403ec9]
dealloc time=1121593057.943444 pc=0x408f4c
      [0x408f4c]
      [0x409f38]
      [0x401ef5]
      [0x401f1d]
number of nearby objects: 2
mf: assertion failure: `c.size() != c3.size()' in int main() at ptr_list.2.cc:25
Aborted

It looks like a good time for me to learn about mudflap and how to interpret
that output.  Thanks for the tip, Andrew.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-17 10:46 -------
P.S. If I compile with -m32 I get 40 mudflap violations, but only one in 64-bit
mode.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-19 13:53 -------
Adding -check-initialization to MUDFLAP_OPTIONS I see a read of an uninitialized
variable earlier in the program.  This happens with both 4.0 and mainline.

I'll try to identify that and see if fixing it affects the original problem.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2005-07-27 08:56 -------
The fix for PR 22591 fixed a miscompilation of std::list::swap.
Could you please try whether this also fixes this problem?


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |reichelt at gcc dot gnu dot
                   |                            |org
Bug 22513 depends on bug 22591, which changed state.

Bug 22591 Summary: [4.0 regression] wrong alias information causes an incorrect redundant load elimination
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22591

           What    |Old Value                   |New Value
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
             Status|NEW                         |ASSIGNED
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXEDBug 22513 depends on bug 22591, which changed state.

Bug 22591 Summary: [4.0 regression] wrong alias information causes an incorrect redundant load elimination
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22591

           What    |Old Value                   |New Value
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
             Status|NEW                         |ASSIGNED
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-27 12:22 -------
gcc version 4.0.2 20050727 (prerelease) still shows the problem.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2005-07-27 12:25 -------
Did you do a full bootstrap?
A library function was miscompiled, so a just using a new compiler
isn't enough.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-27 12:52 -------
No, sorry I didn't.  Bootstrapping now...

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513

[Bug c++/22513] [4.0 regression] Miscompilation of std::list code in Boost.

[redi at gcc dot gnu dot org]

------- Additional Comments From redi at gcc dot gnu dot org  2005-07-27 13:24 -------
Testcase succeeds after a clean bootstrap.  Hoorah!  Thanks.

Marking as a duplicate of bug 22591

*** This bug has been marked as a duplicate of 22591 ***

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |DUPLICATE


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=22513