[Bug c++/35548] New: g++ 4.3.{0,1} miscompile this simple program

[Bug c++/35548] New: g++ 4.3.{0,1} miscompile this simple program

[varg at theor dot jinr dot ru]

$ cat oops.cpp
class refcounted 
{
public:
        refcounted() throw() : refcount(0) { }
        unsigned add_reference() throw() 
        { 
                return ++refcount; 
        }
        unsigned remove_reference() throw()
        { 
                return --refcount; 
        }
        unsigned get_refcount() const throw() 
        { 
                return refcount; 
        }
        void set_refcount(unsigned r) throw() 
        { 
                refcount = r; 
        }
private:
        unsigned refcount;
};

template <class T> class ptr 
{
        T* p;
public:
        ptr(T* t) throw() : p(t) 
        { 
                p->set_refcount(1); 
        }
        explicit ptr(T& t) throw() : p(&t) 
        {
                p->add_reference(); 
        }
        ptr(const ptr& other) throw() : p(other.p)
        { 
                p->add_reference(); 
        }
        ~ptr()
        {
                if (p->remove_reference() == 0)
                        delete p;
        }
        ptr& operator=(const ptr& other)
        {
                T* otherp = other.p;
                otherp->add_reference();
                if (p->remove_reference() == 0)
                        delete p;
                p = otherp;
                return *this;
        }
        T& operator*() const throw() 
        { 
                return *p; 
        }
        T* operator->() const throw() 
        { 
                return p; 
        }
        friend inline T* get_pointer(const ptr& x) throw() 
        { 
                return x.p; 
        }
        template <class U>
        bool operator==(const ptr<U>& rhs) const throw() 
        { 
                return p == get_pointer(rhs); 
        }
};

class ex;
typedef const void* tinfo_t; 
struct tinfo_static_t { };

enum status_flags {
        dynallocated    = 0x0001,
        evaluated       = 0x0002
};

class basic : public refcounted
{
public:
        static const tinfo_static_t tinfo_static;
        basic() : tinfo_key(&tinfo_static), flags(0) { }
        basic(tinfo_t ti) : tinfo_key(ti), flags(0) { }
        basic(const basic& other) : tinfo_key(other.tinfo_key),
                flags(other.flags & ~dynallocated) { }
        virtual basic* duplicate() const 
        { 
                return new basic(*this); 
        }
        int compare(const basic& other) const
        {
                if (tinfo() == other.tinfo())
                        return compare_same_type(other);
                else if (tinfo() < other.tinfo())
                        return -1;
                else
                        return 1;
        }
        const basic& hold() const
        {
                flags |= evaluated;
                return *this;
        }
        virtual ex eval(int level = 0) const;
        tinfo_t tinfo() const 
        { 
                return tinfo_key; 
        }
        virtual ~basic() { }
protected:
        virtual int compare_same_type(const basic& other) const
        { 

                if (this == &other)
                        return 0;
                else if (this > &other)
                        return 1;
                else
                        return -1;
        }
        tinfo_t tinfo_key;
        mutable unsigned flags;
private:
        friend class ex;
};
const tinfo_static_t basic::tinfo_static = { };

class ex {
private:
        mutable ptr<basic> bp;
        static ptr<basic> construct_from_basic(const basic& other)
        {
                if (!(other.flags & evaluated)) {
                        const ex& tmpex = other.eval(1);
                        if ((other.get_refcount() == 0) && (other.flags &
dynallocated))
                                delete &other;

                        return tmpex.bp;
                } else {
                        if (other.flags & dynallocated) {
                                return ptr<basic>(const_cast<basic &>(other));
                        } else {
                                basic* bp = other.duplicate();
                                bp->flags |= dynallocated;
                                return bp;
                        }
                }
        }
public:
        inline ex(const basic& other) : bp(construct_from_basic(other)) { }
        ex eval(int level = 0) const 
        { 
                return bp->eval(level); 
        }
        int compare(const ex& other) const
        {
                if (bp == other.bp)
                        return 0;
                return bp->compare(*other.bp);
        }
        inline unsigned get_refcount() const
        {
                return bp->get_refcount();
        }
};

ex basic::eval(int level) const
{
        return hold();
}

class oops : public basic
{
        int s;
protected:
        virtual int compare_same_type(const basic& other) const
        {
                const oops& o = static_cast<const oops &>(other);
                if (s == o.s)
                        return 0;
                if (s > o.s)
                        return 1;
                return -1;
        }
public:
        oops() : basic(&oops::tinfo_static), s(0) { }
        oops(const int s_) : basic(&oops::tinfo_static), s(s_) { }
        ex eval(int level) const
        {
                return oops(s).hold();
        }
        virtual oops* duplicate() const 
        { 
                return new oops(*this); 
        }
        static const tinfo_static_t tinfo_static;
};
const tinfo_static_t oops::tinfo_static = { };

int main(int argc, char** argv)
{
        int ret = 0;
        const ex e = oops(1).hold();
        const ex& f = argc > 1 ? e : e.eval(-2);
        if (f.get_refcount() == 0)
                ++ret; // XXX: this should not happen
        if (f.compare(e))
                ++ret; // XXX: this should not happen
        return ret;
}
$ g++-4.3 -O0 -Wall -g oops.cpp -o /tmp/oops-4.3
$ /tmp/oops-4.3
Segmentation fault

When compiled with g++ 3.4, 4.{0,1,2} the program works as expected
(i.e. exits with zero status).

$ g++-4.3 -v -save-temps -O0 -Wall -g oops.cpp -o /tmp/oops-4.3
Using built-in specs.
Target: x86_64-linux-gnu
Configured with: ../src/configure linux gnu
Thread model: posix
gcc version 4.3.1 20080309 (prerelease) (Debian 4.3.0-1) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/cc1plus -E -quiet -v -D_GNU_SOURCE
../oops.cpp -mtune=generic -Wall -fworking-directory -O0 -fpch-preprocess -o
oops.ii
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../x86_64-linux-gnu/include"
ignoring nonexistent directory "/usr/include/x86_64-linux-gnu"
#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/4.3
 /usr/include/c++/4.3/x86_64-linux-gnu
 /usr/include/c++/4.3/backward
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/include
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/include-fixed
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/cc1plus -fpreprocessed oops.ii -quiet
-dumpbase oops.cpp -mtune=generic -auxbase oops -g -O0 -Wall -version -o oops.s
GNU C++ (Debian 4.3.0-1) version 4.3.1 20080309 (prerelease) (x86_64-linux-gnu)
        compiled by GNU C version 4.3.1 20080309 (prerelease), GMP version
4.2.2, MPFR version 2.3.1.
GGC heuristics: --param ggc-min-expand=63 --param ggc-min-heapsize=63134
Compiler executable checksum: 6b4f47123a81acc7bc0d52a2f374512f
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 as -V -Qy -o oops.o oops.s
GNU assembler version 2.18.0 (x86_64-linux-gnu) using BFD version (GNU Binutils
for Debian) 2.18.0.20080103
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/:/lib/../lib/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/collect2 --eh-frame-hdr -m elf_x86_64
--hash-style=both -dynamic-linker /lib64/ld-linux-x86-64.so.2 -o /tmp/oops-4.3
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crt1.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crti.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/crtbegin.o
-L/usr/lib/gcc/x86_64-linux-gnu/4.3.1 -L/usr/lib/gcc/x86_64-linux-gnu/4.3.1
-L/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib -L/lib/../lib
-L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../.. oops.o
-lstdc++ -lm -lgcc_s -lgcc -lc -lgcc_s -lgcc
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/crtend.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crtn.o


P.S.
I haven't posted the preprocessed source, since it's virtually identical
to the original one.


-- 
           Summary: g++ 4.3.{0,1} miscompile this simple program
           Product: gcc
           Version: 4.3.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: varg at theor dot jinr dot ru


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] g++ 4.3.{0,1} miscompile this simple program

[rguenth at gcc dot gnu dot org]

------- Comment #1 from rguenth at gcc dot gnu dot org  2008-03-12 10:19 -------
It's by no means a "simple" program ;)

the failure mode is that

Program received signal SIGSEGV, Segmentation fault.
0x0000000000400bed in basic::compare (this=0x603040, other=@0x603010) at t.C:98
98                              return compare_same_type(other);
(gdb) print other
$1 = (const basic &) @0x603010: {<refcounted> = {refcount = 1}, 
  _vptr.basic = 0x401430, static tinfo_static = {<No data fields>}, 
  tinfo_key = 0x401365, flags = 3}
(gdb) print *this
$3 = {<refcounted> = {refcount = 0}, _vptr.basic = 0x0, 
  static tinfo_static = {<No data fields>}, tinfo_key = 0x401365, flags = 3}

the object compare is invoked on is not properly initialized (its _vptr is
NULL).

(gdb) bt
#0  0x0000000000400bed in basic::compare (this=0x603040, other=@0x603010)
    at t.C:98
#1  0x0000000000400f41 in ex::compare (this=0x7fff106c4510, 
    other=@0x7fff106c44e0) at t.C:165
#2  0x00000000004009a8 in main (argc=1, argv=0x7fff106c4628) at t.C:213

For whatever reason (program non-conformance or GCC bug).

Please try to simplify the test program.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] g++ 4.3.{0,1} miscompile this simple program

[varg at theor dot jinr dot ru]

------- Comment #2 from varg at theor dot jinr dot ru  2008-03-13 06:42 -------
Richard Guenther wrote:

> the object compare is invoked on is not properly initialized (its _vptr is
> NULL).

Not exactly. The object (or rather, the pointer managed by that objects) gets
deleted too early.

> Please try to simplify the test program.

template <class T> class ptr 
{
        T* p;
public:
        ptr(T* t) throw() : p(t) 
        { 
                p->set_refcount(1); 
        }
        explicit ptr(T& t) throw() : p(&t) 
        {
                p->add_reference(); 
        }
        ptr(const ptr& other) throw() : p(other.p)
        { 
                p->add_reference(); 
        }
        ~ptr()
        {
                if (p->remove_reference() == 0)
                        delete p;
        }
        ptr& operator=(const ptr& other)
        {
                T* otherp = other.p;
                otherp->add_reference();
                if (p->remove_reference() == 0)
                        delete p;
                p = otherp;
                return *this;
        }
        T& operator*() const throw() 
        { 
                return *p; 
        }
        T* operator->() const throw() 
        { 
                return p; 
        }
};

class refcounted 
{
public:
        refcounted() throw() : refcount(0) { }
        unsigned add_reference() throw() 
        { 
                return ++refcount; 
        }
        unsigned remove_reference() throw()
        { 
                return --refcount; 
        }
        unsigned get_refcount() const throw() 
        { 
                return refcount; 
        }
        void set_refcount(unsigned r) throw() 
        { 
                refcount = r; 
        }
private:
        unsigned refcount;
};

class ex;

enum status_flags {
        dynallocated    = 1,
        evaluated       = 2
};

class basic : public refcounted
{
public:
        basic() : flags(0) { }
        basic(const basic& other) : flags(other.flags & ~dynallocated) { }
        virtual basic* duplicate() const 
        { 
                return new basic(*this); 
        }
        virtual ex eval() const;
        const basic& hold() const
        {
                flags |= evaluated;
                return *this;
        }
        virtual ~basic() { }
protected:
        mutable unsigned flags;
private:
        friend class ex;
};

class ex {
private:
        mutable ptr<basic> bp;
        static ptr<basic> construct_from_basic(const basic& other)
        {
                if (!(other.flags & evaluated)) {
                        const ex& tmpex = other.eval();
                        if ((other.get_refcount() == 0) && (other.flags &
dynallocated))
                                delete &other;

                        return tmpex.bp;
                } else {
                        if (other.flags & dynallocated) {
                                return ptr<basic>(const_cast<basic &>(other));
                        } else {
                                basic* bp = other.duplicate();
                                bp->flags |= dynallocated;
                                return bp;
                        }
                }
        }
public:
        ex(const basic& other) : bp(construct_from_basic(other)) { }
        ex eval() const 
        { 
                return bp->eval();
        }
};

ex basic::eval() const
{
        return hold();
}

class oops : public basic
{
public:
        oops() { }
        oops* duplicate() const 
        { 
                return new oops(*this); 
        }
        ex eval() const
        {
                return oops().hold();
        }
};

int main(int argc, char** argv)
{
        const ex e = oops().hold();
        const ex& f = argc > 1 ? e : e.eval();
        const ex& g = f.eval();
        return 0;
}


-- 

varg at theor dot jinr dot ru changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |varg at theor dot jinr dot
                   |                            |ru


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] g++ 4.3.{0,1} miscompile this simple program

[varg at theor dot jinr dot ru]

------- Comment #3 from varg at theor dot jinr dot ru  2008-03-13 11:17 -------
Even more simple program:

template <class T> class ptr 
{
        T* p;
public:
        ptr(T* t) throw() : p(t) 
        { 
                p->set_refcount(1); 
        }
        explicit ptr(T& t) throw() : p(&t) 
        {
                p->add_reference(); 
        }
        ptr(const ptr& other) throw() : p(other.p)
        { 
                p->add_reference(); 
        }
        ~ptr()
        {
                if (p->remove_reference() == 0)
                        delete p;
        }
        ptr& operator=(const ptr& other)
        {
                T* otherp = other.p;
                otherp->add_reference();
                if (p->remove_reference() == 0)
                        delete p;
                p = otherp;
                return *this;
        }
        T& operator*() const throw() 
        { 
                return *p; 
        }
        T* operator->() const throw() 
        { 
                return p; 
        }
};

class refcounted 
{
public:
        refcounted() throw() : refcount(0) { }
        unsigned add_reference() throw() 
        { 
                return ++refcount; 
        }
        unsigned remove_reference() throw()
        { 
                return --refcount; 
        }
        unsigned get_refcount() const throw() 
        { 
                return refcount; 
        }
        void set_refcount(unsigned r) throw() 
        { 
                refcount = r; 
        }
private:
        unsigned refcount;
};

class ex;

class basic : public refcounted
{
public:
        basic() : flags(false) { }
        basic(const basic& other) : flags(false) { }
        virtual basic* duplicate() const 
        { 
                return new basic(*this); 
        }
        virtual ex eval() const;
        virtual ~basic() { }
protected:
        mutable bool flags;
private:
        friend class ex;
};

class ex {
private:
        mutable ptr<basic> bp;
        static ptr<basic> construct_from_basic(const basic& other)
        {
                if (other.flags)
                        return ptr<basic>(const_cast<basic &>(other));
                else {
                        basic* t = other.duplicate();
                        t->flags = true;
                        return t;
                }
        }
public:
        ex(const basic& other) : bp(construct_from_basic(other)) { }
        ex eval() const 
        { 
                return bp->eval();
        }
};

ex basic::eval() const
{
        return *this;
}

class oops : public basic
{
public:
        oops() { }
        oops* duplicate() const 
        { 
                return new oops(*this); 
        }
        ex eval() const
        {
                return oops();
        }
};

int main(int argc, char** argv)
{
        const ex e = oops();
        const ex& f = argc > 1 ? e : e.eval();
        const ex& g = f.eval();
        return 0;
}


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3.{0,1} miscompile this simple program

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu dot
                   |                            |org
           Keywords|                            |wrong-code
      Known to fail|                            |4.3.0
      Known to work|                            |4.2.3
            Summary|g++ 4.3.{0,1} miscompile    |[4.3/4.4 Regression] g++
                   |this simple program         |4.3.{0,1} miscompile this
                   |                            |simple program
   Target Milestone|---                         |4.3.1


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3.{0,1} miscompile this simple program

[hjl dot tools at gmail dot com]

------- Comment #4 from hjl dot tools at gmail dot com  2008-03-13 22:11 -------
Revision 129596:

http://gcc.gnu.org/ml/gcc-cvs/2007-10/msg00701.html
http://gcc.gnu.org/ml/gcc-patches/2007-10/msg01386.html

is the cause.


-- 

hjl dot tools at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hjl dot tools at gmail dot
                   |                            |com, jason at redhat dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3 miscompile this simple program

[rguenth at gcc dot gnu dot org]

-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
            Summary|[4.3/4.4 Regression] g++    |[4.3/4.4 Regression] g++ 4.3
                   |4.3.{0,1} miscompile this   |miscompile this simple
                   |simple program              |program


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3 miscompile this simple program

[jason at gcc dot gnu dot org]

-- 

jason at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |jason at gcc dot gnu dot org
                   |dot org                     |
             Status|UNCONFIRMED                 |ASSIGNED
     Ever Confirmed|0                           |1
   Last reconfirmed|0000-00-00 00:00:00         |2008-03-17 21:28:26
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3 miscompile this simple program

[jason at gcc dot gnu dot org]

------- Comment #5 from jason at gcc dot gnu dot org  2008-03-18 02:53 -------
Subject: Bug 35548

Author: jason
Date: Tue Mar 18 02:52:34 2008
New Revision: 133299

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=133299
Log:
        PR c++/35548
        * call.c (reference_binding): Check LOOKUP_NO_TEMP_BIND when binding
        a temp directly to a reference as per DR391.

Added:
    trunk/gcc/testsuite/g++.dg/init/ref16.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/call.c
    trunk/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3 miscompile this simple program

[jason at gcc dot gnu dot org]

------- Comment #7 from jason at gcc dot gnu dot org  2008-03-18 02:57 -------
Fixed in 4.3 and 4.4.


-- 

jason at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548

[Bug c++/35548] [4.3/4.4 Regression] g++ 4.3 miscompile this simple program

[jason at gcc dot gnu dot org]

------- Comment #6 from jason at gcc dot gnu dot org  2008-03-18 02:57 -------
Subject: Bug 35548

Author: jason
Date: Tue Mar 18 02:56:52 2008
New Revision: 133300

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=133300
Log:
        PR c++/35548
        * call.c (reference_binding): Check LOOKUP_NO_TEMP_BIND when binding
        a temp directly to a reference as per DR391.

Added:
    branches/gcc-4_3-branch/gcc/testsuite/g++.dg/init/ref16.C
      - copied unchanged from r133299, trunk/gcc/testsuite/g++.dg/init/ref16.C
Modified:
    branches/gcc-4_3-branch/gcc/cp/ChangeLog
    branches/gcc-4_3-branch/gcc/cp/call.c
    branches/gcc-4_3-branch/gcc/testsuite/ChangeLog


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548