[Bug c++/103711] New: Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[Bug c++/103711] New: Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[pierre.mantion at cern dot ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

            Bug ID: 103711
           Summary: Virtual base destroyed twice when an exception is
                    thrown in a derived class' constructor called from a
                    delegated constructor
           Product: gcc
           Version: 11.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: pierre.mantion at cern dot ch
  Target Milestone: ---

Created attachment 52000
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52000&action=edit
preprocessed file that triggers the bug

Virtual base destroyed twice when an exception is thrown in a derived class'
constructor called from a delegated constructor:

The code below causes A’s destructor to be called twice on the same object.
This is the most I could reduce the code to have it trigger the bug.

    #include <iostream>

    int constructions = 0;
    int destructions = 0;

    struct A
    {
        A()
        {
            constructions++;
        }
        virtual ~A() {
            destructions++;
        }
    };

    struct B : public virtual A
    {
        B(int)
        {
        };

        B() : B(1)
        {
            throw -1;
        }
        virtual ~B() = default;
    };

    struct C : public B
    {
    };

    int main() {
        try
        {
            C c;
        }
        catch (int e)
        {
            std::cout << "Caught: " << e << std::endl;
        }
        std::cout << constructions << " constructions" << std::endl;
        std::cout << destructions << " destructions" << std::endl;
        return 0;
    }

Expected output:

    Caught: -1
    1 constructions
    1 destructions

Actual output:

    Caught: -1
    1 constructions
    2 destructions

This seems to be a combination of the “virtual” inheritance in B, the call to
the delegating constructor in B, and the exception thrown in B’s no arg
constructor.
Removing either of these makes the program behave as expected.
Constructing a B instead of a C works fine.

GCC latest version and ICC latest version have the same issue, but clang latest
version doesn’t.

Tested on Godbolt:
- Works/behaves as expected with Clang 13 (https://godbolt.org/z/4Yr5hWW5c)
- fails with GCC 11.2 (https://godbolt.org/z/cr8bz4hMc)
- fails with MSVC 19.29 (https://godbolt.org/z/b3Pd5PEfe)
- fails with ICC 2021.3.0 (https://godbolt.org/z/caM41fjao)
- (other compilers not tested yet).

The problematic behavior was reproduced locally with version of GCC:
% gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-pc-linux-gnu/11.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /build/gcc/src/gcc/configure --prefix=/usr --libdir=/usr/lib
--libexecdir=/usr/lib --mandir=/usr/share/man --infodir=/usr/share/info
--with-bugurl=https://bugs.archlinux.org/
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++,d --with-isl
--with-linker-hash-style=gnu --with-system-zlib --enable-__cxa_atexit
--enable-cet=auto --enable-checking=release --enable-clocale=gnu
--enable-default-pie --enable-default-ssp --enable-gnu-indirect-function
--enable-gnu-unique-object --enable-install-libiberty --enable-linker-build-id
--enable-lto --enable-multilib --enable-plugin --enable-shared
--enable-threads=posix --disable-libssp --disable-libstdcxx-pch
--disable-libunwind-exceptions --disable-werror
gdc_include_dir=/usr/include/dlang/gdc
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.1.0 (GCC) 

The incorrect behavior can be reproduced as well with GCC 4.8.5 (need to pass
-std=c++11 to compile in that case).
% gcc -v
Using built-in specs.
COLLECT_GCC=/acc/sys/L867/usr/bin/g++
COLLECT_LTO_WRAPPER=/nfs/cs-ccr-felab/sys/L867/usr/bin/../libexec/gcc/x86_64-redhat-linux/4.8.5/lto-wrapper
Target: x86_64-redhat-linux
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla
--enable-bootstrap --enable-shared --enable-threads=posix
--enable-checking=release --with-system-zlib --enable-__cxa_atexit
--disable-libunwind-exceptions --enable-gnu-unique-object
--enable-linker-build-id --with-linker-hash-style=gnu
--enable-languages=c,c++,objc,obj-c++,java,fortran,ada,go,lto --enable-plugin
--enable-initfini-array --disable-libgcj
--with-isl=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/isl-install
--with-cloog=/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/cloog-install
--enable-gnu-indirect-function --with-tune=generic --with-arch_32=x86-64
--build=x86_64-redhat-linux
Thread model: posix
gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) 

Complete command to reproduce (GCC 11.1.0):

    g++ -v -save-temps -Wall -Wextra reproducer.cpp && ./a.out

Complete command to reproduce (GCC 4.8.5):

    g++ -v -save-temps -Wall -Wextra reproducer.cpp -std=c++11 && ./a.out

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
ICC has the same behavior ....

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[sebastian.redl at getdesigned dot at]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

Sebastian Redl <sebastian.redl at getdesigned dot at> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sebastian.redl@getdesigned.
                   |                            |at

--- Comment #2 from Sebastian Redl <sebastian.redl at getdesigned dot at> ---
Clang does not.

Here's an extended test case:

#include <iostream>

using namespace std;

int constructions = 0;
int destructions = 0;

struct A
{
    A()
    {
        constructions++;
    }
    virtual ~A() {
        destructions++;
    }
};

struct B : public virtual A
{
    B(int dummy)
    {
    };
    B() : B(1) {
        throw -1;
    }
    virtual ~B() = default;
};

struct C : public B
{
};

int main() {
    try
    {
        B b;
    }
    catch (int e)
    {
        cout << "Caughtb: " << e << endl;
    }
    try
    {
        C c;
    }
    catch (int e)
    {
        cout << "Caughtc: " << e << endl;
    }
    cout << constructions << " constructions" << endl;
    cout << destructions << " destructions" << endl;
}

Now GCC generates two versions of B::B(): one called by the complete object
construction on the stack, and one called by the base object construction in
C::C().

Unfortunately, both versions call the complete object destructor B::~B() in
their unwinding code, when the base object delegating constructor should call
the base object destructor.

Here's a godbolt link with the generated assembly:
https://godbolt.org/z/hEvYjrsGj

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-12-15
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Usually when a constructor throws you don't call the destructor, because the
object hasn't finished being constructed yet. But for a delegating constructor,
once the target constructor finishes the object's lifetime has begun, and so
the destructor *does* get run. It seems that both B::B() and B::B(int) think
they are in-charge of the virtual base and so both run the destructor for it.

G++ has had this bug since delegating constructor were first implemented in GCC
4.7.0

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Without the library dependency, and without the defaulted destructor (since GCC 

int constructions = 0;
int destructions = 0;

struct A
{
  A()
  {
    constructions++;
  }
  virtual ~A() {
    destructions++;
  }
};

struct B : public virtual A
{
  B(int)
  {
  };

  B() : B(1)
  {
    throw -1;
  }
  virtual ~B() = default;
};

struct C : public B
{
};

int main() {
  try
  {
    C c;
  }
  catch (int)
  {
  }
  if (constructions != destructions)
    throw 1;
  return 0;
}

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #4)
> Without the library dependency, and without the defaulted destructor (since
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Oops, ignore that part, I meant to delete it.

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jason at gcc dot gnu.org
                 CC|                            |jason at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:32d8ff73718fd07a9a7dfd2566d3b7b69f37b6bd

commit r12-6335-g32d8ff73718fd07a9a7dfd2566d3b7b69f37b6bd
Author: Jason Merrill <jason@redhat.com>
Date:   Wed Jan 5 19:39:48 2022 -0500

    c++: when delegating constructor throws [PR103711]

    We were always calling the complete destructor if the target constructor
    throws, even if we were calling the base constructor.

            PR c++/103711

    gcc/cp/ChangeLog:

            * init.c (perform_target_ctor): Select destructor by in_chrg.

    gcc/testsuite/ChangeLog:

            * g++.dg/eh/delegating1.C: New test.

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.0

--- Comment #7 from Jason Merrill <jason at gcc dot gnu.org> ---
Fixed for GCC 12 so far.  I plan to backport the fix to GCC 11 soon.

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jason Merrill
<jason@gcc.gnu.org>:

https://gcc.gnu.org/g:2aa4400cb9830da0a335a8cbb75183706714b28d

commit r11-9520-g2aa4400cb9830da0a335a8cbb75183706714b28d
Author: Jason Merrill <jason@redhat.com>
Date:   Wed Jan 5 19:39:48 2022 -0500

    c++: when delegating constructor throws [PR103711]

    We were always calling the complete destructor if the target constructor
    throws, even if we were calling the base constructor.

            PR c++/103711

    gcc/cp/ChangeLog:

            * init.c (perform_target_ctor): Select destructor by in_chrg.

    gcc/testsuite/ChangeLog:

            * g++.dg/eh/delegating1.C: New test.

[Bug c++/103711] Virtual base destroyed twice when an exception is thrown in a derived class' constructor called from a delegated constructor

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103711

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.3
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jason Merrill <jason at gcc dot gnu.org> ---
Fixed for 11.3/12.