[Bug ipa/109770] [10/11/12/13/14 Regression] wrong(?) devirtualization

["rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109770

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to m.cencora from comment #6)
> (In reply to Richard Biener from comment #0)
> > #include <new>
> > 
> > struct Base
> > {
> >   virtual ~Base() {}
> > };
> > struct A : Base
> > {
> >   virtual ~A() {}
> > };
> > struct B : Base
> > {
> >   [[gnu::noinline]] B() { new (this) A; }
> >   virtual ~B() { __builtin_abort (); }
> > };
> > int main()
> > {
> >   Base *p = new B;
> >   delete p;
> > }
> > 
> > aborts when compiled with -O2 (with devirtualization enabled).  Neither
> > GCC nor clang diagnose the placement new in B::B() (but it looks fishy).
> 
> I believe you need to std::launder the p pointer before calling delete:
> https://en.cppreference.com/w/cpp/utility/launder

Ah, interesting.  I was looking for an answer whether

 new T

may produce anything other than an object with dynamic type T or if there
are any constraints on the object constructed.  In particular C++20 11.10.4
refered to by 6.7.3 doesn't mention whether re-using the storage is
permitted for an object under construction.  It says usage is limited
and doesn't explicitely allow re-use so that might mean re-use is not allowed.

Note std::launder is C++17 only, the original reporter was using C++98 / C++14

Reading C++20, 6.7.3/9, at least suggests that the placement new (this) A
in the CTOR invokes undefined behavior because the lifetime of B hasn't
ended (but 6.7.3/1.5 makes this ambiguous - we're re-using the storage here,
and also we're not talking about an object with automatic storage duration).