[Bug libstdc++/109889] [13/14 Regression] Segfault in __run_exit_handlers since r13-5309-gc3c6c307792026

["tuliom at ascii dot art.br" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109889

--- Comment #5 from Tulio Magno Quites Machado Filho <tuliom at ascii dot art.br> ---
(In reply to Jonathan Wakely from comment #3)
> I wonder if we have a static destructor ordering problem.

I'm afraid the issue is happening earlier, when these iterators are being
initialized.
Look at this backtrace taken during initialization:

#0  0x00007ffff7b536e4 in __gnu_debug::_Safe_sequence_base::_M_attach_single
(this=0x100414c8 <__gnu_cxx::annotate_base::map_alloc()::_S_map>, 
    __it=0x7fffffffe8f8, __constant=false) at
/home/test/src/gcc/libstdc++-v3/src/c++11/debug.cc:396
#1  0x00007ffff7b5376c in __gnu_debug::_Safe_sequence_base::_M_attach
(this=0x100414c8 <__gnu_cxx::annotate_base::map_alloc()::_S_map>, 
    __it=0x7fffffffe8f8, __constant=false) at
/home/test/src/gcc/libstdc++-v3/src/c++11/debug.cc:383
#2  0x00007ffff7b53cd8 in __gnu_debug::_Safe_iterator_base::_M_attach
(this=0x7fffffffe8f8, 
    __seq=0x100414c8 <__gnu_cxx::annotate_base::map_alloc()::_S_map>,
__constant=false) at /home/test/src/gcc/libstdc++-v3/src/c++11/debug.cc:430
#3  0x0000000010012244 in __gnu_debug::_Safe_iterator_base::_Safe_iterator_base
(__constant=false, 
    __seq=0x100414c8 <__gnu_cxx::annotate_base::map_alloc()::_S_map>,
this=<optimized out>)
    at /home/test/gcc-14/include/c++/14.0.0/debug/safe_base.h:91
#4  __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<void* const,
std::pair<unsigned long, unsigned long> > >, std::__debug::map<void*,
std::pair<unsigned long, unsigned long>, std::less<void*>,
std::allocator<std::pair<void* const, std::pair<unsigned long, unsigned long> >
> >, std::forward_iterator_tag>::_Safe_iterator (__seq=0x100414c8
<__gnu_cxx::annotate_base::map_alloc()::_S_map>, __i=..., this=0x7fffffffe8f0)
    at /home/test/gcc-14/include/c++/14.0.0/debug/safe_iterator.h:162
#5  __gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<void* const,
std::pair<unsigned long, unsigned long> > >, std::__debug::map<void*,
std::pair<unsigned long, unsigned long>, std::less<void*>,
std::allocator<std::pair<void* const, std::pair<unsigned long, unsigned long> >
> >, std::bidirectional_iterator_tag>::_Safe_iterator (__seq=0x100414c8
<__gnu_cxx::annotate_base::map_alloc()::_S_map>, __i=..., this=0x7fffffffe8f0)
    at /home/test/gcc-14/include/c++/14.0.0/debug/safe_iterator.h:539
#6  std::__debug::map<void*, std::pair<unsigned long, unsigned long>,
std::less<void*>, std::allocator<std::pair<void* const, std::pair<unsigned
long, unsigned long> > > >::find (__x=<synthetic pointer>: 0x0, this=0x100414c8
<__gnu_cxx::annotate_base::map_alloc()::_S_map>)
    at /home/test/gcc-14/include/c++/14.0.0/debug/map.h:583
#7  __gnu_cxx::annotate_base::check_allocated (this=<optimized out>, size=4,
p=0x0)
    at /home/test/gcc-14/include/c++/14.0.0/ext/throw_allocator.h:177
#8  __gnu_cxx::annotate_base::erase (p=p@entry=0x0, size=size@entry=4,
this=<optimized out>)
    at /home/test/gcc-14/include/c++/14.0.0/ext/throw_allocator.h:146
#9  0x0000000010010474 in __gnu_cxx::throw_allocator_base<int,
__gnu_cxx::random_condition>::deallocate (this=<synthetic pointer>, __n=1, 
    __p=0x0) at /home/test/gcc-14/include/c++/14.0.0/ext/throw_allocator.h:888
#10 __gnu_test::check_deallocate_null<__gnu_cxx::throw_allocator_random<int> >
()
    at /home/test/src/gcc/libstdc++-v3/testsuite/util/testsuite_allocator.h:255
#11 main () at
/home/test/src/gcc/libstdc++-v3/testsuite/ext/throw_allocator/check_deallocate_null.cc:30

Frame #2 references 0x7fffffffe8f8, which is part of the stack. Frame #5 is
also referencing an object in the stack.
After these functions return, these objects shouldn't be used anymore.