[Bug libstdc++/49060] New: use of deleted memory in __gnu_cxx::hashtable::erase

[Bug libstdc++/49060] New: use of deleted memory in __gnu_cxx::hashtable::erase

[dtardon at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

           Summary: use of deleted memory in __gnu_cxx::hashtable::erase
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: minor
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: dtardon@redhat.com


Created attachment 24289
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24289
reproducer

How to reproduce:
1. get the attached reproducer
2. g++ -Wall -g -O0 hashtable.cc -o hashtable
3. valgrind ./hashtable

Note:
I think this cannot be triggered through normal use of std::hash_map or
std::hash_set, because it requires that the bucket contains two nodes with
equal key.

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[dtardon at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

--- Comment #1 from David Tardon <dtardon at redhat dot com> 2011-05-19 11:26:42 UTC ---
Created attachment 24290
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=24290
patch

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

--- Comment #2 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-05-19 12:04:27 UTC ---
Personally I consider this legacy code essentially frozen, and don't mean to
spend time on it barring serious regressions. If Ian can review the patch and
approve it, I don't object, though.

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011.05.19 12:03:35
     Ever Confirmed|0                           |1

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |iant at google dot com

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-05-19 12:15:10 UTC ---
CC-ing Ian.

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[ian at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

--- Comment #4 from ian at gcc dot gnu.org <ian at gcc dot gnu.org> 2011-05-25 23:09:20 UTC ---
Author: ian
Date: Wed May 25 23:09:14 2011
New Revision: 174240

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=174240
Log:
    PR libstdc++/49060
    * include/backward/hashtable.h (hashtable::erase): Don't crash if
    erasing first and another element with a reference to the other
    element.
    * testsuite/backward/hash_set/49060.cc: New.

Added:
    trunk/libstdc++-v3/testsuite/backward/hash_set/49060.cc
Modified:
    trunk/libstdc++-v3/ChangeLog
    trunk/libstdc++-v3/include/backward/hashtable.h

[Bug libstdc++/49060] use of deleted memory in __gnu_cxx::hashtable::erase

[ian at airs dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49060

Ian Lance Taylor <ian at airs dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |ian at airs dot com
         Resolution|                            |FIXED

--- Comment #5 from Ian Lance Taylor <ian at airs dot com> 2011-05-25 23:09:37 UTC ---
Fixed.  Thanks.