[Bug libstdc++/55320] New: Invalid delete with throwing copy-c'tor passed to std::function

[Bug libstdc++/55320] New: Invalid delete with throwing copy-c'tor passed to std::function

[benjamin.kircher at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

             Bug #: 55320
           Summary: Invalid delete with throwing copy-c'tor passed to
                    std::function
    Classification: Unclassified
           Product: gcc
           Version: 4.7.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: benjamin.kircher@gmail.com


Created attachment 28682
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28682
Example program

The example program attached compiles w/o warnings and crashes with an invalid
delete when executed.


$ gcc --version
gcc (Debian 4.7.2-4) 4.7.2


$ cat main.cpp
#include <functional>
#include <stdexcept>
#include <iostream>
#include <ostream>

struct functor
{
    functor() = default;
    functor(const functor&) { throw std::exception(); }
    void operator()() {}
};

int main()
try
{
    std::function<void()> func = functor();
    return 0;
}
catch (std::exception&)
{
    std::cout << "catched" << std::endl;
}


Valgrind gives me
$ valgrind --tool=memcheck ./a.out
<snip>
==...== Invalid free() / delete / delete[] / realloc()
==...==    at 0x...: operator delete(void*) (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==...==    by 0x...:
std::_Function_base::_Base_manager<functor>::_M_destroy(std::_Any_data&,
std::integral_constant<bool, false>) (functional:1780)
==...==    by 0x...:
std::_Function_base::_Base_manager<functor>::_M_manager(std::_Any_data&,
std::_Any_data const&, std::_Manager_operation) (functional:1804)
==...==    by 0x...: std::_Function_base::~_Function_base() (functional:1885)
==...==    by 0x...: std::function<void ()>::function<functor>(functor,
std::enable_if<!(std::is_integral<functor>::value), std::function<void
()>::_Useless>::type) (functional:2292)
<snip>

On clang/libc++ this behaves as expected.

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[benjamin.kircher at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

--- Comment #1 from Benjamin Kircher <benjamin.kircher at gmail dot com> 2012-11-14 08:10:06 UTC ---
Sorry.

System type was
$ uname -a
Linux <snip> 3.2.0-4-486 #1 Debian 3.2.32-1 i686 GNU/Linux
$ file a.out 
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically
linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=<snip>, not
stripped


Command line that produced the error was
$ g++ -g -std=c++11 -Wall -Wextra -pedantic main.cpp

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[daniel.kruegler at googlemail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

Daniel Krügler <daniel.kruegler at googlemail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |daniel.kruegler at
                   |                            |googlemail dot com

--- Comment #2 from Daniel Krügler <daniel.kruegler at googlemail dot com> 2012-11-14 09:45:56 UTC ---
On gcc 4.8 HEAD on my mingw-64-bit-system the program behaves normally and just
outputs "catched"

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-11-14
                 CC|                            |jwakely.gcc at gmail dot
                   |                            |com
     Ever Confirmed|0                           |1

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-11-14 10:42:44 UTC ---
On Linux Seg faults everywhere, thus doesn't seem a regression, but we should
look into it. Maybe Jon can help..

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |redi at gcc dot gnu.org
                   |gnu.org                     |
   Target Milestone|---                         |4.7.3

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> 2012-11-14 12:12:19 UTC ---
Untested:

--- functional.orig     2012-11-14 12:11:32.442993035 +0000
+++ functional  2012-11-14 12:11:34.315184425 +0000
@@ -2318,8 +2318,8 @@
        if (_My_handler::_M_not_empty_function(__f))
          {
            _M_invoker = &_My_handler::_M_invoke;
-           _M_manager = &_My_handler::_M_manager;
            _My_handler::_M_init_functor(_M_functor, std::move(__f));
+           _M_manager = &_My_handler::_M_manager;
          }
       }

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

--- Comment #5 from Jonathan Wakely <redi at gcc dot gnu.org> 2012-11-14 23:33:08 UTC ---
Author: redi
Date: Wed Nov 14 23:33:01 2012
New Revision: 193514

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=193514
Log:
    PR libstdc++/55320
    * include/std/functional (function::function(F)): Set _M_manager after
    operations that could throw.
    (_Function_base::_Ref_manager::_M_init_functor): Use addressof.
    * include/tr1/functional
    (_Function_base::_Ref_manager::_M_init_functor): Use addressof.
    (_Function_base::_Base_manager::_M_get_pointer): Likewise.
    * testsuite/20_util/function/cons/55320.cc: New.
    * testsuite/20_util/function/cons/addressof.cc: New.
    * testsuite/20_util/function/cons/callable.cc: Remove header.
    * testsuite/20_util/bind/ref_neg.cc: Adjust dg-error line numbers.
    * testsuite/tr1/3_function_objects/function/10.cc: New.

Added:
    trunk/libstdc++-v3/testsuite/20_util/function/cons/55320.cc
      - copied, changed from r193513,
trunk/libstdc++-v3/testsuite/20_util/function/cons/callable.cc
    trunk/libstdc++-v3/testsuite/20_util/function/cons/addressof.cc
      - copied, changed from r193513,
trunk/libstdc++-v3/testsuite/20_util/function/cons/callable.cc
    trunk/libstdc++-v3/testsuite/tr1/3_function_objects/function/10.cc
      - copied, changed from r193513,
trunk/libstdc++-v3/testsuite/20_util/function/cons/callable.cc
Modified:
    trunk/libstdc++-v3/ChangeLog
    trunk/libstdc++-v3/include/std/functional
    trunk/libstdc++-v3/include/tr1/functional
    trunk/libstdc++-v3/testsuite/20_util/bind/ref_neg.cc
    trunk/libstdc++-v3/testsuite/20_util/function/cons/callable.cc

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> 2012-11-15 00:21:16 UTC ---
Author: redi
Date: Thu Nov 15 00:21:09 2012
New Revision: 193520

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=193520
Log:
    PR libstdc++/55320
    * include/std/functional (function::function(F)): Set _M_manager after
    operations that could throw.
    (_Function_base::_Ref_manager::_M_init_functor): Use addressof.
    * include/tr1/functional
    (_Function_base::_Ref_manager::_M_init_functor): Use addressof.
    (_Function_base::_Base_manager::_M_get_pointer): Likewise.
    * testsuite/20_util/function/cons/55320.cc: New.
    * testsuite/20_util/function/cons/addressof.cc: New.
    * testsuite/20_util/bind/ref_neg.cc: Adjust dg-error line numbers.
    * testsuite/tr1/3_function_objects/function/10.cc: New.

Added:
   
branches/gcc-4_7-branch/libstdc++-v3/testsuite/20_util/function/cons/55320.cc
   
branches/gcc-4_7-branch/libstdc++-v3/testsuite/20_util/function/cons/addressof.cc
   
branches/gcc-4_7-branch/libstdc++-v3/testsuite/tr1/3_function_objects/function/10.cc
Modified:
    branches/gcc-4_7-branch/libstdc++-v3/ChangeLog
    branches/gcc-4_7-branch/libstdc++-v3/include/std/functional
    branches/gcc-4_7-branch/libstdc++-v3/include/tr1/functional
    branches/gcc-4_7-branch/libstdc++-v3/testsuite/20_util/bind/ref_neg.cc

[Bug libstdc++/55320] Invalid delete with throwing copy-c'tor passed to std::function

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55320

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> 2012-11-15 00:23:09 UTC ---
fixed