From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-455896-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 27791 invoked by alias); 8 Jul 2014 16:34:55 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 27526 invoked by uid 48); 8 Jul 2014 16:34:43 -0000
From: "personal@e-maxx.ru" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/61751] New: Empty brace-initializer causes double destruction of unique_ptr
Date: Tue, 08 Jul 2014 16:34:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.8.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: personal@e-maxx.ru
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter attachments.created
Message-ID: <bug-61751-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00487.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61751

            Bug ID: 61751
           Summary: Empty brace-initializer causes double destruction of
                    unique_ptr
           Product: gcc
           Version: 4.8.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: personal@e-maxx.ru

Created attachment 33091
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33091&action=edit
Full example.

Use of empty brace-initializer in default function argument causes strange
effects and, finally, crashes.

The minimal code is:


#include <memory>

class A {
    std::unique_ptr<int> ptr_;
public:
    A() : ptr_(new int(123))
    { }
    A(A&& other) : ptr_(std::move(other.ptr_))
    { }
};

void f(A a)
{ }

void g(A a = {}) // replace "{}" with "A()" makes it work
{ f(std::move(a)); }

int main()
{ g(); }


There is a more detailed example in the attachment, which produces some debug
output, e.g.:

A() called [this=0x7ffffbac34f0, constructed unique_ptr=0xe18010]
A(A&&) called [this=0x7ffffbac34b0, other=0x7ffffbac34d0]
~A() called [this=0x7ffffbac34b0, unique_ptr=0xe18010]
~A() called [this=0x7ffffbac34f0, unique_ptr=0xe18010]
*** glibc detected *** ./a.out: double free or corruption (fasttop):
0x0000000000e18010 ***

On the contrary, using some correct version of compiler (I tried 4.6.3 and
4.9.0) we get:

A() called [this=0x7fff77c52810, constructed unique_ptr=0xe1c010]
A(A&&) called [this=0x7fff77c527e0, other=0x7fff77c52810]
~A() called [this=0x7fff77c527e0, unique_ptr=0xe1c010]
~A() called [this=0x7fff77c52810, unique_ptr=0]

As it can be seen, the difference is that the bogus version moves from object
that has never been constructed.