[Bug c++/61769] New: const reference value is changed to random by a range-for loop

[Bug c++/61769] New: const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

            Bug ID: 61769
           Summary: const reference value is changed to random by a
                    range-for loop
           Product: gcc
           Version: 4.8.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: theemathas at hotmail dot com

I previously thought that the g++ compiler should not contain bugs when
compiling valid code without using very strange tricks. However, the bug I
found can be generated using a relatively simple program. 

A const reference is assigned to be the result of a certain function, and the
value is somehow changed by a for-each loop (that is supposedly useless) to a
random value.

The non-preprocessed source code I have is very short (18 actual code lines,
counted by code::blocks).
It should output 55 (a random literal hard-coded into the program)
It outputs random values, changing on each run.

-----start output of "g++ -v"-----

Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/4.8/lto-wrapper
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.8.2-19ubuntu1'
--with-bugurl=file:///usr/share/doc/gcc-4.8/README.Bugs
--enable-languages=c,c++,java,go,d,fortran,objc,obj-c++ --prefix=/usr
--program-suffix=-4.8 --enable-shared --enable-linker-build-id
--libexecdir=/usr/lib --without-included-gettext --enable-threads=posix
--with-gxx-include-dir=/usr/include/c++/4.8 --libdir=/usr/lib --enable-nls
--with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --enable-gnu-unique-object --disable-libmudflap
--enable-plugin --with-system-zlib --disable-browser-plugin
--enable-java-awt=gtk --enable-gtk-cairo
--with-java-home=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64/jre --enable-java-home
--with-jvm-root-dir=/usr/lib/jvm/java-1.5.0-gcj-4.8-amd64
--with-jvm-jar-dir=/usr/lib/jvm-exports/java-1.5.0-gcj-4.8-amd64
--with-arch-directory=amd64 --with-ecj-jar=/usr/share/java/eclipse-ecj.jar
--enable-objc-gc --enable-multiarch --disable-werror --with-arch-32=i686
--with-abi=m64 --with-multilib-list=m32,m64,mx32 --with-tune=generic
--enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu
--target=x86_64-linux-gnu
Thread model: posix
gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1) 

-----end output of "g++ -v"-----


No warnings or errors when compiling program with "g++ -std=c++11 -pedantic
-Wall -Wextra main.cpp".
The bug disappears after adding one of the following flags: "-O1", "-O2", "-O3"
The shortest command line that still produces the bug is "g++ -std=c++11
main.cpp"

The "main.ii" file created using the command "g++ -save-temps -std=c++11
-pedantic -Wall -Wextra main.cpp" is attached

Thank you.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

theemathas at hotmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |theemathas at hotmail dot com

--- Comment #1 from theemathas at hotmail dot com ---
Created attachment 33099
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33099&action=edit
"main.cpp" non-preprocessed source code

I am having some problems with uploading the "main.ii" file (apparently it is
too big because I #include 3 standard libraries). I am uploading the
non-preprocessed source code first, and I will upload the preprocessed code
ASAP.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to theemathas from comment #1)
> I am having some problems with uploading the "main.ii" file (apparently it
> is too big because I #include 3 standard libraries). I am uploading the
> non-preprocessed source code first, and I will upload the preprocessed code
> ASAP.

Don't bother, the program is invalid. std::abs returns a temporary that goes
out of scope at the end of the expression, std::max returns a dangling
reference to that temporary.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID
           Severity|major                       |normal

--- Comment #3 from Jonathan Wakely <redi at gcc dot gnu.org> ---
The for loop just causes the program to reuse the stack memory where the
std::abs return slots were, so the memory where the dangling reference points
gets modified and you see the value change.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

theemathas at hotmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |---

--- Comment #4 from theemathas at hotmail dot com ---
(In reply to Jonathan Wakely from comment #2)
> (In reply to theemathas from comment #1)
> > I am having some problems with uploading the "main.ii" file (apparently it
> > is too big because I #include 3 standard libraries). I am uploading the
> > non-preprocessed source code first, and I will upload the preprocessed code
> > ASAP.
> 
> Don't bother, the program is invalid. std::abs returns a temporary that goes
> out of scope at the end of the expression, std::max returns a dangling
> reference to that temporary.

(In reply to Jonathan Wakely from comment #3)
> The for loop just causes the program to reuse the stack memory where the
> std::abs return slots were, so the memory where the dangling reference
> points gets modified and you see the value change.

I think my program is valid

According to http://en.cppreference.com/w/cpp/algorithm/max : std::max can
accept "const int&" as parameters

According to
http://herbsutter.com/2008/01/01/gotw-88-a-candidate-for-the-most-important-const/
: binding a temporary to a const reference "lengthens the lifetime of the
temporary to the lifetime of the reference itself"

Thus, no dangling reference.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

theemathas at hotmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |redi at gcc dot gnu.org
           Severity|normal                      |major

[Bug c++/61769] const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

--- Comment #5 from theemathas at hotmail dot com ---
Created attachment 33100
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33100&action=edit
"main.ii.gz" preprocessed and compressed code

Since the "main.ii" file exceeds the 1000 KB limit, I'm uploading a compressed
file instead.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID
           Severity|major                       |normal

--- Comment #6 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to theemathas from comment #4)
> According to
> http://herbsutter.com/2008/01/01/gotw-88-a-candidate-for-the-most-important-
> const/ : binding a temporary to a const reference "lengthens the lifetime of
> the temporary to the lifetime of the reference itself"

You don't bind a temporary to a const-reference, you bind a const-reference to
a const-reference, so the lifetime of the temporary is not extended. The
lifetime extension behaviour is not transitive from reference to reference.

[Bug c++/61769] const reference value is changed to random by a range-for loop

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

--- Comment #7 from Jonathan Wakely <redi at gcc dot gnu.org> ---
If you change it to:

    const int& aa = std::abs(a);
    const int& foo=std::max(aa, aa);

You'll see that the problem goes away because the value returned by std::abs
gets its lifetime extended, then std::max returns a reference to the same
object, which has not gone out of scope.

Alternatively, avoid the pointless reference:

    int foo = std::max(std::abs(a), std::abs(a));

[Bug c++/61769] const reference value is changed to random by a range-for loop

[theemathas at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61769

--- Comment #8 from theemathas at hotmail dot com ---
(In reply to Jonathan Wakely from comment #7)
> If you change it to:
> 
> 	const int& aa = std::abs(a);
> 	const int& foo=std::max(aa, aa);
> 
> You'll see that the problem goes away because the value returned by std::abs
> gets its lifetime extended, then std::max returns a reference to the same
> object, which has not gone out of scope.
> 
> Alternatively, avoid the pointless reference:
> 
> 	int foo = std::max(std::abs(a), std::abs(a));

OK... I think I understand now.
By the way, I managed to find the exact text in the standard that states that
the code is invalid:

http://stackoverflow.com/questions/2784262/does-a-const-reference-prolong-the-life-of-a-temporary

"The lifetime extension is not transitive through a function argument. §12.2/5
[class.temporary]: '...A temporary bound to a reference parameter in a function
call (§5.2.2 [expr.call]) persists until the completion of the full expression
containing the call.' "

Thank you for explaining this, though.
>From gcc-bugs-return-456040-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jul 10 10:44:26 2014
Return-Path: <gcc-bugs-return-456040-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9462 invoked by alias); 10 Jul 2014 10:44:25 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9381 invoked by uid 55); 10 Jul 2014 10:44:19 -0000
From: "ebotcazou at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug middle-end/53590] compiler fails to generate SIMD instruction for FP division
Date: Thu, 10 Jul 2014 10:44:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: middle-end
X-Bugzilla-Version: 4.8.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: enhancement
X-Bugzilla-Who: ebotcazou at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: ebotcazou at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.8.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-53590-4-IwXHRfJqdi@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-53590-4@http.gcc.gnu.org/bugzilla/>
References: <bug-53590-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00631.txt.bz2
Content-length: 645

https://gcc.gnu.org/bugzilla/show_bug.cgi?idS590

--- Comment #15 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Author: ebotcazou
Date: Thu Jul 10 10:43:46 2014
New Revision: 212426

URL: https://gcc.gnu.org/viewcvs?rev!2426&root=gcc&view=rev
Log:
    PR middle-end/53590
    * function.c (allocate_struct_function): Revert r188667 change.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/gnat.dg/opt39.adb
      - copied unchanged from r212425, trunk/gcc/testsuite/gnat.dg/opt39.adb
Modified:
    branches/gcc-4_8-branch/gcc/ChangeLog
    branches/gcc-4_8-branch/gcc/function.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog