[Bug c++/67557] New: Calling copy constructor of base class in constructor of derived class produces crashing code

[Bug c++/67557] New: Calling copy constructor of base class in constructor of derived class produces crashing code

[Georg.Baum at post dot rwth-aachen.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

            Bug ID: 67557
           Summary: Calling copy constructor of base class in constructor
                    of derived class produces crashing code
           Product: gcc
           Version: 5.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: Georg.Baum at post dot rwth-aachen.de
  Target Milestone: ---

Created attachment 36327
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=36327&action=edit
Test case

The bug reported below happens with a self compiled gcc on Linux (Debian
jessie):
$ LANG=C gcc-5.1 -v
Using built-in specs.
COLLECT_GCC=/home/u/bin-gcc5/bin/gcc-5.1
COLLECT_LTO_WRAPPER=/home/u/bin-gcc5/bin/../libexec/gcc/x86_64-unknown-linux-gnu/5.1.1/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-5-branch/configure --prefix=/home/u/bin-gcc5
--program-suffix=-5.1 --enable-languages=c,c++,fortran --disable-bootstrap :
(reconfigured) ../gcc-5-branch/configure --prefix=/home/u/bin-gcc5
--program-suffix=-5.1 --enable-languages=c,c++,fortran --disable-bootstrap
Thread model: posix
gcc version 5.1.1 20150507 (GCC) 

Compiling and running the attached example with

g++-5.1 t.cpp -o t && ./t

produces an eror:

*** Error in `./t': free(): invalid pointer: 0x00007ffd93f3cae0 ***
Aborted.

Running the test case with valgrind produces this:

==6021== Memcheck, a memory error detector
==6021== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==6021== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info
==6021== Command: ./t
==6021== 
==6021== Invalid free() / delete / delete[] / realloc()
==6021==    at 0x4C2A360: operator delete(void*) (vg_replace_malloc.c:507)
==6021==    by 0x4009E3: StartTag::~StartTag() (in /home/u/t)
==6021==    by 0x400A4B: FontTag::~FontTag() (in /home/u/t)
==6021==    by 0x400993: main (in /home/u/t)
==6021==  Address 0xffefffc80 is on thread 1's stack
==6021==  in frame #0, created by operator delete(void*)
(vg_replace_malloc.c:507)
==6021== 
==6021== 
==6021== HEAP SUMMARY:
==6021==     in use at exit: 72,704 bytes in 1 blocks
==6021==   total heap usage: 1 allocs, 1 frees, 72,704 bytes allocated
==6021== 
==6021== LEAK SUMMARY:
==6021==    definitely lost: 0 bytes in 0 blocks
==6021==    indirectly lost: 0 bytes in 0 blocks
==6021==      possibly lost: 0 bytes in 0 blocks
==6021==    still reachable: 72,704 bytes in 1 blocks
==6021==         suppressed: 0 bytes in 0 blocks
==6021== Rerun with --leak-check=full to see details of leaked memory
==6021== 
==6021== For counts of detected and suppressed errors, rerun with: -v
==6021== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

Compiling the same source with gcc 4.x produces a working executable. This bug
was originally reported as a LyX bug at
https://bugzilla.redhat.com/show_bug.cgi?id=1260976. The code may not be
oprtimal (and I am going to change it in LyX to work around the compiler bug),
but it is valid.

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |trippels at gcc dot gnu.org
         Resolution|---                         |INVALID

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
No, this is invalid and undefined.

See §12.6.2 - 14:

»Member functions (including virtual member functions, 10.3) can be called for
an object under construction. Similarly, an object under construction can be
the operand of the typeid operator (5.2.8) or of a dynamic_cast (5.2.7).
However, if these operations are performed in a ctor-initializer (or in a
function called directly or indirectly from a ctor-initializer) before all the
mem-initializers for base classes have completed, the result of the operation
is undefined.«
>From gcc-bugs-return-497044-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sat Sep 12 13:59:06 2015
Return-Path: <gcc-bugs-return-497044-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 115515 invoked by alias); 12 Sep 2015 13:59:05 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 115481 invoked by uid 48); 12 Sep 2015 13:59:02 -0000
From: "bisqwit at iki dot fi" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/67558] New: [C++] OpenMP "if" clause does not utilize compile-time constants
Date: Sat, 12 Sep 2015 13:59:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 5.1.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: bisqwit at iki dot fi
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-67558-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-09/txt/msg01022.txt.bz2
Content-length: 1510

https://gcc.gnu.org/bugzilla/show_bug.cgi?idg558

            Bug ID: 67558
           Summary: [C++] OpenMP "if" clause does not utilize compile-time
                    constants
           Product: gcc
           Version: 5.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bisqwit at iki dot fi
  Target Milestone: ---

Consider this example code.

    unsigned x;

    template<bool Threads>
    void plain_if(unsigned y)
    {
        if(Threads)
        {
            #pragma omp task firstprivate(y) shared(x)
            x = y >> 1;
        }
        else
        {
            x = y >> 1;
        }
    }

    template<bool Threads>
    void omp_if(unsigned y)
    {
        #pragma omp task if(Threads) firstprivate(y) shared(x)
        x = y >> 1;
    }

    void plain_if_false(unsigned y) { plain_if<false>(y); }
    void plain_if_true(unsigned y) { plain_if<true>(y); }

    void omp_if_false(unsigned y) { omp_if<false>(y); }
    void omp_if_true(unsigned y) { omp_if<true>(y); }

plain_if and omp_if do essentially the same thing. In both of them, the
template parameter "Threads" controls whether to create an OpenMP task for the
action or not.

However, when the code is compiled, all functions explicitly call GOMP_task,
except plain_if<false>.
It is clear that GCC treats a plain if() differently than an OpenMP if(). It is
a case of lacking optimization.

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #2 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
See PR67519 for a possible future compiler warning.

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[Georg.Baum at post dot rwth-aachen.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #3 from Georg Baum <Georg.Baum at post dot rwth-aachen.de> ---
Can you please explain why §12.6.2 - 14 is applicable? I do not see any member
function (virtual or not) being called on the partially constructed object. I
still think that this is valid code with well defined behaviour.
>From gcc-bugs-return-497079-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sun Sep 13 08:08:41 2015
Return-Path: <gcc-bugs-return-497079-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 100153 invoked by alias); 13 Sep 2015 08:08:40 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 98459 invoked by uid 48); 13 Sep 2015 08:08:36 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code
Date: Sun, 13 Sep 2015 08:08:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 5.1.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Resolution: INVALID
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-67557-4-uFZx0cStRL@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-67557-4@http.gcc.gnu.org/bugzilla/>
References: <bug-67557-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-09/txt/msg01057.txt.bz2
Content-length: 210

https://gcc.gnu.org/bugzilla/show_bug.cgi?idg557

--- Comment #4 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Well, the automatically generated copy constructor is a (special) member
function.

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[trippels at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |redi at gcc dot gnu.org

--- Comment #5 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
Anyway, the issue started with the new std::string implementation r218964.

Jonathan?

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[Georg.Baum at post dot rwth-aachen.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #6 from Georg Baum <Georg.Baum at post dot rwth-aachen.de> ---
(In reply to Markus Trippelsdorf from comment #4)
> Well, the automatically generated copy constructor is a (special) member
> function.

OK, I see what you mean, but I still do not understand. The automatically
generated default constructor is a special member function as well. Yet calling
it (implicitly by the compiler or explicitly by the programmer in the
initializer list) from a constructor of a derived class is legal. Also,
explicitly calling user defined constructors like in

FontTag::FontTag() : StartTag("") {}

is legal as well (at least this is my understanding and I have seen this many
times in existing code). What is special about a copy constructor that makes
§12.6.2 - 14 apply to it but not to other constructors?
>From gcc-bugs-return-497086-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sun Sep 13 10:39:08 2015
Return-Path: <gcc-bugs-return-497086-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 29843 invoked by alias); 13 Sep 2015 10:39:07 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 29727 invoked by uid 48); 13 Sep 2015 10:39:03 -0000
From: "dcb314 at hotmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/67563] New: verify_flow_info failed
Date: Sun, 13 Sep 2015 10:39:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 6.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: dcb314 at hotmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created
Message-ID: <bug-67563-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-09/txt/msg01064.txt.bz2
Content-length: 1449

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67563

            Bug ID: 67563
           Summary: verify_flow_info failed
           Product: gcc
           Version: 6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 36330
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=36330&action=edit
C source code

For trunk gcc dated 20150912

$ ../results/bin/gcc -c -O2 -fexceptions bug228.c
emit_lua.c: In function ‘emit_package.isra.20’:
emit_lua.c:1140:1: error: BB 167 can not throw but has an EH edge
emit_lua.c:1140:1: error: BB 180 can not throw but has an EH edge
emit_lua.c:1140:1: error: BB 192 can not throw but has an EH edge
emit_lua.c:1140:1: error: BB 204 can not throw but has an EH edge
emit_lua.c:1140:1: internal compiler error: verify_flow_info failed
0x722373 verify_flow_info()
        ../../src/trunk/gcc/cfghooks.c:262
0xa7c019 execute_function_todo
        ../../src/trunk/gcc/passes.c:1963
0xa7d557 do_per_function
        ../../src/trunk/gcc/passes.c:1642
0xa7d557 execute_todo
        ../../src/trunk/gcc/passes.c:2008
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
>From gcc-bugs-return-497087-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Sun Sep 13 10:58:02 2015
Return-Path: <gcc-bugs-return-497087-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 54750 invoked by alias); 13 Sep 2015 10:58:01 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 54140 invoked by uid 48); 13 Sep 2015 10:57:57 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/67563] verify_flow_info failed
Date: Sun, 13 Sep 2015 10:58:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 6.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on cc everconfirmed cf_known_to_fail
Message-ID: <bug-67563-4-bCub5B5KJO@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-67563-4@http.gcc.gnu.org/bugzilla/>
References: <bug-67563-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-09/txt/msg01065.txt.bz2
Content-length: 751

https://gcc.gnu.org/bugzilla/show_bug.cgi?idg563

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-09-13
                 CC|                            |trippels at gcc dot gnu.org
     Ever confirmed|0                           |1
      Known to fail|                            |5.2.1, 6.0

--- Comment #1 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
static void emit_package (int p1)
{
  int a;
  int b[0];
  a = __fprintf_chk (0, 0, "");
}
void emit_lua () { emit_package (0); }

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #9 from Jonathan Wakely <redi at gcc dot gnu.org> ---
(In reply to Jonathan Wakely from comment #8)
> 0x7ffdd31bbb60 constructed
> 0x7ffdd31bbb90 copied from 0x7ffdd31bbb60
> 0x7ffdd31bbb60 destroyed
> 0x7ffdd31bbbe0 x.tag_ in main()
> 0x7ffdd31bbbe0 destroyed
> Aborted (core dumped)
> 
> Note that the 'this' pointer in the copy constructor is 0x7fffde6c4d20,

Oops, that was an earlier run, in the output above it is 0x7ffdd31bbb90,

> which is not the address of x.tag_ and not the address in the destructor.

the object that gets destroyed is at 0x7ffdd31bbbe0

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #10 from Jonathan Wakely <redi at gcc dot gnu.org> ---
This reminds me of PR 62052 but doesn't involve lambdas.

[Bug c++/67557] Calling copy constructor of base class in constructor of derived class produces crashing code

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org

--- Comment #11 from Jonathan Wakely <redi at gcc dot gnu.org> ---
Jason, this is the copy elision bug I mentioned.

[Bug c++/67557] [4.9/5/6 regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Calling copy constructor of |[4.9/5/6 regression]
                   |base class in constructor   |Calling copy constructor of
                   |of derived class produces   |base class in constructor
                   |crashing code               |of derived class produces
                   |                            |crashing code

--- Comment #12 from Jason Merrill <jason at gcc dot gnu.org> ---
This seems to be a regression from 4.0.

[Bug c++/67557] [4.9/5/6 regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #13 from Jason Merrill <jason at gcc dot gnu.org> ---
Author: jason
Date: Thu Oct  8 14:42:02 2015
New Revision: 228602

URL: https://gcc.gnu.org/viewcvs?rev=228602&root=gcc&view=rev
Log:
        PR c++/67557

        * call.c (is_base_field_ref): New.
        (unsafe_copy_elision_p): New.
        (build_over_call): Use it.

Added:
    trunk/gcc/testsuite/g++.dg/init/elide3.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/call.c

[Bug c++/67557] [4.9/5/6 regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #14 from Jason Merrill <jason at gcc dot gnu.org> ---
Author: jason
Date: Mon Oct 12 07:58:43 2015
New Revision: 228704

URL: https://gcc.gnu.org/viewcvs?rev=228704&root=gcc&view=rev
Log:
        PR c++/67557

        * expr.c (store_field): Call store_constructor directly when
        storing a CONSTRUCTOR into a target smaller than its type.
        Guard against unsafe bitwise copy.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/expr.c
    trunk/gcc/testsuite/g++.dg/init/vbase1.C

[Bug c++/67557] [4.9/5/6 regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.4

[Bug c++/67557] [4.9/5/6 regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

--- Comment #15 from Jason Merrill <jason at gcc dot gnu.org> ---
Author: jason
Date: Wed Oct 21 09:27:12 2015
New Revision: 229121

URL: https://gcc.gnu.org/viewcvs?rev=229121&root=gcc&view=rev
Log:
        PR c++/67557

        * call.c (is_base_field_ref): New.
        (unsafe_copy_elision_p): New.
        (build_over_call): Use it.

Added:
    branches/gcc-5-branch/gcc/testsuite/g++.dg/init/elide3.C
Modified:
    branches/gcc-5-branch/gcc/cp/ChangeLog
    branches/gcc-5-branch/gcc/cp/call.c

[Bug c++/67557] [4.9 Regression] Calling copy constructor of base class in constructor of derived class produces crashing code

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67557

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |peter_foelsche at agilent dot com

--- Comment #22 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 34121 has been marked as a duplicate of this bug. ***