[Bug c++/98419] New: wrong code when destructor of local variable modifies returned object

["leni536 at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98419

            Bug ID: 98419
           Summary: wrong code when destructor of local variable modifies
                    returned object
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: leni536 at gmail dot com
  Target Milestone: ---

Version:
g++ (Compiler-Explorer-Build) 10.2.0

Command line options:
-std=c++17 -O2 -pedantic-errors


```
struct A {
    int i;
    A(int ** iptrptr): i(1) {
        *iptrptr = &i;
    }
};

struct B {
    int* iptr;
    B(): iptr(0) {}
    ~B() {
        *iptr = 2;
    }
};

A foo() {
    B b;
    return A(&b.iptr);
}
```

Observed behavior:
foo() returns an object with its `i` member having the value 1.

https://godbolt.org/z/Yhcjo9

Expected behavior:
foo() to return an object with its `i` member having the value 2.

The destruction of `b` is sequenced before the initialization of the returned
object. The constructor of A sets the int* contained in `b` to point within the
returned object (there is no temporary created with type A, C++17's mandatory
copy elision is assumed here). ~B() then sets the `i` member of the returned
object to 2.

Other observations:
With command line options `-std=c++17 -O0 -pedantic-errors -fsanitize=address`
~B() tramples the stack:

https://godbolt.org/z/M5ETa9

When A has a user-defined copy-constructor or destructor then I get the
expected behavior:

https://godbolt.org/z/osqbfz
https://godbolt.org/z/ozzPaf

Presumably when the returned type is trivially copyable then the copy isn't
elided, with the assumption that it's not observable. In C++17 the copy elision
is mandatory, and it is observable even for trivially copyable types, as shown
in this example.