From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id B7A6F384A023; Tue, 22 Dec 2020 12:16:05 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B7A6F384A023
From: "leni536 at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/98419] New: wrong code when destructor of local variable
 modifies returned object
Date: Tue, 22 Dec 2020 12:16:05 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 10.2.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: leni536 at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-98419-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Dec 2020 12:16:05 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D98419

            Bug ID: 98419
           Summary: wrong code when destructor of local variable modifies
                    returned object
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: leni536 at gmail dot com
  Target Milestone: ---

Version:
g++ (Compiler-Explorer-Build) 10.2.0

Command line options:
-std=3Dc++17 -O2 -pedantic-errors


```
struct A {
    int i;
    A(int ** iptrptr): i(1) {
        *iptrptr =3D &i;
    }
};

struct B {
    int* iptr;
    B(): iptr(0) {}
    ~B() {
        *iptr =3D 2;
    }
};

A foo() {
    B b;
    return A(&b.iptr);
}
```

Observed behavior:
foo() returns an object with its `i` member having the value 1.

https://godbolt.org/z/Yhcjo9

Expected behavior:
foo() to return an object with its `i` member having the value 2.

The destruction of `b` is sequenced before the initialization of the return=
ed
object. The constructor of A sets the int* contained in `b` to point within=
 the
returned object (there is no temporary created with type A, C++17's mandato=
ry
copy elision is assumed here). ~B() then sets the `i` member of the returned
object to 2.

Other observations:
With command line options `-std=3Dc++17 -O0 -pedantic-errors -fsanitize=3Da=
ddress`
~B() tramples the stack:

https://godbolt.org/z/M5ETa9

When A has a user-defined copy-constructor or destructor then I get the
expected behavior:

https://godbolt.org/z/osqbfz
https://godbolt.org/z/ozzPaf

Presumably when the returned type is trivially copyable then the copy isn't
elided, with the assumption that it's not observable. In C++17 the copy eli=
sion
is mandatory, and it is observable even for trivially copyable types, as sh=
own
in this example.=