libstdc++/6991: Seg fault in std::num_put (called from ostringstream::operator<<) while putting numbers

[nikhild@flashmail.com]

>Number:         6991
>Category:       libstdc++
>Synopsis:       Seg fault in std::num_put (called from ostringstream::operator<<) while putting numbers
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun 11 07:06:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Nikhil Deshpande
>Release:        GCC 3.0.4
>Organization:
>Environment:
AIX 4.3.3.0
GNU binutils 2.12.1
GCC 3.0.4
>Description:
- Seg fault when writing (operator<<) numbers to 
  ostringstream.
- BUT seg fault only if os << i statement is followed by
  os.str() call. If os.str() is removed, it does not crash.
  e.g. 
    ostringstream os;
    int i = 1234;
    os << i; // crashes here
    os.str(); // presence of this stmt effects above crash
- Also happens for long, float, double etc. (any number).

----------------------------------------------------------

GNU gdb 5.2
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "powerpc-ibm-aix4.3.3.0"...
Core was generated by `a.out'.
Program terminated with signal 11, Segmentation fault.
bt#0  0x10002888 in std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::put(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, long) const (
    this=0x60002, __s=
      {<iterator<std::output_iterator_tag,void,void,void,void>> = {<No data fields>}, _M_sbuf = 0x2ff2289c, _M_failed = false}, __f=@0x2ff228f0, __fill=32 ' ', __v=1234)
    at /usr/local/gcc-3.0.4/include/g++-v3/bits/locale_facets.h:758
758           { return do_put(__s, __f, __fill, __v); }
(gdb) bt
#0  0x10002888 in std::num_put<char, std::ostreambuf_iterator<char, std::char_traits<char> > >::put(std::ostreambuf_iterator<char, std::char_traits<char> >, std::ios_base&, char, long) const (
    this=0x60002, __s=
      {<iterator<std::output_iterator_tag,void,void,void,void>> = {<No data fields>}, _M_sbuf = 0x2ff2289c, _M_failed = false}, __f=@0x2ff228f0, __fill=32 ' ', __v=1234)
    at /usr/local/gcc-3.0.4/include/g++-v3/bits/locale_facets.h:758
#1  0x100014f4 in std::ostream::operator<<(long) (this=0x2ff22898, __n=1234)
    at /usr/local/gcc-3.0.4/include/g++-v3/bits/ostream.tcc:157
#2  0x10000848 in std::ostream::operator<<(int) (this=0x2ff22898, __n=1234)
    at /usr/local/gcc-3.0.4/include/g++-v3/bits/std_ostream.h:120
#3  0x100004e4 in main (argc=1, argv=0x2ff229e8) at t.cc:6
#4  0x100001dc in __start ()

----------------------------------------------------------

storab@kansai ~/nikhild/test>g++ -v
Reading specs from /usr/local/gcc-3.0.4/lib/gcc-lib/powerpc-ibm-aix4.3.3.0/3.0.4/specs
Configured with: ../gcc-3.0.4/configure --prefix=/usr/local/gcc-3.0.4 --enable-threads=posix --enable-languages=c,c++ --disable-libgcj
Thread model: single
gcc version 3.0.4
----------------------------------------------------------

storab@kansai ~/nikhild/test>g++ -v -pthread
Reading specs from /usr/local/gcc-3.0.4/lib/gcc-lib/powerpc-ibm-aix4.3.3.0/3.0.4/specs
Configured with: ../gcc-3.0.4/configure --prefix=/usr/local/gcc-3.0.4 --enable-threads=posix --enable-languages=c,c++ --disable-libgcj
Thread model: posix
gcc version 3.0.4
g++: No input files
>How-To-Repeat:
1. Compile t.cc example source code with g++ 3.0.4
   g++ -pthread -g t.cc
2. Run (which results in to seg fault).
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted:
----gnatsweb-attachment----
Content-Type: text/plain; name="t.cc"
Content-Disposition: inline; filename="t.cc"

#include <sstream>

int main(int argc, char* argv[]) {
    int i = 1234;
    std::ostringstream os;
    os << i;
    os.str();
    return 0;
}