From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 31020 invoked by alias); 25 Oct 2002 20:06:02 -0000 Mailing-List: contact gcc-prs-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Archive: List-Post: List-Help: Sender: gcc-prs-owner@gcc.gnu.org Received: (qmail 30972 invoked by uid 71); 25 Oct 2002 20:06:01 -0000 Resent-Date: 25 Oct 2002 20:06:01 -0000 Resent-Message-ID: <20021025200601.30970.qmail@sources.redhat.com> Resent-From: gcc-gnats@gcc.gnu.org (GNATS Filer) Resent-Cc: gcc-prs@gcc.gnu.org, gcc-bugs@gcc.gnu.org Resent-Reply-To: gcc-gnats@gcc.gnu.org, vwhite@entercept.com Received: (qmail 27228 invoked by uid 61); 25 Oct 2002 20:05:03 -0000 Message-Id: <20021025200503.27226.qmail@sources.redhat.com> Date: Fri, 25 Oct 2002 13:06:00 -0000 From: vwhite@entercept.com Reply-To: vwhite@entercept.com To: gcc-gnats@gcc.gnu.org X-Send-Pr-Version: gnatsweb-2.9.3 (1.1.1.1.2.31) Subject: libstdc++/8359: STL container can fault at runtime destroying contained objects with virtual destructors X-SW-Source: 2002-10/txt/msg01029.txt.bz2 List-Id: >Number: 8359 >Category: libstdc++ >Synopsis: STL container can fault at runtime destroying contained objects with virtual destructors >Confidential: no >Severity: serious >Priority: medium >Responsible: unassigned >State: open >Class: sw-bug >Submitter-Id: net >Arrival-Date: Fri Oct 25 13:06:00 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Victor White, for D. Hosterman >Release: "gcc (GCC) 3.2 20020708 (experimental)" with "libstdc++-v3" >Organization: >Environment: HP PA2.0 hardware (compiling PA1.1 code), HP-UX 11i >Description: The standard template library file include/c++/3.2/bits/stl_construct.h includes a definition of the following template function: template inline void _Destroy(_Tp* __pointer) { __pointer->~_Tp(); } The function will be called when destroying an element of a container (vector, list, etc.). If that element is a derived object with virtual destructors, it can end up calling an incorrect sequence of destructors which (on my system) results in a SIGSEGV when an object is removed from the container. >How-To-Repeat: Sorry, I don't happen to have a canned example. This appeared in a very large program we are working on which I have not included. Depends on the program. It must use a container that holds the object itself (not a pointer to). The object must be a derived type with a virtual destructor. >Fix: The change made locally was: template inline void _Destroy(_Tp* __pointer) { __pointer->_Tp::~_Tp(); } //<= only our destructor Which seems to both make sense and fix the problem. We have not yet checked to see if there are other places in which destructors are being explicitly called that may have similar issues. >Release-Note: >Audit-Trail: >Unformatted: