[llvm-bugs] [Bug 46625] New: segv in string move-constructor with _LIBCPP_DEBUG=1

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=46625

            Bug ID: 46625
           Summary: segv in string move-constructor with _LIBCPP_DEBUG=1
           Product: libc++
           Version: 9.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: All Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: graydon at pobox.com
                CC: llvm-bugs at lists.llvm.org, mclow.lists at gmail.com

I believe this program winds up move-constructing over a non-small string in
LHS
of the + operator and something about this disagrees with the strings (or more
specifically the iterator-debugging machinery within the strings) produced by
std::to_string. I haven't been able to narrow it down further or determine
cause:


Example program:

#include <string>

void use(std::string const& out) {}

int main() {
    use("0123456789012345678901" + std::to_string(1));
}


Example compile command:

$ clang++-9 -stdlib=libc++ -D_LIBCPP_DEBUG=1 t.cpp


Example run:

$ ./a.out 
Segmentation fault (core dumped)


With sanitizer:

$ clang++-9 -stdlib=libc++ -D_LIBCPP_DEBUG=1 -fsanitize=address t.cpp
$ ./a.out

AddressSanitizer:DEADLYSIGNAL
=================================================================
==42275==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc
0x7f2c525e7647 bp 0x7fff815df6f0 sp 0x7fff815df680 T0)
==42275==The signal is caused by a READ memory access.
==42275==Hint: address points to the zero page.
    #0 0x7f2c525e7646 in std::__1::__libcpp_db::swap(void*, void*)
libcxx/build/src/./libcxx/src/debug.cpp:463:18
    #1 0x4c6603 in std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >::basic_string(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >&&)
(/home/src/stellar-core/a.out+0x4c6603)
    #2 0x4c5f55 in std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > std::__1::operator+<char,
std::__1::char_traits<char>, std::__1::allocator<char> >(char const*,
std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >&&) (/home/src/stellar-core/a.out+0x4c5f55)
    #3 0x4c5d50 in main (/home/src/stellar-core/a.out+0x4c5d50)
    #4 0x7f2c513c0b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #5 0x41bcf9 in _start (/home/src/stellar-core/a.out+0x41bcf9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV libcxx/build/src/./libcxx/src/debug.cpp:463:18
in std::__1::__libcpp_db::swap(void*, void*)
==42275==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200707/81739e4c/attachment.html>