<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Undefined behaviour in v1/list when using push_back (detected using -fsanitize=undefined-trap)"
href="https://llvm.org/bugs/show_bug.cgi?id=24574">24574</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Undefined behaviour in v1/list when using push_back (detected using -fsanitize=undefined-trap)
</td>
</tr>
<tr>
<th>Product</th>
<td>libc++
</td>
</tr>
<tr>
<th>Version</th>
<td>3.7
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Macintosh
</td>
</tr>
<tr>
<th>OS</th>
<td>MacOS X
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>All Bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedclangbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>alex@rogue-research.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org, mclow.lists@gmail.com
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=14774" name="attach_14774" title="Source file that reproduces problem.">attachment 14774</a> <a href="attachment.cgi?id=14774&action=edit" title="Source file that reproduces problem.">[details]</a></span>
Source file that reproduces problem.
For the following trap.cpp file:
#include <list>
struct point {
double x;
double y;
};
int main(void) {
std::list<point> l;
point p;
p.x = 1.0;
p.y = 2.0;
// This results in undefined behaviour with libc++ but not libstdc++.
l.push_back(p);
}
Compiling and running:
builder13:trap builder$ clang++ -std=c++11 -stdlib=libc++
-fsanitize=undefined-trap -O3 -o trap trap.cpp
builder13:trap builder$ ./trap
/Users/builder/llvm/llvm-rel-install/bin/../include/c++/v1/list:218:16:
runtime error: downcast of address 0x7fff4fe1faf8 with insufficient space for
an object of type 'std::__1::__list_node<point, void *>'
0x7fff4fe1faf8: note: pointer points here
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
Interestingly, if the optimization level is lowered to -O0, there is no runtime
error. All other optimization levels -0{1,2,3} result in error.
There are no errors when using libstdc++.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>