[cfe-dev] boost serialization crash with clang 5.0.0

[Malcolm Parsons via cfe-dev]

Hi,

I tried to upgrade to clang 5.0.0 and found that a program that uses
the boost serialization library crashes with a null pointer
dereference during serialization.

The relevant part of boost serialization (from
https://github.com/boostorg/serialization/blob/develop/include/boost/archive/detail/oserializer.hpp)
is:

    template<class T>
    static const basic_pointer_oserializer * register_type(Archive
&ar, T & /*t*/){
        // there should never be any need to save an abstract polymorphic
        // class pointer.  Inhibiting code generation for this
        // permits abstract base classes to be used - note: exception
        // virtual serialize functions used for plug-ins
        typedef
            typename mpl::eval_if<
                boost::serialization::is_abstract< T >,
                mpl::identity<abstract>,
                mpl::identity<non_abstract>
            >::type typex;
        return typex::template register_type< T >(ar);
    }

    template<class TPtr>
    static void invoke(Archive &ar, const TPtr t){
        register_type(ar, * t);
        if(NULL == t){
            basic_oarchive & boa
                =
boost::serialization::smart_cast_reference<basic_oarchive &>(ar);
            boa.save_null_pointer();
            save_access::end_preamble(ar);
            return;
        }
        save(ar, * t);
    }

Clang 5.0.0 removes the check for a null pointer.
GCC 7.2 and Clang 4.0.1 keep the check

I see that t is dereferenced before the null check, but memory isn't
actually accessed until afterwards.

Simplified reproduction: https://godbolt.org/g/L7zC82

Is this a bug in clang 5.0.0, or in boost serialization?

-- 
Malcolm Parsons