[llvm-bugs] [Bug 24574] New: Undefined behaviour in v1/list when using push_back (detected using -fsanitize=undefined-trap)

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=24574

            Bug ID: 24574
           Summary: Undefined behaviour in v1/list when using push_back
                    (detected using -fsanitize=undefined-trap)
           Product: libc++
           Version: 3.7
          Hardware: Macintosh
                OS: MacOS X
            Status: NEW
          Severity: normal
          Priority: P
         Component: All Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: alex at rogue-research.com
                CC: llvm-bugs at lists.llvm.org, mclow.lists at gmail.com
    Classification: Unclassified

Created attachment 14774
  --> https://llvm.org/bugs/attachment.cgi?id=14774&action=edit
Source file that reproduces problem.

For the following trap.cpp file:

    #include <list>

    struct point {
        double x;
        double y;
    };

    int main(void) {

        std::list<point> l;

        point p;
        p.x = 1.0;
        p.y = 2.0;

        // This results in undefined behaviour with libc++ but not libstdc++.
        l.push_back(p);
    }

Compiling and running:
    builder13:trap builder$ clang++ -std=c++11 -stdlib=libc++
-fsanitize=undefined-trap -O3 -o trap trap.cpp
    builder13:trap builder$ ./trap
    /Users/builder/llvm/llvm-rel-install/bin/../include/c++/v1/list:218:16:
runtime error: downcast of address 0x7fff4fe1faf8 with insufficient space for
an object of type 'std::__1::__list_node<point, void *>'
0x7fff4fe1faf8: note: pointer points here
     00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
00 00 00 00  00 00 00 00

Interestingly, if the optimization level is lowered to -O0, there is no runtime
error. All other optimization levels -0{1,2,3} result in error.

There are no errors when using libstdc++.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150825/a8b54c85/attachment.html>