[llvm-bugs] [Bug 33439] New: dynamic_cast to ambiguous base produces the wrong answer

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=33439

            Bug ID: 33439
           Summary: dynamic_cast to ambiguous base produces the wrong
                    answer
           Product: clang
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: C++
          Assignee: unassignedclangbugs at nondot.org
          Reporter: arthur.j.odwyer at gmail.com
                CC: dgregor at apple.com, llvm-bugs at lists.llvm.org

Consider the following class hierarchy:

#include <stdio.h>

struct Class2 { virtual ~Class2() {} };
struct Class3 { virtual ~Class3() {} };
struct Class4 : public Class3 {};
struct Class8 : public Class2, public virtual Class4 {};
struct Class9 : public Class4, public Class8 {};

int main() {
    Class9 c9;
    Class2 *c2 = static_cast<Class2 *>(&c9);
    printf("cast Class2 to Class4: %p\n", dynamic_cast<Class4 *>(c2));
}

Clang correctly produces a warning diagnostic:

prog.cc:7:17: warning: direct base 'Class4' is inaccessible due to ambiguity:
    struct Class9 -> struct Class4
    struct Class9 -> struct Class8 -> struct Class4 [-Winaccessible-base]
struct Class9 : public Class4, public Class8 {};
                ^~~~~~~~~~~~~
1 warning generated.

But when you run the code, the dynamic_cast succeeds instead of failing as
expected.

cast Class2 to Class4: 0x7ffc2c41edd0

What we see there is the address of the inaccessible non-virtual base object,
NOT the address of the accessible virtual base object. (Not that the latter
would have been any more correct.)  What we SHOULD see is a null pointer,
because dynamic_cast to an ambiguous base is supposed to fail.

GCC and MSVC get it right.

(This was caught by the same fuzzer as bug 33425, but it is a distinct bug
triggered under different conditions.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170613/082c267c/attachment.html>