Bug 48562 - [C++0x] warn about uses of initializer_list that will lead to dangling pointers
Summary: [C++0x] warn about uses of initializer_list that will lead to dangling pointers
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: c++ (show other bugs)
Version: 4.6.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: diagnostic
Depends on:
Blocks:
 
Reported: 2011-04-11 21:45 UTC by Johannes Schaub
Modified: 2019-05-21 13:37 UTC (History)
5 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2011-09-23 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Schaub 2011-04-11 21:45:45 UTC
The C++0x spec requires that GCC destroys the backing-up array at "delete p", but GCC appears to destroy it immediately after the first declaration (as checked by using a class type that has a side-effecting destructor). 

    auto *p= new initializer_list<int>{1, 2, 3}; 
    { auto q(*p); }
    delete p;
Comment 1 Alexander Monakov 2011-04-19 09:20:05 UTC
*** Bug 48669 has been marked as a duplicate of this bug. ***
Comment 2 Paolo Carlini 2011-09-23 22:01:23 UTC
Is this again PR48370, or should be kept separate?
Comment 3 Jason Merrill 2011-09-23 22:13:45 UTC
This is related to DR 1290.  At Bloomington we decided to clarify that the lifetime of the array is like a temporary bound to a reference; in this case it has full-expression lifetime.  We should probably add a warning about "new initializer_list".
Comment 4 Paolo Carlini 2011-09-23 22:23:04 UTC
Ah, Ok, thanks. Let's see what I can do.
Comment 5 Paolo Carlini 2011-09-25 10:54:07 UTC
Johannes, sorry about the dumb question: now I understand the issue decently well - and after all boils down to adding a warning - but I'm not sure to understand your code snippet: is it meant to crash at runtime? Trigger valgrind errors?
Comment 6 Johannes Schaub 2011-09-25 14:22:33 UTC
(In reply to comment #5)
> Johannes, sorry about the dumb question: now I understand the issue decently
> well - and after all boils down to adding a warning - but I'm not sure to
> understand your code snippet: is it meant to crash at runtime? Trigger valgrind
> errors?

In the C++11 spec, it is said that the lifetime of the backing-up array is the same as the lifetime of the initializer_list object which was initialized by the array (not considering the DRs and their resolution that Jason has pointed to). My code was just meant to test whether GCC obeys those rules.

struct X {
  X(int) { cout << "+"; }
  X(X const&) { cout << "+"; }
  ~X() { cout << "-"; }
};

auto *p = new initalizer_list<X>{1, 2, 3}; // ... not at this
delete p; // C++11 requires "now" at this point ...

(again not considering those DRs that revise these rules). 

I think that a warning against "({...})" would be useful too

    // fine
    initializer_list<int> a{1, 2, 3};

    // this is bad
    initializer_list<int> b({1, 2, 3});

Second one is bad because it will destroy the array after initializing 'b', and won't lengthen the lifetime (because it will use the copy/move constructor).
Comment 7 Paolo Carlini 2011-09-25 14:39:07 UTC
Ok, thanks. At the moment, I'm not really working on this.
Comment 8 Florian Weimer 2018-03-28 11:44:47 UTC
It would also mention to warn about std::initializer_list references in function arguments, I think.  We received a downstream bug report:

#include <initializer_list>
#include <iostream>

template <typename T> class ArrayRef {
public:
  using size_type = size_t;

private:
  /// The start of the array, in an external buffer.
  const T *Data = nullptr;

  /// The number of elements.
  size_type Length = 0;

public:
  /// Construct an ArrayRef from a std::initializer_list.
  /*implicit*/ ArrayRef(const std::initializer_list<T> &Vec)
      : Data(Vec.begin() == Vec.end() ? (T *)nullptr : Vec.begin()),
        Length(Vec.size()) {}

  const T &operator[](size_t Index) const { return Data[Index]; }
};

int main(int argc, char **argv) {
  const ArrayRef<int> Foo = {42};
  std::cout << "Foo " << Foo[0] << "\n";
  return 0;
}

https://bugzilla.redhat.com/show_bug.cgi?id=1561373

I believe this code is buggy, and it would be nice to warn about this.  Almost any std::initializer_list object will be a temporary, after all, and the called function should move the initializer elements, not copy them.
Comment 9 Jonathan Wakely 2018-03-28 12:30:45 UTC
(In reply to Florian Weimer from comment #8)
> Almost any std::initializer_list object will be a temporary, after all, and
> the called function should move the initializer elements, not copy them.

std::initializer_list only gives const access to its elements, so you can't move from them.
Comment 10 Eric Gallager 2018-03-28 17:37:17 UTC
Possibly related to bug 67445?
Comment 11 Jason Merrill 2018-05-29 20:05:24 UTC
Author: jason
Date: Tue May 29 20:04:52 2018
New Revision: 260905

URL: https://gcc.gnu.org/viewcvs?rev=260905&root=gcc&view=rev
Log:
	PR c++/67445 - returning temporary initializer_list.

	PR c++/67711 - assigning from temporary initializer_list.
	PR c++/48562 - new initializer_list.
	* typeck.c (maybe_warn_about_returning_address_of_local): Also warn
	about returning local initializer_list.
	* cp-tree.h (AUTO_TEMP_NAME, TEMP_NAME_P): Remove.
	* call.c (build_over_call): Warn about assignment from temporary
	init_list.
	* init.c (build_new_1): Warn about 'new std::initializer_list'.
	(find_list_begin, maybe_warn_list_ctor): New.
	(perform_member_init): Use maybe_warn_list_ctor.

Added:
    trunk/gcc/testsuite/g++.dg/warn/Winit-list1.C
    trunk/gcc/testsuite/g++.dg/warn/Winit-list2.C
    trunk/gcc/testsuite/g++.dg/warn/Winit-list3.C
Modified:
    trunk/gcc/c-family/ChangeLog
    trunk/gcc/c-family/c.opt
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/call.c
    trunk/gcc/cp/cp-tree.h
    trunk/gcc/cp/init.c
    trunk/gcc/cp/typeck.c
    trunk/gcc/doc/invoke.texi
    trunk/gcc/testsuite/c-c++-common/pr43395.c
    trunk/gcc/testsuite/g++.dg/cpp1y/pr77591.C
    trunk/gcc/testsuite/g++.dg/warn/Wreturn-local-addr.C
    trunk/gcc/testsuite/g++.dg/warn/return-reference2.C
    trunk/gcc/testsuite/g++.old-deja/g++.bob/array1.C
    trunk/gcc/testsuite/g++.old-deja/g++.brendan/crash55.C
    trunk/libstdc++-v3/testsuite/util/testsuite_random.h
Comment 12 Martin Liška 2018-11-19 12:02:16 UTC
Can the bug be marked as resolved?
Comment 13 Eric Gallager 2019-02-19 17:40:23 UTC
(In reply to Martin Liška from comment #12)
> Can the bug be marked as resolved?

WAITING on a reply
Comment 14 Eric Gallager 2019-05-21 13:37:00 UTC
(In reply to Eric Gallager from comment #13)
> (In reply to Martin Liška from comment #12)
> > Can the bug be marked as resolved?
> 
> WAITING on a reply

no reply; assuming this was fixed