[Bug optimization/11505] New: Runtime segfault: C++ heap-allocated object loses/changes 'this' address at -O3 when calling virtual inline const function

["dan at bti dot net" <gcc-bugzilla at gcc dot gnu dot org>]

PLEASE REPLY TO gcc-bugzilla@gcc.gnu.org ONLY, *NOT* gcc-bugs@gcc.gnu.org.

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=11505

           Summary: Runtime segfault: C++ heap-allocated object
                    loses/changes 'this' address at -O3 when calling virtual
                    inline const function
           Product: gcc
           Version: 3.3
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: dan at bti dot net
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu

This problem occurs while compiling our company's library code with -O3; the problem is not 
present at lower optimization levels.

A complex C++ class named TTCPConnectionObj contains the following function:

virtual inline bool IsLingerSet () const
    { return (fLingerTime != kTCPLingerNone); }

This function is called (among other times) from within a Connect() method within the same object.  
At optimization -O3, the call to IsLingerSet() fails with a segfault.  Follows is a GDB (5.3) backtrace:

#0  0x400bf513 in bti::TTCPConnectionObj::IsLingerSet() const (this=0x400c23f9) at 
bti_tcp_lib.h:274
#1  0xbffff6e8 in ?? ()
#2  0x400bbdf2 in bti::TTCPConnectionObj::Connect(unsigned long, int, int, int) (this=0xbffff9b0, 
networkAddress=1074537465, 
    port=1074533544, ioBufferSize=4096, connectTimeout=1074537465) at bti_tcp_lib.cc:161
#3  0x400bc084 in bti::TTCPConnectionObj::Connect(bti::TString, int, int, int) (this=0xbffff9b0, 
host=
        {<TBuffer> = {_vptr.TBuffer = 0x804a988, fStackBufferPtr = "www.bti.net", '\0' <repeats 20 
times>, fExternalBufferPtr = 0x0, fCurrentBufferPtr = 0xbffff8f4 "www.bti.net", fCapacity = 32, 
fUsed = 11}, <No data fields>}, port=1074537465, 
    ioBufferSize=1074537465, connectTimeout=1074537465) at bti_tcp_lib.cc:224
#4  0x08048f5a in main (argc=3, argv=0x400c23f8) at blah.cc:29
#5  0x401c3ae2 in __libc_start_main (main=0x8048e60 <main>, argc=3, ubp_av=0xbffff9b0, 
init=0x8048b70 <_init>, 
    fini=0x400c14a8 <vtable for bti::TTCPConnectionObj+8>, rtld_fini=0x5000, 
stack_end=0x7c400bfe)
    at ../sysdeps/generic/libc-start.c:129

Notice that the address of 'this' changes somewhere between frames 0 and 2.  It shouldn't, and it 
apparently doesn't with less optimization.  Frame 2 (bti_tcp_lib.cc:161) points directly to the call to 
IsLingerSet().