[Bug libstdc++/17012] [DR 526] std::list's function, remove, looks like it is reading memory that has been freed.

["hhinnant at apple dot com" <gcc-bugzilla at gcc dot gnu dot org>]

------- Comment #13 from hhinnant at apple dot com  2007-02-07 16:59 -------
(In reply to comment #12)

> If we have a utility similar to boost::address_of, that might be better than
> using operator& to get the address of the value_type (to accommodate types
> which overload operator&).

Oops, I forgot about allocator::address and:

http://home.twcny.rr.com/hinnant/cpp_extensions/issues_preview/lwg-active.html#580

New patch uses allocator::address:

Index: libstdc++-v3/include/bits/list.tcc
===================================================================
--- libstdc++-v3/include/bits/list.tcc  (revision 121691)
+++ libstdc++-v3/include/bits/list.tcc  (working copy)
@@ -176,14 +176,23 @@
     {
       iterator __first = begin();
       iterator __last = end();
+      iterator __extra = __last;
+      allocator_type __a = get_allocator();
       while (__first != __last)
        {
          iterator __next = __first;
          ++__next;
          if (*__first == __value)
-           _M_erase(__first);
+         {
+           if (__a.address(__value) != __a.address(*__first))
+             _M_erase(__first);
+           else
+             __extra = __first;
+         }
          __first = __next;
        }
+      if (__extra != __last)
+        _M_erase(__extra);
     }

   template<typename _Tp, typename _Alloc>


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17012