Maybe g++ bug (in stl_algo.h 0x08048beb in std::__unguarded_partition)

[Niklaus <niklaus at gmail dot com>]

hi,
 This crashes on g++ 4.2.3. I think my code is correct. I'm not doing
any out of bound errors but sort crashes.

Same is present at http://rafb.net/p/nyMKCk70.html or
http://pastebin.com/m67e4529b

Why does this occur ?

unk@edubuntu:~/prog/mipt$ gdb ./a.out
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) run < inh
Starting program: /home/junk/prog/mipt/a.out < inh

Program received signal SIGSEGV, Segmentation fault.
0x08048beb in std::__unguarded_partition<int*, int, bool (*)(int,
int)> (__first=0x8363000, __last=0x8361d70, __pivot=18,
__comp=0x8048634 <cmp(int, int)>)
    at /usr/include/c++/4.2/bits/stl_algo.h:2278
2278		  while (__comp(*__first, __pivot))
(gdb)


===========source code=================

#include<cstdio>
#include<algorithm>
#include<iostream>
using namespace std;
#define MAX 900
char str[MAX];
int graph[MAX][MAX], n, arr[MAX];

bool
cmp (const int a, const int b)
{

  if (a > 0 && a <= n && b > 0 && b <= n)
    {
      if (graph[a][b] == 1)
	return true;
      if (graph[a][b] == -1)
	return false;
    }

  return true;
}

int
main ()
{
  int k = 1, i, z, j, st = -1;
  scanf (" %d", &n);

  for (i = 1; i <= n; i++)
    arr[i] = i;

  for (z = 0; z < n; z++)
    {
      scanf (" %s", str);
      for (i = 0; i<k && str[i] && (str[i] != '#'); i++)
	{
	  if (str[i] == '+')
	    {
	      graph[k][i + 1] = 1;
	      graph[i + 1][k] = -1;
	    }
	  else if (str[i] == '-')
	    {
	      graph[k][i + 1] = -1;
	      graph[i + 1][k] = 1;
	    }
	}
      sort (arr + 1, arr + n + 1, cmp);
      k++;
    }

  for (i = 1; i < n; i++)
    printf ("%d ", arr[i]);
  printf ("%d\n", arr[i]);




  return 0;
}

========input=======================
35
#
+#
++#
+++#
++++#
+++++#
++++++#
+++++++#
++++++++#
+++++++++#
++++++++++#
+++++++++++#
++++++++++++#
+++++++++++++#
++++++++++++++#
+++++++++++++++#
++++++++++++++++#
+++++++++++++++++#
++++++++++++++++++#
+++++++++++++++++++#
++++++++++++++++++++#
+++++++++++++++++++++#
++++++++++++++++++++++#
+++++++++++++++++++++++#
++++++++++++++++++++++++#
+++++++++++++++++++++++++#
++++++++++++++++++++++++++#
+++++++++++++++++++++++++++#
++++++++++++++++++++++++++++#
+++++++++++++++++++++++++++++#
++++++++++++++++++++++++++++++#
+++++++++++++++++++++++++++++++#
++++++++++++++++++++++++++++++++#
+++++++++++++++++++++++++++++++++#
++++++++++++++++++++++++++++++++++#