libstdc++/8359: STL container can fault at runtime destroying contained objects with virtual destructors

[vwhite at entercept dot com]

>Number:         8359
>Category:       libstdc++
>Synopsis:       STL container can fault at runtime destroying contained objects with virtual destructors
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 25 13:06:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Victor  White, for D. Hosterman
>Release:        "gcc (GCC) 3.2 20020708 (experimental)" with "libstdc++-v3"
>Organization:
>Environment:
HP PA2.0 hardware (compiling PA1.1 code), HP-UX 11i
>Description:
The standard template library file

    include/c++/3.2/bits/stl_construct.h

includes a definition of the following template function:

    template <class _Tp>
      inline void
      _Destroy(_Tp* __pointer)
      { __pointer->~_Tp(); }

The function will be called when destroying
an element of a container (vector, list, etc.).
If that element is a derived object with virtual
destructors, it can end up calling an incorrect
sequence of destructors which (on my system) results
in a SIGSEGV when an object is removed from the
container.

>How-To-Repeat:
Sorry, I don't happen to have a canned example.  This
appeared in a very large program we are working on
which I have not included.

Depends on the program.  It must use a container
that holds the object itself (not a pointer to).
The object must be a derived type with a virtual
destructor.

>Fix:
The change made locally was:

    template <class _Tp>
      inline void
      _Destroy(_Tp* __pointer)
      { __pointer->_Tp::~_Tp(); } //<= only our destructor

Which seems to both make sense and fix the problem.

We have not yet checked to see if there are other places
in which destructors are being explicitly called that may
have similar issues.
>Release-Note:
>Audit-Trail:
>Unformatted: