[Bug c++/35548] New: g++ 4.3.{0,1} miscompile this simple program

["varg at theor dot jinr dot ru" <gcc-bugzilla at gcc dot gnu dot org>]

$ cat oops.cpp
class refcounted 
{
public:
        refcounted() throw() : refcount(0) { }
        unsigned add_reference() throw() 
        { 
                return ++refcount; 
        }
        unsigned remove_reference() throw()
        { 
                return --refcount; 
        }
        unsigned get_refcount() const throw() 
        { 
                return refcount; 
        }
        void set_refcount(unsigned r) throw() 
        { 
                refcount = r; 
        }
private:
        unsigned refcount;
};

template <class T> class ptr 
{
        T* p;
public:
        ptr(T* t) throw() : p(t) 
        { 
                p->set_refcount(1); 
        }
        explicit ptr(T& t) throw() : p(&t) 
        {
                p->add_reference(); 
        }
        ptr(const ptr& other) throw() : p(other.p)
        { 
                p->add_reference(); 
        }
        ~ptr()
        {
                if (p->remove_reference() == 0)
                        delete p;
        }
        ptr& operator=(const ptr& other)
        {
                T* otherp = other.p;
                otherp->add_reference();
                if (p->remove_reference() == 0)
                        delete p;
                p = otherp;
                return *this;
        }
        T& operator*() const throw() 
        { 
                return *p; 
        }
        T* operator->() const throw() 
        { 
                return p; 
        }
        friend inline T* get_pointer(const ptr& x) throw() 
        { 
                return x.p; 
        }
        template <class U>
        bool operator==(const ptr<U>& rhs) const throw() 
        { 
                return p == get_pointer(rhs); 
        }
};

class ex;
typedef const void* tinfo_t; 
struct tinfo_static_t { };

enum status_flags {
        dynallocated    = 0x0001,
        evaluated       = 0x0002
};

class basic : public refcounted
{
public:
        static const tinfo_static_t tinfo_static;
        basic() : tinfo_key(&tinfo_static), flags(0) { }
        basic(tinfo_t ti) : tinfo_key(ti), flags(0) { }
        basic(const basic& other) : tinfo_key(other.tinfo_key),
                flags(other.flags & ~dynallocated) { }
        virtual basic* duplicate() const 
        { 
                return new basic(*this); 
        }
        int compare(const basic& other) const
        {
                if (tinfo() == other.tinfo())
                        return compare_same_type(other);
                else if (tinfo() < other.tinfo())
                        return -1;
                else
                        return 1;
        }
        const basic& hold() const
        {
                flags |= evaluated;
                return *this;
        }
        virtual ex eval(int level = 0) const;
        tinfo_t tinfo() const 
        { 
                return tinfo_key; 
        }
        virtual ~basic() { }
protected:
        virtual int compare_same_type(const basic& other) const
        { 

                if (this == &other)
                        return 0;
                else if (this > &other)
                        return 1;
                else
                        return -1;
        }
        tinfo_t tinfo_key;
        mutable unsigned flags;
private:
        friend class ex;
};
const tinfo_static_t basic::tinfo_static = { };

class ex {
private:
        mutable ptr<basic> bp;
        static ptr<basic> construct_from_basic(const basic& other)
        {
                if (!(other.flags & evaluated)) {
                        const ex& tmpex = other.eval(1);
                        if ((other.get_refcount() == 0) && (other.flags &
dynallocated))
                                delete &other;

                        return tmpex.bp;
                } else {
                        if (other.flags & dynallocated) {
                                return ptr<basic>(const_cast<basic &>(other));
                        } else {
                                basic* bp = other.duplicate();
                                bp->flags |= dynallocated;
                                return bp;
                        }
                }
        }
public:
        inline ex(const basic& other) : bp(construct_from_basic(other)) { }
        ex eval(int level = 0) const 
        { 
                return bp->eval(level); 
        }
        int compare(const ex& other) const
        {
                if (bp == other.bp)
                        return 0;
                return bp->compare(*other.bp);
        }
        inline unsigned get_refcount() const
        {
                return bp->get_refcount();
        }
};

ex basic::eval(int level) const
{
        return hold();
}

class oops : public basic
{
        int s;
protected:
        virtual int compare_same_type(const basic& other) const
        {
                const oops& o = static_cast<const oops &>(other);
                if (s == o.s)
                        return 0;
                if (s > o.s)
                        return 1;
                return -1;
        }
public:
        oops() : basic(&oops::tinfo_static), s(0) { }
        oops(const int s_) : basic(&oops::tinfo_static), s(s_) { }
        ex eval(int level) const
        {
                return oops(s).hold();
        }
        virtual oops* duplicate() const 
        { 
                return new oops(*this); 
        }
        static const tinfo_static_t tinfo_static;
};
const tinfo_static_t oops::tinfo_static = { };

int main(int argc, char** argv)
{
        int ret = 0;
        const ex e = oops(1).hold();
        const ex& f = argc > 1 ? e : e.eval(-2);
        if (f.get_refcount() == 0)
                ++ret; // XXX: this should not happen
        if (f.compare(e))
                ++ret; // XXX: this should not happen
        return ret;
}
$ g++-4.3 -O0 -Wall -g oops.cpp -o /tmp/oops-4.3
$ /tmp/oops-4.3
Segmentation fault

When compiled with g++ 3.4, 4.{0,1,2} the program works as expected
(i.e. exits with zero status).

$ g++-4.3 -v -save-temps -O0 -Wall -g oops.cpp -o /tmp/oops-4.3
Using built-in specs.
Target: x86_64-linux-gnu
Configured with: ../src/configure linux gnu
Thread model: posix
gcc version 4.3.1 20080309 (prerelease) (Debian 4.3.0-1) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/cc1plus -E -quiet -v -D_GNU_SOURCE
../oops.cpp -mtune=generic -Wall -fworking-directory -O0 -fpch-preprocess -o
oops.ii
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory
"/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../x86_64-linux-gnu/include"
ignoring nonexistent directory "/usr/include/x86_64-linux-gnu"
#include "..." search starts here:
#include <...> search starts here:
 /usr/include/c++/4.3
 /usr/include/c++/4.3/x86_64-linux-gnu
 /usr/include/c++/4.3/backward
 /usr/local/include
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/include
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/include-fixed
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/cc1plus -fpreprocessed oops.ii -quiet
-dumpbase oops.cpp -mtune=generic -auxbase oops -g -O0 -Wall -version -o oops.s
GNU C++ (Debian 4.3.0-1) version 4.3.1 20080309 (prerelease) (x86_64-linux-gnu)
        compiled by GNU C version 4.3.1 20080309 (prerelease), GMP version
4.2.2, MPFR version 2.3.1.
GGC heuristics: --param ggc-min-expand=63 --param ggc-min-heapsize=63134
Compiler executable checksum: 6b4f47123a81acc7bc0d52a2f374512f
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 as -V -Qy -o oops.o oops.s
GNU assembler version 2.18.0 (x86_64-linux-gnu) using BFD version (GNU Binutils
for Debian) 2.18.0.20080103
COMPILER_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/
LIBRARY_PATH=/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/:/lib/../lib/:/usr/lib/../lib/:/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../:/lib/:/usr/lib/
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-Wall' '-O0' '-g' '-o' '/tmp/oops-4.3'
'-shared-libgcc' '-mtune=generic'
 /usr/lib/gcc/x86_64-linux-gnu/4.3.1/collect2 --eh-frame-hdr -m elf_x86_64
--hash-style=both -dynamic-linker /lib64/ld-linux-x86-64.so.2 -o /tmp/oops-4.3
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crt1.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crti.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/crtbegin.o
-L/usr/lib/gcc/x86_64-linux-gnu/4.3.1 -L/usr/lib/gcc/x86_64-linux-gnu/4.3.1
-L/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib -L/lib/../lib
-L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../.. oops.o
-lstdc++ -lm -lgcc_s -lgcc -lc -lgcc_s -lgcc
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/crtend.o
/usr/lib/gcc/x86_64-linux-gnu/4.3.1/../../../../lib/crtn.o


P.S.
I haven't posted the preprocessed source, since it's virtually identical
to the original one.


-- 
           Summary: g++ 4.3.{0,1} miscompile this simple program
           Product: gcc
           Version: 4.3.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: varg at theor dot jinr dot ru


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35548