Access violation because member variable value changes unexpectedly

["Jonathan Pryor" <jonpryor at vt dot edu>]

(This bug was previously reported on the Cygwin mailing list.)

The value of a member variable in a template base class
changes unexpectedly at run time, causing a pointer to
point to invalid memory.

For example, if we compile the attached source file and run
the output `a.exe', we get the following output:

    main: Creating CUser object.  After successful creation,
        m_pUnkOuter should be a non-null value.
    CoClass::CoClass(): value of this: 0x245ff3c
    CoClass::CoClass(): value of m_pUnkOuter: 0x0
    Baz::Baz(): value of this: 0x245ff38
    Baz::Baz(): value of m_pUnkOuter: 0x0
    CNonDelegator::CNonDelegator(): value of this: 0x245ff40
    CNonDelegator::CNonDelegator(): value of m_pThis: 0x245ff38
    CDelegator::CDelegator(): assigning m_pUnkOuter to &m_nd.
    CDelegator::CDelegator(): value of m_pUnkOuter: 0x245ff40
    CUser::CUser(): value of m_pUnkOuter: 0x4081c8
    main: Calling IFoo::Bar().  This will end up going through
        m_pUnkOuter.
    CDelegator::Bar(): value of m_pUnkOuter: 0x4081c8
    [main] C:\tmp\a.exe 1000 (0) handle_exceptions:
        Exception: STATUS_ACCESS_VIOLATION
    [main] a 1000 (0) handle_exceptions: Dumping stack trace
        to a.exe.core

The access violation appears to occur from `m_pUnkOuter' not
pointing to a valid object.  However, I'm not sure *why* its
pointing to an invalid object...  I got this "bug" trying to
minimize the source code needed to demonstrate another bug
-- and instead got access violations.

What I can point out is that the value of `m_pUnkOuter' changes
for some reason between the CDelegator constructor and the CUser
constructor (it changes from 0x245FF40 to 0x4081c8).  All I know
is that *I'm* not doing this change...

The system tested on is Windows NT 4.0 Workstation, SP4, under
cygwin b20.1 and mingw32.

Output from the command:

    g++ -v --save-temps def2.cpp

Reading specs from
C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/specs
gcc version egcs-2.91.60 19981201 (egcs-1.1.1 release)

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/cpp.exe -lang-c++ -v -iprefix
C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/ -undef -D__GNUC__=2 -D__GNUG__=2 -D__cplusplus -D__GNUC_MINOR__=91 
-Di386 -D_WIN32 -DWINNT -D_X86_=1 -D__STDC__=1 -D__stdcall=__attribute__((__
stdcall__)) -D__cdecl=__attribute__((__cdecl__)) -D__declspec(x)=__attribute
__((x)) -D__i386__ -D_WIN32 -D__WINNT__ -D_X86_=1 -D__STDC__=1 -D__stdcall=_
_attribute__((__stdcall__)) -D__cdecl=__attribute__((__cdecl__)) -D__declspe
c(x)=__attribute__((x)) -D__i386 -D__WINNT -Asystem(winnt) -Acpu(i386) -Amac
hine(i386) -D__EXCEPTIONS -remap -Asystem(unix) -Acpu(i386) -Amachine(i386) 
-Di386 -D__i386 -D__i386__ -Di586 -Dpentium -D__i586 -D__i586__ -D__pentium 
-D__pentium__ -D__CYGWIN32__ -D__CYGWIN__ def2.cpp def2.ii
GNU CPP version egcs-2.91.60 19981201 (egcs-1.1.1 release) (80386, BSD
syntax)
#include "..." search starts here:
#include <...> search starts here:

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/../../../../../include/g++

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/../../../../../include

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/../../../../i586-cygwin32/include

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/include
 /usr/include
End of search list.

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/cc1plus.exe def2.ii -quiet -dumpbase def2.cc -version -o def2.s
GNU C++ version egcs-2.91.60 19981201 (egcs-1.1.1 release) (i586-cygwin32)
compiled by GNU C version egcs-2.91.60 19981201 (egcs-1.1.1 release).

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/../../../../i586-cygwin32/bin/as.exe -o def2.o def2.s

C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/collect2.exe
C:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-
2.91.60/../../../../i586-cygwin32/lib/crt0.o -LC:\usr\local\cygnus\CYGWIN~1\
H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/egcs-2.91.60 -LC:\usr\local\cygnus
\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib -LC:\usr\local\cygnus\CYGWIN~1\H-I586~
1\bin/../lib/gcc-lib/i586-cygwin32/egcs-2.91.60/../../../../i586-cygwin32/li
b -LC:\usr\local\cygnus\CYGWIN~1\H-I586~1\bin/../lib/gcc-lib/i586-cygwin32/e
gcs-2.91.60/../../..
def2.o -lstdc++ -lm -lgcc -lcygwin -lkernel32 -ladvapi32 -lshell32 -lgcc

def2.ii