std::packaged_task crash on HPUX g++ 4.9.3

[Brian Groose <brian at groose dot com>]

I'm currently hitting an SIGSEGV with any use of std::pacakged_task on
HPUX ia64.  Unfortunately, I cannot get anything later than 4.9.3 to
compile on HPUX, so I can't test a new version, though the same code
appears to work fine on Linux with gcc 4.9.3.

Here's my test case:
#include <future>
int main()
{
    std::packaged_task<void()> task([]{});
    task();
    return 0;
}

$ g++ -pthread -std=c++11 test.cpp -gdwarf-2 -o test

I've chased this down to the point where the following happens:
std::packaged_task::operator() calls into _M_set_result()  which calls
std::call_once()
std::call_once() is entered in <mutex>
__gthread_once() is called from call_once
__gthread_once() calls back into __once_call_impl()
__once_call_impl() calls __once_callable(), which points to
__bound_functor which is stack allocated inside call_once()
after a few calls through std::_Bind_simple, we get to a
std::reference_wrapper<bool>::get call where _M_data is NULL, which is
where we crash

I've put breakpoints on every constructor in
std::reference_wrapper<bool> and the object being used at the time of
the crash has a different this pointer than any of the ones I've seen
constructed, which explains how we got an impossible NULL
reference_wrapper.

Some output from gdb, the backtrace seems to stop once it hits
__once_call_impl and frames #2 and #3 have bogus function names, I'm
not sure why, maybe due to HPUX's libunwind:

Breakpoint 1, std::reference_wrapper<bool>::get (this=0x7e402d80) at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:429
429           { return *_M_data; }

(gdb) p _M_data
$1 = (bool *) 0x0

(gdb) p *this
$2 = {<std::_Reference_wrapper_base<bool>> =
{<std::_Reference_wrapper_base_impl<false, false, bool>> =
{<std::_Weak_result_type<bool>> = {<std::_Weak_result_type_impl<bool>>
= {<std::_Maybe_get_result_type<false, bool>> = {<No data fields>},
<No data fields>}, <No data fields>}, <No data fields>}, <No data
fields>}, _M_data = 0x0}

(gdb) bt
#0  std::reference_wrapper<bool>::get (this=0x7e402d80) at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:429
#1  0x0000000004015800 in std::reference_wrapper<bool>::operator bool&
(this=0x7e402d80) at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:425
#2  0x00000000040151f0 in _divRemI () at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:569
#3  0x00000000040149b0 in _div32U () at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:1700
#4  0x0000000004013950 in std::_Bind_simple<std::_Mem_fn<void
(std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base,
std::__future_base::_Result_base::_Deleter> ()>&, bool&)>
(std::__future_base::_State_baseV2*,
std::reference_wrapper<std::function<std::unique_ptr<std::__future_base::_Result_base,
std::__future_base::_Result_base::_Deleter> ()> >,
std::reference_wrapper<bool>)>::operator()() (this=0x7e402d80) at
/opt/act-gcc-4.9.3/include/c++/4.9.3/functional:1688
#5  0x00000000040125e0 in
std::__once_call_impl<std::_Bind_simple<std::_Mem_fn<void
(std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base,
std::__future_base::_Result_base::_Deleter> ()>&, bool&)>
(std::__future_base::_State_baseV2*,
std::reference_wrapper<std::function<std::unique_ptr<std::__future_base::_Result_base,
std::__future_base::_Result_base::_Deleter> ()> >,
std::reference_wrapper<bool>)> >() () at
/opt/act-gcc-4.9.3/include/c++/4.9.3/mutex:714
#6  0x200000007ef086f0 in ?? ()
#7  0x0000000000000000 in ?? ()

I have tried using std::call_once() directly and it works as expected,
but I was unable to find any outstanding packaged_task bugs that were
not fixed prior to 4.9.3.

Any suggestions on what to try next?

Apologies if I forgot some details, I've been neck-deep in gdb for a
few hours so I may have omitted some basic info.