libstdc++/8359: STL container can fault at runtime destroying contained objects with virtual destructors
vwhite@entercept.com
vwhite@entercept.com
Fri Oct 25 13:16:00 GMT 2002
>Number: 8359
>Category: libstdc++
>Synopsis: STL container can fault at runtime destroying contained objects with virtual destructors
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: unassigned
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Oct 25 13:06:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Victor White, for D. Hosterman
>Release: "gcc (GCC) 3.2 20020708 (experimental)" with "libstdc++-v3"
>Organization:
>Environment:
HP PA2.0 hardware (compiling PA1.1 code), HP-UX 11i
>Description:
The standard template library file
include/c++/3.2/bits/stl_construct.h
includes a definition of the following template function:
template <class _Tp>
inline void
_Destroy(_Tp* __pointer)
{ __pointer->~_Tp(); }
The function will be called when destroying
an element of a container (vector, list, etc.).
If that element is a derived object with virtual
destructors, it can end up calling an incorrect
sequence of destructors which (on my system) results
in a SIGSEGV when an object is removed from the
container.
>How-To-Repeat:
Sorry, I don't happen to have a canned example. This
appeared in a very large program we are working on
which I have not included.
Depends on the program. It must use a container
that holds the object itself (not a pointer to).
The object must be a derived type with a virtual
destructor.
>Fix:
The change made locally was:
template <class _Tp>
inline void
_Destroy(_Tp* __pointer)
{ __pointer->_Tp::~_Tp(); } //<= only our destructor
Which seems to both make sense and fix the problem.
We have not yet checked to see if there are other places
in which destructors are being explicitly called that may
have similar issues.
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the Gcc-bugs
mailing list