[Bug libstdc++/55911] New: Segfault in unordered_map with max_load_factor > 1

[timj at gtk dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55911

             Bug #: 55911
           Summary: Segfault in unordered_map with max_load_factor > 1
    Classification: Unclassified
           Product: gcc
           Version: 4.7.2
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: libstdc++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: timj@gtk.org


Created attachment 29114
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29114
C++11 unordered_map segfault example

The attached test program segfaults when compiled and executed with the
following g++ versions:
g++-4.7 (Ubuntu/Linaro 4.7.2-11precise2) 4.7.2
g++-4.6 (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3

The program inserts values into an unordered_map and iterates over it's bucket
stats. Removing the line
> pmap.max_load_factor (50);
does not cause a segfault.

Example output:
$ g++ -g -Wall -O2 -std=gnu++0x -pthread umap-bug.cc && dbg ./a.out         
unordered_map:        max_size: 768614336404564650
unordered_map:            size: 10352716
unordered_map:    bucket_count: 218971
unordered_map:     load_factor: 47.278938
unordered_map: max_load_factor: 50.000000

Program received signal SIGSEGV, Segmentation fault.
__distance<std::__detail::_Node_const_iterator<std::pair<long const, double>,
false, false> > (__last=..., __first=...)
    at /usr/include/c++/4.6/bits/stl_iterator_base_funcs.h:82
82                ++__first;
(gdb) bt
#0  __distance<std::__detail::_Node_const_iterator<std::pair<long const,
double>, false, false> > (__last=..., __first=...)
    at /usr/include/c++/4.6/bits/stl_iterator_base_funcs.h:82
#1  distance<std::__detail::_Node_const_iterator<std::pair<long const, double>,
false, false> > (__last=..., __first=...)
    at /usr/include/c++/4.6/bits/stl_iterator_base_funcs.h:117
#2  bucket_size (__n=218971, this=0x7fffffffde30) at
/usr/include/c++/4.6/bits/hashtable.h:299
#3  unordered_map_bucket_stats<std::unordered_map<long, double, HashPtrdiff> >
(umap=...) at umap-bug.cc:16
#4  main (argc=<optimized out>, argv=<optimized out>) at umap-bug.cc:55