[Bug middle-end/64922] New: runtime error: member call on misaligned address for type 'struct _Rep'

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64922

            Bug ID: 64922
           Summary: runtime error: member call on misaligned address for
                    type 'struct _Rep'
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: mpolacek at gcc dot gnu.org

Compile x.cc with -fsanitize=alignment,bool,enum -O2
-D_GLIBCXX_USE_CXX11_ABI=0.  Then run the generated binary:

$ ./a.out d_mos1.model
/home/marek/x/trunk/x86_64-unknown-linux-gnu/libstdc++-v3/include/bits/basic_string.h:2941:9:
runtime error: member call on misaligned address 0xffffffffffffffe9 for type
'struct _Rep', which requires 8 byte alignment
0xffffffffffffffe9: note: pointer points here
<memory cannot be printed>
Segmentation fault (core dumped)

That runtime error seems like a bug.  Note that the failure goes away with e.g.
-fno-tree-fre.  Without -fsanitize=... it doesn't even segfault, which is what
makes this bug extremely hard to analyze.  Also I haven't manage to reduce the
test case more.

$ cat d_mos1.model
/**/
$ cat x.cc
#include <string>
class CS_FILE {};
class CS {
private:
  char* _name;
  char* _cmd;
  int  _cnt;
  bool _ok;
  int  _length;
  static enum MATCH_STYLE {msPARTIAL, msIGNORE_CASE, msEXACT} _ms;
public:
  explicit    CS(CS_FILE, const std::string& name, int i=0);
  int          cursor()const    {return _cnt;}
  bool        stuck(int* last)    {bool ok=*last<_cnt; *last=_cnt; return !ok;}
        operator bool()const{return _ok;}
  char          peek()const    {return _cmd[_cnt];}
  bool          ns_more()const    {return peek()!='\0';}
  CS&          dmatch(const std::string&);
  bool          match1(char c)const{return (peek()==c);}
  CS&          skip(int c=1)    {_cnt+=c; _ok=_cnt<=_length; return *this;}
  CS&          skipbl();
  CS&          skip1b(char);
  CS&          skip1(char);
  CS&          skipto1(char);
  CS&          operator>>(const char x)    {return skip1b(x);}
};    
template <class T>
inline bool get(CS& cmd, const std::string& key, T* val)
{
  if (cmd.dmatch(key)) {
    cmd >> '=' >> *val;
    return true;
  }
  return false;
}
template <class T>
inline CS& operator>>(CS& cmd, T& val)
{
  val.parse(cmd);
  return cmd;
}
class Base;
class Code_Block;
class Head;
class File;
class CS;
class Base
{
public:
  virtual void parse(CS&) = 0;
  virtual ~Base() {}
};
class Code_Block
  :public Base
{
  const char* _begin;
  const char* _end;
public:
  void parse(CS& f);
  Code_Block() :_begin(0), _end(0) {}
};
class Head
  :public Base
{
public:
  void parse(CS& f);
};
class File
{
  std::string    _name;
  CS        _file;
  Head        _head;
  Code_Block    _h_headers;
public:
  File(const std::string& file_name);
};
void Code_Block::parse(CS& file) 
{
  file.skipbl().skip1('{');
}
void Head::parse(CS& file)
{
  file.skipto1('*');
}
File::File(const std::string& file_name)
  :_name(file_name),
   _file(CS_FILE(), file_name)
{
  get(_file, "foo", &_head);
  int here = _file.cursor();
  for (;;) {
      get(_file, "X", &_h_headers)
      || get(_file, "X", &_h_headers)
      || get(_file, "X", &_h_headers)
      ;
    if (_file.stuck(&here))
      break;
  }
}
CS::MATCH_STYLE CS::_ms(msPARTIAL);
CS& CS::dmatch(const std::string& s)
{
  asm ("": "+r" (_ms));
  return *this;
}
CS::CS(CS_FILE, const std::string& name, int i)
  :_name(0),
   _cmd(0),
   _cnt(i),
   _ok(true),
   _length(0)
{
  _name = new char[name.length()+1];
  __builtin_strcpy(_name, name.c_str());
  _length = 1;
  _cmd = new char[_length+2];
  _cmd[_length++] = '\0';
}
CS& CS::skipbl()
{
  while (peek() && (!isgraph(peek())))
    skip();
  return *this;
}
CS& CS::skip1b(char t)
{
  return *this;
}
CS& CS::skip1(char t)
{
  if (match1(t))
    skip();
  return *this;
}
CS& CS::skipto1(char c)
{
  while (ns_more() && !match1(c))
    skip();
  return *this;
}
int main(int argc, char** argv)
{
  File f(argv[1]);
}