[gcc r13-2086] Fix bug in emergency cxa pool free

[Richard Biener]

https://gcc.gnu.org/g:5bc2042df437cd8aeebcdf5bbb858678e3733ca4

commit r13-2086-g5bc2042df437cd8aeebcdf5bbb858678e3733ca4
Author: Keef Aragon <keef.aragon@konscious.net>
Date:   Wed Aug 17 08:45:15 2022 +0200

    Fix bug in emergency cxa pool free
    
    This probably has never actually affected anyone in practice. The normal
    ABI implementation just uses malloc and only falls back to the pool on
    malloc failure. But if that happens a bunch of times the freelist gets out
    of order which violates some of the invariants of the freelist (as well as
    the comments that follow the bug). The bug is just a comparison reversal
    when traversing the freelist in the case where the pointer being returned
    to the pool is after the existing freelist.
    
    libstdc++-v3/
            * libsupc++/eh_alloc.cc (pool::free): Inverse comparison.

Diff:
---
 libstdc++-v3/libsupc++/eh_alloc.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libstdc++-v3/libsupc++/eh_alloc.cc b/libstdc++-v3/libsupc++/eh_alloc.cc
index c85b9aed40b..68f319869f9 100644
--- a/libstdc++-v3/libsupc++/eh_alloc.cc
+++ b/libstdc++-v3/libsupc++/eh_alloc.cc
@@ -224,8 +224,8 @@ namespace
 	  free_entry **fe;
 	  for (fe = &first_free_entry;
 	       (*fe)->next
-	       && (reinterpret_cast <char *> ((*fe)->next)
-		   > reinterpret_cast <char *> (e) + sz);
+	       && (reinterpret_cast <char *> (e) + sz
+		   > reinterpret_cast <char *> ((*fe)->next));
 	       fe = &(*fe)->next)
 	    ;
 	  // If we can merge the next block into us do so and continue