http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50714

             Bug #: 50714
           Summary: codecvt_byname::codecvt::_M_c_locale_codecvt not
                    initialized by destroyed
    Classification: Unclassified
           Product: gcc
           Version: 4.6.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
        AssignedTo: unassig...@gcc.gnu.org
        ReportedBy: rgue...@gcc.gnu.org


/// class codecvt_byname [22.2.1.6].
  template<typename _InternT, typename _ExternT, typename _StateT>
    class codecvt_byname : public codecvt<_InternT, _ExternT, _StateT>
    {
    public:
      explicit
      codecvt_byname(const char* __s, size_t __refs = 0)
      : codecvt<_InternT, _ExternT, _StateT>(__refs)
      {
        if (__builtin_strcmp(__s, "C") != 0
            && __builtin_strcmp(__s, "POSIX") != 0)
          {
            this->_S_destroy_c_locale(this->_M_c_locale_codecvt);
            this->_S_create_c_locale(this->_M_c_locale_codecvt, __s);
          }
      }

destroys _M_c_locale_codecvt but that member is never initialized by
the base constructor call.  Thus the attached testcase segfaults
because it reads garbage.

Reply via email to