http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51866

--- Comment #4 from Jonathan Wakely <redi at gcc dot gnu.org> 2012-01-16 
12:33:35 UTC ---
in _Hashtable::_M_insert(Arg&&, false_type):

    const key_type& __k = this->_M_extract()(__v);

that takes a reference to the key part of the value, then:

        __new_node = _M_allocate_node(std::forward<_Arg>(__v));

that invalidates the value, while __k stills refers to the moved-from object.

then:

        size_type __n = _M_bucket_index(__k, __code);
        _BaseNode* __prev = _M_find_before_node(__n, __k, __code);

that uses the invalid key

Reply via email to