https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65209
Bug ID: 65209
Summary: [5.0 regression] Broken code with global static
variables, invalid pointer when freeing global
variables
Product: gcc
Version: 5.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c++
Assignee: unassigned at gcc dot gnu.org
Reporter: manisandro at gmail dot com
Created attachment 34870
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34870&action=edit
testcase
Using gcc-5.0.0-0.15.fc23.x86_64
Test case attached. Build with
$ g++ -g -Wall -o main foo.cpp main.cpp
The test case crashes when freeing global variables:
./main
*** Error in `/home/sandro/Desktop/a/main': free(): invalid pointer:
0x0000000000610001 ***
#0 0x00007ffff71a6ae8 in raise () from /lib64/libc.so.6
#1 0x00007ffff71a877a in abort () from /lib64/libc.so.6
#2 0x00007ffff71eb092 in __libc_message () from /lib64/libc.so.6
#3 0x00007ffff71f2994 in _int_free () from /lib64/libc.so.6
#4 0x00007ffff71f748c in free () from /lib64/libc.so.6
#5 0x000000000040099b in FooData::~FooData (this=0x602118
<_ZGVZN12_GLOBAL__N_112Q_QGS_s_self13innerFunctionEvE6holder>,
__in_chrg=<optimized out>)
at foo.cpp:5
#6 0x00000000004009da in Foo::~Foo (this=0x602100
<_ZZN12_GLOBAL__N_112Q_QGS_s_self13innerFunctionEvE6holder>,
__in_chrg=<optimized out>) at foo.cpp:8
#7 0x0000000000400a12 in FooSingleton::~FooSingleton (this=0x602100
<_ZZN12_GLOBAL__N_112Q_QGS_s_self13innerFunctionEvE6holder>,
__in_chrg=<optimized out>) at foo.cpp:15
#8 0x0000000000400a69 in (anonymous
namespace)::Q_QGS_s_self::innerFunction()::Holder::~Holder() (
this=0x602100 <_ZZN12_GLOBAL__N_112Q_QGS_s_self13innerFunctionEvE6holder>,
__in_chrg=<optimized out>) at foo.cpp:33
#9 0x00007ffff71ab628 in __run_exit_handlers () from /lib64/libc.so.6
#10 0x00007ffff71ab675 in exit () from /lib64/libc.so.6
#11 0x00007ffff7191847 in __libc_start_main () from /lib64/libc.so.6
#12 0x00000000004007e9 in _start ()
Observations:
- Depends on the Q_QGS_s_self namespace being called such (more precisely,
exactly such, not even any other name with equal length)
- Depends on the innerFunction method being called such
- Depends on innerFunction being inline
- Depends on the size of the global variables
