[Bug libstdc++/52967] New: Segmentation fault on std::vector destruction

[karlicoss at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52967

             Bug #: 52967
           Summary: Segmentation fault on std::vector destruction
    Classification: Unclassified
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: libstdc++
        AssignedTo: unassig...@gcc.gnu.org
        ReportedBy: karlic...@gmail.com


GCC version:
4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3) 

Environment:
Ubuntu 11.10 amd64

I've also reproduced it at:
Ubuntu 11.10 amd64, gcc version 4.4.6
Windows 7 x64, mingw version 4.6.2. 
Gentoo x86, gcc-4.5.3-r2
Arch Linux x64, gcc version 4.7.0 


How to repeat:
main.cpp:
#include <vector>

struct Foo
{
    double a, b, c, d;
};

std::vector<Foo> v;
int steps = 3;

double run()
{
    if (steps == 0)
        return 1.0;

    steps--;
    v.push_back(Foo());

    v[0].a = run();

    //double tmp = run();
    //nodes[0].a = tmp;

    return 1.0;
}

int main()
{
    run();
    return 0;
}


$ g++ main.cpp -o main && ./main
results in segmentation fault. The backtrace shows the problem is in vector
destructor.


This one is very weird, for example:
1)
replacing 
nodes[0].a = run()
with
double tmp = run();
nodes[0].a = tmp;
does not give segfault anymore.

2)
Reducing the Foo structure size (for example, using only three doubles instead
of four or using two doubles and two ints) does not give segfault.

3)
Decreasing the steps variable does not result in segfault.

4)
Returning 0.0 in the run function does not result in segfault (any non-zero
value still does).

5)
Setting the initial size for v sometimes results in segfault, sometime does.