https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91146
--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Regarding the original testcase, small tweak results in the same warning even
without sanitization:
#include "pr91146.h"
class A
{
public:
virtual void f () = 0;
};
template <typename T>
void foo (T &);
class B : public A
{
public:
void f () override
{
small_vector<int, 20> v;
auto i = v.begin ();
foo (i);
v.insert (i, 1);
foo (v);
}
};
int main ()
{
B b;
b.f ();
return 0;
}
Here we just make sure the method isn't optimized away completely and that the
optimizer doesn't know v.insert is called with v.begin () iterator.
And the problem is that the llvm small vector implementation does:
iterator insert(iterator I, T &&Elt) {
...
T *EltPtr = &Elt;
if (I <= EltPtr && EltPtr < this->EndX)
++EltPtr;
*I = ::std::move(*EltPtr);
return I;
}
*++EltPtr on an int (not array) is obviously UB, but the condition should guard
that this doesn't happen. Except that there is UB already in the condition
that guards this, because non-equality pointer comparisons are valid only if
both pointers point into the same object or one past the end of it, or both are
NULL.
That isn't the case here, as I points into the payload of the v variable and so
does this->endX, while EltPtr points to a temporary holding 1.
So, I'd say this is LLVM bug.
