https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99402

            Bug ID: 99402
           Summary: std::copy creates _GLIBCXX_DEBUG false positive for
                    attempt to subscript a dereferenceable
                    (start-of-sequence) iterator
           Product: gcc
           Version: 10.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kip at thevertigo dot com
  Target Milestone: ---

The following is a minimal:

// Standard C++ / POSIX system headers...
#include <algorithm>
#include <set>
#include <vector>

using namespace std;

int main()
{
    // Container of eleven elements...
    const set<int> Source = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };

    // Goal is to copy the first ten elements in to here, or 0 to 9 inclusive.
    //  It has space for ten elements...
    vector<int> Destination(10);

    // This should point to the end of the source range, or element with value
    //  10 which is the first value after the range to be copied...
    const auto EndIterator = next(cbegin(Source), 10);

    // This results in memory corruption, or an abort with STL debugging
    //  enabled. copy_n(..., 10, ...) works fine...
    copy(cbegin(Source), EndIterator, begin(Destination));

    return 0;
}

Compile and run with the following:

    $ g++-10 -D_GLIBCXX_DEBUG test.cpp -o test -g3 -std=c++17 && ./test 

I see the following:

    /usr/include/c++/10/bits/stl_algobase.h:566:
    In function:
        _OI std::copy(_II, _II, _OI) [with _II = 
        __gnu_debug::_Safe_iterator<std::_Rb_tree_const_iterator<int>, 
        std::__debug::set<int>, std::bidirectional_iterator_tag>; _OI = 
        __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<int*, 
        std::__cxx1998::vector<int, std::allocator<int> > >, 
        std::__debug::vector<int>, std::random_access_iterator_tag>]

    Error: attempt to subscript a dereferenceable (start-of-sequence) iterator 
    11 step from its current position, which falls outside its dereferenceable 
    range.

    Objects involved in the operation:
        iterator "__result" @ 0x0x7ffc3a448040 {
          type = __gnu_cxx::__normal_iterator<int*, std::__cxx1998::vector<int,
std::allocator<int> > > (mutable iterator);
          state = dereferenceable (start-of-sequence);
          references sequence with type 'std::__debug::vector<int,
std::allocator<int> >' @ 0x0x7ffc3a4480d0
        }
    Aborted (core dumped)

I've been advised from another who ran the same test that this works fine with
GCC 8 and 9, so it may be a regression.

Reply via email to