https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118160
--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The releases/gcc-14 branch has been updated by Jonathan Wakely <r...@gcc.gnu.org>: https://gcc.gnu.org/g:f83bc0edb51e3e70e9cb5786f99f299ad2baa283 commit r14-11359-gf83bc0edb51e3e70e9cb5786f99f299ad2baa283 Author: Giuseppe D'Angelo <giuseppe.dang...@kdab.com> Date: Thu Feb 6 14:24:17 2025 +0000 libstdc++: fix a dangling reference crash in ranges::is_permutation [PR118160] The code was caching the result of `invoke(proj, *it)` in a local `auto &&` variable. The problem is that this may create dangling references, for instance in case `proj` is `std::identity` (the common case) and `*it` produces a prvalue: lifetime extension does not apply here due to the expressions involved. Instead, store (and lifetime-extend) the result of `*it` in a separate variable, then project that variable. While at it, also forward the result of the projection to the predicate, so that the predicate can act on the proper value category. libstdc++-v3/ChangeLog: PR libstdc++/118160 PR libstdc++/100249 * include/bits/ranges_algo.h (__is_permutation_fn): Avoid a dangling reference by storing the result of the iterator dereference and the result of the projection in two distinct variables, in order to lifetime-extend each one. Forward the projected value to the predicate. * testsuite/25_algorithms/is_permutation/constrained.cc: Add a test with a range returning prvalues. Test it in a constexpr context, in order to rely on the compiler to catch UB. Signed-off-by: Giuseppe D'Angelo <giuseppe.dang...@kdab.com> (cherry picked from commit 2a2bd96d0d2109384a0eedde843ba811d2e18738)
