Xcode 7.2: clang/STM: Crash when using -fsanitize=object-size and std::list<std::string>

Originator:weissismail
Number:rdar://24654420 Date Originated:15-Feb-2016 03:03 PM
Status:Open Resolved:
Product:Developer Tools Product Version:Xcode 7.2 (7C68)
Classification:Crash/Hang/Data Loss Reproducible:Always
 
Summary:
========
Creating an empty std::list of std::string (e.g. `std::list<std::string> groups;`) and running the program in optimisation mode -Os, it just crashes.

Steps to Reproduce:
1. Download the attached file test.mm as /tmp/test.mm
2. Compile it as follows:
    clang -o /tmp/test -Os -fsanitize=object-size -fsanitize-undefined-trap-on-error -framework Foundation -ggdb -lstdc++ /tmp/test.mm
3. Run it with
    /tmp/test
    
Expected Results:
================
Program exits and returns zero.

Actual Results:
===============
Program crashes with SIGILL.

The reason is that this:

   215 	    _LIBCPP_INLINE_VISIBILITY
   216 	    pointer __self()
   217 	    {
-> 218 	        return static_cast<pointer>(pointer_traits<__base_pointer>::pointer_to(*this));
   219 	    }
   220 	};

in C++ STM (/Applications/Xcode.app/Contents//Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1/list) the line 218 comes out as a straight UD2 in the compiled output.

Also see the output of the disassembly:

$ otool -tV /tmp/test
/tmp/test:
(__TEXT,__text) section
_main:
0000000100000f9a    pushq	%rbp
0000000100000f9b    movq	%rsp, %rbp
0000000100000f9e    ud2

Regression:
===========
don't know

Notes:
======
The attached program in text form:
---
#include <string>
#include <list>

int main(int argc, char **argv)
{
    std::list<std::string> groups;
    return 0;
}
---

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!