IZ97834: ?: CAUSING DESTRUCTOR CALLED TWICE

May 2012 PTF for XL C/C++ for AIX, V10.1
January 2013 PTF for XL C/C++ for AIX, V10.1
XL C/C++ for AIX Fix Pack 18 (July 2013 PTF) for 10.1
XL C/C++ for AIX Fix Pack 19 (October 2013 PTF) for 10.1
XL C/C++ for AIX Fix Pack 21 (October 2015 PTF) for 10.1
May 2011 PTF for XL C/C++ for AIX, V10.1
October 2011 PTF for XL C/C++ for AIX, V10.1
February 2012 PTF for XL C/C++ for AIX, V10.1
September 2012 PTF for XL C/C++ for AIX, V10.1
XL C/C++ for AIX Fix Pack 20 (October 2014 PTF) for 10.1

APAR status

• Closed as program error.

Error description

• An application has runtime segmentation fault.
  
  The segfault is caused by memory corruption when calling a
  destructor of the same class allocated on stack twice.
  Second (wrong) time is called when throw() is executed.
  __DoThrowV6 on stack.
  
  If changing the code from : ? to if-else, problem disappears.
  
  A reduced test case follows:
  
  
  ==========
  TEST CASE:
  ==========
  
  $cat t.C && xlC t.C && ./a.out
  extern "C" int printf(const char *, ...);
  
  struct S {
    S(int i) { printf("S::S(%d), this = 0x%lx\n", i, this); }
    ~S() { printf("S::~S(), this = 0x%lx\n", this); }
    S(const S&) { printf("S(const S&), this = 0x%lx\n", this);}
  };
  
  void bar(S s) { }
  
  void foo(bool b, S* p) {
    bar(b ? *p : S(2));
    throw 42;
  }
  
  int main() {
    try {
      S s(1);
      foo(true, &s);
    }
    catch(int i) {
      printf("caught\n");
    }
    return 0;
  }
  
  ==============
  ACTUAL OUTPUT:
  ==============
  S::S(1), this = 0x2ff229a0
  S(const S&), this = 0x2ff22908
  S::~S(), this = 0x2ff22908
  S::~S(), this = 0x2ff22908
  S::~S(), this = 0x2ff229a0
  caught
  
  ================
  EXPECTED OUTPUT:
  ================
  S::S(1), this = 0x2ff229a0
  S(const S&), this = 0x2ff22908
  S::~S(), this = 0x2ff22908
  S::~S(), this = 0x2ff229a0
  caught
  (constructor and destructor pairs should match)
  

Local fix

• Replace conditional expressions with 'if else'.
  

Problem summary

• PROBLEM DESCRIPTION: Double destruction of temporaries may
  occur in code using conditional expressions.
  
  USERS AFFECTED: Conditional expression used in copy-by-value
  argument.
  

Problem conclusion

• A fix is available to ensure the exception handling state is
  corrected in the affected cases. Apply applicable service.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IZ94726

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  XL C++ AIX

• Fixed component ID

  5724U8100

Applicable component levels