[Bug libstdc++/112591] variant allows for creating multiple empty objects at same address

[pinskia at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112591

Andrew Pinski  changed:

   What|Removed |Added

 Status|UNCONFIRMED |NEW
   Last reconfirmed||2023-11-19
 Ever confirmed|0   |1

--- Comment #3 from Andrew Pinski  ---
Confirmed.

[Bug libstdc++/112591] variant allows for creating multiple empty objects at same address

[redi at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112591

--- Comment #2 from Jonathan Wakely  ---
Ug. The C++20 behaviour is correct, but fixing it for C++17 is an ABI
change. I think we need to do it though.

It should work to change the C++17 variant to use a union of
__aligned_membuf and Empty, and then just ignore the latter (or maybe we
can use the C++20 impl for C++17 too?)

This is a more general problem with __aligned_membuf, it's just that
std::variant is probably the only place you can trigger it, because you can't
have a data member of types such as _Rb_tree_node. We could change
aligned_membuf to use a union internally, so that anything using aligned_membuf
avoids having the same problem.

[Bug libstdc++/112591] variant allows for creating multiple empty objects at same address

[barry.revzin at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112591

--- Comment #1 from Barry Revzin  ---
Basically, in C++17, Sub looks like this:

struct Sub17 : Empty {
aligned_membuf storage;
unsigned char index;
};

But in C++20 it turns into:

struct Sub20 : Empty {
union { Empty storage; };
unsigned char index;
};

sizeof(Sub17) == 2 because of the empty base optimization, but sizeof(Sub20) ==
3 because now the language understands that storage is an Empty and thus needs
a distinct address from the Empty base class.