Programmer's error or gcc-5.1.0 bug?

Question

I tried to compile a big piece of software using gcc-5.1.0 with optimization flags -O1/-O2/-O3/-Og. It gave me warnings either -Wmaybe-uninitialized or -Wuninitialized and failed at runtime. After debugging I found the code that causes it, however I was not able to understand why. I reduced the code to reproduce the failure:

#include <cstdlib>
#include <iostream>

template<class T>
struct foo {
    template<class U>
    char bar(const U &x) {
        //return id(x)[0];
        const T &y = id(x);
        return y[0];
    }

    const T &id(const T &elem) {
        return elem;
    }
};

int main(void) {
    foo<const char *> f;
    char *str = "hello world";
    //std::cout << f.bar((const char *)str) << std::endl;
    std::cout << f.bar(str) << std::endl;
    return 0;
}

gcc-5.1.0 gives following warning:

g++ -Og -Wall -Wextra -Wno-write-strings    test.cpp   -o test
test.cpp: In function ‘int main()’:
test.cpp:10:19: warning: ‘<anonymous>’ is used uninitialized in this function [-Wuninitialized]
         return y[0];
                   ^
test.cpp:9:24: note: ‘<anonymous>’ was declared here
         const T &y = id(x);
                        ^

The program recieves SIGSEGV at runtime and crashes. It is hard to debug because of optimizations, but after playing with the code I believe the problem is that const T &y = id(x); assigns NULL to y. (Figured that out by replacing return y[0]; with function call which just returns y[0].) I can't currently test the code with other versions of gcc, however the code from which the example was derived worked correctly when compiled with gcc-4.9.2. It also works correctly with any optimization levels when comipled with clang-3.6.1. My next step was to try to figure out what is the exact optimization that causes it, so I put in my makefile all of gcc's optimization flags I was able to find, but it compiles without the warning and doesn't crash at runtime.

My questions are:

• Is it correct C++ code?
• Is it a known/unknown bug in gcc-5.1.0?
• Do I understand it correctly that in the example above T = [const char *]; U = [char *] and when I write const T &y = id(x); there should be implicit convertion of x from char * to const char * and y is a constant reference to const char *?
• If the template is wrong what is the exact error?
• How to figure out what is the exact optimization flag that causes it?

Note: uncommenting any of the commented lines fixes the program.

$ g++ -v
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-unknown-linux-gnu/5.1.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: /build/gcc-multilib/src/gcc-5-20150623/configure --prefix=/usr --libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/ --enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++ --enable-shared --enable-threads=posix --enable-libmpx --with-system-zlib --with-isl --enable-__cxa_atexit --disable-libunwind-exceptions --enable-clocale=gnu --disable-libstdcxx-pch --disable-libssp --enable-gnu-unique-object --enable-linker-build-id --enable-lto --enable-plugin --enable-install-libiberty --with-linker-hash-style=gnu --enable-gnu-indirect-function --enable-multilib --disable-werror --enable-checking=release --with-default-libstdcxx-abi=c++98
Thread model: posix
gcc version 5.1.0 (GCC)

gcc's optimization flags I tried:

-falign-functions -falign-jumps -falign-labels -falign-loops -fassociative-math
-fauto-inc-dec -fbranch-count-reg -fbranch-probabilities -fbranch-target-load-optimize
-fbranch-target-load-optimize2 -fbtr-bb-exclusive -fcaller-saves -fcheck-data-deps -fcheck-new
-fcombine-stack-adjustments -fcompare-elim -fconserve-stack -fcprop-registers -fcrossjumping
-fcse-follow-jumps -fcse-skip-blocks -fcx-fortran-rules -fcx-limited-range -fdata-sections
-fdce -fdefer-pop -fdelete-null-pointer-checks -fdevirtualize -fdevirtualize-speculatively
-fdse -fearly-inlining -fexpensive-optimizations -fext-numeric-literals -ffast-math
-ffinite-math-only -ffloat-store -ffor-scope -fforward-propagate -ffriend-injection
-ffunction-sections -fgcse -fgcse-after-reload -fgcse-las -fgcse-lm -fgcse-sm -fguess-branch-probability
-fhoist-adjacent-loads -fif-conversion -fif-conversion2 -findirect-inlining -finline-functions
-finline-functions-called-once -finline-small-functions -fipa-cp -fipa-cp-alignment -fipa-cp-clone
-fipa-icf -fipa-matrix-reorg -fipa-profile -fipa-pta -fipa-pure-const -fipa-ra -fipa-reference
-fipa-sra -fipa-struct-reorg -fisolate-erroneous-paths-dereference -fivopts -fkeep-inline-functions
-fkeep-static-consts -floop-block -floop-interchange -floop-strip-mine -flra-remat -fmerge-all-constants
-fmerge-constants -fmodulo-sched -fmodulo-sched-allow-regmoves -fmove-loop-invariants -fms-extensions
-fnothrow-opt -fomit-frame-pointer -foptimize-register-move -foptimize-sibling-calls -foptimize-strlen
-fpartial-inlining -fpeel-loops -fpeephole2 -fpermissive -fpredictive-commoning -fprefetch-loop-arrays
-fprofile-correction -fprofile-generate -fprofile-use -fprofile-values -freciprocal-math -fregmove
-frename-registers -freorder-blocks -freorder-blocks-and-partition -freorder-functions -frerun-cse-after-loop
-freschedule-modulo-scheduled-loops -frounding-math -fsched-interblock -fsched-spec -fsched-spec-load
-fsched-spec-load-dangerous -fsched-stalled-insns -fsched-stalled-insns-dep -fsched2-use-superblocks
-fsched2-use-traces -fschedule-insns -fschedule-insns2 -fsee -fsel-sched-pipelining
-fsel-sched-pipelining-outer-loops -fselective-scheduling -fselective-scheduling2 -fshrink-wrap
-fsignaling-nans -fsingle-precision-constant -fsized-deallocation -fsplit-ivs-in-unroller
-fsplit-wide-types -fssa-phiopt -fstack-protector -fstack-protector-all -fstrict-aliasing
-fstrict-overflow -fthread-jumps -ftracer -ftree-bit-ccp -ftree-builtin-call-dce -ftree-ccp
-ftree-ch -ftree-coalesce-vars -ftree-copy-prop -ftree-copyrename -ftree-dce -ftree-dominator-opts
-ftree-dse -ftree-forwprop -ftree-fre -ftree-loop-distribute-patterns -ftree-loop-distribution
-ftree-loop-im -ftree-loop-ivcanon -ftree-loop-linear -ftree-loop-optimize -ftree-loop-vectorize
-ftree-partial-pre -ftree-phiprop -ftree-pre -ftree-pta -ftree-reassoc -ftree-sink -ftree-slp-vectorize
-ftree-slsr -ftree-sra -ftree-switch-conversion -ftree-tail-merge -ftree-ter -ftree-vect-loop-version
-ftree-vectorize -ftree-vrp -funit-at-a-time -funroll-all-loops -funroll-loops -funsafe-loop-optimizations
-funsafe-math-optimizations -funswitch-loops -fuse-cxa-atexit -fvariable-expansion-in-unroller
-fvect-cost-model -fvisibility-inlines-hidden -fvisibility-ms-compat -fvpt -fvtv-counts -fvtv-debug
-fweb -fwhole-program

Answer 1

Your string literal is (illegally) bound to a char*:

char *str = "hello world";

This is a leftover conversion from C, which has been deprecated since C++98 (or C++03?) and been removed in C++11. gcc still allows it as an extension, as does clang++.

When you call f.bar(str), it deduces U == char*, so its function parameter type becomes char* const&.

using U = char*;
template<>
char bar(const U &x) { // char* const& x
    const T &y = id(x);
    return y[0];
}

However, you have instantiated f with the template argument char const*, hence the function parameter type of id is char const* const&:

const T &id(const T &elem) { // char const* const& elem
    return elem;
}

Therefore, the expression id(x) in bar has to convert from char* to char const*, which creates a temporary. This temporary lasts until the end of the full-expression const T& y = id(x);, and therefore creates a dangling reference y.

---

Basically, one of your assumptions is incorrect / incomplete:

Do I understand it correctly that in the example above T = [const char*]; U = [char *] and when I write const T &y = id(x); there should be implicit convertion of x from char * to const char * and y is a constant reference to const char *?

The types T const* and T* are not reference-compatible. For details, see [dcl.init.ref]. However, T* can be converted to T const*, so a temporary is created and bound to T const*&. This is similar to:

int i = 42;
double const& d = i; // creates a temporary double and binds it to d

This is the behaviour for all reference-incompatible types where the source is implicitly convertible to the destination type (save for class types with conversion functions/operators).

Why are T const* and T* not reference compatible? The same reasoning applies as for T const** vs T**, which are also incompatible. This prevents a subtle error, see https://stackoverflow.com/a/2908332/