Bug#210848: g++-3.3: Code miscompilation with -O0 -finline (discovered in QT)

[Kevin Puetz <puetzk@iastate.edu>]

Package: g++-3.3
Version: 1:3.3.2-0pre3
Severity: grave
Tags: security
Justification: renders package unusable

3.3.2-0pre3 introduces a very serious miscompilation when inline functions are in the lvalue of conditional expressions (at least, I think that this is the trigger condition).

It was introduced sometime between 3.3.2-0pre2 (2003/08/31) and 3.3.2-0pre3 (2003/09/08).
It appears to generally generate an infinite loop in which it repeatedly evaluates the inlined function, though I also observed it to manifest in repeated, but terminating evaluation (in which it calculated the left-hand expression two or more times, butr then did perform the assignment).

This will break most users of the QT template library container classes (and thus KDE) - probably most other C++ applications if my guess as to the nature of the bug is correct. I discovered it manifesting in the form of my locally-built kbuildsycoca, qt-assistant, and qt-linguist hanging partway through their startups. Chris Cheney (KDE maintainer) is also able to reproduce the behavior in my provided testcase, though his KDE/QT debian have not been rebuilt since 3.3.2-0pre3 was installed.

A minimal testcase derived from the QListView::addColumn method (in which I first observed this problem) is available at http://puetzk.org/tmp/testcast.tgz. If compiled with 3.3.2-0pre2 it will run and exit, with 3.3.2-0pre3 it hangs with 100% cpu usage. It will also run in 3.2.3-0pre3 as long as -finline is disabled. I was unable to isolate a small example for the behavior in which it executed more than once the lvalue function (qux) more than once, but not endlessly, though I occasionally saw this behavior as I worked to minimize the testcase. I believe both symptoms are related to the same underlying cause.

-- System Information:
Debian Release: testing/unstable
Architecture: i386
Kernel: Linux puetzk 2.6.0-test4-mm1 #1 SMP Tue Aug 26 22:09:58 CDT 2003 i686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8

Versions of packages g++-3.3 depends on:
ii  gcc-3.3                    1:3.3.2-0pre3 The GNU C compiler
ii  gcc-3.3-base               1:3.3.2-0pre3 The GNU Compiler Collection (base 
ii  libc6                      2.3.2-7       GNU C Library: Shared libraries an
ii  libstdc++5-3.3-dev         1:3.3.2-0pre3 The GNU Standard C++ Library v3 (d

-- no debconf information