Crash when attempting to call mpz_invert in a program that uses mpq_class and mpz_class

[Álvaro Begué]

I tried some simplifications of the program and the problem went away.
Anyway, I got it down to around 10 lines, so it should be easy to see
what's going on.

Here's the laundry list:

   - The GMP version number, and if pre-packaged or patched then say so.*
   6.1 patchlevel 0. This was installed from an ubuntu package.*
   - A test program that makes it possible for us to reproduce the bug.
   Include instructions on how to run the program.

#include <gmpxx.h>

mpz_class fraction_mod_m(mpq_class x, mpz_class m) {
  mpz_t inverse;
  mpz_class den = x.get_den();
  mpz_invert(inverse, den.get_mpz_t(), m.get_mpz_t()); // Crashes
  return mpz_class(inverse);
}

int main() {
  mpq_class x = mpq_class(10, 21);
  mpz_class m(37);
  mpz_class z = fraction_mod_m(x, m);
}

Just compile it and run it. I compiled it with g++ 5.3.0, thusly:

g++ -std=c++11 kk.cpp -o kk -O3 -Wall -Wextra -lgmp -lgmpxx



   - A description of what is wrong. If the results are incorrect, in what
   way. If you get a crash, say so. *I get a crash.*
   - If you get a crash, include a stack backtrace from the debugger if
   it’s informative (‘where’ in gdb, or ‘$C’ in adb). *It doesn't seem
   particularly informative to me, but here it is, just in case.*

(gdb) bt
#0  0x00007ffff6d1c428 in __GI_raise (sig=sig at entry=6) at
../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff6d1e02a in __GI_abort () at abort.c:89
#2  0x00007ffff6d5e7ea in __libc_message (do_abort=do_abort at entry=2,
fmt=fmt at entry=0x7ffff6e772e0 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff6d6c1d0 in malloc_printerr (ar_ptr=<optimized out>,
    ptr=0x400c98 <__gmp_expr<__mpq_struct [1], __mpq_struct
[1]>::__gmp_expr(__gmp_expr<__mpq_struct [1], __mpq_struct [1]>
const&)+62>,
    str=0x7ffff6e741c6 "realloc(): invalid pointer", action=3) at
malloc.c:5004
#4  __GI___libc_realloc (bytes=<optimized out>,
    oldmem=0x400c98 <__gmp_expr<__mpq_struct [1], __mpq_struct
[1]>::__gmp_expr(__gmp_expr<__mpq_struct [1], __mpq_struct [1]>
const&)+62>) at malloc.c:3011
#5  realloc_hook_ini (
    ptr=0x400c98 <__gmp_expr<__mpq_struct [1], __mpq_struct
[1]>::__gmp_expr(__gmp_expr<__mpq_struct [1], __mpq_struct [1]>
const&)+62>,
    sz=<optimized out>, caller=<optimized out>) at hooks.c:41
#6  0x00007ffff6d6ad3f in __GI___libc_realloc (
    oldmem=0x400c98 <__gmp_expr<__mpq_struct [1], __mpq_struct
[1]>::__gmp_expr(__gmp_expr<__mpq_struct [1], __mpq_struct [1]>
const&)+62>, bytes=16) at malloc.c:2981
#7  0x00007ffff7b60744 in __gmp_default_reallocate () from
/usr/lib/x86_64-linux-gnu/libgmp.so.10
#8  0x00007ffff7b7735a in __gmpz_realloc () from
/usr/lib/x86_64-linux-gnu/libgmp.so.10
#9  0x00007ffff7b673c1 in __gmpz_add () from
/usr/lib/x86_64-linux-gnu/libgmp.so.10
#10 0x00007ffff7b71079 in __gmpz_invert () from
/usr/lib/x86_64-linux-gnu/libgmp.so.10
#11 0x0000000000400969 in fraction_mod_m (x=..., m=...) at kk.cpp:6
#12 0x0000000000400a64 in main () at kk.cpp:13



   - Please do not send core dumps, executables or straces.
   - The ‘configure’ options you used when building GMP, if any.* I didn't
   build GMP myself.*
   - The output from ‘configure’, as printed to stdout, with any options
   used. *I didn't build GMP myself.*
   - The name of the compiler and its version. For gcc, get the version
   with ‘gcc -v’, otherwise perhaps ‘what `which cc`’, or similar. *g++
   5.3.0, as mentioned above.*
   - The output from running ‘uname -a’.

Linux MS-7850 4.4.0-66-generic #87-Ubuntu SMP Fri Mar 3 15:29:05 UTC 2017
x86_64 x86_64 x86_64 GNU/Linux


   - The output from running ‘./config.guess’, and from running ‘
   ./configfsf.guess’ (might be the same). *Not even sure where I am
   supposed to run those.*
   - If the bug is related to ‘configure’, then the compressed contents of
   config.log.
   - If the bug is related to an asm file not assembling, then the contents
   of config.m4 and the offending line or lines from the temporary
   mpn/tmp-<file>.s.


Regards,
Álvaro.