title: Bug in std::sort?
body: <p>OK, I typically default to assuming that the error is in my code, but what I am seeing is making literally no sense to me.</p>
  
  <hr>
  
  <p>I have a <code>std::vector&lt;DocumentWidget *&gt;</code>, which I want to be sorted by some relatively simple algorithm. Here's what I am seeing.</p>
  
  <p>The code looks like this:</p>
  
  <pre><code>std::vector&lt;DocumentWidget *&gt; documents = DocumentWidget::allDocuments();
  
  // NOTE(eteran): on my system, I have observed a **consistent** crash
  // when documents.size() == 17 while using std::sort.
  std::sort(documents.begin(), documents.end(), [](const DocumentWidget *a, const DocumentWidget *b) {
  
      int rc = (a-&gt;filenameSet_ == b-&gt;filenameSet_) ? 0 : a-&gt;filenameSet_ &amp;&amp; !b-&gt;filenameSet_ ? 1 : -1;
      if (rc != 0) {
          return rc &lt; 0;
      }
      if(a-&gt;filename_ &lt; b-&gt;filename_) {
          return true;
      }
      return a-&gt;path_ &lt; b-&gt;path_;
  });
  </code></pre>
  
  <p>Seems simple enough, but it crashes specifically when I have a 17th item in the list! The sorting predicate clearly is not modifying the <code>vector</code> in any way, so I can't see that being an issue. Address sanitizer and valgrind show no errors up until this point.</p>
  
  <p><code>qSort</code> <strong>does not crash</strong>, seems to work fine. No other threads that are running are touching this data, and it happens reliably no matter how slowly I step... so it's not a race condition.</p>
  
  <p>When I look in the debugger, the <code>a</code> parameter seems to be where the "one past the end" iterator is pointing. But that shouldn't be happening if <code>std::sort</code> is behaving <img src="https://i.stack.imgur.com/6QC6K.png" alt="Crash">.</p>
  
  <p><strong>Note</strong> There are 17 items in the <code>std::vector</code>, I forced the debugger to display an 18th item to illustrate where <code>a</code> seems to be coming from.</p>
  
  <p>I can't imagine that <code>std::sort</code> is bugged, but I am really struggling to find another explanation. Am I missing some obvious bug here?!</p>