title: undefined behavior when casting template holding a polymorphic type
body: <p>For reasons of type erasure I have a template <code>A&lt;T&gt;</code> which can hold any datatype. When <code>A</code> holds a polymorphic type <code>Derived</code> which is derived from <code>Base</code> and I cast it to <code>A&lt;Base&gt;</code>, GCC's undefined behavior sanitizer reports runtime errors:</p>
  
  <pre><code>#include &lt;iostream&gt;
  
  struct I
  {
      virtual ~I() = default;
  };
  
  template&lt;typename T&gt; 
  struct A : public I
  {
      explicit A(T&amp;&amp; value) : value(std::move(value)) {}
      T&amp; get() { return value; }
  private:
      T value;
  };
  
  struct Base
  {
      virtual ~Base() = default;
      virtual void fun() 
      {
          std::cout &lt;&lt; "Derived" &lt;&lt; std::endl;
      }
  };
  
  struct Derived : Base
  {
      void fun() override
      {
          std::cout &lt;&lt; "Derived" &lt;&lt; std::endl;
      }
  };
  
  int main()
  {
      I* a_holding_derived = new A&lt;Derived&gt;(Derived());
      A&lt;Base&gt;* a_base = static_cast&lt;A&lt;Base&gt;*&gt;(a_holding_derived);
      Base&amp; b = a_base-&gt;get();
      b.fun();
      return 0;
  }
  </code></pre>
  
  <p><strong>compile &amp; run</strong></p>
  
  <pre><code>$ g++ -fsanitize=undefined -g -std=c++11 -O0 -fno-omit-frame-pointer &amp;&amp; ./a.out
  </code></pre>
  
  <p><strong>output:</strong></p>
  
  <pre><code>main.cpp:37:62: runtime error: downcast of address 0x000001902c20 which does not point to an object of type 'A'
  
  0x000001902c20: note: object is of type 'A&lt;Derived&gt;'
  
   00 00 00 00  20 1e 40 00 00 00 00 00  40 1e 40 00 00 00 00 00  00 00 00 00 00 00 00 00  21 00 00 00
  
                ^~~~~~~~~~~~~~~~~~~~~~~
  
                vptr for 'A&lt;Derived&gt;'
  
      #0 0x400e96 in main /tmp/1450529422.93451/main.cpp:37
  
      #1 0x7f35cb1a176c in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
  
      #2 0x400be8  (/tmp/1450529422.93451/a.out+0x400be8)
  
  
  main.cpp:38:27: runtime error: member call on address 0x000001902c20 which does not point to an object of type 'A'
  
  0x000001902c20: note: object is of type 'A&lt;Derived&gt;'
  
   00 00 00 00  20 1e 40 00 00 00 00 00  40 1e 40 00 00 00 00 00  00 00 00 00 00 00 00 00  21 00 00 00
  
                ^~~~~~~~~~~~~~~~~~~~~~~
  
                vptr for 'A&lt;Derived&gt;'
  
      #0 0x400f5b in main /tmp/1450529422.93451/main.cpp:38
  
      #1 0x7f35cb1a176c in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
  
      #2 0x400be8  (/tmp/1450529422.93451/a.out+0x400be8)
  
  
  Derived
  </code></pre>
  
  <p><strong><kbd><a href="http://coliru.stacked-crooked.com/a/802755edf1b4da6d" rel="nofollow">live example on coliru</a></kbd></strong></p>
  
  <p>I have two questions:</p>
  
  <ol>
  <li>Is the sanitizer's output correct?</li>
  <li>If yes, how would a valid conversion from <code>A&lt;Derived&gt;</code>to <code>A&lt;Base&gt;</code> look like?</li>
  </ol>