<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Exception causes double-free of lambda capture"
href="https://bugs.llvm.org/show_bug.cgi?id=41810">41810</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Exception causes double-free of lambda capture
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>8.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>-New Bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedclangbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>lasse.reinhold@man-es.com
</td>
</tr>
<tr>
<th>CC</th>
<td>htmldeveloper@gmail.com, llvm-bugs@lists.llvm.org, neeilans@live.com, richard-llvm@metafoo.co.uk
</td>
</tr></table>
<p>
<div>
<pre>Following program will double-free the str object. Run with tsan or valgrind
--------------------------------------------------------------------------------
#include <string>
template<typename F> void execute(F)
{
throw std::runtime_error("");
}
int main()
{
std::string str{ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" };
try {
execute([str]() {});
}
catch (...) {
}
}
--------------------------------------------------------------------------------
me@ubuntu:~/clang8/telemetry/test/telemetry_data_test$ clang++ -stdlib=libc++
-pthread -std=c++17
/mnt/hgfs/F/map/ConsoleApplication1/ConsoleApplication1/ConsoleApplication1.cpp
me@ubuntu:~/clang8/telemetry/test/telemetry_data_test$ valgrind ./a.out
==84029== Memcheck, a memory error detector
==84029== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==84029== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==84029== Command: ./a.out
==84029==
==84029== Invalid free() / delete / delete[] / realloc()
==84029== at 0x4C30F78: free (vg_replace_malloc.c:530)
==84029== by 0x400BC1: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029== Address 0x60fb0b0 is 0 bytes inside a block of size 48 free'd
==84029== at 0x4C30F78: free (vg_replace_malloc.c:530)
==84029== by 0x400C94: main::$_0::~$_0() (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029== by 0x400BB8: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029== Block was alloc'd at
==84029== at 0x4C2FDCB: malloc (vg_replace_malloc.c:299)
==84029== by 0x4EC4834: operator new(unsigned long) (in
/usr/local/clang_8.0.0/lib/libc++.so.1.0)
==84029== by 0x4EC57F2: std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char>
<span class="quote">>::basic_string(std::__1::basic_string<char, std::__1::char_traits<char>,</span >
std::__1::allocator<char> > const&) (in
/usr/local/clang_8.0.0/lib/libc++.so.1.0)
==84029== by 0x400B77: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029==
==84029==
==84029== HEAP SUMMARY:
==84029== in use at exit: 16 bytes in 1 blocks
==84029== total heap usage: 5 allocs, 5 frees, 281 bytes allocated
==84029==
==84029== LEAK SUMMARY:
==84029== definitely lost: 0 bytes in 0 blocks
==84029== indirectly lost: 0 bytes in 0 blocks
==84029== possibly lost: 0 bytes in 0 blocks
==84029== still reachable: 16 bytes in 1 blocks
==84029== suppressed: 0 bytes in 0 blocks
==84029== Rerun with --leak-check=full to see details of leaked memory
==84029==
==84029== For counts of detected and suppressed errors, rerun with: -v
==84029== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
me@ubuntu:~/clang8/telemetry/test/telemetry_data_test$
me@ubuntu:~/clang8/telemetry/test/telemetry_data_test$ clang++ --version
clang version 8.0.0 (tags/RELEASE_800/final)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/clang_8.0.0/bin</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>