[cfe-dev] Miscompilation: heap-use-after-free in C++ coroutines

[chuanqi.xcq via cfe-dev]

Hi Adrian,

I met this problem before. I agree that this behavior would make symmetric transfer much harder.

From my point of view, this is an undefined behavior. From 17.12.4.6 of N4878, we can find:
```
void destroy() const;
4 Preconditions: *this refers to a suspended coroutine.
5 Effects: Destroys the coroutine
```

To my mind, the coroutine **isn't suspended** in the await_suspend. So it is an undefined behavior if we call `coroutine_handle::destroy()` in await_suspend.

But I strongly agree with you it is really suffering that if we want symmetric transfer and we can't destroy the coroutine in final await_suspend directly.

I would look into the details and try to fix it.

Thanks,
Chuanqi



------------------------------------------------------------------
From:Adrian Vogelsgesang via cfe-dev <cfe-dev at lists.llvm.org>
Send Time:2021年2月4日(星期四) 04:21
To:cfe-dev at lists.llvm.org <cfe-dev at lists.llvm.org>
Subject:[cfe-dev] Miscompilation: heap-use-after-free in C++ coroutines


Dear Clang community,

 I think I stumbled across a front-end bug in clang’s coroutine implementation.

 Having an awaitable with

 ```
template<typename PROMISE> std::experimental::coroutine_handle<> await_suspend(std::experimental::coroutine_handle<PROMISE> coro) noexcept {
      coro.destroy();
     return std::experimental::noop_coroutine();
}
```

 destroys the function’s own coroutine frame. This is valid, as long as no-one afterwards resumes the coroutine anymore. However, address-sanitizer reports a heap-use-after-free error (see https://godbolt.org/z/eq6eoc )

 Afaict, this is because clang stores the return value of `await_suspend` in the coroutine frame. Instead, clang should probably store this return value on the stack. Storing on the stack should be valid, as it is guaranteed that this return value will never live across a suspension point.

 You can find a minimal repro in https://godbolt.org/z/eq6eoc and a more complex end-to-end version in https://godbolt.org/z/8Yadv1 . See https://stackoverflow.com/questions/65991264/c-coroutines-is-it-valid-to-call-handle-destroy-from-the-final-suspend-poin (in particular the comments to David Haim’s reply) for more context.

 Cheers,
 Adrian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20210204/2d02f478/attachment-0001.html>