[llvm-bugs] [Bug 41810] New: Exception causes double-free of lambda capture

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=41810

            Bug ID: 41810
           Summary: Exception causes double-free of lambda capture
           Product: clang
           Version: 8.0
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: -New Bugs
          Assignee: unassignedclangbugs at nondot.org
          Reporter: lasse.reinhold at man-es.com
                CC: htmldeveloper at gmail.com, llvm-bugs at lists.llvm.org,
                    neeilans at live.com, richard-llvm at metafoo.co.uk

Following program will double-free the str object. Run with tsan or valgrind

--------------------------------------------------------------------------------
#include <string>

template<typename F> void execute(F)
{
    throw std::runtime_error("");
}

int main()
{
    std::string str{ "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" };

    try {
        execute([str]() {});
    }
    catch (...) {
    }
}
--------------------------------------------------------------------------------

me at ubuntu:~/clang8/telemetry/test/telemetry_data_test$ clang++ -stdlib=libc++
-pthread -std=c++17
/mnt/hgfs/F/map/ConsoleApplication1/ConsoleApplication1/ConsoleApplication1.cpp 
me at ubuntu:~/clang8/telemetry/test/telemetry_data_test$ valgrind ./a.out
==84029== Memcheck, a memory error detector
==84029== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==84029== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==84029== Command: ./a.out
==84029== 
==84029== Invalid free() / delete / delete[] / realloc()
==84029==    at 0x4C30F78: free (vg_replace_malloc.c:530)
==84029==    by 0x400BC1: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029==  Address 0x60fb0b0 is 0 bytes inside a block of size 48 free'd
==84029==    at 0x4C30F78: free (vg_replace_malloc.c:530)
==84029==    by 0x400C94: main::$_0::~$_0() (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029==    by 0x400BB8: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029==  Block was alloc'd at
==84029==    at 0x4C2FDCB: malloc (vg_replace_malloc.c:299)
==84029==    by 0x4EC4834: operator new(unsigned long) (in
/usr/local/clang_8.0.0/lib/libc++.so.1.0)
==84029==    by 0x4EC57F2: std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char>
>::basic_string(std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > const&) (in
/usr/local/clang_8.0.0/lib/libc++.so.1.0)
==84029==    by 0x400B77: main (in
/home/me/clang8/telemetry/test/telemetry_data_test/a.out)
==84029== 
==84029== 
==84029== HEAP SUMMARY:
==84029==     in use at exit: 16 bytes in 1 blocks
==84029==   total heap usage: 5 allocs, 5 frees, 281 bytes allocated
==84029== 
==84029== LEAK SUMMARY:
==84029==    definitely lost: 0 bytes in 0 blocks
==84029==    indirectly lost: 0 bytes in 0 blocks
==84029==      possibly lost: 0 bytes in 0 blocks
==84029==    still reachable: 16 bytes in 1 blocks
==84029==         suppressed: 0 bytes in 0 blocks
==84029== Rerun with --leak-check=full to see details of leaked memory
==84029== 
==84029== For counts of detected and suppressed errors, rerun with: -v
==84029== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
me at ubuntu:~/clang8/telemetry/test/telemetry_data_test$

me at ubuntu:~/clang8/telemetry/test/telemetry_data_test$ clang++ --version
clang version 8.0.0 (tags/RELEASE_800/final)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/clang_8.0.0/bin

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190509/3dee91b5/attachment-0001.html>