[Bug c++/101367] New: [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[Bug c++/101367] New: [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[noah at vectorized dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

            Bug ID: 101367
           Summary: [coroutines] destructor for capture in lambda
                    temporary operand to co_yield expression called twice
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: noah at vectorized dot io
  Target Milestone: ---

I'm observing an issue in which it appears that the destructor for a captured
object in a lambda which is passed as a temporary to a co_await/co_yield
expression is being called twice.

Here is a reproducer https://godbolt.org/z/8jrGx7qsT which is a slight
modification of the reproducer used in
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95599 that was related to the
order of destructors in co_await/co_yield expressions.

In the reproducer I gave when the lambda temporary doesn't capture a
std::string value things work, but when it does you can see that gcc reports
`free(): invalid pointer`.

It also appears that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100611 may be
closely related.

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[noah at vectorized dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

--- Comment #1 from Noah Watkins <noah at vectorized dot io> ---
In the reproducer there are no errors for:

generator<int> f() {
    co_yield resource{[]{}};
}

but `free(): invalid pointer` occurs for:

generator<int> f() {
    std::string s;
    co_yield resource{[s]{}};
}

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[davidledger at live dot com.au]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

David Ledger <davidledger at live dot com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |davidledger at live dot com.au

--- Comment #2 from David Ledger <davidledger at live dot com.au> ---
that may be expected, as std::string frees on destruction, where as an empty
capture list doesn't.

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[noah at vectorized dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

--- Comment #3 from Noah Watkins <noah at vectorized dot io> ---
Happy to work on providing a different reproducer if it is helpful.
This was the first smallish example we could create, and the `free of
an invalid pointer error` seemed as good enough as any unexpected
behavior for a similar situation.

On Sun, Aug 8, 2021 at 5:40 PM davidledger at live dot com.au
<gcc-bugzilla@gcc.gnu.org> wrote:
>
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367
>
> David Ledger <davidledger at live dot com.au> changed:
>
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |davidledger at live dot com.au
>
> --- Comment #2 from David Ledger <davidledger at live dot com.au> ---
> that may be expected, as std::string frees on destruction, where as an empty
> capture list doesn't.
>
> --
> You are receiving this mail because:
> You reported the bug.

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[davidledger at live dot com.au]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

--- Comment #4 from David Ledger <davidledger at live dot com.au> ---
Yeah, I'm just saying I suspect the problem was still there with the empty
capture list, its just not observable.

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[noah at vectorized dot io]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

--- Comment #5 from Noah Watkins <noah at vectorized dot io> ---
Got it. Thanks for clarifying, I must have misinterpreted your earlier comment.

On Mon, Aug 9, 2021 at 8:06 PM davidledger at live dot com.au
<gcc-bugzilla@gcc.gnu.org> wrote:
>
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367
>
> --- Comment #4 from David Ledger <davidledger at live dot com.au> ---
> Yeah, I'm just saying I suspect the problem was still there with the empty
> capture list, its just not observable.
>
> --
> You are receiving this mail because:
> You reported the bug.

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

Iain Sandoe <iains at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-10-01
                 CC|                            |iains at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

[Bug c++/101367] [coroutines] destructor for capture in lambda temporary operand to co_yield expression called twice

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101367

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Iain D Sandoe <iains@gcc.gnu.org>:

https://gcc.gnu.org/g:58a7b1e354530d8dfe7d8fb859c8b8b5a9140f1f

commit r13-4479-g58a7b1e354530d8dfe7d8fb859c8b8b5a9140f1f
Author: Iain Sandoe <iain@sandoe.co.uk>
Date:   Wed Nov 30 17:05:56 2022 +0000

    coroutines: Do not promote temporaries that will be elided.

    We usually need to 'promote' (i.e. save to the coroutine frame) any
temporary
    variable that is in a target expression that must persist across an await
    expression.  However, if the TE is just used as a direct initializer for
    another object it will be elided - and we should not promote it since that
    would lead to a DTOR call for something that is never constructed.

    Since we now have a mechanism to tell if TEs will be elided, use that.

    Although the PRs referenced initially appear to be different issues, they
all
    stem from this.

    Co-Authored-By: Adrian Perl <adrian.perl@web.de>
    Signed-off-by: Iain Sandoe <iain@sandoe.co.uk>

            PR c++/100611
            PR c++/101367
            PR c++/101976
            PR c++/99576

    gcc/cp/ChangeLog:

            * coroutines.cc (find_interesting_subtree): Do not promote
temporaries
            that are only used as direct initializers for some other object.

    gcc/testsuite/ChangeLog:

            * g++.dg/coroutines/pr100611.C: New test.
            * g++.dg/coroutines/pr101367.C: New test.
            * g++.dg/coroutines/pr101976.C: New test.
            * g++.dg/coroutines/pr99576_1.C: New test.
            * g++.dg/coroutines/pr99576_2.C: New test.