From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id C3C37385841E; Mon, 6 Sep 2021 11:01:49 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C3C37385841E From: "max at duempel dot org" To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/102217] New: co_awaiting a temporary produced by ternary operator crashes (double-free) Date: Mon, 06 Sep 2021 11:01:49 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c++ X-Bugzilla-Version: 11.2.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: max at duempel dot org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Sep 2021 11:01:49 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D102217 Bug ID: 102217 Summary: co_awaiting a temporary produced by ternary operator crashes (double-free) Product: gcc Version: 11.2.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c++ Assignee: unassigned at gcc dot gnu.org Reporter: max at duempel dot org Target Milestone: --- Created attachment 51414 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=3D51414&action=3Dedit Crashing demo program When awaiting a coroutine task which is a temporary evaluated with the tern= ary operator, GCC emits faulty code that destructs the task twice, leading to a crash due to double free / use-after-free. Tested with "gcc version 10.2.1 20210110 (Debian 10.2.1-6)" and "gcc version 11.2.0 (Debian 11.2.0-1)" clang ("Debian clang version 11.0.1-2") is fine. This crash bug can be worked around by assigning the result of the ternary operator to a local variable first, and then co_await that variable. In my demo program, the UniqueHandle destructor gets called twice with the = same contained pointer value; however, the UniqueHandle instance that gets destructed first was never constructed. ASan output with GCC 11: =3D=3D2=3D=3DERROR: AddressSanitizer: heap-use-after-free on address 0x6060= 00000028 at pc 0x5573042b18a9 bp 0x7ffdde510f60 sp 0x7ffdde510f58 READ of size 8 at 0x606000000028 thread T0 #0 0x5573042b18a8 in Co::UniqueHandle > >::~UniqueHandle() (/home/max/dl/a.out+0x28a8) #1 0x5573042b1284 in FooC(FooC(bool)::_Z4FooCb.frame*) [clone .actor] (/home/max/dl/a.out+0x2284) #2 0x5573042b0582 in FooA(FooA()::_Z4FooAv.frame*) [clone .actor] (/home/max/dl/a.out+0x1582) #3 0x5573042b13a1 in FooC(FooC(bool)::_Z4FooCb.frame*) [clone .actor] (/home/max/dl/a.out+0x23a1) #4 0x5573042b00dd in main (/home/max/dl/a.out+0x10dd) #5 0x7fa1f4ffbe39 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27e39) #6 0x5573042b01e9 in _start (/home/max/dl/a.out+0x11e9) 0x606000000028 is located 8 bytes inside of 64-byte region [0x606000000020,0x606000000060) freed by thread T0 here: #0 0x7fa1f55b6957 in operator delete(void*) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:160 #1 0x5573042b05b7 in FooA(FooA()::_Z4FooAv.frame*) [clone .actor] (/home/max/dl/a.out+0x15b7) previously allocated by thread T0 here: #0 0x7fa1f55b5f57 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99 #1 0x5573042b0af5 in FooA() (/home/max/dl/a.out+0x1af5)=