From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 4C7A1395CC12; Thu, 14 May 2020 12:02:21 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4C7A1395CC12
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
 s=default; t=1589457741;
 bh=2qqbn1B6ExRgGPgcGqlOp1HrQHnKeBOWWMp8v7EkIXI=;
 h=From:To:Subject:Date:In-Reply-To:References:From;
 b=vo1xdvq9buFZbUNpSKbCDEstoUo5QIGTN0NKuyNYBKbqKnbwieGvWwEfClrumArms
 ygfw8qcz2CBmGvO9H8Ditq4bfNkDuLpgOwAMsDfhfWchkpyA7nmq/B29S3WuEbqawL
 t/XIqY/EmZh6sazffmlYaA5gxDUekcz0lvWmNVds=
From: "iains at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/95111] coroutines use-after-free with lambdas
Date: Thu, 14 May 2020 12:02:21 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 10.1.1
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: iains at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: iains at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-95111-4-O9QnlaEpBM@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-95111-4@http.gcc.gnu.org/bugzilla/>
References: <bug-95111-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <http://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <http://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Thu, 14 May 2020 12:02:21 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D95111

--- Comment #19 from Iain Sandoe <iains at gcc dot gnu.org> ---
(In reply to Ville Voutilainen from comment #17)
> (In reply to Ville Voutilainen from comment #16)
> > (In reply to Iain Sandoe from comment #14)
> > > (In reply to Ville Voutilainen from comment #12)
> > > The idea of bringing the lambda's captures into the coro frame was wh=
at I
> > > originally implemented.  Richard pointed out that this is wrong when =
the
> > > lambda is mutable (see
> > > gcc/testsuite/g++.dg/coroutines/torture/lambda-10-mutable.C)
> > >=20
> > > so if one has
> > >=20
> > > auto X =3D [...] () -> some_coro<xxx> {};
> > >=20
> > > X must exist for the duration of the lambda coro [it was pointed out =
by
> > > Lewis that really this is only the same as saying that if you have a =
class
> > > with a member function lambda, the instance of that class has to pers=
ist for
> > > the duration of the coro].
> >=20
> > Ah. So the work-around for this problem is to copy the capture to a loc=
al
> > variable, and co_return that; then the local variable is in the coro-st=
ate.
> > Right?
>=20
> That is, instead of writing
>=20
> [x] {co_return x;}
>=20
> write
>=20
> [x] {auto xx =3D x; co_return xx;}

hmm I'm not sure this is sufficient; if the initial suspend is suspend-alwa=
ys,
and the closure object goes away before the initial resume, then xx will be
initialised with garbage.=