← Back to index
|
Original Bugzilla link
Bug 14443 – [REG2.067.0] Incorrect double freeing of reference counted struct
Status
RESOLVED
Resolution
FIXED
Severity
regression
Priority
P1
Component
dmd
Product
D
Version
D2
Platform
All
OS
All
Creation time
2015-04-13T20:46:00Z
Last change time
2015-06-17T21:04:52Z
Keywords
pull, wrong-code
Assigned to
nobody
Creator
code
Comments
Comment #0
by code — 2015-04-13T20:46:14Z
cat > bug.d << CODE import std.typecons; struct Path { struct Payload { int p; } RefCounted!Payload _data; unittest { auto path = Path(RefCounted!Payload(12)); assert(path._data.p == 12); foreach(element; PathRange(path)) {} } } struct PathRange { Path path; size_t i; @property empty() { return i > 2; } void popFront() { ++i; } @property PathElement front() { return PathElement(this, path._data.p); } } struct PathElement { PathRange range; this(PathRange range, int) { this.range = range; } } CODE dmd -main -unittest -run bug ---- This code works with 2.066.1 but segfaults with 2.067.0, apparently because the refcount of _data in path drops to 0 while it's still used. My malloc implementation also complains about a double free.
Comment #1
by code — 2015-04-17T16:23:56Z
Regression was apparently introduced with
https://github.com/D-Programming-Language/dmd/pull/4078.
Comment #2
by k.hara.pg — 2015-04-18T14:45:25Z
https://github.com/D-Programming-Language/dmd/pull/4595
Comment #3
by github-bugzilla — 2015-04-18T16:30:39Z
Commits pushed to master at
https://github.com/D-Programming-Language/dmd
https://github.com/D-Programming-Language/dmd/commit/46841af5b6ac2ceb60a897974423d6f31b8a8301
fix Issue 14443 - Incorrect double freeing of reference counted struct After the issue 13586 fix (pull#4078), the emission of 'prefix' expressions on `CallExp` had accidentally changed `valueNoDtor()` in `ReturnStatement::semantic()` no-op. Then excessive destructor call had happened in PathRange.front().
https://github.com/D-Programming-Language/dmd/commit/c46be675fd3be445dcb0db691a544898aa0332ee
Merge pull request #4595 from 9rnsr/fix14443 [REG2.067] Issue 14443 - Incorrect double freeing of reference counted struct
Comment #4
by github-bugzilla — 2015-04-18T16:31:16Z
Commit pushed to stable at
https://github.com/D-Programming-Language/dmd
https://github.com/D-Programming-Language/dmd/commit/ee257090f0f89adf19eadc70692070c6d30ebac1
Merge pull request #4595 from 9rnsr/fix14443 [REG2.067] Issue 14443 - Incorrect double freeing of reference counted struct
Comment #5
by github-bugzilla — 2015-04-26T00:04:44Z
Commit pushed to master at
https://github.com/D-Programming-Language/dmd
https://github.com/D-Programming-Language/dmd/commit/ee257090f0f89adf19eadc70692070c6d30ebac1
Merge pull request #4595 from 9rnsr/fix14443
Comment #6
by github-bugzilla — 2015-06-17T21:04:52Z
Commits pushed to stable at
https://github.com/D-Programming-Language/dmd
https://github.com/D-Programming-Language/dmd/commit/46841af5b6ac2ceb60a897974423d6f31b8a8301
fix Issue 14443 - Incorrect double freeing of reference counted struct
https://github.com/D-Programming-Language/dmd/commit/c46be675fd3be445dcb0db691a544898aa0332ee
Merge pull request #4595 from 9rnsr/fix14443