Bug 8832 – Segfault when accessing range returned by function that has delegate referencing local variables
Status
RESOLVED
Resolution
FIXED
Severity
major
Priority
P2
Component
dmd
Product
D
Version
D2
Platform
All
OS
All
Creation time
2012-10-16T17:18:00Z
Last change time
2013-01-29T11:56:31Z
Keywords
wrong-code
Assigned to
nobody
Creator
hsteoh
Comments
Comment #0 by hsteoh — 2012-10-16T17:18:50Z
import std.algorithm;
import std.range;
import std.stdio;
auto boo() {
auto C = [2];
return [1,1].map!((a) => C).joiner;
}
void main() {
writeln(boo().take(12));
}
This code will either segfault or produce nonsensical output. Replacing (a)=>C with (a)=>[2] makes the problem go away; shortening [1,1] to [1] also makes the problem go away, and removing .joiner also makes the problem go away. Removing the .map makes the problem go away too.
The problem is suspected to be the delegate (a)=>C which references the local variable C, which goes out of scope when boo() returns. For whatever reason, dmd isn't emitting code to allocate the delegate's context on the heap, causing a crash when writeln() tries to read the second element off the range. (I'm not sure why it doesn't crash with the first element. Maybe luck.)
Replacing the delegate with function(a)=>[1] makes the problem go away.
Comment #1 by hsteoh — 2012-10-16T21:50:50Z
See also issue 7978, probably the same bug in a different context.
Comment #2 by hsteoh — 2012-10-18T08:44:25Z
I think I may have figured out the cause of this bug. If boo() is modified as follows:
auto boo() {
auto C = [2];
auto d = delegate(int) => C;
return [1,1].map!d.joiner;
}
then everything works. Seems to me that the compiler is failing to pick up the reference to C *when the delegate is defined inside the compile-time parameter* to map. Hopefully this helps narrow it down enough to find the problem in the dmd code.
Comment #3 by maxim — 2012-10-26T11:41:40Z
(In reply to comment #0)
> import std.algorithm;
> import std.range;
> import std.stdio;
>
> auto boo() {
> auto C = [2];
> return [1,1].map!((a) => C).joiner;
> }
>
> void main() {
> writeln(boo().take(12));
> }
>
> This code will either segfault or produce nonsensical output. Replacing (a)=>C
> with (a)=>[2] makes the problem go away; shortening [1,1] to [1] also makes the
> problem go away, and removing .joiner also makes the problem go away. Removing
> the .map makes the problem go away too.
>
> The problem is suspected to be the delegate (a)=>C which references the local
> variable C, which goes out of scope when boo() returns. For whatever reason,
> dmd isn't emitting code to allocate the delegate's context on the heap, causing
> a crash when writeln() tries to read the second element off the range. (I'm not
> sure why it doesn't crash with the first element. Maybe luck.)
>
> Replacing the delegate with function(a)=>[1] makes the problem go away.
The problem is in erroneous treating (a) => C of type void. If this is fixed to:
- delegate(int a) { return C; }
- (int a) { return C; )
- (int a) => C;
everything works fine.
Comment #4 by bugzilla — 2012-12-29T00:41:00Z
A clearer test case:
import std.algorithm;
import std.range;
import std.stdio;
auto boo() {
auto C = [2];
auto bar(int) { return C; }
return [1,1].map!(bar).joiner;
}
void main() {
writeln(boo().take(12));
}
The problem is that joiner!(MapResult!(bar,int[])) is not recognized as a 'local' template instantiation, even though MapResult!(bar,int[]) is marked as local. Hence, boo() is not marked as needing a closure (case (4) in FuncDeclaration::needsClosure()).
The fix listed for Issue 8863 correctly fixes this one. But there are other problems with that fix, as listed in 8863.