This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug c++/77312] Lambda that deletes itself accesses freed memory, but only if class is templated
- From: "pinskia at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Mon, 22 Aug 2016 16:30:47 +0000
- Subject: [Bug c++/77312] Lambda that deletes itself accesses freed memory, but only if class is templated
- Authentication-results: sourceware.org; auth=none
- Auto-submitted: auto-generated
- References: <bug-77312-4@http.gcc.gnu.org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77312
--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
It all comes down to this statement:
delete this;
The C++ front-end expands it as:
[t33.cc:28:39] D.3592 = [t33.cc:28:39] __closure->__this;
[t33.cc:28:41] LambdaHolder<int>::~LambdaHolder (D.3592);
[t33.cc:28:39] D.3592 = [t33.cc:28:39] __closure->__this;
[t33.cc:28:41] operator delete (D.3592, 360);
Notice how it reads from __closure here but __closure is deleted during the
call to ~LambdaHolder.
So the question comes what is the semantics of:
delete XYZ;
Inside a lambda where XYZ is captured? Do we need to read from the closure
twice, once for the deconstructor and then again for the call to delete.