[Bug c++/77312] Lambda that deletes itself accesses freed memory, but only if class is templated
pinskia at gcc dot gnu.org
gcc-bugzilla@gcc.gnu.org
Mon Aug 22 16:30:00 GMT 2016
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77312
--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
It all comes down to this statement:
delete this;
The C++ front-end expands it as:
[t33.cc:28:39] D.3592 = [t33.cc:28:39] __closure->__this;
[t33.cc:28:41] LambdaHolder<int>::~LambdaHolder (D.3592);
[t33.cc:28:39] D.3592 = [t33.cc:28:39] __closure->__this;
[t33.cc:28:41] operator delete (D.3592, 360);
Notice how it reads from __closure here but __closure is deleted during the
call to ~LambdaHolder.
So the question comes what is the semantics of:
delete XYZ;
Inside a lambda where XYZ is captured? Do we need to read from the closure
twice, once for the deconstructor and then again for the call to delete.
More information about the Gcc-bugs
mailing list