Skip to content

Reference outlives the value it points to (segfault) #37418

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
benschulz opened this issue Oct 26, 2016 · 4 comments
Closed

Reference outlives the value it points to (segfault) #37418

benschulz opened this issue Oct 26, 2016 · 4 comments

Comments

@benschulz
Copy link
Contributor

A is value referenced both outside as well as inside a closure and the closure is boxed and (indirectly) returned. A segfault is raised when the closure is eventually invoked and the reference dereferenced.

I tried this code:

I failed to create an SSCEE for the bug, however, I originally stumbled over the behaviour here. Semantically the code contains the same error as the following code.

fn foo() -> Box<Fn() -> usize> {
    let x = 0;
    Box::new(|| x)
}

fn main() {
    foo()();
}

I expected to see this happen: The compiler should force me to mark the closure as move and resolve the resulting errors as it does with the small example given above.

Instead, this happened: The code compiles as is and segfaults when the test is run (simply via cargo testing the repo). The segfault happens when dereferencing expected_key2 inside the closure. It does not occur when marking the closure as move and passing &*expected_key instead of &*expected_key2 to store.write_blob.

Meta

rustc --version --verbose:
rustc 1.12.1 (d4f3940 2016-10-19)
binary: rustc
commit-hash: d4f3940
commit-date: 2016-10-19
host: x86_64-unknown-linux-gnu
release: 1.12.1

Backtrace (from gdb):

#0  0x000055555558cbd9 in object_store::ops::write_blob::WriteBlob::new::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h729166bb3b5a29fc ()
#1  0x000055555558d773 in _$LT$futures..then..Then$LT$A$C$$u20$B$C$$u20$F$GT$$u20$as$u20$futures..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h3985deb15ce38518 ()
#2  0x0000555555580a22 in {{inlined-root}}::poll<object_store::hash::verify::Verify<std::io::cursor::Cursor<collections::string::String>, std::fs::File, object_store::hash::Sha256Hasher, object_store::hash::Sha256Hash>,futures::done::Done<(), std::io::error::Error>,closure,closure> (self=0x7ffff5e5b068, f=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/chain.rs:38
#3  0x0000555555588afc in {{inlined-root}}::poll<object_store::hash::verify::Verify<std::io::cursor::Cursor<collections::string::String>, std::fs::File, object_store::hash::Sha256Hasher, object_store::hash::Sha256Hash>,futures::done::Done<(), std::io::error::Error>,closure> (self=0x7ffff5e5b068)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/then.rs:31
#4  0x00005555555673b0 in {{inlined-root}}::poll<closure,futures::then::Then<object_store::hash::verify::Verify<std::io::cursor::Cursor<collections::string::String>, std::fs::File, object_store::hash::Sha256Hasher, object_store::hash::Sha256Hash>, futures::done::Done<(), std::io::error::Error>, closure>,(),std::io::error::Error> (self=0x7ffff5e5b000)
    at /home/benshu/git-repos/object-store-rs/src/intermediate_path.rs:52
#5  0x00005555555867c0 in {{inlined-root}}::poll<object_store::blob::Blob,object_store::intermediate_path::IntermediatePath<closure, futures::then::Then<object_store::hash::verify::Verify<std::io::cursor::Cursor<collections::string::String>, std::fs::File, object_store::hash::Sha256Hasher, object_store::hash::Sha256Hash>, futures::done::Done<(), std::io::error::Error>, closure>>,closure> (self=0x7ffff5e5b000) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/map.rs:29
#6  0x0000555555587279 in {{inlined-root}}::poll<std::io::error::Error,futures::map::Map<object_store::intermediate_path::IntermediatePath<closure, futures::then::Then<object_store::hash::verify::Verify<std::io::cursor::Cursor<collections::string::String>, std::fs::File, object_store::hash::Sha256Hasher, object_store::hash::Sha256Hash>, futures::done::Done<(), std::io::error::Error>, closure>>, closure>,closure> (self=0x7ffff5e5b000) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/map_err.rs:29
#7  0x0000555555576e61 in {{inlined-root}}::poll<Future> (self=0x7ffff5e3f030) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/lib.rs:231
#8  0x00005555555be8a1 in {{inlined-root}}::poll<Future> (self=0x7ffff63fe830) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/lib.rs:231
#9  0x00005555555cad9c in object_store::ops::write_blob::{{impl}}::poll (self=0x7ffff63fe830) at /home/benshu/git-repos/object-store-rs/src/ops/write_blob.rs:53
#10 0x00005555555811f8 in {{inlined-root}}::poll<object_store::ops::write_blob::WriteBlob,object_store::ops::write_tree::WriteTree,closure,closure> (self=0x7ffff63fe828, f=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/chain.rs:25
#11 0x0000555555589efc in {{inlined-root}}::poll<object_store::ops::write_blob::WriteBlob,object_store::ops::write_tree::WriteTree,closure> (self=0x7ffff63fe828)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/and_then.rs:31
#12 0x0000555555586b00 in {{inlined-root}}::poll<(),futures::and_then::AndThen<object_store::ops::write_blob::WriteBlob, object_store::ops::write_tree::WriteTree, closure>,closure> (
    self=0x7ffff63fe828) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/map.rs:29
#13 0x00005555555874b8 in {{inlined-root}}::poll<(),futures::map::Map<futures::and_then::AndThen<object_store::ops::write_blob::WriteBlob, object_store::ops::write_tree::WriteTree, closure>, closure>,closure> (self=0x7ffff63fe828) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/map_err.rs:29
#14 0x000055555558d145 in _$LT$futures..task..Spawn$LT$F$GT$$GT$::poll_future::_$u7b$$u7b$closure$u7d$$u7d$::h3e038fa9311180df ()
    at /buildslave/rust-buildbot/slave/stable-dist-rustc-linux/build/obj/../src/libstd/collections/hash/table.rs:1040
#15 0x000055555558d187 in _$LT$futures..task..Spawn$LT$T$GT$$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hb84cd279a381c4af ()
    at /buildslave/rust-buildbot/slave/stable-dist-rustc-linux/build/obj/../src/libstd/collections/hash/table.rs:1040
#16 0x000055555558d2a1 in futures::task::set::_$u7b$$u7b$closure$u7d$$u7d$::h9de1fc90a64552d1 ()
    at /buildslave/rust-buildbot/slave/stable-dist-rustc-linux/build/obj/../src/libstd/collections/hash/table.rs:1040
#17 0x0000555555574071 in {{inlined-root}}::with<core::cell::Cell<(*const futures::task::Task, *const core::cell::RefCell<std::collections::hash::map::HashMap<core::any::TypeId, Box<Opaque>, core::hash::BuildHasherDefault<futures::task::data::IdHasher>>>)>,closure,core::result::Result<futures::poll::Async<()>, ()>> (
    self=0x5555558dbb50 <futures::task::CURRENT_TASK::h4df43acd7ab31fdb>, f=...) at /buildslave/rust-buildbot/slave/stable-dist-rustc-linux/build/obj/../src/libstd/thread/local.rs:245
#18 0x0000555555587f9b in {{inlined-root}}::set<closure,core::result::Result<futures::poll::Async<()>, ()>> (task=0x7ffff63fdd08, data=0x7ffff63fe860, f=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/task/mod.rs:72
#19 0x0000555555571bab in {{inlined-root}}::enter<futures::map_err::MapErr<futures::map::Map<futures::and_then::AndThen<object_store::ops::write_blob::WriteBlob, object_store::ops::write_tree::WriteTree, closure>, closure>, closure>,closure,core::result::Result<futures::poll::Async<()>, ()>> (self=0x7ffff63fe828, unpark=..., f=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/task/mod.rs:304
#20 0x0000555555571a1b in {{inlined-root}}::poll_future<futures::map_err::MapErr<futures::map::Map<futures::and_then::AndThen<object_store::ops::write_blob::WriteBlob, object_store::ops::write_tree::WriteTree, closure>, closure>, closure>> (self=0x7ffff63fe828, unpark=...) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/futures-0.1.2/src/task/mod.rs:217
---Type <return> to continue, or q <return> to quit---
#21 0x000055555558c688 in tokio_core::reactor::Core::run::_$u7b$$u7b$closure$u7d$$u7d$::hfb022cd8bb9d6df8 ()
    at /buildslave/rust-buildbot/slave/stable-dist-rustc-linux/build/obj/../src/libstd/collections/hash/table.rs:1040
#22 0x000055555560908a in tokio_core::reactor::{{impl}}::_run::{{closure}} () at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-core-0.1.0/src/reactor/mod.rs:232
#23 0x00005555555efb3f in {{inlined-root}}::set<tokio_core::reactor::Core,closure,bool> (self=0x5555558db7f0 <tokio_core::reactor::CURRENT_LOOP::hb69805ae44045245>, t=0x7ffff63feb50, f=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/scoped-tls-0.1.0/src/lib.rs:135
#24 0x00005555556040a1 in tokio_core::reactor::Core::_run (self=0x7ffff63feb50, done=...)
    at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-core-0.1.0/src/reactor/mod.rs:232
#25 0x0000555555568e64 in {{inlined-root}}::run<futures::map_err::MapErr<futures::map::Map<futures::and_then::AndThen<object_store::ops::write_blob::WriteBlob, object_store::ops::write_tree::WriteTree, closure>, closure>, closure>> (self=0x7ffff63feb50, f=...) at /home/benshu/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-core-0.1.0/src/reactor/mod.rs:217
#26 0x000055555558c25a in foo::write_object () at /home/benshu/git-repos/object-store-rs/tests/foo.rs:34
#27 0x000055555559802c in _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hf1def207a373fb3f ()
#28 0x0000555555590340 in std::panicking::try::do_call::h9297bd73d4296b2b ()
#29 0x0000555555646f07 in __rust_maybe_catch_panic ()
#30 0x0000555555597a5b in _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hb675dcf15ec220c3 ()
#31 0x000055555563d2e3 in std::sys::thread::Thread::new::thread_start::h57f688c224d4fa4d ()
#32 0x00007ffff79c0454 in start_thread () from /usr/lib/libpthread.so.0
#33 0x00007ffff74ec7df in clone () from /usr/lib/libc.so.6
@Stebalien
Copy link
Contributor

This looks like #18937

Trait definition: https://github.com/benschulz/object-store-rs/blob/7d6ecea8a1700de2c9dfe8ebb148e58c7265cac7/src/store.rs#L153

Function with more restrictive lifetimes: https://github.com/benschulz/object-store-rs/blob/7d6ecea8a1700de2c9dfe8ebb148e58c7265cac7/src/store.rs#L167

FYI, while looking through your code, I noticed https://github.com/benschulz/orc/blob/320651873e964eefd79d360adf7f3b4bba7dfb7c/src/lib.rs#L150. Transmuting an immutable reference into a mutable reference is never considered safe.

@benschulz
Copy link
Contributor Author

Ah, this does look like an instance of the issue described in #18937. Closing this issue.

(Also thanks for the audit. That's actually dead code.)

@KalitaAlexey
Copy link
Contributor

Is there any way to mark this issue linked with #18937 to check this after #18937 is fixed?

@benschulz
Copy link
Contributor Author

I subscribed to #18937 and will check once its resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Stebalien @benschulz @KalitaAlexey