{"action":"created","issue":{"url":"https://api.github.com/repos/rust-lang/rust/issues/34592","repository_url":"https://api.github.com/repos/rust-lang/rust","labels_url":"https://api.github.com/repos/rust-lang/rust/issues/34592/labels{/name}","comments_url":"https://api.github.com/repos/rust-lang/rust/issues/34592/comments","events_url":"https://api.github.com/repos/rust-lang/rust/issues/34592/events","html_url":"https://github.com/rust-lang/rust/issues/34592","id":163288630,"number":34592,"title":"Segfault due to using return pointer directly","user":{"login":"alexcrichton","id":64996,"avatar_url":"https://avatars.githubusercontent.com/u/64996?v=3","gravatar_id":"","url":"https://api.github.com/users/alexcrichton","html_url":"https://github.com/alexcrichton","followers_url":"https://api.github.com/users/alexcrichton/followers","following_url":"https://api.github.com/users/alexcrichton/following{/other_user}","gists_url":"https://api.github.com/users/alexcrichton/gists{/gist_id}","starred_url":"https://api.github.com/users/alexcrichton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexcrichton/subscriptions","organizations_url":"https://api.github.com/users/alexcrichton/orgs","repos_url":"https://api.github.com/users/alexcrichton/repos","events_url":"https://api.github.com/users/alexcrichton/events{/privacy}","received_events_url":"https://api.github.com/users/alexcrichton/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rust-lang/rust/labels/A-codegen","name":"A-codegen","color":"d7e102"},{"url":"https://api.github.com/repos/rust-lang/rust/labels/I-nominated","name":"I-nominated","color":"e10c02"},{"url":"https://api.github.com/repos/rust-lang/rust/labels/I-wrong","name":"I-wrong","color":"e10c02"},{"url":"https://api.github.com/repos/rust-lang/rust/labels/T-compiler","name":"T-compiler","color":"bfd4f2"}],"state":"closed","locked":false,"assignee":{"login":"luqmana","id":287063,"avatar_url":"https://avatars.githubusercontent.com/u/287063?v=3","gravatar_id":"","url":"https://api.github.com/users/luqmana","html_url":"https://github.com/luqmana","followers_url":"https://api.github.com/users/luqmana/followers","following_url":"https://api.github.com/users/luqmana/following{/other_user}","gists_url":"https://api.github.com/users/luqmana/gists{/gist_id}","starred_url":"https://api.github.com/users/luqmana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luqmana/subscriptions","organizations_url":"https://api.github.com/users/luqmana/orgs","repos_url":"https://api.github.com/users/luqmana/repos","events_url":"https://api.github.com/users/luqmana/events{/privacy}","received_events_url":"https://api.github.com/users/luqmana/received_events","type":"User","site_admin":false},"assignees":[{"login":"luqmana","id":287063,"avatar_url":"https://avatars.githubusercontent.com/u/287063?v=3","gravatar_id":"","url":"https://api.github.com/users/luqmana","html_url":"https://github.com/luqmana","followers_url":"https://api.github.com/users/luqmana/followers","following_url":"https://api.github.com/users/luqmana/following{/other_user}","gists_url":"https://api.github.com/users/luqmana/gists{/gist_id}","starred_url":"https://api.github.com/users/luqmana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luqmana/subscriptions","organizations_url":"https://api.github.com/users/luqmana/orgs","repos_url":"https://api.github.com/users/luqmana/repos","events_url":"https://api.github.com/users/luqmana/events{/privacy}","received_events_url":"https://api.github.com/users/luqmana/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2016-06-30T23:27:28Z","updated_at":"2016-07-26T18:21:26Z","closed_at":"2016-07-07T15:39:45Z","body":"First reported at https://github.com/rust-lang-nursery/rustc-serialize/issues/154, it looks like the code in that issue will segfault on all platforms and isn't related to the allocator in question, it's just a bad free. It looks like the expansion of `#[derive(RustcDecodable)]` is the function that's segfaulting, specifically:\r\n\r\n```rust\r\nextern crate rustc_serialize;\r\n\r\nuse rustc_serialize::*;\r\n\r\npub struct Request {\r\n    pub id: String,\r\n    pub arg: String,\r\n}\r\n\r\nimpl Decodable for Request {\r\n    fn decode<D: Decoder>(d: &mut D) -> Result<Request, D::Error> {\r\n        d.read_struct(\"Request\", 2, |d| {\r\n            Ok(Request {\r\n                id: match d.read_struct_field(\"id\", 0, Decodable::decode) {\r\n                    Ok(v) => v,\r\n                    Err(e) => return Err(e),\r\n                },\r\n                arg: match d.read_struct_field(\"arg\", 1, Decodable::decode) {\r\n                    Ok(v) => v,\r\n                    Err(e) => return Err(e),\r\n                },\r\n            })\r\n        })\r\n    }\r\n}\r\n```\r\n\r\nIn this function the closure *should* detect that it has nested returns and therefore the closure should write intermediate results into a local alloca of what to return. Instead, though, no alloca is created an results are stored directly into the return pointer.\r\n\r\nThe fault looks like it happens when:\r\n\r\n* The `decode` function is called, `read_struct` is called, then the closure is called.\r\n* The first call to `read_struct_field` succeeds, so the string is stored in the `id` field *directly into the return pointer*\r\n* The second call to `read_struct_field` fails, returning an error\r\n* The compiler writes the result (`Err(D::Error)`) into the return pointer\r\n* The compiler then attempts to free the string stored to `id`\r\n\r\nBasically at that point it's freeing arbitrary data because the string has already been paved over. I have been unable to reproduce this with a smaller example because everything I do seems to trigger usage of an alloca for the return value (which should be happening here). Maybe someone else knows though how to trigger this with a smaller example.\r\n\r\nIn any case though this segafult happens on nightly/beta/stable, but would be very good to fix!\r\n\r\ncc @rust-lang/compiler \r\n\r\nalso nominating"},"comment":{"url":"https://api.github.com/repos/rust-lang/rust/issues/comments/235358766","html_url":"https://github.com/rust-lang/rust/issues/34592#issuecomment-235358766","issue_url":"https://api.github.com/repos/rust-lang/rust/issues/34592","id":235358766,"user":{"login":"posborne","id":41714,"avatar_url":"https://avatars.githubusercontent.com/u/41714?v=3","gravatar_id":"","url":"https://api.github.com/users/posborne","html_url":"https://github.com/posborne","followers_url":"https://api.github.com/users/posborne/followers","following_url":"https://api.github.com/users/posborne/following{/other_user}","gists_url":"https://api.github.com/users/posborne/gists{/gist_id}","starred_url":"https://api.github.com/users/posborne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/posborne/subscriptions","organizations_url":"https://api.github.com/users/posborne/orgs","repos_url":"https://api.github.com/users/posborne/repos","events_url":"https://api.github.com/users/posborne/events{/privacy}","received_events_url":"https://api.github.com/users/posborne/received_events","type":"User","site_admin":false},"created_at":"2016-07-26T18:21:26Z","updated_at":"2016-07-26T18:21:26Z","body":"@alexcrichton  I'm running into this on 1.10 and it also fails on `rustc 1.11.0-beta.1 (8dc253bcf 2016-07-05)` (but not nightly).  For me, my code crashes if I (or a user) provides invalid JSON that correct code tries to parse using .  I would very much like to see a fix in 1.11 if possible.  Any chance of that?\r\n\r\nThis bug would seems to breaks the canonical way of doing JSON parsing for the majority of users."}}
{"actor":{"display_login":"posborne"}}