Segfault / double free with vector

[vohewirid]

Hi guys,

I'm trying understanding what am I doing wrong here.
When I compile the code below and run it segfaults because free
recognizes that vector is freed twice.

Is this expected behavior?

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <algorithm>
#include <vector>
#include <iostream>


static int _argc;
static char **_argv;
using std::vector;
using std::begin;
using std::end;

struct Transform {
    const vector<int> &items;

    explicit Transform(vector<int> const &items) : items{items} {}

    const Transform &operator>>(std::string const &val) const {
        std::cout << val << ": ";
        return *this;
    }

    const Transform &operator>>(vector<int>(FUNC)(vector<int>)) const{
        auto const ret = FUNC(items);
        std::cout << "(";
        std::for_each(begin(ret), end(ret), [](auto const &v) {
            std::cout << v << ",";
        });
        std::cout << "\b)" << std::endl;
        return *this;
        // It segfaults here on function exit
    }
};

int main() {
    vector<int> items {1, 2, 3, 4, 4, 5, 6, 7};
    auto _ = Transform(items);
    _ >> "example" >> [](vector<int> src) -> vector<int>  {
        return src;
    };


    return 0;
}

[Repeater]

Doesn't segfault here: https://ideone.com/iDyBFr

[vohewirid]

That's the interesting thing.
On my Ubuntu 18.04 it doesn't too, but on Ubuntu 16.04 it does.

So is this a compiler bug or am I doing something wrong?

[lastchance]

It doesn't segfault in cpp shell, but it doesn't produce the correct answer.
Making a deliberate copy on line 42 seems to help:
return vector<int>( src );

I don't really understand this, but wouldn't you be calling the destructor of src at the same time as you were trying to move(?) it out of the function?

[vohewirid]

The correct answer is the other thing that I forgot to notice for Ubuntu 16.04 version of GCC.
For some reason it also prints the wrong answer before it dies.

Segfault is happening in assembly that is cleaning variables that go out of scope of >> [](){} operator.

[lastchance]

Produces the wrong answer in cpp shell as is, although it seems to work on the compilers I have on my desktop.

If you replace the lambda function by a normal function it then works in cpp shell.

Curious.

[Peter87]

For me, doesn't work correctly on GCC 4.9.2, but works fine with GCC 7.3.

I can't see anything wrong with the code so perhaps it's a bug that has been fixed in recent versions of GCC.

[Markus23]

In Ubuntu 18.04 it doesn't work correctly, but on Ubuntu 16.04 it does. I also can't understand what the problem here. So one more time where is the mistake?
______________________
https://goo.gl/b7GTEb

[vohewirid]

I would just like to know if this is a compiler bug or have I done something wrong here.
Is there some C++ expert that could explain that to us.

I really don't want to read whole C++ standard to figure it out :)

[lastchance]

I think it is probably a bug in the way an old version of the compiler deals with lambda functions (because switching to a normal function seems to work OK). Some of your code is C++14.

Newer compilers seem to be OK with it, and no warnings flash related to this problem (though you've got plenty of other unused stuff in).

I can't see anything wrong with your code (other than it's very contorted!).

[Peter87]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65354