invalid free with uniq-by-ref

[jruderman]

fn f(&i: ~int) { i = ~2; }
fn main() { f(~1); }

unique-fn-arg-mut_expr_8_12(66672,0xb060b000) malloc: *** error for object 0x1000000: pointer being freed was not allocated

(Based on src/test/run-pass/unique-fn-arg-mut.rs. The important change is not assigning ~1 to a local before passing it to f.)

[brson]

Similarly, assigning a shared box to a mutable reference:

fn f(&i: @int) { i = @2; }
fn main() { f(@1); }

rt: fatal, 'leaked memory in rust main loop (1 objects)' failed, ../src/rt/memory_region.cpp:131 1 objects

[brson]

So I think the problem is that immediates are spilled so they can be used as references, then the callee changes that spilled value; afterwards, the caller runs a cleanup which respills the old pointer.

[brson]

Since this only affects mutating references to temporaries I kind of think we should just disallow it.

[marijnh]

Disallowing moving out of temporaries will break a lot of existing code, and for no good reason. The compiler can see that it's dealing with a temporary (lval_result.is_mem is false iff the value is a temporary) and can simply revoke the cleanup on the caller side (I thought it was already doing that).

[marijnh]

Hold on, I misread the example code, thinking it was passing by move. Passing a temporary by mutable value is indeed disallowed, but there was a bug in the mut checker that made it fail to catch that. This is fixed in 6164b72, which I guess closes this issue.