https://issues.dlang.org/show_bug.cgi?id=9614

[email protected] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #1 from [email protected] ---
A complete test case:

----
import std.stdio;

size_t from_f, from_g;

void main ()
{
    put();
    f();
    writefln("%#x", from_f); /* prints "0x1111" */
    writefln("%#x", from_g); /* prints "0x1111" */
}

void put()
{
    /* Put 0x1111 where there will be a gap between f's stack frame and g's
    stack frame. */
    size_t[2] a;
    a[0] = 0x1111;
}

void f()
{
    size_t a;
    from_f = *(&a - 1); /* This reads put's 0x1111. This isn't so bad as we're
        reading from beyond the live stack. */
    g();
}

void g()
{
    size_t a;
    from_g = *(&a + 3); /* Reads put's 0x1111 again. This is bad, because we're
        reading from the middle of the live stack. If the value were a GC
        pointer, it would keep its allocation alive. */
}
----

Tested with dmd 2.067.1 on linux.
Problem doesn't show with -m32.
ldc doesn't seem to have the issue.

--

Reply via email to