Double Drop on Rust beta

[pranjalssh]

Getting double Drop/free errors on Rust. Sounds very dangerous. It started on 23 May rust nightly. Fails on beta as well, which is the next release.

A minimal repro https://bit.ly/2A52CJe
Dropping is printed twice. Flipping the order of elements in struct, makes it work and then drop is only called once.

Cc @asm89

[jonas-schievink]

@rustbot ping cleanup

[rustbot]

Hey Cleanup Crew ICE-breakers! This bug has been identified as a good
"Cleanup ICE-breaking candidate". In case it's useful, here are some
instructions for tackling these sorts of bugs. Maybe take a look?
Thanks! <3

cc @AminArria @camelid @chrissimpkins @contrun @DutchGhost @elshize @ethanboxx @h-michael @HallerPatrick @hdhoang @hellow554 @imtsuki @kanru @KarlK90 @LeSeulArtichaut @MAdrianMattocks @matheus-consoli @mental32 @nmccarty @Noah-Kennedy @pard68 @PeytonT @pierreN @Redblueflame @RobbieClarken @RobertoSnap @robjtede @SarthakSingh31 @senden9 @shekohex @sinato @spastorino @turboladen @woshilapin @yerke

[pranjalssh]

Possibly related to #71956 ?

[Darksonn]

Here is a simpler test case:

struct DD {
    a: String,
}

// DD is dropped twice
impl Drop for DD {
    fn drop(&mut self) {
        println!("Dropping!");
    }
}

struct Yolo {
    a: DD,
    b: Option<DD>,
}

async fn gg(x: &Yolo) {}

fn main() {
    futures::executor::block_on(async {
        let d2 = async { DD { a: "a".to_owned() } };

        // Swap the order here and it works
        let action = Yolo {
            b: None,
            a: d2.await,
        };
        gg(&action).await;
    });
}

playground

[lcnr]

Note that the underlying problem is not a double free. We instead copy the value of a both into b and a, which changes b to Some(Yolo { .. }) which is then correctly dropped.

An example illustrating this is

struct Foo {
    a: usize,
    b: &'static u32,
}

fn main() {
    futures::executor::block_on(async {
        // Swap the order here and it works
        let action = Foo {
            b: &42,
            a: async { 0 }.await,
        };
        
        println!("{:p}", action.b);
        // ^ This prints `0x0`

        async {}.await;
    });
}

[pranjalssh]

This would explain why my debugger replied with cannot access memory on action.b