https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105336
--- Comment #5 from Avi Kivity <avi at scylladb dot com> ---
I reduced it to a few lines (attached, intentionally triggers use-after-free).
The culprit is -Og.
With
g++ coroutine-asan.cc -o coroutine-asan --std=c++20 -fsanitize=address -Og
I see
READ of size 8 at 0x607000000020 thread T0
#0 0x4018e2 in test() (/home/avi/tests/coroutine-asan+0x4018e2)
#1 0x40192b in main (/home/avi/tests/coroutine-asan+0x40192b)
#2 0x7fb2e0a1d58f in __libc_start_call_main (/lib64/libc.so.6+0x2d58f)
#3 0x7fb2e0a1d648 in __libc_start_main_alias_1 (/lib64/libc.so.6+0x2d648)
#4 0x401144 in _start (/home/avi/tests/coroutine-asan+0x401144)
0x607000000020 is located 0 bytes inside of 80-byte region
[0x607000000020,0x607000000070)
freed by thread T0 here:
#0 0x7fb2e0fdebc8 in operator delete(void*) (/lib64/libasan.so.8+0xbbbc8)
#1 0x40164f in
test_coroutine(test_coroutine(std::__n4861::coroutine_handle<void>&)::_Z14test_coroutineRNSt7__n486116coroutine_handleIvEE.Frame*)
[clone .actor] (/home/avi/tests/coroutine-asan+0x40164f)
#2 0x40200f (/home/avi/tests/coroutine-asan+0x40200f)
previously allocated by thread T0 here:
#0 0x7fb2e0fde188 in operator new(unsigned long)
(/lib64/libasan.so.8+0xbb188)
#1 0x4016c0 in test_coroutine(std::__n4861::coroutine_handle<void>&)
(/home/avi/tests/coroutine-asan+0x4016c0)
The stack traces are truncated, compared to
g++ coroutine-asan.cc -o coroutine-asan --std=c++20 -fsanitize=address
which yields
READ of size 8 at 0x607000000020 thread T0
#0 0x401cef in std::__n4861::coroutine_handle<void>::resume() const
(/home/avi/tests/coroutine-asan+0x401cef)
#1 0x401b0f in test() (/home/avi/tests/coroutine-asan+0x401b0f)
#2 0x401b85 in main (/home/avi/tests/coroutine-asan+0x401b85)
#3 0x7f79b8be958f in __libc_start_call_main (/lib64/libc.so.6+0x2d58f)
#4 0x7f79b8be9648 in __libc_start_main_alias_1 (/lib64/libc.so.6+0x2d648)
#5 0x4011a4 in _start (/home/avi/tests/coroutine-asan+0x4011a4)
0x607000000020 is located 0 bytes inside of 80-byte region
[0x607000000020,0x607000000070)
freed by thread T0 here:
#0 0x7f79b91aabc8 in operator delete(void*) (/lib64/libasan.so.8+0xbbbc8)
#1 0x4019a5 in
test_coroutine(test_coroutine(std::__n4861::coroutine_handle<void>&)::_Z14test_coroutineRNSt7__n486116coroutine_handleIvEE.Frame*)
[clone .actor] (/home/avi/tests/coroutine-asan+0x4019a5)
#2 0x401cf7 in std::__n4861::coroutine_handle<void>::resume() const
(/home/avi/tests/coroutine-asan+0x401cf7)
#3 0x401b0f in test() (/home/avi/tests/coroutine-asan+0x401b0f)
#4 0x401b85 in main (/home/avi/tests/coroutine-asan+0x401b85)
#5 0x7f79b8be958f in __libc_start_call_main (/lib64/libc.so.6+0x2d58f)
previously allocated by thread T0 here:
#0 0x7f79b91aa188 in operator new(unsigned long)
(/lib64/libasan.so.8+0xbb188)
#1 0x401293 in test_coroutine(std::__n4861::coroutine_handle<void>&)
(/home/avi/tests/coroutine-asan+0x401293)
#2 0x401af9 in test() (/home/avi/tests/coroutine-asan+0x401af9)
#3 0x401b85 in main (/home/avi/tests/coroutine-asan+0x401b85)
#4 0x7f79b8be958f in __libc_start_call_main (/lib64/libc.so.6+0x2d58f)
The traces go all the away to main.
