• d-bugmail puremagic.com (36/36) Oct 05 2021 https://issues.dlang.org/show_bug.cgi?id=22359

d-bugmail puremagic.com writes:

https://issues.dlang.org/show_bug.cgi?id=22359

          Issue ID: 22359
           Summary: joiner over an empty forward range object liable to
                    segfault
           Product: D
           Version: D2
          Hardware: x86_64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: phobos
          Assignee: nobody puremagic.com
          Reporter: destructionator gmail.com

There's some old bugs from a decade ago that are apparently related but not
quite the same as their test case is one item deep and this requires something
two items deep. Behold:

------

import std.range;
ForwardRange!int fnFlatten(int[][] r)
{
        import std.range : inputRangeObject;
        import std.algorithm : map, joiner;

        auto range = inputRangeObject(r);

        return range.map!(a =>inputRangeObject(a)).joiner.inputRangeObject;
}

void main() {
        auto f = fnFlatten([[]]);
        f.save();
}

------


In the `private enum popFrontEmptyElement` of joiner, there's a `_current =
typeof(_current).init;`

If _current is some kind of class, that's null. Then when you call `save` on
it, it is a null this deref.

--