Avoid use-after-return caused by double move #11485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

tamird wants to merge 1 commit into pytorch:main from tamird:export-D76271359

Contributor

tamird commented Jun 9, 2025 •

edited

Loading

Summary:

Previously, Result<T>'s constructor used std::move(val) to initialize the
value. This resulted in an unnecessary extra move and destructor call on a
moved-from stack object, triggering an HWASAN stack tag mismatch when the
moved-from object was later destructed.

Replacing std::move(val) with std::forward<T>(val) avoids the extra move
while preserving correct semantics. This ensures only one move occurs and
avoids lifetime violations that can lead to tag mismatches under HWASAN.

Differential Revision: D76271359

tamird requested review from JacobSzwejbka, lucylq and swolchok as code owners

June 9, 2025 16:26

pytorch-bot bot commented Jun 9, 2025 •

edited

Loading

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/11485

📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

✅ No Failures

As of commit 2c6361e with merge base 611092d ():
💚 Looks good so far! There are no failures yet. 💚

This comment was automatically generated by Dr. CI and updates every 15 minutes.

facebook-github-bot added the CLA Signed label

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359

facebook-github-bot added the fb-exported label

Contributor Author

tamird commented Jun 9, 2025

@pytorchbot label "release notes: none"

pytorch-bot bot added the release notes: none label

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359

1 similar comment

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359

tamird changed the title ~~Use std::forward to avoid immediate trivial move~~ Avoid use-after-return caused by double move

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359

1 similar comment

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359


          Avoid use-after-return caused by double move

2c6361e

Summary:
Previously, `Result<T>`'s constructor used `std::move(val)` to initialize the
value. This resulted in an unnecessary extra move and destructor call on a
moved-from stack object, triggering an HWASAN stack tag mismatch when the
moved-from object was later destructed.

Replacing `std::move(val)` with `std::forward<T>(val)` avoids the extra move
while preserving correct semantics. This ensures only one move occurs and
avoids lifetime violations that can lead to tag mismatches under HWASAN.

Reviewed By: StefanBossbaly

Differential Revision: D76271359

Contributor

facebook-github-bot commented Jun 9, 2025

This pull request was exported from Phabricator. Differential Revision: D76271359

JacobSzwejbka reviewed

View reviewed changes

Contributor

JacobSzwejbka left a comment

Thanks for the catch!

runtime/core/result.h

    
                /* implicit */ Result(T&& val) : value_(std::move(val)), hasValue_(true) {}

                /// Value forwarding constructor.

                /* implicit */ Result(T&& val)

                    : value_(std::forward<T>(val)), hasValue_(true) {}

Contributor

JacobSzwejbka Jun 9, 2025

Can you add a test that wouldve caught the previous bad behavior.

Contributor Author

tamird Jun 9, 2025

Sure. Where are the tests for this type?

Contributor

lucylq Jun 9, 2025

Can you try adding to this file: https://github.com/pytorch/executorch/blob/2dedc9e0e39047269b7762652b593c5c53883168/runtime/core/test/error_handling_test.cpp

swolchok suggested changes

View reviewed changes

Contributor

swolchok left a comment

looks great, needs test, happy to accept with the test

Contributor Author

tamird commented Jun 9, 2025

looks great, needs test, happy to accept with the test

I tried writing a test, but I have failed to induce the problematic behavior. I think it shows up only in the presence of stack tagging as performed by hwasan.

swolchok reviewed

View reviewed changes

runtime/core/result.h

Comment on lines -73 to +75

    
                /// Value move constructor.

                /* implicit */ Result(T&& val) : value_(std::move(val)), hasValue_(true) {}

                /// Value forwarding constructor.

                /* implicit */ Result(T&& val)

                    : value_(std::forward<T>(val)), hasValue_(true) {}

Contributor

swolchok Jun 9, 2025

I misread what was going on here originally. This isn't a template function (though it is a member of a template class), so this really is an rvalue reference. I think that the original code is probably correct; std::forward is for arguments to template functions (https://en.cppreference.com/w/cpp/utility/forward.html).

Contributor Author

tamird commented Jun 11, 2025

This turned out to be a red herring.

tamird closed this

tamird deleted the export-D76271359 branch

June 11, 2025 17:21

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed fb-exported release notes: none