Boost C++ Libraries: Ticket #9260: Phoenix switch_ statements accessing wrong memory and cause segfault https://svn.boost.org/trac10/ticket/9260 <p> Seth Heeren and I tracked down a problem in phoenix 3's switch_ statements that causes a crash in the attached example. </p> <p> Judging from valgrind outputs, it appears as if the switch_ accesses memory outside it's stack. In the attached case that causes a crash when accessing local variables in the enclosing rule. </p> <p> To reproduce: </p> <p> With this rule: qi::rule&lt;It, bool(), qi::locals&lt;bool, unsigned int, double, std::string&gt;, Skipper&gt; enclosing; </p> <p> defined as: enclosing %= condition[_a = _1] &gt;&gt; double_[_val = _a]; </p> <p> it works. </p> <p> If it is defined as: enclosing %= condition[_a = _1] &gt;&gt; double_[_c = _1, _val = _a]; </p> <p> it crashes. </p> <p> When not using local variables there is no crash but still undefined behavior caused by the switch_. Phoenix 2 does not have this problem. </p> en-us Boost C++ Libraries /htdocs/site/boost.png https://svn.boost.org/trac10/ticket/9260 Trac 1.4.3 stephan.menzel@… Fri, 18 Oct 2013 07:46:56 GMT attachment set https://svn.boost.org/trac10/ticket/9260 https://svn.boost.org/trac10/ticket/9260 <ul> <li><strong>attachment</strong> → <span class="trac-field-new">phx_3_crash_reproducer.cpp</span> </li> </ul> <p> reproducer </p> Ticket Stephan.menzel@… Sat, 19 Oct 2013 06:37:25 GMT component changed; owner set https://svn.boost.org/trac10/ticket/9260#comment:1 https://svn.boost.org/trac10/ticket/9260#comment:1 <ul> <li><strong>owner</strong> set to <span class="trac-author">Thomas Heller</span> </li> <li><strong>component</strong> <span class="trac-field-old">None</span> → <span class="trac-field-new">phoenix</span> </li> </ul> Ticket John Fletcher <J.P.Fletcher@…> Sat, 01 Feb 2014 17:04:01 GMT <link>https://svn.boost.org/trac10/ticket/9260#comment:2 </link> <guid isPermaLink="false">https://svn.boost.org/trac10/ticket/9260#comment:2</guid> <description> <p> The example submitted is not a minimal example of the failure in phoenix let_ structure. </p> <p> I have been correcting some bugs (5715 and 5824) which relate to the operation of the comma operator in phoenix and those fixes may well be relevant. </p> <p> The 5715 fix is currently in master and 5824 in develop and I will move it to master after 24 hours of tests on develop. You can follow this by looking at bug5715 and bug5824 in the testing reports. </p> <p> I expect these fixes will be in 1.56.0 when it comes out. </p> <p> Please if you read this could you check your problem and see if it is fixed against those fixes? </p> <p> If not could you supply a smaller example of the problem in phoenix. </p> <p> Thanks </p> <p> John Fletcher </p> </description> <category>Ticket</category> </item> </channel> </rss>