diff --git a/src/test/ui/generator/dropck.rs b/src/test/ui/generator/dropck.rs new file mode 100644 index 00000000000..0b143d7f514 --- /dev/null +++ b/src/test/ui/generator/dropck.rs @@ -0,0 +1,28 @@ +// Copyright 2018 The Rust Project Developers. See the COPYRIGHT +// file at the top-level directory of this distribution and at +// http://rust-lang.org/COPYRIGHT. +// +// Licensed under the Apache License, Version 2.0 or the MIT license +// , at your +// option. This file may not be copied, modified, or distributed +// except according to those terms. + +#![feature(generators, generator_trait, box_leak)] + +use std::cell::RefCell; +use std::ops::Generator; + +fn main() { + let (cell, mut gen); + cell = Box::new(RefCell::new(0)); + let ref_ = Box::leak(Box::new(Some(cell.borrow_mut()))); + // the upvar is the non-dropck `&mut Option>`. + gen = || { + // but the generator can use it to drop a `Ref<'a, i32>`. + let _d = ref_.take(); //~ ERROR `ref_` does not live long enough + yield; + }; + gen.resume(); + // drops the RefCell and then the Ref, leading to use-after-free +} diff --git a/src/test/ui/generator/dropck.stderr b/src/test/ui/generator/dropck.stderr new file mode 100644 index 00000000000..deaf00fff07 --- /dev/null +++ b/src/test/ui/generator/dropck.stderr @@ -0,0 +1,16 @@ +error[E0597]: `ref_` does not live long enough + --> $DIR/dropck.rs:23:18 + | +21 | gen = || { + | -- capture occurs here +22 | // but the generator can use it to drop a `Ref<'a, i32>`. +23 | let _d = ref_.take(); //~ ERROR `ref_` does not live long enough + | ^^^^ borrowed value does not live long enough +... +28 | } + | - borrowed value dropped before borrower + | + = note: values in a scope are dropped in the opposite order they are created + +error: aborting due to previous error +