-
Yedidya Feldblum authored
Summary: Code may pass a callback which captures an object with a destructor which mutates through a stored reference, triggering heap-use-after-free or stack-use-after-scope. ```lang=c++ void performDataRace() { auto number = std::make_unique<int>(0); auto guard = folly::makeGuard([&number] { *number = 1; }); folly::via(getSomeExecutor(), [guard = std::move(guard)]() mutable {}).wait(); // data race - we may wake and destruct number before guard is destructed on the // executor thread, which is both stack-use-after-scope and heap-use-after-free! } ``` We can avoid this condition by always destructing the provided functor before setting any result on the promise. Retry at {D4982969}. Reviewed By: andriigrynenko Differential Revision: D5058750 fbshipit-source-id: 4d1d878b4889e5e6474941187f03de5fa84d3061
8e110a76