Segfault when matching a copy of a owned box

[lbonn]

I am very new to rust, so please bear with me :).

When trying to do a small routine to parse the arguments of a program, I stumbled on a nice segfault. Here is the prototype of what I tried.

fn parse_args() -> ~str {
    let args = core::os::args();
    let mut n = 0;

    while n < args.len() {
        match copy args[n] {
            ~"-v" => (),
            s => {
                return s;
            }
        }
        n += 1;
    }

    return ~""
}

fn main() {
    io::println(parse_args());
}

This example is meaningless and only illustrates the issue. I managed to write what I wanted in a cleanier style afterwards but I still think it's a bug.

It compiles without a warning but it crashes violently when running it.

[jdm]

#0  0x000000395a87b4dd in malloc_consolidate () from /lib64/libc.so.6
#1  0x000000395a87bf08 in _int_free () from /lib64/libc.so.6
#2  0x00007ffff7d97b49 in rust_sched_loop::run_single_turn (this=0x405c00) at /run/media/jdm/ssd/rust/src/rt/rust_sched_loop.cpp:263
#3  0x00007ffff7d99235 in rust_sched_driver::start_main_loop (this=0x406e80) at /run/media/jdm/ssd/rust/src/rt/rust_sched_driver.cpp:50
#4  0x00007ffff7d92a8a in rust_thread_start (ptr=<optimized out>) at /run/media/jdm/ssd/rust/src/rt/sync/rust_thread.cpp:35
#5  0x000000395b007d14 in start_thread () from /lib64/libpthread.so.0
#6  0x000000395a8f168d in clone () from /lib64/libc.so.6

[lbonn]

It seems to happen with any type behind the owned box and looks like a double-free.

Here is a more minimal sample:

fn main() {
    let k = ~1;
    match copy k {
        c => ()
    }
}

[bstrie]

Possibly related to #4355.

[graydon]

reproduced on 2013-03-20, seems imporant-ish

[catamorphism]

Reproduced with 64963d6. Nominating for milestone 5, production-ready

[nikomatsakis]

Fixed on my branch for #3235

[emberian]

Test passes on master, in suite and un-xfailed (pending my xfailing PR)