Hackery to narrow down an intermittent crash by ispeters · Pull Request #2100 · NVIDIA/stdexec

ispeters · 2026-05-28T00:16:47Z

Repro the crash with

$ cmake -S . -B build -GNinja \
  -DCMAKE_BUILD_TYPE=Debug \
  -DCMAKE_CXX_FLAGS="-fsanitize=address" \
  -DCMAKE_CXX_STANDARD:STRING=20 \
  -DCMAKE_CXX_EXTENSIONS:BOOL=OFF \
  -DSTDEXEC_BUILD_TESTS:BOOL=ON \
  -DCMAKE_CXX_COMPILER=$(which clang++)
$ cmake --build build && ./build/test/test.stdexec

This is obviously not for merging; I'm just sharing my narrowed-down repro now that it doesn't depend on apple-clang. Maybe it repros on Linux or Windows, too?

Repro the crash with ```sh $ cmake -S . -B build -GNinja \ -DCMAKE_BUILD_TYPE=Debug \ -DCMAKE_CXX_FLAGS="-fsanitize=address" \ -DCMAKE_CXX_STANDARD:STRING=20 \ -DCMAKE_CXX_EXTENSIONS:BOOL=OFF \ -DSTDEXEC_BUILD_TESTS:BOOL=ON \ -DCMAKE_CXX_COMPILER=$(which clang++) $ cmake --build build && ./build/test/test.stdexec ```

copy-pr-bot · 2026-05-28T00:16:51Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

ispeters · 2026-05-28T00:23:31Z

Configuring with -fsanitize=undefined gives this output:

/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:275:57: runtime error: reference binding to misaligned address 0x000000000002 for type 'const std::execution::__detail::__state<receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>', which requires 8 byte alignment
0x000000000002: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:275:57 
/Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:103:39: runtime error: reference binding to null pointer of type 'const std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:103:39 
/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:182:20: runtime error: member call on null pointer of type 'const std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger> *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:182:20 
/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:184:14: runtime error: reference binding to null pointer of type 'const (anonymous namespace)::logger'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:184:14 
/Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:31:18: runtime error: reference binding to null pointer of type 'const (anonymous namespace)::logger'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:31:18 
/Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:103:25: runtime error: reference binding to null pointer of type 'const (anonymous namespace)::logger'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:103:25 
/Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:105:24: runtime error: reference binding to null pointer of type 'const std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:105:24 
/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:179:10: runtime error: reference binding to null pointer of type 'const (anonymous namespace)::logger'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__env.hpp:179:10 
/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:209:16: runtime error: member access within null pointer of type 'std::execution::__detail::__state<receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:209:16 
/Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:209:47: runtime error: reference binding to null pointer of type 'receiver_t'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/include/stdexec/__detail/__basic_sender.hpp:209:47 
/Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:251:10: runtime error: member call on null pointer of type 'receiver_t *'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/ianpetersen/git/stdexec/test/stdexec/algos/adaptors/test_write_env.cpp:251:10 
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==47741==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000008 (pc 0x000104cec0dc bp 0x00016b1169a0 sp 0x00016b116960 T40489955)
==47741==The signal is caused by a READ memory access.
==47741==Hint: address points to the zero page.
    #0 0x000104cec0dc in main::receiver_t::set_value() && test_write_env.cpp:253
    #1 0x000104cec078 in void std::execution::__detail::__defaults::__complete::'lambda'<typename $T, typename $T0, typename $T1, typename ...$T2>($T, $T0&, $T1, $T2&&...)::operator()<std::__1::integral_constant<unsigned long, 0ul>, std::execution::__detail::__state<main::receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, std::execution::set_value_t>($T, $T0&, $T1, $T2&&...) const __basic_sender.hpp:209
    #2 0x000104cebf88 in void (anonymous namespace)::ReceiverIncomplete<(anonymous namespace)::OpStateIncomplete<std::execution::(anonymous namespace)::__sexpr<std::execution::'lambda3'(){}>, std::execution::__rcvr<std::execution::__write_env_t, std::execution::__detail::__state<main::receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, 0ul>>, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>::set_value<(anonymous namespace)::logger const&>((anonymous namespace)::logger const&) && test_write_env.cpp:184
    #3 0x000104cebe30 in std::execution::__read_env::__opstate<(anonymous namespace)::ReceiverIncomplete<(anonymous namespace)::OpStateIncomplete<std::execution::(anonymous namespace)::__sexpr<std::execution::'lambda3'(){}>, std::execution::__rcvr<std::execution::__write_env_t, std::execution::__detail::__state<main::receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, 0ul>>, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, (anonymous namespace)::query_t>::start() test_write_env.cpp:53
    #4 0x000104cebcd4 in (anonymous namespace)::OpStateIncomplete<std::execution::(anonymous namespace)::__sexpr<std::execution::'lambda3'(){}>, std::execution::__rcvr<std::execution::__write_env_t, std::execution::__detail::__state<main::receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, 0ul>>::start() & test_write_env.cpp:214
    #5 0x000104cebc34 in auto std::execution::__detail::__defaults::__start::'lambda'<typename ...$T>(std::execution::__ignore, $T&...)::operator()<(anonymous namespace)::OpStateIncomplete<std::execution::(anonymous namespace)::__sexpr<std::execution::'lambda3'(){}>, std::execution::__rcvr<std::execution::__write_env_t, std::execution::__detail::__state<main::receiver_t, std::execution::prop<(anonymous namespace)::query_t, (anonymous namespace)::logger>>, 0ul>>>(std::execution::__ignore, $T&...) const __basic_sender.hpp:199
    #6 0x000104ce95a0 in main test_write_env.cpp:264
    #7 0x00018ac63dfc in start+0x1b4c (dyld:arm64e+0x1fdfc)

==47741==Register values:
 x[0] = 0x0000000000000000   x[1] = 0x0000000000000000   x[2] = 0x0000000000000000   x[3] = 0x000000010a301310  
 x[4] = 0x0000000063000000   x[5] = 0x0000000000000000   x[6] = 0x0000000000000000   x[7] = 0x0000000000000000  
 x[8] = 0x0000000000000000   x[9] = 0x00000001052f8fb8  x[10] = 0x0000000105130000  x[11] = 0x1000000000000000  
x[12] = 0x0000000000000000  x[13] = 0x00000001052fb0e0  x[14] = 0x000000016b115a38  x[15] = 0x0000000000000000  
x[16] = 0x0000000000000049  x[17] = 0x0000000000000000  x[18] = 0x0000000000000000  x[19] = 0x00000001f6eec058  
x[20] = 0x00000001f6eec100  x[21] = 0x000000016b116eb8  x[22] = 0xfffffffffffffff0  x[23] = 0x00000001f71a3760  
x[24] = 0x0000000000000001  x[25] = 0x000000016b117020  x[26] = 0x00000001f71a3770  x[27] = 0x0000000000000000  
x[28] = 0x0000000000000000     fp = 0x000000016b1169a0     lr = 0x0000000104cec0d4     sp = 0x000000016b116960  
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV test_write_env.cpp:253 in main::receiver_t::set_value() &&
==47741==ABORTING
default 0x16b116c7b
copy from 0x16b116c7b to 0x16b116c52
move from 0x16b116c52 to 0x16b116b7f
move from 0x16b116b7f to 0x16b116c56
destroy 0x16b116b7f
move from 0x16b116c56 to 0x16b116c58
write_env::get_env 0x16b116c58
copy from 0x16b116c58 to 0x16b1169e6
destroy 0x16b1169e6
write_env::get_env 0x16b116c58
copy from 0x16b116c58 to 0x16b116517
destroy 0x16b116517
ReceiverIncomplete::get_env 0x16b116517
write_env::get_env 0x16b116c58
copy from 0x16b116c58 to 0x16b116686
destroy 0x16b116686
destroy 0x16b116c56
destroy 0x16b116c52
write_env::get_env 0x2
copy from 0x2 to 0x16b1169d7
destroy 0x16b1169d7
ReceiverIncomplete::get_env 0x16b1169d7
write_env::get_env 0x0
copy from 0x0 to 0x16b116aee
destroy 0x16b116aee
completing with 0x16b116aee

ericniebler · 2026-05-28T01:14:35Z

/ok to test ca0bdad

ispeters · 2026-05-28T01:21:25Z

Looks like I missed including <optional>, and the test runner can't find the test anyway.

ericniebler · 2026-05-28T03:01:27Z

/ok to test 4564d06

ericniebler · 2026-05-28T03:17:32Z

/ok to test d30afe2

ispeters · 2026-05-28T03:28:31Z

Pretty sure I've found the solution in #2102.

Fix the UB, I think

4564d06

Maybe fix more UB?

d30afe2

ispeters mentioned this pull request May 28, 2026

Give struct __rcvr user-defined ctors in __basic_sender #2102

Open

ispeters closed this May 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hackery to narrow down an intermittent crash#2100

Hackery to narrow down an intermittent crash#2100
ispeters wants to merge 3 commits into
NVIDIA:mainfrom
ispeters:bug_hunting

ispeters commented May 28, 2026

Uh oh!

copy-pr-bot Bot commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ispeters commented May 28, 2026

Uh oh!

copy-pr-bot Bot commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ericniebler commented May 28, 2026

Uh oh!

ispeters commented May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants