Calling returned closures cause segfault #6

New issue

Open

opened 2026-07-12 10:39:27 +00:00 by manabug · 0 comments

manabug commented

2026-07-12 10:39:27 +00:00

Owner

When calling a closure that has been returned from a function, a segmentation fault happens.

This is because the closure inherits then function's environment, which gets automatically destroyed as soon as the function body has been evaluated. So when the closure is called, a use-after-free bug happens when accessing it's environment.

Reproducible example:

fun returns_closure(x) {
    fun closure() { // closure inherits environment from returns_closure
        return x
    }
    return closure
} // the returns_closure environment gets destroyed.

c := returns_closure(2)
c()

When calling a closure that has been returned from a function, a segmentation fault happens. This is because the closure inherits then function's environment, which gets automatically destroyed as soon as the function body has been evaluated. So when the closure is called, a use-after-free bug happens when accessing it's environment. Reproducible example: ``` fun returns_closure(x) { fun closure() { // closure inherits environment from returns_closure return x } return closure } // the returns_closure environment gets destroyed. c := returns_closure(2) c() ```

manabug added the

bug

evaluator

labels

2026-07-12 10:39:27 +00:00