<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Issue 4368: Potential dangling reference returned from transform_sender</title>
<meta property="og:title" content="Issue 4368: Potential dangling reference returned from transform_sender">
<meta property="og:description" content="C++ library issue. Status: New">
<meta property="og:url" content="https://cplusplus.github.io/LWG/issue4368.html">
<meta property="og:type" content="website">
<meta property="og:image" content="http://cplusplus.github.io/LWG/images/cpp_logo.png">
<meta property="og:image:alt" content="C++ logo">
<style>
  p {text-align:justify}
  li {text-align:justify}
  pre code.backtick::before { content: "`" }
  pre code.backtick::after { content: "`" }
  blockquote.note
  {
    background-color:#E0E0E0;
    padding-left: 15px;
    padding-right: 15px;
    padding-top: 1px;
    padding-bottom: 1px;
  }
  ins {background-color:#A0FFA0}
  del {background-color:#FFA0A0}
  table.issues-index { border: 1px solid; border-collapse: collapse; }
  table.issues-index th { text-align: center; padding: 4px; border: 1px solid; }
  table.issues-index td { padding: 4px; border: 1px solid; }
  table.issues-index td:nth-child(1) { text-align: right; }
  table.issues-index td:nth-child(2) { text-align: left; }
  table.issues-index td:nth-child(3) { text-align: left; }
  table.issues-index td:nth-child(4) { text-align: left; }
  table.issues-index td:nth-child(5) { text-align: center; }
  table.issues-index td:nth-child(6) { text-align: center; }
  table.issues-index td:nth-child(7) { text-align: left; }
  table.issues-index td:nth-child(5) span.no-pr { color: red; }
  @media (prefers-color-scheme: dark) {
     html {
        color: #ddd;
        background-color: black;
     }
     ins {
        background-color: #225522
     }
     del {
        background-color: #662222
     }
     a {
        color: #6af
     }
     a:visited {
        color: #6af
     }
     blockquote.note
     {
        background-color: rgba(255, 255, 255, .10)
     }
  }
</style>
</head>
<body>
<hr>
<p><em>This page is a snapshot from the LWG issues list, see the <a href="lwg-active.html">Library Active Issues List</a> for more information and the meaning of <a href="lwg-active.html#New">New</a> status.</em></p>
<h3 id="4368"><a href="lwg-active.html#4368">4368</a>. Potential dangling reference returned from <code class='backtick'>transform_sender</code></h3>
<p><b>Section:</b> 33.9.5 <a href="https://wg21.link/exec.domain.default">[exec.domain.default]</a> <b>Status:</b> <a href="lwg-active.html#New">New</a>
 <b>Submitter:</b> Eric Niebler <b>Opened:</b> 2025-08-31 <b>Last modified:</b> 2025-09-15</p>
<p><b>Priority: </b>Not Prioritized
</p>
<p><b>View all other</b> <a href="lwg-index.html#exec.domain.default">issues</a> in [exec.domain.default].</p>
<p><b>View all issues with</b> <a href="lwg-status.html#New">New</a> status.</p>
<p><b>Discussion:</b></p>
<p>
The following has been reported by Trevor Gray to me:
</p>
<blockquote style="border-left: 3px solid #ccc;padding-left: 15px;">
<p>
There is a potential stack-use-after-scope in <code class='backtick'>execution::transform_sender</code> 
with <code class='backtick'>execution::default_domain::transform_sender</code>.
<p/>
I'll give an example of the problem using <code class='backtick'>starts_on</code> with the <code class='backtick'>default_domain</code>.
<p/>
<code class='backtick'>starts_on</code> defines a <code class='backtick'>transform_sender</code> so <code class='backtick'>execution::transform_sender</code> will expand to:
</p>
<blockquote><pre>
return transform_sender(
    dom,
    dom.transform_sender(std::forward&lt;Sndr&gt;(sndr), env...),
    env...);
</pre></blockquote>
<p>
where <code class='backtick'>dom</code> is the <code class='backtick'>default_domain</code> and <code class='backtick'>sndr</code> is <code class='backtick'>starts_on</code>.
<p/>
Execution flow:
</p>
<ul>
<li><p><code>dom.transform_sender(std::forward&lt;Sndr&gt;(sndr), env...)</code> uses <code class='backtick'>default_domain</code> 
to invoke <code class='backtick'>start_on</code>'s <code class='backtick'>transform_sender</code>. The return type is <code class='backtick'>T</code> (where <code class='backtick'>T</code> is a <code class='backtick'>let_value</code> sender)</p></li>
<li><p><code>transform_sender(dom, declval&lt;T&gt;(), env...)</code> is then run which uses <code class='backtick'>default_domain</code> 
to just return <code>std::forward&lt;T&gt;(t)</code>.</p></li>
</ul>
<p>
This means the value returned from the entire expression is <code>T&amp;&amp;</code> which a reference 
to a temporary variable in the frame of <code class='backtick'>transform_sender</code> which is no longer valid after the return.
</p>
</blockquote>
<p>
In the reference implementation, this scenario does not create a dangling reference because 
its implementation of <code class='backtick'>default_domain::transform_sender</code> does not conform to the spec. By default, 
it returns an rvalue sender as a prvalue instead of an xvalue as the spec requires.
<p/>
The fix is for the spec to follow suit and return prvalues when an xvalue would otherwise be returned.
</p>


<p id="res-4368"><b>Proposed resolution:</b></p>
<p>
This wording is relative to <a href="https://wg21.link/N5014">N5014</a>.
</p>

<ol>

<li><p>Modify 33.9.5 <a href="https://wg21.link/exec.domain.default">[exec.domain.default]</a> as indicated:</p>

<blockquote>
<pre>
template&lt;sender Sndr, <i>queryable</i>... Env&gt;
  requires (sizeof...(Env) &lt;= 1)
constexpr sender decltype(auto) transform_sender(Sndr&amp;&amp; sndr, const Env&amp;... env)
  noexcept(<i>see below</i>);
</pre>
<blockquote>
<p>
-2- Let <code class='backtick'>e</code> be the expression
</p>
<blockquote><pre>
tag_of_t&lt;Sndr&gt;().transform_sender(std::forward&lt;Sndr&gt;(sndr), env...)
</pre></blockquote>
<p>
if that expression is well-formed; otherwise, <code><ins>static_cast&lt;Sndr&gt;(</ins>std::forward&lt;Sndr&gt;(sndr)<ins>)</ins></code>.
<p/>
-3- <i>Returns</i>: <code class='backtick'>e</code>.
<p/>
-4- <i>Remarks</i>: The exception specification is equivalent to <code class='backtick'>noexcept(e)</code>.
</p>
</blockquote>
</blockquote>

</li>

</ol>




</body>
</html>
