[Issue 14443] New: [Reg 2.067.0] Incorrect double freeing of reference counted struct

[via Digitalmars-d-bugs]

https://issues.dlang.org/show_bug.cgi?id=14443

          Issue ID: 14443
           Summary: [Reg 2.067.0] Incorrect double freeing of reference
                    counted struct
           Product: D
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: regression
          Priority: P1
         Component: DMD
          Assignee: nobody at puremagic.com
          Reporter: code at dawg.eu

cat > bug.d << CODE
import std.typecons;

struct Path
{
    struct Payload
    {
        int p;
    }
    RefCounted!Payload _data;

    unittest
    {
        auto path = Path(RefCounted!Payload(12));
        assert(path._data.p == 12);
        foreach(element; PathRange(path)) {}
    }
}

struct PathRange
{
    Path path;
    size_t i;

    @property empty()
    {
        return i > 2;
    }

    void popFront()
    {
        ++i;
    }

    @property PathElement front()
    {
        return PathElement(this, path._data.p);
    }
}

struct PathElement
{
    PathRange range;

    this(PathRange range, int)
    {
        this.range = range;
    }
}
CODE

dmd -main -unittest -run bug
----

This code works with 2.066.1 but segfaults with 2.067.0, apparently because the
refcount of _data in path drops to 0 while it's still used.
My malloc implementation also complains about a double free.

--