Memory holding schedule function might be freed during its invocation

[tmiasko]

Currently waking the waker by value hands over the ownership of the task to the
schedule without retaining any refcount on its own. Once the scheduling
function hands over the ownership of task further there is no guarantee that
memory that holds scheduling function will remain valid.

For example (drop(task) is used to avoid irrelevant complexity):

fn main() {
    let s = "1234".to_owned();

    let (task, _) = async_task::spawn(
        async {},
        move |task| {
            println!("{:?}", s);
            drop(task);
            println!("{:?}", s);
        },
        (),
    );
    task.schedule();
}

I'm not sure I understand -- maybe I'm missing something?

When the Waker wakes the task by value, it becomes a Task that is passed into the schedule function. The reference count doesn't change. Even if the schedule function hands over ownership of the Task, it will remain valid because it is counted by the reference counter. So everything is okay.

[tmiasko]

The schedule function is part of a task, so the code that invokes it should
guarantee that it will remain valid for the duration of the invocation.

The memory behind task can be deallocated at any point after task ownership is
transferred, since neither wake function nor schedule function retains any
shared ownership over task / waker.

The code above triggers use-after-free. Sending the task through a channel and
then completing it / dropping it has an equivalent issue together with a data
race (between dropping and deallocating the memory in one thread, and continued
use of schedule function in another).

Ohhhh I see what you mean now, you're absolutely right! Good job catching this very subtle issue!! :)

We should increment the reference count before calling the schedule function and then decrement it (unless the schedule function is zero-sized). I submitted a PR fixing the problem.