Reproduce split race/crash

[ccotter]

https://gist.github.com/ccotter/c0504455c7d54240758a34dc99d620f0 is the ASAN report.

From

stdexec/include/stdexec/__detail/__shared.hpp

Line 247 in 54b38c9

auto __old = __self->__dec_ref();

the shared state becomes a dangling pointer if if

stdexec/include/stdexec/__detail/__shared.hpp

Line 346 in 54b38c9

this->__dec_ref(); // release the extra ref count, deletes this

frees the memory from another thread.

I'm not quite sure how to fix this, but this PR manages to reproduce this bug reliably with ASAN in the "split forwards results from a different thread"" test.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ccotter]

I naively tried to make a copy of the intrusive_ptr inside __detach to keep the ref count positive long enough to ensure the object is kept alive, but I wasn't able to get that to work.

[ericniebler]

A million thanks for this, Chris. I'll investigate as soon as I can, but probably not before next week. Big presentation coming up.