[libcxx-commits] [PATCH] D99624: [libc++] Remove UB in std::list

[Louis Dionne via Phabricator via libcxx-commits]

ldionne created this revision.
ldionne requested review of this revision.
Herald added a project: libc++.
Herald added a subscriber: libcxx-commits.
Herald added a reviewer: libc++.

We create list nodes by allocating them, but we never actually call the
constructor of the list node itself - we only construct its subobjects
one at a time. This patch fixes that by making sure that we construct
the list node itself. This is a different attempt to fix the underlying
issue behind D98750 <https://reviews.llvm.org/D98750>.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D99624

Files:
  libcxx/include/list


Index: libcxx/include/list
===================================================================
--- libcxx/include/list
+++ libcxx/include/list
@@ -270,11 +270,14 @@
 struct __list_node
     : public __list_node_base<_Tp, _VoidPtr>
 {
-    _Tp __value_;
+    union { _Tp __value_; };
 
     typedef __list_node_base<_Tp, _VoidPtr> __base;
     typedef typename __base::__link_pointer __link_pointer;
 
+    _LIBCPP_INLINE_VISIBILITY
+    __list_node() { }
+
     _LIBCPP_INLINE_VISIBILITY
     __link_pointer __as_link() {
         return static_cast<__link_pointer>(__base::__self());
@@ -1113,6 +1116,7 @@
     _LIBCPP_INLINE_VISIBILITY
     __hold_pointer __allocate_node(__node_allocator& __na) {
       __node_pointer __p = __node_alloc_traits::allocate(__na, 1);
+      ::new ((void*)_VSTD::addressof(*__p)) __node();
       __p->__prev_ = nullptr;
       return __hold_pointer(__p, __node_destructor(__na, 1));
     }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D99624.334287.patch
Type: text/x-patch
Size: 924 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/libcxx-commits/attachments/20210330/a57c1b44/attachment.bin>