[libcxx-commits] [libcxx] [libc++] Fix UB in <expected> related to "has value" flag (#68552) (PR #68733)

[Jan Kokemüller via libcxx-commits]

================
@@ -440,9 +399,10 @@ class expected {
       std::destroy_at(std::addressof(__union_.__val_));
     } else {
       std::destroy_at(std::addressof(__union_.__unex_));
-      __has_val_ = true;
     }
-    return *std::construct_at(std::addressof(__union_.__val_), std::forward<_Args>(__args)...);
+    std::construct_at(std::addressof(__union_.__val_), std::forward<_Args>(__args)...);
----------------
jiixyj wrote:

> I think this case is still broken, as this `construct_at` can write into the tail padding of the `expected` object, which might be nested within another object. We might need a compiler extension to make this work. :-(

Yes, this case is still broken. @philnik777 suggested to pad out the `std::expected` so this can no longer happen. I just created a (draft) PR for this ABI breaking change here: <https://github.com/llvm/llvm-project/pull/69673>

https://github.com/llvm/llvm-project/pull/68733