[llvm-bugs] [Bug 33388] New: Format Variadic: formatv_object_base : buggy move & copy constructors

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=33388

            Bug ID: 33388
           Summary: Format Variadic: formatv_object_base : buggy move &
                    copy constructors
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Support Libraries
          Assignee: unassignedbugs at nondot.org
          Reporter: benoit.belley at autodesk.com
                CC: llvm-bugs at lists.llvm.org

formatv_object_base currently uses the implicitly defined move and copy
constructors. It turns out these are buggy. In typical use-cases, the problem
doesn't show-up because every single call to the move and copy constructors are
elided. Thus, the buggy constructors are never invoked. 

The issue especially shows-up when code is compiled using the
-fno-elide-constructors compiler flag. For instance, this is useful when
attempting to collect accurate code coverage statistics.

The exact issue is the following:

The Parameters data member is correctly moved or copied, thus making the
parameters occupy new memory locations in the target object. Unfortunately, the
default copying of the Adapters blindly copies the vector of pointers, leaving
each of these pointers referencing the parameters in the original object
instead of the copied one. These pointers quickly become dangling when the
original object is deleted. This quickly leads to crashes.

The solution is to update the Adapters pointers when performing a copy or move.
For example as in:

  formatv_object_base(formatv_object_base const &rhs)
      : Fmt(rhs.Fmt), Adapters(), // Adapters are initialized by formatv_object
        Replacements(rhs.Replacements) {
    Adapters.reserve(rhs.Adapters.size());
  };

  formatv_object_base(formatv_object_base &&rhs)
      : Fmt(std::move(rhs.Fmt)),
        Adapters(), // Adapters are initialized by formatv_object
        Replacements(std::move(rhs.Replacements)) {
    Adapters.reserve(rhs.Adapters.size());
  };

I am currently working on a patch for this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170609/c29427de/attachment-0001.html>