Uploaded image for project: 'C++ Standard Library'
  1. C++ Standard Library
  2. STDCXX-131

SIGSEGV in std::stable_partition() due to double destruction

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 4.1.2, 4.1.3
    • 4.2.0
    • 25. Algorithms
    • None
    • all

    Description

      From http://mail-archives.apache.org/mod_mbox/incubator-stdcxx-dev/200601.mbox/%3c43DA43F0.9020601@moscow.vdiweb.com%3e:

      -------- Original Message --------
      Subject: Re: Re: test for lib.alg.partitions
      Date: Fri, 27 Jan 2006 19:01:52 +0300
      From: Anton Pevtsov <antonp@moscow.vdiweb.com>
      Reply-To: stdcxx-dev@incubator.apache.org
      To: stdcxx-dev@incubator.apache.org

      ...

      Martin Sebor wrote:
      > It's certainly possible that there is a bug in the algorithm, but I
      > would be more inclined to suspect the test before the algorithm just
      > because you just made making non-trivial changes to it.
      [...]
      > A simple test case would be helpful.

      The old test version didn't exercise all possible cases. I updated the
      test according to your notes and got the same results. So I still
      suspect the bug in the algorithm.
      The attached file stable_partition_test.cpp illustrates the problem:
      the algorithm fails when the predicate returns true for any element.

      I debug the algorithm and found the following code in algorithm.cc, line
      760:

      ...
      _Dist __fill = 0;

      const _BidirIter __res =
      _stable_partition_adaptive (_first, __last, __pred, __dist,
      __pair.first, __pair.second,
      __fill, (_TypeT*)0);

      for (TypeT *ptr = __pair.first + __fill; !(_pair.first ==
      --__ptr); )
      (*__ptr).~_TypeT ();
      ...

      If the __fill remains equal to 0 after the __stable_partition_adaptive
      call the "for" will never end and will try to call destructors of
      non-existing elements moving from the left bound of the given sequence
      to left. Also if __fill is equal to 1 no destructors will be called, but
      one should be, shouldn't it?
      May be, something like this

      ...
      for (TypeT *ptr = __pair.first + __fill; !(_pair.first ==
      __ptr--); )
      (*__ptr).~_TypeT ();
      ...
      will fix the issue?

      And I have another question: what will happen with the temporary buffer
      in stable_partition if the X copy ctor throws an exception? It looks
      like the buffer will leak.

      With best wishes,
      Anton Pevtsov

      Attachments

        Activity

          People

            sebor Martin Sebor
            sebor Martin Sebor
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment