Skip to content

Unsound: AtomSetOnce::dup is not panic safe #18

@yvt

Description

@yvt
#[test]
fn dup_panic_safety() {
    struct WeirdTy(String);

    impl Clone for WeirdTy {
        fn clone(&self) -> Self {
            panic!("")
        }
    }

    let x = AtomSetOnce::new(Box::new(WeirdTy("hoge".to_owned())));
    std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
        x.dup(Ordering::Acquire); // `v.clone()` panics, skipping `mem::forget(v)` and dropping `Box<WeirdTy>`
    }));
    // The `Box<WeirdTy>` is dropped again, causing a double-free
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions