From e12d3869e3c5f7ee3e49fbccb668edabd9cdb643 Mon Sep 17 00:00:00 2001 From: Alexis Beingessner Date: Thu, 4 Jun 2015 17:18:27 -0700 Subject: [PATCH] properly null out ptr in LinkedList::split_off - fixes #26020 --- src/libcollections/linked_list.rs | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/libcollections/linked_list.rs b/src/libcollections/linked_list.rs index 7c045c4537621..0bfbfd7337713 100644 --- a/src/libcollections/linked_list.rs +++ b/src/libcollections/linked_list.rs @@ -609,7 +609,13 @@ impl LinkedList { length: len - at }; + // Swap split_node.next with list_head (which is None), nulling out split_node.next, + // as it is the new tail. mem::swap(&mut split_node.resolve().unwrap().next, &mut splitted_list.list_head); + // Null out list_head.prev. Note this `unwrap` won't fail because if at == len + // we already branched out at the top of the fn to return the empty list. + splitted_list.list_head.as_mut().unwrap().prev = Rawlink::none(); + // Fix the tail ptr self.list_tail = split_node; self.length = at; @@ -1075,6 +1081,26 @@ mod tests { } } + #[test] + fn test_26021() { + use std::iter::ExactSizeIterator; + // There was a bug in split_off that failed to null out the RHS's head's prev ptr. + // This caused the RHS's dtor to walk up into the LHS at drop and delete all of + // its nodes. + // + // https://github.com/rust-lang/rust/issues/26021 + let mut v1 = LinkedList::new(); + v1.push_front(1u8); + v1.push_front(1u8); + v1.push_front(1u8); + v1.push_front(1u8); + let _ = v1.split_off(3); // Dropping this now should not cause laundry consumption + assert_eq!(v1.len(), 3); + + assert_eq!(v1.iter().len(), 3); + assert_eq!(v1.iter().collect::>().len(), 3); + } + #[cfg(test)] fn fuzz_test(sz: i32) { let mut m: LinkedList<_> = LinkedList::new();