Skip to content

Conversation

thestinger
Copy link
Contributor

The code generation previously assumed a reference could not alter the
value in a way the destructor would notice. This is an incorrect
assumption for &mut, and is also incorrect for an & pointer to a
non-Freeze type.

Closes #7972

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this want the #[unsafe_no_drop_flag] back?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

whoops :)

@thestinger
Copy link
Contributor Author

cc @nikomatsakis

I can't see a way around doing this, but it seems like it was intended for this to be unnecessary.

@thestinger
Copy link
Contributor Author

cc @metajack - this probably fixes the servo bug

@nikomatsakis
Copy link
Contributor

This makes me a bit nervous. I don't understand what you mean by "a reference cannot alter the value in a way the destructor will observe". The change to ensure zeroable memory was there for a reason, though -- I have to refresh my memory of the precise details.

@nikomatsakis
Copy link
Contributor

(Also, as an aside, I have a complete overhaul of the cleanup code bitrotting away on my branch for #3511 -- not that this should stop you from landing this patch)

@nikomatsakis
Copy link
Contributor

OK, I think I see what's going on now. The fix seems not unreasonable. r+ from me pending a better comment.

@thestinger
Copy link
Contributor Author

This didn't end up fixing the actual issue with UnsafeArc, but it does fix jack's servo issue and the minimized test cases I made.

The code generation previously assumed a reference could not alter the
value in a way the destructor would notice. This is an incorrect
assumption for `&mut`, and is also incorrect for an `&` pointer to a
non-`Freeze` type.

Closes #7972
bors added a commit that referenced this pull request Oct 17, 2013
The code generation previously assumed a reference could not alter the
value in a way the destructor would notice. This is an incorrect
assumption for `&mut`, and is also incorrect for an `&` pointer to a
non-`Freeze` type.

Closes #7972
@bors bors closed this Oct 17, 2013
@bors bors merged commit 34ae5d7 into rust-lang:master Oct 17, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Double free with &mut pointers to temporaries

4 participants