Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VecDeque::append() forgets ZSTs on capacity overflow #108454

Closed
LegionMammal978 opened this issue Feb 25, 2023 · 1 comment · Fixed by #108462
Closed

VecDeque::append() forgets ZSTs on capacity overflow #108454

LegionMammal978 opened this issue Feb 25, 2023 · 1 comment · Fixed by #108462
Assignees
Labels
C-bug Category: This is a bug.

Comments

@LegionMammal978
Copy link
Contributor

LegionMammal978 commented Feb 25, 2023

I tried this code:

// compile with opt-level=2 or higher
use std::collections::VecDeque;

#[derive(Clone)]
struct Droppy;

impl Drop for Droppy {
    fn drop(&mut self) {
        println!("dropped!");
    }
}

fn main() {
    let mut buf1 = VecDeque::from(vec![Droppy; usize::MAX]);
    let mut buf2 = VecDeque::from(vec![Droppy]);

    let total = buf1.len() as u128 + buf2.len() as u128;
    println!("{} + {} = {}", buf1.len(), buf2.len(), total);

    buf1.append(&mut buf2);

    let total = buf1.len() as u128 + buf2.len() as u128;
    println!("{} + {} = {}", buf1.len(), buf2.len(), total);
}

I expected to see this happen: A capacity overflow panic, followed by 264 lines of dropped!.

Instead, this happened:

18446744073709551615 + 1 = 18446744073709551616
0 + 0 = 0

This is caused by VecDeque::append() using a wrapping addition for the length when T::IS_ZST:

pub fn append(&mut self, other: &mut Self) {
    if T::IS_ZST {
        self.len += other.len;
        other.len = 0;
        other.head = 0;
        return;
    }

    /* ... */
}

Meta

rustc --version --verbose:

rustc 1.69.0-nightly (c5c7d2b37 2023-02-24)
binary: rustc
commit-hash: c5c7d2b37780dac1092e75f12ab97dd56c30861d
commit-date: 2023-02-24
host: x86_64-unknown-linux-gnu
release: 1.69.0-nightly
LLVM version: 15.0.7
@LegionMammal978 LegionMammal978 added the C-bug Category: This is a bug. label Feb 25, 2023
@pommicket
Copy link
Contributor

@rustbot claim

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C-bug Category: This is a bug.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants