a6f21bc32e
> In file included from workdir/UnpackedTarball/mdds/include/mdds/flat_segment_tree.hpp:37, > from sc/inc/columnspanset.hxx:16, > from sc/source/core/data/columnspanset.cxx:10: > In function ‘void mdds::__st::intrusive_ptr_add_ref(node<T>*) [with T = mdds::flat_segment_tree<int, bool>]’, > inlined from ‘boost::intrusive_ptr<T>::intrusive_ptr(const boost::intrusive_ptr<T>&) [with T = mdds::__st::node<mdds::flat_segment_tree<int, bool> >]’ at workdir/UnpackedTarball/boost/boost/smart_ptr/intrusive_ptr.hpp:93:44, > inlined from ‘boost::intrusive_ptr<T>& boost::intrusive_ptr<T>::operator=(const boost::intrusive_ptr<T>&) [with T = mdds::__st::node<mdds::flat_segment_tree<int, bool> >]’ at workdir/UnpackedTarball/boost/boost/smart_ptr/intrusive_ptr.hpp:154:9, > inlined from ‘mdds::flat_segment_tree<_Key, _Value>::flat_segment_tree(const mdds::flat_segment_tree<_Key, _Value>&) [with _Key = int; _Value = bool]’ at workdir/UnpackedTarball/mdds/include/mdds/flat_segment_tree_def.inl:88:25: > workdir/UnpackedTarball/mdds/include/mdds/node.hpp:244:10: error: pointer used after ‘void operator delete(void*, std::size_t)’ [-Werror=use-after-free] > 244 | ++p->refcount; > | ~~~^~~~~~~~ > In function ‘void mdds::__st::intrusive_ptr_release(node<T>*) [with T = mdds::flat_segment_tree<int, bool>]’, > inlined from ‘void mdds::__st::intrusive_ptr_release(node<T>*) [with T = mdds::flat_segment_tree<int, bool>]’ at workdir/UnpackedTarball/mdds/include/mdds/node.hpp:248:13, > inlined from ‘boost::intrusive_ptr<T>::~intrusive_ptr() [with T = mdds::__st::node<mdds::flat_segment_tree<int, bool> >]’ at workdir/UnpackedTarball/boost/boost/smart_ptr/intrusive_ptr.hpp:98:44, > inlined from ‘boost::intrusive_ptr<T>& boost::intrusive_ptr<T>::operator=(const boost::intrusive_ptr<T>&) [with T = mdds::__st::node<mdds::flat_segment_tree<int, bool> >]’ at workdir/UnpackedTarball/boost/boost/smart_ptr/intrusive_ptr.hpp:154:9, > inlined from ‘mdds::flat_segment_tree<_Key, _Value>::flat_segment_tree(const mdds::flat_segment_tree<_Key, _Value>&) [with _Key = int; _Value = bool]’ at workdir/UnpackedTarball/mdds/include/mdds/flat_segment_tree_def.inl:87:19: > workdir/UnpackedTarball/mdds/include/mdds/node.hpp:252:9: note: call to ‘void operator delete(void*, std::size_t)’ here > 252 | delete p; > | ^~~~~~~~ etc. The warning is apparently new in GCC 12 trunk (see <https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=671a283636de75f7ed638ee6b01ed2d44361b8b6> "Add -Wuse-after-free [PR80532]"), and I'm not entirely sure whether this is a true or false positive, but the fix looks somewhat plausible, and at least also my (Clang) ASan+UBSan build does a successful `make check` with (and without) this change. Change-Id: I63fafceba8d1b4e0ddd7cf2e58403a3bc763e53c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129008 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
12 lines
440 B
Diff
12 lines
440 B
Diff
--- include/mdds/flat_segment_tree_def.inl
|
|
+++ include/mdds/flat_segment_tree_def.inl
|
|
@@ -84,8 +84,8 @@
|
|
// Move on to the next destination node, and have the next node point
|
|
// back to the previous node.
|
|
node_ptr old_node = dest_node;
|
|
+ dest_node->next->prev = old_node;
|
|
dest_node = dest_node->next;
|
|
- dest_node->prev = old_node;
|
|
|
|
if (src_node == r.m_right_leaf.get())
|
|
{
|