[Boost-bugs] [Boost C++ Libraries] #10389: [container] Double free problem on boost::containers::vector<std::unique_ptr<T>>

Subject: [Boost-bugs] [Boost C++ Libraries] #10389: [container] Double free problem on boost::containers::vector<std::unique_ptr<T>>
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2014-08-22 10:00:45

#10389: [container] Double free problem on
boost::containers::vector<std::unique_ptr<T>>
------------------------------------+------------------------
 Reporter:  kbinani <kbinani.bt@…>  |      Owner:  igaztanaga
     Type:  Bugs                    |     Status:  new
Milestone:  To Be Determined        |  Component:  container
  Version:  Boost 1.56.0            |   Severity:  Problem
 Keywords:                          |
------------------------------------+------------------------
 Using boost::container::vector with std::unique_ptr causes double-free
 problem.

 === Compiler ===
 clang++ on Mac OSX 10.9.4

 {{{#!text
 $ clang++ --version
 $ Apple LLVM version 5.0 (clang-500.2.79) (based on LLVM 3.3svn)
 $ Target: x86_64-apple-darwin13.3.0
 $ Thread model: posix
 }}}

 === Boost version ===
 1.54, 1.55, 1.56, HEAD(d811937 on https://github.com/boostorg/boost.git)

 === How to reproduce ===

 Compile the sample code below and run.

 {{{#!cpp
 //file: container_vector_double_free.cpp
 //clang++ container_vector_double_free.cpp -std=c++11
 -I/Users/kbinani/Documents/github/boostorg/boost
 #include <boost/container/vector.hpp>
 #include <memory>

 int main()
 {
         typedef std::unique_ptr<int> object_ptr_t;
         typedef boost::container::vector<object_ptr_t> container_t;

         container_t c;

         // if the number of object to 'push_back' is less than 3, double-
 free problem does not occur.
         int const kNum = 10;

         // when 'reserve' called before 'push_back', double-free problem
 does not occur.
         //c.reserve(kNum);

         for (int i = 0; i < kNum; ++i) {
                 object_ptr_t item(new int(0));
                 c.push_back(boost::move(item));
         }

         return 0;
 }
 }}}

 Result:

 {{{#!text
 a.out(31615,0x7fff79acb310) malloc: *** error for object 0x7ff170403980:
 pointer being freed was not allocated
 *** set a breakpoint in malloc_error_break to debug
 Abort trap: 6
 }}}

 Stack trace:

 {{{#!text
 #3      0x00007fff8da6707f in free ()
 #4      0x0000000100002560 in
 std::__1::default_delete<int>::operator()(int*) const [inlined] at
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/c++/v1/memory:2488
 #5      0x0000000100002539 in std::__1::unique_ptr<int,
 std::__1::default_delete<int> >::reset(int*) [inlined] at
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/c++/v1/memory:2687
 #6      0x00000001000024e3 in std::__1::unique_ptr<int,
 std::__1::default_delete<int> >::~unique_ptr() [inlined] at
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/c++/v1/memory:2655
 #7      0x00000001000024e3 in std::__1::unique_ptr<int,
 std::__1::default_delete<int> >::~unique_ptr() [inlined] at
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/c++/v1/memory:2655
 #8      0x00000001000024e3 in
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >::destroy(std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*) [inlined] at
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/c++/v1/memory:1739
 #9      0x00000001000024af in void
 boost::container::allocator_traits<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >
 >::priv_destroy<std::__1::unique_ptr<int, std::__1::default_delete<int> >
 >(boost::integral_constant<bool, true>,
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >&, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/allocator_traits.hpp:300
 #10     0x0000000100002471 in void
 boost::container::allocator_traits<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > > >::destroy<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >
 >(std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >&, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/allocator_traits.hpp:242
 #11     0x0000000100002259 in void
 boost::container::destroy_alloc_n<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >, std::__1::unique_ptr<int,
 std::__1::default_delete<int>
 >*>(std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >&, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*,
 std::__1::iterator_traits<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*>::difference_type,
 boost::container::container_detail::enable_if_c<!(boost::has_trivial_destructor<std::__1::iterator_traits<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*>::value_type>::value), void>::type*) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/detail/utilities.hpp:1073
 #12     0x0000000100001f2d in void
 boost::container::vector<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >,
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >
 >::priv_forward_range_insert_new_allocation<boost::container::container_detail::insert_move_proxy<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*> >(std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*, unsigned long, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*, unsigned long,
 boost::container::container_detail::insert_move_proxy<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*>) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/vector.hpp:2417
 #13     0x0000000100001aee in
 boost::container::container_detail::vec_iterator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*, false>
 boost::container::vector<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >,
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >
 >::priv_forward_range_insert_no_capacity<boost::container::container_detail::insert_move_proxy<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*> >(std::__1::unique_ptr<int,
 std::__1::default_delete<int> >* const&, unsigned long,
 boost::container::container_detail::insert_move_proxy<std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >, std::__1::unique_ptr<int,
 std::__1::default_delete<int> >*>,
 boost::container::container_detail::integral_constant<unsigned int, 1u>)
 at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/vector.hpp:2045
 #14     0x000000010000193c in void
 boost::container::vector<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >,
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > >
 >::priv_push_back<std::__1::unique_ptr<int, std::__1::default_delete<int>
 > >(std::__1::unique_ptr<int, std::__1::default_delete<int> >&&) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/vector.hpp:1944
 #15     0x0000000100001810 in
 boost::container::vector<std::__1::unique_ptr<int,
 std::__1::default_delete<int> >,
 std::__1::allocator<std::__1::unique_ptr<int,
 std::__1::default_delete<int> > > >::push_back(std::__1::unique_ptr<int,
 std::__1::default_delete<int> >&&) at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/../../../boost/container/vector.hpp:1467
 #16     0x0000000100001581 in main at
 /Users/kbinani/Documents/github/boostorg/boost/libs/container/boost_container_vector_test/boost_container_vector_test/main.cpp:14
 }}}

-- 
Ticket URL: <https://svn.boost.org/trac/boost/ticket/10389>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.