[Webkit-unassigned] [Bug 165568] New: Variant can crash when constructed with default constructor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=165568

            Bug ID: 165568
           Summary: Variant can crash when constructed with default
                    constructor
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Web Template Framework
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: krollin at apple.com
                CC: krollin at apple.com, sam at webkit.org

Given the following struct:

struct MyStruct {
    MyStruct(Vector<String> val) : m_vector(val) {}
    Vector<String> m_vector;                                                                                                                                                                            
};  

The following will crash in the WTF::Variant destructor:

{
    WTF::Variant<MyStruct> temp;
}

Here's the backtrace:

0     WTF::RefPtr<WTF::StringImpl>::~RefPtr() + 67 (utility:754)
1     WTF::RefPtr<WTF::StringImpl>::~RefPtr() + 21 (RefPtr.h:62)
2     WTF::String::~String() + 21 (WTFString.h:137)
3     WTF::String::~String() + 21 (WTFString.h:137)
4     WTF::VectorDestructor<true, WTF::String>::destruct(WTF::String*, WTF::String*) + 47 (Vector.h:59)
5     WTF::VectorTypeOperations<WTF::String>::destruct(WTF::String*, WTF::String*) + 29 (Vector.h:225)
6     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::shrink(unsigned long) + 132 (Vector.h:1026)
7     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() + 43 (Vector.h:631)
8     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() + 21 (Vector.h:634)
9     WebKit::NetworkCapture::MyStruct::~MyStruct() + 21 (NetworkCaptureManager.cpp:64)
10    WebKit::NetworkCapture::MyStruct::~MyStruct() + 21 (NetworkCaptureManager.cpp:64)
11    WTF::__storage_wrapper<WebKit::NetworkCapture::MyStruct>::__destroy() + 29 (Variant.h:444)
12    WTF::__variant_storage<WebKit::NetworkCapture::MyStruct, false>::__destroy(WTF::__storage_wrapper<WebKit::NetworkCapture::MyStruct>&) + 21 (Variant.h:481)
13    WTF::__variant_data<WebKit::NetworkCapture::MyStruct>::__destroy(WTF::in_place_tag (&)(WTF::__in_place_private::__value_holder<0ul>&)) + 28 (Variant.h:552)
14    void WTF::__destroy_op_table<WTF::Variant<WebKit::NetworkCapture::MyStruct>, WTF::__index_sequence<0l> >::__destroy_func<0l>(WTF::Variant<WebKit::NetworkCapture::MyStruct>*) + 45 (Variant.h:827)
15    WTF::Variant<WebKit::NetworkCapture::MyStruct>::__destroy_self() + 77 (Variant.h:1471)
16    WTF::__variant_base<WTF::Variant<WebKit::NetworkCapture::MyStruct>, false>::~__variant_base() + 21 (Variant.h:923)
17    WTF::Variant<WebKit::NetworkCapture::MyStruct>::~Variant() + 21 (Variant.h:1439)
18    WTF::Variant<WebKit::NetworkCapture::MyStruct>::~Variant() + 21 (Variant.h:1439)

The Variant default constructor is suppose to create an instance of its first type, so the fact that we're destructing one seems proper. Since the destruction is failing, I guess that the object wasn't properly created in the first place. I also note that MyStruct does not have a default constructor, so I don't know how Variant is creating one in the first place. And I don't know why a WTF::String is being destructed since the Vector should be empty.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161208/45216549/attachment.html>