search

fitzgen / bumpalo

A fast bump allocation arena for Rust
https://docs.rs/bumpalo
Apache License 2.0
1.35k stars 110 forks source link

Can `bumpalo::boxed::Box` and `bumpalo::collection::Vec` contains data on the same Bump? #177

Closed zxch3n closed 1 year ago

zxch3n commented 1 year ago

Would a recursive type looks like this cause undefined behavior when dropping?

BumpBox<'a, BumpVec<'a, BumpBox<'a, ...>>>

I encounter BAD ACCESS when using a struct that has this structure. When dropping, it will try to access a freed footer pointer of the RawVec, which causes BAD ACCESS.

https://github.com/fitzgen/bumpalo/blob/f551c3765f3b366c8cbf7dd2466d0917114b906b/src/collections/raw_vec.rs#L659

It works fine after switching to &'a mut BumpVec.

If this struct should not be allowed, I think it's better to mention it in the doc.

konsumlamm commented 1 year ago

I encounter BAD ACCESS when using a struct that has this structure. When dropping, it will try to access a freed footer pointer of the RawVec, which causes BAD ACCESS.

Do you have a reproducible example?

If this struct should not be allowed, I think it's better to mention it in the doc.

A program that doesn't use unsafe shouldn't be able to cause UB, no matter what the docs say. A bug should be fixed and not be documented.

zxch3n commented 1 year ago

Sorry, it turns out is a bug on my side.