Fix iterator comparison bug in expr_iterator #1610
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
reuk
requested review from
kroening,
peterschrammel,
smowton and
tautschnig
as code owners
smowton
approved these changes
Nov 22, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After calling
mutate()on anexpr_iterator, a new state struct is created, containing iterators over the operands of a new expr created by copy-on-write behaviour. When this struct is compared for equality with the current struct at the back of the stack, iterators from two different collections are compared, which is undefined behaviour.This patch changes the equality comparison to check the size of the iterator range in each state struct, rather than comparing iterators directly. This way, there's no danger of comparing iterators from different collections.
This bug was found by enabling
-D_GLIBCXX_DEBUG. I suggest that this debug mode is added to Travis.