slide-rs/atom

Unsound: `AtomSetOnce::dup` is not panic safe

yvt opened this issue · 0 comments

yvt commented
#[test]
fn dup_panic_safety() {
    struct WeirdTy(String);

    impl Clone for WeirdTy {
        fn clone(&self) -> Self {
            panic!("")
        }
    }

    let x = AtomSetOnce::new(Box::new(WeirdTy("hoge".to_owned())));
    std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
        x.dup(Ordering::Acquire); // `v.clone()` panics, skipping `mem::forget(v)` and dropping `Box<WeirdTy>`
    }));
    // The `Box<WeirdTy>` is dropped again, causing a double-free
}