This is an automated email from the ASF dual-hosted git repository.
chenBright pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brpc.git
The following commit(s) were added to refs/heads/master by this push:
new 3d1da246 Fix use-after-destruction when erasing MultiFlatMap bucket
head (#3617)
3d1da246 is described below
commit 3d1da246c1734b42d9a4e6fe88f15555c1ef9894
Author: Dongsheng He <[email protected]>
AuthorDate: Sat Oct 17 22:53:17 2026 +0800
Fix use-after-destruction when erasing MultiFlatMap bucket head (#3617)
* Fix MultiFlatMap erase on bucket head
* destroy element before set_invalid
---
src/butil/containers/flat_map_inl.h | 5 +++--
test/flat_map_unittest.cpp | 13 ++++++++++++-
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/src/butil/containers/flat_map_inl.h
b/src/butil/containers/flat_map_inl.h
index d14d0db5..0319fd78 100644
--- a/src/butil/containers/flat_map_inl.h
+++ b/src/butil/containers/flat_map_inl.h
@@ -470,8 +470,8 @@ FlatMap<_K, _T, _H, _E, _S, _A, _M>::erase(
}
Bucket* temp = p;
p = p->next;
- temp->destroy_element();
if (temp != &first_node) {
+ temp->destroy_element();
_pool.back(temp);
}
--_size;
@@ -490,7 +490,8 @@ FlatMap<_K, _T, _H, _E, _S, _A, _M>::erase(
new_tail->next = nullptr;
}
if (nullptr == new_head) {
- // Erase all element.
+ // Erase all elements.
+ first_node.destroy_element();
first_node.set_invalid();
if (_S) {
bit_array_unset(_thumbnail, index);
diff --git a/test/flat_map_unittest.cpp b/test/flat_map_unittest.cpp
index 811713b3..45702149 100644
--- a/test/flat_map_unittest.cpp
+++ b/test/flat_map_unittest.cpp
@@ -1624,6 +1624,17 @@ TEST_F(FlatMapTest, multi) {
Bar& g2 = map2[1];
ASSERT_EQ(&g, &g2);
ASSERT_EQ(0, g2.x);
-}
+ // Erase the first node in a bucket and move the next node to the bucket
head.
+ butil::MultiFlatMap<int, std::vector<char>> map3;
+ ASSERT_EQ(0, map3.init(bucket_count));
+
+ ASSERT_NE(nullptr, map3.insert(1, std::vector<char>(64, 'a')));
+ ASSERT_NE(nullptr, map3.insert(same_bucket_key, std::vector<char>(64,
'b')));
+ ASSERT_EQ(1u, map3.erase(1));
+
+ const std::vector<char> *value = map3.seek(same_bucket_key);
+ ASSERT_NE(nullptr, value);
+ ASSERT_EQ(std::vector<char>(64, 'b'), *value);
+}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
