[libc++] Fix proxy iterator issues that trigger an assertion in Chromium.
Crash report: https://bugs.chromium.org/p/chromium/issues/detail?id=1346012 The triggered assertion is related sorting with `v8::internal::AtomicSlot`. `AtomicSlot` is a proxy iterator with a proxy type `AtomicSlot::Reference` (see https://chromium.googlesource.com/v8/v8/+/9bcb5eb590643db0c1f688fea316c7f1f4786a3c/src/objects/slots-atomic-inl.h). https://reviews.llvm.org/D130197 correctly spotted the issue in `__iter_move` but doesn't actually fix the issue. The reason is that `AtomicSlot::operator*` returns a prvalue `Reference`. After the fix in D130197, the return type of `__iter_move` is `Reference&&`. But the rvalue reference is bound to the temporary value returned by `operator*`, which will be dangling after `__iter_move` returns. The idea of the fix in this change is borrowed from C++17's move_iterator https://timsong-cpp.github.io/cppwp/n4659/move.iterators#move.iterator-1 When the underlying reference is a prvalue, we just return it by value. Differential Revision: https://reviews.llvm.org/D130212
Loading
Please sign in to comment