[libc++] Fix proxy iterator issues that trigger an assertion in Chromium.
authorHui Xie <hui.xie1990@gmail.com>
Thu, 21 Jul 2022 00:03:29 +0000 (17:03 -0700)
committerKonstantin Varlamov <varconst@apple.com>
Thu, 21 Jul 2022 01:05:49 +0000 (18:05 -0700)
commit7abbd6224b0b6089e4483a9c939be5d9a16b682b
treed405fa233aa0cd7af8d064055dab9557b5034124
parentf6b5f24c1951fd845ec0c42a73447e8ada2dcb5e
[libc++] Fix proxy iterator issues that trigger an assertion in Chromium.

Crash report:
https://bugs.chromium.org/p/chromium/issues/detail?id=1346012

The triggered assertion is related sorting with `v8::internal::AtomicSlot`.
`AtomicSlot` is a proxy iterator with a proxy type `AtomicSlot::Reference`
(see https://chromium.googlesource.com/v8/v8/+/9bcb5eb590643db0c1f688fea316c7f1f4786a3c/src/objects/slots-atomic-inl.h).

https://reviews.llvm.org/D130197 correctly spotted the issue in
`__iter_move` but doesn't actually fix the issue. The reason is that
`AtomicSlot::operator*` returns a prvalue `Reference`. After the fix in
D130197, the return type of `__iter_move` is `Reference&&`. But the
rvalue reference is bound to the temporary value returned by
`operator*`, which will be dangling after `__iter_move` returns.

The idea of the fix in this change is borrowed from C++17's move_iterator
https://timsong-cpp.github.io/cppwp/n4659/move.iterators#move.iterator-1
When the underlying reference is a prvalue, we just return it by value.

Differential Revision: https://reviews.llvm.org/D130212
libcxx/include/__algorithm/iterator_operations.h
libcxx/test/std/algorithms/alg.sorting/alg.sort/sort/sort_proxy.pass.cpp