diff options
author | Jonathan Wakely <jwakely@redhat.com> | 2022-01-21 12:08:20 +0000 |
---|---|---|
committer | Jonathan Wakely <jwakely@redhat.com> | 2022-01-23 22:47:00 +0000 |
commit | 2d8a9ad4a922e3248d0f6c60a6331be6f47dc435 (patch) | |
tree | 2e04720702ab3bf795dbd06dbb25b334f260bc1f /libstdc++-v3 | |
parent | 2da90ad39bf8fa9ee287e040d1f4411cb7a2e7ed (diff) | |
download | gcc-2d8a9ad4a922e3248d0f6c60a6331be6f47dc435.zip gcc-2d8a9ad4a922e3248d0f6c60a6331be6f47dc435.tar.gz gcc-2d8a9ad4a922e3248d0f6c60a6331be6f47dc435.tar.bz2 |
libstdc++: Fix aliasing violation in std::shared_ptr [PR104019]
The non-atomic store that sets both reference counts to zero uses a
type-punned pointer, which has undefined behaviour. We could use memset
to write 8 bytes, but we don't actually need it to be a single store
anyway. No other thread can observe the values, that's why it's safe to
use non-atomic stores in the first place. So we can just set each count
to zero.
With -fstore-merging (which is enabled by default at -O2) GCC produces
the same code for this as for memset or the type punned store. Clang
does that store merging even at -O1.
libstdc++-v3/ChangeLog:
PR libstdc++/104019
* include/bits/shared_ptr_base.h (_Sp_counted_base<>::_M_release):
Set members to zero without type punning.
Diffstat (limited to 'libstdc++-v3')
-rw-r--r-- | libstdc++-v3/include/bits/shared_ptr_base.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libstdc++-v3/include/bits/shared_ptr_base.h b/libstdc++-v3/include/bits/shared_ptr_base.h index 5b8f84b..b2f955b 100644 --- a/libstdc++-v3/include/bits/shared_ptr_base.h +++ b/libstdc++-v3/include/bits/shared_ptr_base.h @@ -340,7 +340,7 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION // we are releasing the last strong reference. No other // threads can observe the effects of this _M_release() // call (e.g. calling use_count()) without a data race. - *(long long*)(&_M_use_count) = 0; + _M_weak_count = _M_use_count = 0; _GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_use_count); _GLIBCXX_SYNCHRONIZATION_HAPPENS_AFTER(&_M_weak_count); _M_dispose(); |