• Xiao Shi's avatar
    fix erase use-after-free in F14Vector containers · d22d402e
    Xiao Shi authored
    Summary:
    Upon `erase`, F14 vector containers destroys the value and erases the item
    (i.e., index into the `values_` vector) from the underlying hashtable. However,
    the item still needs to be hashable when erasing from the hashtable, so we have
    to destroy the value _afterwards_.
    
    This diff fixes the bug.
    
    There are a couple of reasons that this was previous undetected / did not cause
    a problem:
      * for POD types, `allocator_traits::destroy` is a no-op.
      * this code path is only hit if the chunk of the destroyed item has hosted
        overflowed items
      * the use was immediately after free
      * our test coverage did not have vector policy + non-SSO string keys
    
    Reviewed By: nbronson
    
    Differential Revision: D7488050
    
    fbshipit-source-id: ea29e875a0c7a39b8deed40a15777a6983438836
    d22d402e
F14Map.h 30.9 KB