Bug 165568 – Variant can crash when constructed with default constructor

• Status: NEW
• Component: Web Template Framework

[Keith Rollin]

Given the following struct:

struct MyStruct {
    MyStruct(Vector<String> val) : m_vector(val) {}
    Vector<String> m_vector;                                                                                                                                                                            
};  

The following will crash in the WTF::Variant destructor:

{
    WTF::Variant<MyStruct> temp;
}

Here's the backtrace:

0     WTF::RefPtr<WTF::StringImpl>::~RefPtr() + 67 (utility:754)
1     WTF::RefPtr<WTF::StringImpl>::~RefPtr() + 21 (RefPtr.h:62)
2     WTF::String::~String() + 21 (WTFString.h:137)
3     WTF::String::~String() + 21 (WTFString.h:137)
4     WTF::VectorDestructor<true, WTF::String>::destruct(WTF::String*, WTF::String*) + 47 (Vector.h:59)
5     WTF::VectorTypeOperations<WTF::String>::destruct(WTF::String*, WTF::String*) + 29 (Vector.h:225)
6     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::shrink(unsigned long) + 132 (Vector.h:1026)
7     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() + 43 (Vector.h:631)
8     WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() + 21 (Vector.h:634)
9     WebKit::NetworkCapture::MyStruct::~MyStruct() + 21 (NetworkCaptureManager.cpp:64)
10    WebKit::NetworkCapture::MyStruct::~MyStruct() + 21 (NetworkCaptureManager.cpp:64)
11    WTF::__storage_wrapper<WebKit::NetworkCapture::MyStruct>::__destroy() + 29 (Variant.h:444)
12    WTF::__variant_storage<WebKit::NetworkCapture::MyStruct, false>::__destroy(WTF::__storage_wrapper<WebKit::NetworkCapture::MyStruct>&) + 21 (Variant.h:481)
13    WTF::__variant_data<WebKit::NetworkCapture::MyStruct>::__destroy(WTF::in_place_tag (&)(WTF::__in_place_private::__value_holder<0ul>&)) + 28 (Variant.h:552)
14    void WTF::__destroy_op_table<WTF::Variant<WebKit::NetworkCapture::MyStruct>, WTF::__index_sequence<0l> >::__destroy_func<0l>(WTF::Variant<WebKit::NetworkCapture::MyStruct>*) + 45 (Variant.h:827)
15    WTF::Variant<WebKit::NetworkCapture::MyStruct>::__destroy_self() + 77 (Variant.h:1471)
16    WTF::__variant_base<WTF::Variant<WebKit::NetworkCapture::MyStruct>, false>::~__variant_base() + 21 (Variant.h:923)
17    WTF::Variant<WebKit::NetworkCapture::MyStruct>::~Variant() + 21 (Variant.h:1439)
18    WTF::Variant<WebKit::NetworkCapture::MyStruct>::~Variant() + 21 (Variant.h:1439)

The Variant default constructor is suppose to create an instance of its first type, so the fact that we're destructing one seems proper. Since the destruction is failing, I guess that the object wasn't properly created in the first place. I also note that MyStruct does not have a default constructor, so I don't know how Variant is creating one in the first place. And I don't know why a WTF::String is being destructed since the Vector should be empty.

[Sam Weinig]

I think the bug is that it is allowing it to be compiled at all. I believe a Variant with a non-default constructible first parameter is not supposed to be default constructible itself.