llvm / llvm/llvm-project

[Support][JSON] ObjectKey ownership and Value assignment bugs

Open
#214,103 0 comments 0 reactions 0 assignees View on GitHub
llvm:support
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Bug with ObjectKey copy assignment

ObjectKey copy assignment did not clear the destination's owned string when assigning from a non-owning key. This left Owned and Data in an inconsistent state and could cause an erased json::Object property to reappear after copying the object.

https://godbolt.org/z/9P4eqGsGM

Explanation:
```cpp
// Initially, the destination owns its key string.
this->Owned -> "old"
this->Data -> *this->Owned

// The source is a non-owning key.
C.Owned == nullptr
C.Data == "new"

// Copy-assign the non-owning source to the owning destination.
// Since C.Owned is null, the non-owning branch is selected.
} else {
Data = C.Data;
}

// The previous ownership is not cleared, leaving Owned and Data inconsistent.
this->Owned -> "old" // Stale ownership remains.
this->Data -> "new"
```

An example of how this inconsistent state can cause hidden bugs in `json::Value`:
```cpp
json::Value Original = json::Object{{std::string("removed"), 1},
{std::string("remaining"), 2}};
json::Object &Object = *Original.getAsObject();
Object.erase("removed");

llvm::errs() << "Original: " << Original << '\n';
json::Value Copy = Original;
llvm::errs() << "Copy: " << Copy << '\n';

/*
Original: {"remaining":2}
Copy: {"remaining":2,"removed":1} // key revived in copy
*/
```

## Bug with json:Value assignment

https://godbolt.org/z/KWsT85Kad

Value assignment destroyed the destination before copying or moving the source. If the source was nested inside the destination, this invalidated the source and could result in a use-after-free.

Contributor guide

Open the contributing guide

Research direction

Start by running the two Godbolt reproductions for json::ObjectKey copy assignment and json::Value assignment, then locate the corresponding assignment implementations in LLVM's JSON support. Done means ownership state remains consistent when assigning a non-owning key and nested source assignment does not invalidate the source or cause use-after-free; add focused regression tests if the existing test area is found.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.