[Support][JSON] ObjectKey ownership and Value assignment bugs
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
## Bug with ObjectKey copy assignment
ObjectKey copy assignment did not clear the destination's owned string when assigning from a non-owning key. This left Owned and Data in an inconsistent state and could cause an erased json::Object property to reappear after copying the object.
https://godbolt.org/z/9P4eqGsGM
Explanation:
```cpp
// Initially, the destination owns its key string.
this->Owned -> "old"
this->Data -> *this->Owned
// The source is a non-owning key.
C.Owned == nullptr
C.Data == "new"
// Copy-assign the non-owning source to the owning destination.
// Since C.Owned is null, the non-owning branch is selected.
} else {
Data = C.Data;
}
// The previous ownership is not cleared, leaving Owned and Data inconsistent.
this->Owned -> "old" // Stale ownership remains.
this->Data -> "new"
```
An example of how this inconsistent state can cause hidden bugs in `json::Value`:
```cpp
json::Value Original = json::Object{{std::string("removed"), 1},
{std::string("remaining"), 2}};
json::Object &Object = *Original.getAsObject();
Object.erase("removed");
llvm::errs() << "Original: " << Original << '\n';
json::Value Copy = Original;
llvm::errs() << "Copy: " << Copy << '\n';
/*
Original: {"remaining":2}
Copy: {"remaining":2,"removed":1} // key revived in copy
*/
```
## Bug with json:Value assignment
https://godbolt.org/z/KWsT85Kad
Value assignment destroyed the destination before copying or moving the source. If the source was nested inside the destination, this invalidated the source and could result in a use-after-free.
Contributor guide
Research direction
Start by running the two Godbolt reproductions for json::ObjectKey copy assignment and json::Value assignment, then locate the corresponding assignment implementations in LLVM's JSON support. Done means ownership state remains consistent when assigning a non-owning key and nested source assignment does not invalidate the source or cause use-after-free; add focused regression tests if the existing test area is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100