`String::retain` can result in invalid utf-8 on panic

[Darksonn]

This safe code creates a string containing invalid utf-8, which is undefined behavior:

use bumpalo::{Bump, collections::string::String};
use std::panic::AssertUnwindSafe;

fn main() {
    let bump = Bump::new();
    let mut s = String::new_in(&bump);

    s.push_str("_få_b");
    std::panic::catch_unwind(AssertUnwindSafe(|| {
        s.retain(|c| {
            if c == 'b' {
                panic!();
            }
            c != '_'
        });
    }));


    println!("{:?}", core::str::from_utf8(s.as_bytes()));
}

Err(Utf8Error { valid_up_to: 3, error_len: Some(1) })

[fitzgen]

Thanks for the report. Would you be interested in implementing a fix?

[Darksonn]

There's already a fix available. This function was copied from the stdlib, and the stdlib has since fixed this bug, so you should be able to grab the new stdlib implementation to fix this.

Also, I'd like to make the same recommendation as I did for zakarumych/allocator-api2#29.

[fitzgen]

Also, I'd like to make the same recommendation as I did for zakarumych/allocator-api2#29.

Unfortunately, I don't have cycles to constantly update the forked code from std, ripping out all the unstable bits and re-tweaking it to work with Bump again and all that.

What we really need is for feature(allocator_api) to stabilize.