[c++] Invalid free when destroying a class with an std::string member

[Volker-Weissmann]

Input C/C++ Header

#include <string>
namespace MySpace {
	class MyString {
		std::string internal;
	public:
		MyString();
		~MyString();
	};
	MyString::MyString() {printf("constructing MyString\n");}
	MyString::~MyString(){printf("destructing MyString\n");}
}

Bindgen Invocation

let wl = "MySpace.*";
bindgen::Builder::default()
        .header("wrapper.hpp")
        .parse_callbacks(Box::new(bindgen::CargoCallbacks))
        .clang_arg("-x")
        .clang_arg("c++")
        .opaque_type("std::.*")
        .whitelist_var(wl)
        .whitelist_type(wl)
        .whitelist_function(wl)
        .generate()

Actual Results

pub type std_string = [u64; 4usize];
#[repr(C)]
#[derive(Debug)]
pub struct MySpace_MyString {
    pub internal: std_string,
}
#[test]
fn bindgen_test_layout_MySpace_MyString() {
    assert_eq!(
        ::std::mem::size_of::<MySpace_MyString>(),
        32usize,
        concat!("Size of: ", stringify!(MySpace_MyString))
    );
    assert_eq!(
        ::std::mem::align_of::<MySpace_MyString>(),
        8usize,
        concat!("Alignment of ", stringify!(MySpace_MyString))
    );
    assert_eq!(
        unsafe { &(*(::std::ptr::null::<MySpace_MyString>())).internal as *const _ as usize },
        0usize,
        concat!(
            "Offset of field: ",
            stringify!(MySpace_MyString),
            "::",
            stringify!(internal)
        )
    );
}
extern "C" {
    #[link_name = "\u{1}_ZN7MySpace8MyStringC1Ev"]
    pub fn MySpace_MyString_MyString(this: *mut MySpace_MyString);
}
extern "C" {
    #[link_name = "\u{1}_ZN7MySpace8MyStringD1Ev"]
    pub fn MySpace_MyString_MyString_destructor(this: *mut MySpace_MyString);
}
impl MySpace_MyString {
    #[inline]
    pub unsafe fn new() -> Self {
        let mut __bindgen_tmp = ::std::mem::MaybeUninit::uninit();
        MySpace_MyString_MyString(__bindgen_tmp.as_mut_ptr());
        __bindgen_tmp.assume_init()
    }
    #[inline]
    pub unsafe fn destruct(&mut self) {
        MySpace_MyString_MyString_destructor(self)
    }
}

this looks fine, but if I run

let mut val = MySpace_MyString::new();
val.destruct();

I get the output

constructing MyString
destructing MyString
free(): invalid pointer
Aborted (core dumped)

Expected Results

There should be no invalid free, the code looks fine to me. And it works if I use C++ instead of rust.

[emilio]

I think this is because of a combination of two things:

• Your std::string has internal pointer optimizations (so the empty string points to a buffer inside the string object).
• Rust is generating a memmove in MySpace_MyString::new (so the object moves in memory but that pointer isn't fixed up).

Does it work if you inline the MySpace_MyString::new? So if you do:

let mut val = MaybeUninit::<MySpace_MyString>::uninit();
MySpace_MyString_MyString(val.as_mut_ptr());
MySpace_MyString_MyString_destructor(val.as_mut_ptr());

?

That'd confirm that theory.

[emilio]

I think we have documentations about interior pointers and such (that's basically why ::new() is unsafe), but if we don't we should get some.

[Volker-Weissmann]

let mut val = MaybeUninit::<MySpace_MyString>::uninit();
MySpace_MyString_MyString(val.as_mut_ptr());
MySpace_MyString_MyString_destructor(val.as_mut_ptr());

If I do that I don't get an invalid free.

[Volker-Weissmann]

I think we have documentations about interior pointers and such (that's basically why ::new() is unsafe), but if we don't we should get some.

Where?

[emilio]

Apparently we only have a note about the different move semantics:

Automatically calling copy and/or move constructors or destructors. Supporting this isn't possible with Rust's move semantics.

It's a bit of a stretch expecting people would figure out that classes relying on these (like std::string, to keep track of the interior pointer) won't work properly when moved, and definitely unexpected that the auto-generated ::new() causes a move.

So we should definitely expand the C++ docs to explain this.