1 result · Feed
-
Unscored —
Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics
Shrinking an `AlignedBox<[T]>` takes ownership of the buffer out of `self.container` with `ManuallyDrop::take`, destroys the elements past the new length, and only then commits the new `Box` back into `self.container`. `ManuallyDrop::take` moves ownership but…