1 result · Feed
-
Unscored —
Double free in `StackVec::retain` when a predicate or element `Drop` panics
## Summary `StackVec::retain` committed its new length to `self.len` only after its internal loop completed. If the retain predicate or a removed element's `Drop` implementation panicked before the loop finished, unwinding proceeded with `self.len` still equa…