From e0c97196724d82335ee0dbb07cb3f3166f91c009 Mon Sep 17 00:00:00 2001
From: Giacomo Stevanato <giaco.stevanato@gmail.com>
Date: Mon, 24 May 2021 12:41:13 +0200
Subject: Avoid a double drop in Vec::dedup if a destructor panics

---
 library/alloc/src/vec/mod.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'library/alloc/src')

diff --git a/library/alloc/src/vec/mod.rs b/library/alloc/src/vec/mod.rs
index 1c33ff555d6..105c60e7bf0 100644
--- a/library/alloc/src/vec/mod.rs
+++ b/library/alloc/src/vec/mod.rs
@@ -1619,6 +1619,8 @@ impl<T, A: Allocator> Vec<T, A> {
                 let prev_ptr = ptr.add(gap.write.wrapping_sub(1));
 
                 if same_bucket(&mut *read_ptr, &mut *prev_ptr) {
+                    // Increase `gap.read` now since the drop may panic.
+                    gap.read += 1;
                     /* We have found duplicate, drop it in-place */
                     ptr::drop_in_place(read_ptr);
                 } else {
@@ -1631,9 +1633,8 @@ impl<T, A: Allocator> Vec<T, A> {
 
                     /* We have filled that place, so go further */
                     gap.write += 1;
+                    gap.read += 1;
                 }
-
-                gap.read += 1;
             }
 
             /* Technically we could let `gap` clean up with its Drop, but
-- 
cgit 1.4.1-3-g733a5