[libc++] Fix __hash_table::erase(iterator, iterator) to update the bucket list correctly when erasing the last bucket

Author: philnik777

libcxx/include/__hash_table

@@ -1910,6 +1910,8 @@ __hash_table<_Tp, _Hash, _Equal, _Alloc>::erase(const_iterator __first, const_it
         __bucket_list_[__next_chash] = __before_first;
         __chash                      = __next_chash;
       }
+    } else { // When __next is a nullptr we've fully erased the last bucket. Update the bucket list accordingly.
+      __bucket_list_[__chash] = nullptr;
     }
   }
 

libcxx/test/std/containers/unord/unord.multiset/erase_range.pass.cpp

@@ -64,6 +64,25 @@ int main(int, char**) {
     for (const auto& v : map)
       assert(v == 1 || v == collision_val);
   }
+  { // Make sure that we're properly updating the bucket list when we're erasing to the end
+    std::unordered_multiset<int> m;
+    m.emplace(1);
+    m.emplace(2);
+
+    {
+      auto [it, end] = m.equal_range(1);
+      assert(it != end);
+      m.erase(it, end);
+    }
+
+    {
+      auto [it, end] = m.equal_range(2);
+      assert(it != end);
+      m.erase(it, end);
+    }
+
+    m.emplace(3); // heap-use-after-free
+  }
 #if TEST_STD_VER >= 11
   {
     typedef std::unordered_multiset<int, std::hash<int>, std::equal_to<int>, min_allocator<int>> C;