[ADT][DenseMap] Assignment of DenseMap values using other DenseMap values may result in assignment of destructed values

[JanekvO]

Has occurred in #110930

Reproducible, linked with libclang-cpp:

#include <cstdint>
#include "llvm/ADT/DenseMap.h"
#include <iostream>

struct MyInt {
  int64_t MemberInt;
  MyInt() : MemberInt(0) {}
  MyInt(int64_t Value) : MemberInt(Value) {}
  MyInt(MyInt &MI) : MemberInt(MI.MemberInt) {}
  MyInt(MyInt &&Other) : MemberInt(Other.MemberInt){
    Other.MemberInt = -1;
  }

  MyInt &operator=(MyInt &Other) {
    MemberInt = Other.MemberInt;
    return *this;
  }

  MyInt &operator=(MyInt &&Other) {
    MemberInt = Other.MemberInt;
    Other.MemberInt = -1;
    return *this;
  }
};


int main() {
  const int until = 100;
  llvm::DenseMap<int64_t, MyInt> IntMap;

  for (int64_t i = 0; i < until; ++i)
    IntMap[i] = MyInt(i);

  for (int64_t i = 0; i < until; ++i) {
    IntMap[until+i] = IntMap[i];
    std::cout << "IntMap[" << until+i << "] = " << IntMap[until+i].MemberInt << std::endl;
  }

  return 0;
}

Will print:

IntMap[100] = 0
IntMap[101] = 1
...
IntMap[189] = 89
IntMap[190] = 90
IntMap[191] = -1
IntMap[192] = 92
IntMap[193] = 93
...
IntMap[198] = 98
IntMap[199] = 99

Where IntMap[191] has been assigned using an already moved MyInt which I believe happens in DenseMap.h's void moveFromOldBuckets(BucketT *OldBucketsBegin, BucketT *OldBucketsEnd) as part of grow.

Apologies if this is a known issue (or a wont-fix), if there is one I wasn't able to find it.

[asl]

Apologies if this is a known issue (or a wont-fix), if there is one I wasn't able to find it.

DenseMap is known to have some unusual iterator invalidation rules. So, the things like Map[A] = Map[B] might not work as Map[B] would result in stale reference should the Map[A] require rehash.

[topperc]

Here's a previous instance of the same kind of bug 0fe645c