Skip to content

Assert that a writer with an open submessage isn't moved or swapped - #168

Open
kkaefer wants to merge 1 commit into
masterfrom
kk/assert-no-open-submessage-on-move
Open

kkaefer wants to merge 1 commit into
masterfrom
kk/assert-no-open-submessage-on-move

Conversation

@kkaefer

@kkaefer kkaefer commented Nov 3, 2026

Copy link
Copy Markdown
Member

Moving or swapping a basic_pbf_writer that has an open submessage leaves the sub-writer pointing to the moved-from object. In debug builds this later fails with an unrelated assert, in release builds it silently produces a corrupt message.

The "fix" is to assert in the move constructor and swap() instead, and prohibit moving writers with an open submessage.

This PR also adds assertion tests, where a failed assert ends the process and we check for the correct assert being triggered in case of API misuse. This is the first place where we're checking that we fire the correct assertions in case of API misuse, but I think we should extend this pattern to other places to ensure we're correctly hitting them in case of misuse. WDYT, @joto?

Moving or swapping a basic_pbf_writer that has an open submessage leaves
the sub-writer pointing to the moved-from object. In debug builds this
later fails with an unrelated assert, in release builds it silently
produces a corrupt message.

Assert in the move constructor and swap() instead. We also add
assert_tests, where a failed assert ends the process and we check
for the correct assert being triggered in case of API misuse.
@kkaefer
kkaefer requested a review from a team as a code owner November 3, 2026 08:38
@kkaefer
kkaefer requested a review from joto November 3, 2026 08:38
@joto

joto commented Nov 12, 2026

Copy link
Copy Markdown
Collaborator

A move that only works sometimes isn't great. But I don't have an idea either how to do the move with an open submessage.

Regarding the assertion tests: Without looking too much into the details, it seems all rather complex for not many cases. There isn't much need for functions being "noexcept", destructors, move and swap are really the only cases where this is important. What about making all the "noexcept"s for functions with protozero_assert() in them into macros that we can define away to be empty in the tests? Could that be a simpler solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants