How to use placement new in an exception safe way? - c++

Question

Suppose I have a MyStack class which exposes:
class MyStack {
public:
template <typename T>
T* Push() {
Reserve(sizeof(T)); // Make sure that the buffer can hold an additional sizeof(T) bytes , realloc if needed
auto prev= _top;
_top += sizeof(T);
new (prev) T();
return reinterpret_cast<T*>(prev);
}
template <typename T>
T* Pop() {
_top -= sizeof(T);
return return reinterpret_cast<T*>(_top);
}
bool Empty() const {
return _bottom == _top;
}
private:
char* _bottom;
char* _top;
};
// Assumes all stack elements have the same type
template <typename T>
void ClearStack(MyStack& stack) {
while (!stack.Empty()) {
stack.template Pop<T>()->~T();
}
}
There's a hidden bug here. Constructing T in MyStack::Push() could throw which would leave the stack buffer in an undefined state (the allocated space would contain garbage). Later, when ClearStack is called, it will attempt to reinterpret the garbage as T and invoke its destructor which could cause an access violation.
Is there a way to fix this bug by only modifying MyStack::Push()? (the limitation is because this is an external code and we prefer to make minimal changes so it's relatively easy to update the library)
I thought about changing MyStack::Push to:
T* Push() {
auto prev = _top;
T t();
Reserve(sizeof(T));
_top += sizeof(T);
reinterpret_cast<T*>(prev) = std::move(t);
return prev;
}
But it looks bad and I'm not even sure that it doesn't invoke any UB (and also forces T to have a move constructor)
Is there a better solution here to protect against throwing constructors? (preferably a small change inside MyStack::Push())

Answer 1

The problem here is really that your design is wrong. You're making a type that behaves a bit like std::vector, but it has no actual concept of "capacity". So when it Reserves memory, it genuinely expects that _top will point to the end of the allocated storage after this process has completed. And therefore if it doesn't, the type is in an invalid state.
Which means that, in the event of an exception, you have to undo the call to Reserve: reallocating the old size of storage and moving the stuff in that storage back1. A more vector-like implementation has 3 pointers: a pointer to the start, a pointer to the first unused byte of memory, and a pointer to past the end of the allocated storage. This way, if you Reserve but get an exception, you've simply got some extra storage lying around.
1: FYI: what you seem to be trying to do most likely will not work. Or at least, not with most user-defined C++ types. Odds are good that your Reserve call allocates new storage and does a memcpy into it and never calls the destructor on those objects (since you have no idea what type they are). Well, that's only legal for objects for which memcpy is a valid action. Namely, TriviallyCopyable types. Yet your Push function has nothing to guard it against non-TriviallyCopyable types.
Not to mention the fact that if anyone had a pointer to the old object, every Push call will invalidate that pointer. And since you don't remember the types of any objects, there's no way to reconstitute them.

Answer 2

How about this code:
template <typename T>
T* Push() {
Reserve(sizeof(T));
auto prev= _top;
_top += sizeof(T);
try {
new (prev) T();
return reinterpret_cast<T*>(prev);
}
catch (...) {
Unreserve(sizeof(T)); //release the memory, optional?
_top = prev;
throw;
}
}

Answer 3

You could use three-pointer implementation:
begin points to the first element.
end points to one past the last element
reserved points to one element past the reserved space.
begin=end=reserved(=nullptr) represents non-allocated container.
begin+1=end=reserved represents filled container with one element.
begin+1=end;begin+4=reserved represents container with one element and space for 2 more.
Then your Push method would look like:
template <typename T>
T* Push() {
if(end==reserved)
//relocate, ensure that begin<=end<reserved
new (end) T();
end+=sizeof(T);
return reinterpret_cast<T*>(end-1);
}