Compare commits

...
Author SHA1 Message Date
Niels Lohmann a92a3046fb Use the reserve_array helper in the initializer_list insert fix
The previous commit called array_t::reserve() directly on the
temporary buffer used to copy an ilist's values before inserting.
std::deque, a documented ArrayType (tests/src/unit-custom-array-type.cpp),
has no reserve(), so insert(pos, initializer_list) no longer compiled
for it. Use the existing detail::reserve_array() SFINAE helper (already
used by the SAX DOM parser) instead, which leaves array types without
reserve() untouched.

Added a regression check that deque_json::insert(pos, {...}) compiles
and handles the aliasing case from #5656.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
2026-09-29 23:41:52 +02:00
Niels Lohmann 8948bfc4d9 Copy values before inserting an initializer list into an array
insert(pos, {...}) inserted wrong values when the initializer list
contained const references to elements of the array being inserted
into. json_ref stores only a pointer for a const lvalue, so the
initializer_list_t range passed straight to the array's range insert
aliased the array's own storage; std::vector::insert(pos, first, last)
may move or shift elements before copying from that range, so the
source elements were already stale by the time they were read
(different wrong results on libc++ and libstdc++).

Copy the referenced values into a temporary array_t first, then move
that temporary into place, so the source range never aliases the
array being modified.

Fixes #5656.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
2026-09-29 23:37:46 +02:00
5 changed files with 65 additions and 3 deletions
+3 -1
View File
@@ -195,5 +195,7 @@ Strong exception safety: if an exception occurs, the original value stays intact
1. Added in version 1.0.0.
2. Added in version 1.0.0.
3. Added in version 1.0.0.
4. Added in version 1.0.0.
4. Added in version 1.0.0. Fixed in version 3.13.0 to copy the values before inserting; before, an `ilist` that
referred to elements of the array being inserted into could insert wrong values, because the range insert could
move from or shift an element before it was copied.
5. Added in version 3.0.0.
+9 -1
View File
@@ -4152,8 +4152,16 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
JSON_THROW(invalid_iterator::create(202, "iterator does not fit current value", this));
}
// copy the values first: ilist may refer to elements of this array
array_t values;
detail::reserve_array(values, ilist.size(), detail::priority_tag<1> {});
for (const auto& element : ilist)
{
values.push_back(element.moved_or_copied());
}
// insert to array and return iterator
return insert_iterator(pos, ilist.begin(), ilist.end());
return insert_iterator(pos, std::make_move_iterator(values.begin()), std::make_move_iterator(values.end()));
}
/// @brief inserts range of elements into object
+9 -1
View File
@@ -30233,8 +30233,16 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
JSON_THROW(invalid_iterator::create(202, "iterator does not fit current value", this));
}
// copy the values first: ilist may refer to elements of this array
array_t values;
detail::reserve_array(values, ilist.size(), detail::priority_tag<1> {});
for (const auto& element : ilist)
{
values.push_back(element.moved_or_copied());
}
// insert to array and return iterator
return insert_iterator(pos, ilist.begin(), ilist.end());
return insert_iterator(pos, std::make_move_iterator(values.begin()), std::make_move_iterator(values.end()));
}
/// @brief inserts range of elements into object
+16
View File
@@ -117,6 +117,22 @@ TEST_CASE("array type without capacity()")
CHECK(nested.flatten().unflatten() == nested);
}
SECTION("insert(pos, initializer_list) compiles and works without reserve()")
{
// std::deque has no reserve() either; insert(pos, ilist) must not
// require it (regression test for #5656, which also covers an ilist
// that refers to elements of the array being inserted into)
deque_json j = deque_json::array();
j.push_back("a");
j.push_back("b");
j.push_back("c");
const deque_json& cj = j;
auto it = j.insert(j.begin(), {cj[0], cj[1]});
CHECK(*it == deque_json("a"));
CHECK(j == deque_json({"a", "b", "a", "b", "c"}));
}
SECTION("references stay valid while the array grows")
{
deque_json j = deque_json::array();
+28
View File
@@ -761,6 +761,34 @@ TEST_CASE("modifiers")
}
}
SECTION("initializer list referring to the array's own elements (#5656)")
{
SECTION("sufficient capacity (no reallocation)")
{
json j_own = json::array();
j_own.get_ref<json::array_t&>().reserve(8);
j_own.push_back("a");
j_own.push_back("b");
j_own.push_back("c");
const json& j_own_cref = j_own;
auto it = j_own.insert(j_own.begin(), {j_own_cref[0], j_own_cref[1]});
CHECK(*it == json("a"));
CHECK(j_own == json({"a", "b", "a", "b", "c"}));
}
SECTION("insufficient capacity (reallocation)")
{
json j_own = {"a", "b", "c"};
j_own.get_ref<json::array_t&>().shrink_to_fit();
const json& j_own_cref = j_own;
auto it = j_own.insert(j_own.begin(), {j_own_cref[2]});
CHECK(*it == json("c"));
CHECK(j_own == json({"c", "a", "b", "c"}));
}
}
SECTION("invalid iterator")
{
// pass iterator to a different array