CFI: avoid a bad cast in InsertBeforeAndInvalidateAllPointers.

cc/base/list_container.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CC_BASE_LIST_CONTAINER_H_
 #define CC_BASE_LIST_CONTAINER_H_
 
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
@@ skipping 106 matching lines @@
   template <typename DerivedElementType>
   DerivedElementType* AllocateAndCopyFrom(const DerivedElementType* source) {
     return new (helper_.Allocate(sizeof(DerivedElementType)))
         DerivedElementType(*source);
   }
 
   // Construct a new element on top of an existing one.
   template <typename DerivedElementType>
   DerivedElementType* ReplaceExistingElement(Iterator at) {
     at->~BaseElementType();
     return new (*at) DerivedElementType();

[ccameron, 2015/09/21 19:01:39]

Could you grab this instance as well? I'm surprised this didn't trigger it as
well (the operator* will do a reinterpret here, and I'd think that the dtor
above would make that no longer acceptable).

[weiliangc, 2015/09/21 19:04:18]

This is another case here.

[krasin, 2015/09/21 20:43:34]

Done.

[krasin, 2015/09/21 20:43:34]

Done.

   }
 
   // Insert |count| new elements of |DerivedElementType| before |at|. This will
   // invalidate all outstanding pointers and iterators. Return a valid iterator
   // for the beginning of the newly inserted segment.
   template <typename DerivedElementType>
   Iterator InsertBeforeAndInvalidateAllPointers(Iterator at, size_t count) {
     helper_.InsertBeforeAndInvalidateAllPointers(&at, count);
     Iterator result = at;
     for (size_t i = 0; i < count; ++i) {
-      new (*at) DerivedElementType();
+      new (at.item_iterator) DerivedElementType();
       ++at;
     }
     return result;
   }
 
   template <typename DerivedElementType>
   void swap(ListContainer<DerivedElementType>& other) {
     helper_.data_.swap(other.helper_.data_);
   }
 
@@ skipping 186 matching lines @@
 
  private:
   ListContainerHelper helper_;
 
   DISALLOW_COPY_AND_ASSIGN(ListContainer);
 };
 
 }  // namespace cc
 
 #endif  // CC_BASE_LIST_CONTAINER_H_