[libc++] Fix an exception safety issue in `forward_list` and add tests.

[var-const]

Summary

When inserting nodes into a forward list, each new node is allocated but
not constructed. The constructor was being called explicitly on the node
value_ but the next_ pointer remained uninitialized rather than
being set to null. This bug is only triggered in the cleanup code if an
exception is thrown -- upon successful creation of new nodes, the last
incorrect "next" value is overwritten to a correct pointer.

This issue was found due to new tests added in
https://reviews.llvm.org/D149830.

[ldionne]

Thanks a lot for fixing this and adding test coverage! I suspected it was indeed a "silly" mistake in the current code. I have a few comments below.

libcxx/include/forward_list

1262–1263

This makes me wonder whether we should instead be constructing this with e.g. make_unique. Why don't we have a proper constructor for __node and call that instead, it would make sure that we never forget to initialize some of its members. Do you have thoughts about this?

libcxx/test/std/containers/exception_safety_helpers.h

14

<cstddef> is missing, there is a reference to std::size_t below.

16

You need to include test_macros.h.

libcxx/test/std/containers/sequences/forwardlist/robust_against_exceptions.pass.cpp

70 ↗

(On Diff #529115)

The fact that ThrowingCopy will throw after 3 copies is hardcoded inside test_exception_safety_throwing_copy_iterator_pair, making this a false abstraction IMO. Like I can't understand this test without immediately reading what test_exception_safety_throwing_copy_iterator_pair does and understanding that I need to construct at least 3 elements below to make this test work as expected. This makes me wonder whether this is a good candidate for a function.

[ldionne]

libcxx/include/forward_list

1262–1263

This is what I had in mind:

unique_ptr<__node, _Dp> __h = std::make_unique<__node>(__node(__v, __next=nullptr) _Dp(__a, 1));

Now we need to allocate using the right allocator, so we might need to use something like __allocation_guard instead:

__allocation_guard<__node_allocator> __h(__a, 1);
std::construct_at(__h.__get(), __v, /*next*/nullptr); // this is nicer here cause we call the node's constructor for real
__node_pointer __first = __h.__release();

[Mordante]

Nice catch! Thanks for working on this.

libcxx/test/std/containers/exception_safety_helpers.h

37

Would deleting the function have the same effect?

76–77

Alternatively there is the TEST_VALIDATE_EXCEPTION macro which I use in the formatting tests
libcxx//data/src/llvm/libcxx/test/std/utilities/format/format.functions/vformat.pass.cpp for example.

[var-const]

Address feedback

libcxx/include/forward_list

1262–1263

Unfortunately, construct_at doesn't work because it expects the argument to be a raw pointer whereas the allocator might define the pointer type to be a class. We could avoid using construct_at but I'm not sure this is worth pursuing -- what do you think?

libcxx/test/std/containers/exception_safety_helpers.h

37

No, operator= is still used within instantiated code (even if it's not invoked at runtime), and the compiler complains about overload resolution choosing a deleted function.

76–77

Hmm, is having an assert(false) preferable to just letting the wrong exception escape and crash the test?

libcxx/test/std/containers/sequences/forwardlist/robust_against_exceptions.pass.cpp

70 ↗

(On Diff #529115)

Reworked the function to take the total number of elements created and the number of the throwing copy as template parameters. I also reduced the number of these functions to just two, removing some of the convenience ones (the _container one is a bit more difficult to remove because creating the container inside the user callback means the container would get destroyed when the exception is thrown, increasing the number of destroyed elements; then it becomes harder to check how many elements were destroyed inside the helper function).

[ldionne]

libcxx/include/forward_list

1262–1263

This is what we do in other places with the same pattern:

(void*)std::addressof(*__guard.__get()));

You can see this at play for example in libcxx/include/__memory/shared_ptr.h around shared_ptr<_Tp> allocate_shared(const _Alloc& __a, _Args&& ...__args).

[ldionne]

LGTM w/ comments and passing CI, thanks!

libcxx/test/std/containers/exception_safety_helpers.h

13

#include <functional> for hash

78

libcxx/test/std/containers/sequences/forwardlist/robust_against_exceptions.pass.cpp

1 ↗

(On Diff #537577)

Let's call this something like exception_safety.pass.cpp since robust_against_foo has a different meaning in the test suite (usually it means it's something we do across a large number of types).

[var-const]

Partially address feedback, fix accidental revertal

[var-const]

Address feedback

[var-const]

Rebase

[var-const]

libcxx/include/forward_list

1262–1263

Done. I've had to make __allocation_guard follow the rule of 5.

[var-const]

Fixing CI.

[ldionne]

libcxx/include/__memory/allocation_guard.h

48

I feel bad for not doing this when I wrote the class (IIRC), but we should add a few basic libcxx/test/libcxx tests for basic functionality. Don't go crazy, but at least basic usage. If I had done that, I wouldn't have written a class that has 4x incorrectly defined special members. 🤦🏼‍♂️

libcxx/include/forward_list

1263–1271

Here, I might put these three lines into a scope of their own. That way, we end the lifetime of the guard so we can easily understand it's not needed anymore. Then, within the for loop below, you can just create a new guard variable every time.

1264

You're bypassing any allocator's ::construct method in the new patch. I think you want to keep using _node_traits::construct instead.

It should be easy to add a test with a simple custom allocator where you can check that its construct method has been called.

1279

Same about ::construct.

[var-const]

Partially address feedback.

[var-const]

Address feedback.

[var-const]

Rebase.

[var-const]

libcxx/include/__memory/allocation_guard.h

48

Added some tests, please let me know what you think.

libcxx/include/forward_list

1263–1271

Done. I think it's cleaner that way as well, it's more obvious what exactly the guard is protecting.

1264

Switched back to using __node_traits::construct.

Re. testing -- it seems like this would mean adding tests to all the functions that might allocate (IMO conceptually there's no reason to add the test only to insert_after), which I think is a bit overkill for this patch. In the future, I'd be happy to add a suite of tests like allocator_aware.pass.cpp to check all the allocator-related requirements in one place.

[ldionne]

LGTM w/ green CI. I think it's failing because your allocation_guard test isn't C++11/C++03 friendly.

[var-const]

Fix the CI.

[var-const]

Fix the CI.

[var-const]

It looks like the back-deployment test failed due to a configuration issue unrelated to the patch:

# command stderr:
ld: file not found: /Library/Developer/CommandLineTools/usr/lib/arc/libarclite_macosx.a
clang: error: linker command failed with exit code 1 (use -v to see invocation)

I'll go ahead and merge this patch now.

libcxx/include/__memory/allocation_guard.h

 // -*- C++ -*-
 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef _LIBCPP___MEMORY_ALLOCATION_GUARD_H
 #define _LIBCPP___MEMORY_ALLOCATION_GUARD_H
 
 #include <__config>
+#include <__memory/addressof.h>
 #include <__memory/allocator_traits.h>
 #include <__utility/move.h>
 #include <cstddef>
 
 #if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
 #  pragma GCC system_header
 #endif
 

 // guard's destructor will be called, and the memory will be released using
 // Allocator deallocation. Otherwise, we release the memory from the guard on
 // line (3) in an operation that can't throw -- after that, the guard is not
 // responsible for the memory anymore.
 //
 // This is similar to a unique_ptr, except it's easier to use with a
 // custom allocator.
 template<class _Alloc>
 struct __allocation_guard {
     using _Pointer = typename allocator_traits<_Alloc>::pointer;
     using _Size = typename allocator_traits<_Alloc>::size_type;
 
     template<class _AllocT> // we perform the allocator conversion inside the constructor
     _LIBCPP_HIDE_FROM_ABI
     explicit __allocation_guard(_AllocT __alloc, _Size __n)
         : __alloc_(_VSTD::move(__alloc))
         , __n_(__n)
         , __ptr_(allocator_traits<_Alloc>::allocate(__alloc_, __n_)) // initialization order is important
     { }
 
     _LIBCPP_HIDE_FROM_ABI
     ~__allocation_guard() _NOEXCEPT {
-        if (__ptr_ != nullptr) {
-            allocator_traits<_Alloc>::deallocate(__alloc_, __ptr_, __n_);
-        }
+        __destroy();
+    }
+
+    _LIBCPP_HIDE_FROM_ABI __allocation_guard(const __allocation_guard&) = delete;
+    _LIBCPP_HIDE_FROM_ABI __allocation_guard(__allocation_guard&& __other) _NOEXCEPT
+        : __alloc_(std::move(__other.__alloc))
+        , __n_(__other.__n)
+        , __ptr_(__other.__ptr_) {
+      __other.__ptr_ = nullptr;
+
+    _LIBCPP_HIDE_FROM_ABI __allocation_guard& operator=(const __allocation_guard& __other) = delete;
+    _LIBCPP_HIDE_FROM_ABI __allocation_guard& operator=(__allocation_guard&& __other) _NOEXCEPT {
+        if (std::addressof(__other) != this) {
+            __destroy();
+
+            __alloc_ = std::move(__other.__alloc_);
+            __n_ = __other.__n_;
+            __ptr_ = __other.__ptr_;
+            __other.__ptr_ = nullptr;
+        }
+
+        return *this;
     }
 
     _LIBCPP_HIDE_FROM_ABI
     _Pointer __release_ptr() _NOEXCEPT { // not called __release() because it's a keyword in objective-c++
         _Pointer __tmp = __ptr_;
         __ptr_ = nullptr;
         return __tmp;
     }
 
     _LIBCPP_HIDE_FROM_ABI
     _Pointer __get() const _NOEXCEPT {
         return __ptr_;
     }
 
 private:
+    _LIBCPP_HIDE_FROM_ABI
+    void __destroy() _NOEXCEPT {
+        if (__ptr_ != nullptr) {
+            allocator_traits<_Alloc>::deallocate(__alloc_, __ptr_, __n_);
+        }
+    }
+
     _Alloc __alloc_;
     _Size __n_;
     _Pointer __ptr_;
 };
 
 _LIBCPP_END_NAMESPACE_STD
 
 _LIBCPP_POP_MACROS
 
 #endif // _LIBCPP___MEMORY_ALLOCATION_GUARD_H

libcxx/include/forward_list

 #include <__assert> // all public C++ headers provide the assertion handler
 #include <__availability>
 #include <__config>
 #include <__iterator/distance.h>
 #include <__iterator/iterator_traits.h>
 #include <__iterator/move_iterator.h>
 #include <__iterator/next.h>
 #include <__memory/addressof.h>
+#include <__memory/allocation_guard.h>
 #include <__memory/allocator.h>
 #include <__memory/allocator_destructor.h>
 #include <__memory/allocator_traits.h>
 #include <__memory/compressed_pair.h>
 #include <__memory/pointer_traits.h>
 #include <__memory/swap_allocator.h>
 #include <__memory/unique_ptr.h>
 #include <__memory_resource/polymorphic_allocator.h>

 struct __forward_begin_node
 {
     typedef _NodePtr pointer;
     typedef __rebind_pointer_t<_NodePtr, __forward_begin_node> __begin_node_pointer;
 
     pointer __next_;
 
     _LIBCPP_INLINE_VISIBILITY __forward_begin_node() : __next_(nullptr) {}
+    _LIBCPP_INLINE_VISIBILITY explicit __forward_begin_node(pointer __n) : __next_(__n) {}
 
     _LIBCPP_INLINE_VISIBILITY
     __begin_node_pointer __next_as_begin() const {
         return static_cast<__begin_node_pointer>(__next_);
     }
 };
 
 template <class _Tp, class _VoidPtr>
 using __begin_node_of = __forward_begin_node<__rebind_pointer_t<_VoidPtr, __forward_list_node<_Tp, _VoidPtr> > >;
 
 template <class _Tp, class _VoidPtr>
 struct _LIBCPP_STANDALONE_DEBUG __forward_list_node
     : public __begin_node_of<_Tp, _VoidPtr>
 {
     typedef _Tp value_type;
+    typedef __begin_node_of<_Tp, _VoidPtr> _Base;
+    typedef typename _Base::pointer _NodePtr;
 
     value_type __value_;
+
+    _LIBCPP_HIDE_FROM_ABI __forward_list_node() = default;
+    _LIBCPP_HIDE_FROM_ABI __forward_list_node(const value_type& __v, _NodePtr __next) : _Base(__next), __value_(__v) {}
 };
 
 
 template <class _Tp, class _Alloc = allocator<_Tp> > class _LIBCPP_TEMPLATE_VIS forward_list;
 template<class _NodeConstPtr> class _LIBCPP_TEMPLATE_VIS __forward_list_const_iterator;
 
 template <class _NodePtr>
 class _LIBCPP_TEMPLATE_VIS __forward_list_iterator
forward_list<_Tp, _Alloc>::insert_after(const_iterator __p, const value_type& __v)
     return iterator(__r->__next_);
 }
 
 template <class _Tp, class _Alloc>
 typename forward_list<_Tp, _Alloc>::iterator
 forward_list<_Tp, _Alloc>::insert_after(const_iterator __p, size_type __n,
                                         const value_type& __v)
 {
+    using _Guard = __allocation_guard<__node_allocator>;
+
     __begin_node_pointer __r = __p.__get_begin();
     if (__n > 0)
     {
         __node_allocator& __a = base::__alloc();
-        typedef __allocator_destructor<__node_allocator> _Dp;
-        unique_ptr<__node, _Dp> __h(__node_traits::allocate(__a, 1), _Dp(__a, 1));
-        __node_traits::construct(__a, _VSTD::addressof(__h->__value_), __v);
-        __node_pointer __first = __h.release();
+
+        __node_pointer __first = nullptr;
+        {
+          _Guard __h(__a, 1);
+          __node_traits::construct(__a, std::addressof(__h.__get()->__value_), __v);
+          __h.__get()->__next_ = nullptr;
+          __first = __h.__release_ptr();
+        }
         __node_pointer __last = __first;
 #ifndef _LIBCPP_HAS_NO_EXCEPTIONS
         try
         {
 #endif // _LIBCPP_HAS_NO_EXCEPTIONS
             for (--__n; __n != 0; --__n, __last = __last->__next_)
             {
-                __h.reset(__node_traits::allocate(__a, 1));
-                __node_traits::construct(__a, _VSTD::addressof(__h->__value_), __v);
-                __last->__next_ = __h.release();
+                _Guard __h(__a, 1);
+                __node_traits::construct(__a, std::addressof(__h.__get()->__value_), __v);
+                __h.__get()->__next_ = nullptr;
+                __last->__next_ = __h.__release_ptr();
             }
 #ifndef _LIBCPP_HAS_NO_EXCEPTIONS
         }
         catch (...)
         {
             while (__first != nullptr)
             {
                 __node_pointer __next = __first->__next_;

 }
 
 template <class _Tp, class _Alloc>
 template <class _InputIterator>
 __enable_if_t<__has_input_iterator_category<_InputIterator>::value, typename forward_list<_Tp, _Alloc>::iterator>
 forward_list<_Tp, _Alloc>::insert_after(const_iterator __p,
                                         _InputIterator __f, _InputIterator __l)
 {
+    using _Guard = __allocation_guard<__node_allocator>;
+
     __begin_node_pointer __r = __p.__get_begin();
     if (__f != __l)
     {
         __node_allocator& __a = base::__alloc();
-        typedef __allocator_destructor<__node_allocator> _Dp;
-        unique_ptr<__node, _Dp> __h(__node_traits::allocate(__a, 1), _Dp(__a, 1));
-        __node_traits::construct(__a, _VSTD::addressof(__h->__value_), *__f);
-        __node_pointer __first = __h.release();
+        __node_pointer __first = nullptr;
+        {
+          _Guard __h(__a, 1);
+          __node_traits::construct(__a, std::addressof(__h.__get()->__value_), *__f);
+          __h.__get()->__next_ = nullptr;
+          __first = __h.__release_ptr();
+        }
         __node_pointer __last = __first;
 #ifndef _LIBCPP_HAS_NO_EXCEPTIONS
         try
         {
 #endif // _LIBCPP_HAS_NO_EXCEPTIONS
             for (++__f; __f != __l; ++__f, ((void)(__last = __last->__next_)))
             {
-                __h.reset(__node_traits::allocate(__a, 1));
-                __node_traits::construct(__a, _VSTD::addressof(__h->__value_), *__f);
-                __last->__next_ = __h.release();
+                _Guard __h(__a, 1);
+                __node_traits::construct(__a, std::addressof(__h.__get()->__value_), *__f);
+                __h.__get()->__next_ = nullptr;
+                __last->__next_ = __h.__release_ptr();
             }
 #ifndef _LIBCPP_HAS_NO_EXCEPTIONS
         }
         catch (...)
         {
             while (__first != nullptr)
             {
                 __node_pointer __next = __first->__next_;

libcxx/test/std/containers/container.adaptors/from_range_container_adaptors.h

 #include <algorithm>
 #include <cassert>
 #include <cstddef>
 #include <queue>
 #include <ranges>
 #include <utility>
 #include <vector>
 
+#include "../exception_safety_helpers.h"
 #include "../from_range_helpers.h"
 #include "MoveOnly.h"
 #include "almost_satisfies_types.h"
 #include "count_new.h"
 #include "test_macros.h"
 #include "unwrap_container_adaptor.h"
 
 template <class Container, class Range>
constexpr void test_container_adaptor_move_only() {
   std::ranges::subrange in(std::move_iterator{input}, std::move_iterator{input + 5});
 
   [[maybe_unused]] Container<MoveOnly> c(std::from_range, in);
 }
 
 template <template <class ...> class Adaptor>
 void test_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
-    Adaptor<T, std::vector<T>> c(std::from_range, in);
-    assert(false); // The constructor call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
+    [[maybe_unused]] Adaptor<T, std::vector<T>> c(std::from_range, std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Adaptor, class T>
 void test_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 

libcxx/test/std/containers/container.adaptors/push_range_container_adaptors.h

 #include <cassert>
 #include <concepts>
 #include <cstddef>
 #include <initializer_list>
 #include <ranges>
 #include <type_traits>
 #include <vector>
 
+#include "../exception_safety_helpers.h"
 #include "../from_range_helpers.h"
 #include "../insert_range_helpers.h"
 #include "MoveOnly.h"
 #include "almost_satisfies_types.h"
 #include "count_new.h"
 #include "min_allocator.h"
 #include "test_allocator.h"
 #include "test_iterators.h"
void test_push_range_inserter_choice(bool is_result_heapified = false) {
   }
 }
 
 // Exception safety.
 
 template <template <class ...> class Container>
 void test_push_range_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](auto* from, auto* to) {
     Container<T> c;
-    c.push_range(in);
-    assert(false); // The function call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+    c.push_range(std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Adaptor, template <class ...> class BaseContainer, class T>
 void test_push_range_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 

libcxx/test/std/containers/exception_safety_helpers.h

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef SUPPORT_EXCEPTION_SAFETY_HELPERS_H
+#define SUPPORT_EXCEPTION_SAFETY_HELPERS_H
+
+#include <cassert>
+#include <cstddef>
+#include <functional>
+#include <utility>
+#include "test_macros.h"
+
+#if !defined(TEST_HAS_NO_EXCEPTIONS)
+template <int N>
+struct ThrowingCopy {
+  static bool throwing_enabled;
+  static int created_by_copying;
+  static int destroyed;
+  int x = 0; // Allows distinguishing between different instances.
+
+  ThrowingCopy() = default;
+  ThrowingCopy(int value) : x(value) {}
+  ~ThrowingCopy() {
+    ++destroyed;
+  }
+
+  ThrowingCopy(const ThrowingCopy& other) : x(other.x) {
+    ++created_by_copying;
+    if (throwing_enabled && created_by_copying == N) {
+      throw -1;
+    }
+  }
+
+  // Defined to silence GCC warnings. For test purposes, only copy construction is considered `created_by_copying`.
+  ThrowingCopy& operator=(const ThrowingCopy& other) {
+    x = other.x;
+    return *this;
+  }
+
+  friend bool operator==(const ThrowingCopy& lhs, const ThrowingCopy& rhs) { return lhs.x == rhs.x; }
+  friend bool operator<(const ThrowingCopy& lhs, const ThrowingCopy& rhs) { return lhs.x < rhs.x; }
+
+  static void reset() {
+    created_by_copying = destroyed = 0;
+  }
+};
+
+template <int N>
+bool ThrowingCopy<N>::throwing_enabled = true;
+template <int N>
+int ThrowingCopy<N>::created_by_copying = 0;
+template <int N>
+int ThrowingCopy<N>::destroyed = 0;
+
+template <int N>
+struct std::hash<ThrowingCopy<N>> {
+  std::size_t operator()(const ThrowingCopy<N>& value) const {
+    return value.x;
+  }
+};
+
+template <int ThrowOn, int Size, class Func>
+void test_exception_safety_throwing_copy(Func&& func) {
+  using T = ThrowingCopy<ThrowOn>;
+  T::reset();
+  T in[Size];
+
+  try {
+    func(in, in + Size);
+    assert(false); // The function call above should throw.
+
+  } catch (int) {
+    assert(T::created_by_copying == ThrowOn);
+    assert(T::destroyed == ThrowOn - 1); // No destructor call for the partially-constructed element.
+  }
+}
+
+// Destroys the container outside the user callback to avoid destroying extra elements upon throwing (which would
+// complicate asserting that the expected number of elements was destroyed).
+template <class Container, int ThrowOn, int Size, class Func>
+void test_exception_safety_throwing_copy_container(Func&& func) {
+  using T = ThrowingCopy<ThrowOn>;
+  T::throwing_enabled = false;
+  T in[Size];
+  Container c(in, in + Size);
+  T::throwing_enabled = true;
+  T::reset();
+
+  try {
+    func(std::move(c));
+    assert(false); // The function call above should throw.
+
+  } catch (int) {
+    assert(T::created_by_copying == ThrowOn);
+    assert(T::destroyed == ThrowOn - 1); // No destructor call for the partially-constructed element.
+  }
+}
+
+#endif // !defined(TEST_HAS_NO_EXCEPTIONS)
+
+#endif // SUPPORT_EXCEPTION_SAFETY_HELPERS_H

libcxx/test/std/containers/from_range_helpers.h

 template <>
 struct std::hash<KeyValue> {
   std::size_t operator()(const KeyValue& kv) const {
     return kv.key;
   }
 };
 
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-template <int N>
-struct ThrowingCopy {
-  static bool throwing_enabled;
-  static int created_by_copying;
-  static int destroyed;
-  int x = 0; // Allows distinguishing between different instances.
-
-  ThrowingCopy() = default;
-  ThrowingCopy(int value) : x(value) {}
-  ~ThrowingCopy() {
-    ++destroyed;
-  }
-
-  ThrowingCopy(const ThrowingCopy& other) : x(other.x) {
-    ++created_by_copying;
-    if (throwing_enabled && created_by_copying == N) {
-      throw -1;
-    }
-  }
-
-  // Defined to silence GCC warnings. For test purposes, only copy construction is considered `created_by_copying`.
-  ThrowingCopy& operator=(const ThrowingCopy& other) {
-    x = other.x;
-    return *this;
-  }
-
-  friend auto operator<=>(const ThrowingCopy&, const ThrowingCopy&) = default;
-
-  static void reset() {
-    created_by_copying = destroyed = 0;
-  }
-};
-
-template <int N>
-struct std::hash<ThrowingCopy<N>> {
-  std::size_t operator()(const ThrowingCopy<N>& value) const {
-    return value.x;
-  }
-};
-
-template <int N>
-bool ThrowingCopy<N>::throwing_enabled = true;
-template <int N>
-int ThrowingCopy<N>::created_by_copying = 0;
-template <int N>
-int ThrowingCopy<N>::destroyed = 0;
 
 template <class T>
 struct ThrowingAllocator {
   using value_type = T;
   using char_type = T;
   using is_always_equal = std::false_type;
 
   ThrowingAllocator() = default;

libcxx/test/std/containers/sequences/forwardlist/exception_safety.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// <forward_list>
+
+// TODO:
+// - throwing upon moving;
+// - initializer lists;
+// - throwing when constructing the element in place.
+
+// forward_list(size_type n, const value_type& v);
+// forward_list(size_type n, const value_type& v, const allocator_type& a);
+// template <class InputIterator>
+//     forward_list(InputIterator first, InputIterator last);
+// template <class InputIterator>
+//     forward_list(InputIterator first, InputIterator last, const allocator_type& a);
+// forward_list(const forward_list& x);
+// forward_list(const forward_list& x, const allocator_type& a);
+//
+// forward_list& operator=(const forward_list& x);
+//
+// template <class InputIterator>
+//     void assign(InputIterator first, InputIterator last);
+// void assign(size_type n, const value_type& v);
+//
+// void push_front(const value_type& v);
+//
+// iterator insert_after(const_iterator p, const value_type& v);
+// iterator insert_after(const_iterator p, size_type n, const value_type& v);
+// template <class InputIterator>
+//     iterator insert_after(const_iterator p,
+//                           InputIterator first, InputIterator last);
+//
+// void resize(size_type n, const value_type& v);
+
+#include <forward_list>
+#include <cassert>
+
+#include "../../exception_safety_helpers.h"
+#include "min_allocator.h"
+
+int main(int, char**) {
+  {
+    constexpr int ThrowOn = 1;
+    constexpr int Size = 1;
+    using T = ThrowingCopy<ThrowOn>;
+
+    // void push_front(const value_type& v);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*){
+      std::forward_list<T> c;
+      c.push_front(*from);
+    });
+
+    // iterator insert_after(const_iterator p, const value_type& v);
+    test_exception_safety_throwing_copy</*ThrowOn=*/1, Size>([](T* from, T*){
+      std::forward_list<T> c;
+      c.insert_after(c.before_begin(), *from);
+    });
+  }
+
+  {
+    constexpr int ThrowOn = 3;
+    constexpr int Size = 5;
+    using T = ThrowingCopy<ThrowOn>;
+    using C = std::forward_list<T>;
+    using Alloc = std::allocator<T>;
+
+    // forward_list(size_type n, const value_type& v);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*){
+      std::forward_list<T> c(Size, *from);
+      (void)c;
+    });
+
+    // forward_list(size_type n, const value_type& v, const allocator_type& a);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*){
+      std::forward_list<T> c(Size, *from, Alloc());
+      (void)c;
+    });
+
+    // template <class InputIterator>
+    //     forward_list(InputIterator first, InputIterator last);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T* to){
+      std::forward_list<T> c(from, to);
+      (void)c;
+    });
+
+    // template <class InputIterator>
+    //     forward_list(InputIterator first, InputIterator last, const allocator_type& a);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T* to){
+      std::forward_list<T> c(from, to, Alloc());
+      (void)c;
+    });
+
+    // forward_list(const forward_list& x);
+    test_exception_safety_throwing_copy_container<C, ThrowOn, Size>([](C&& in) {
+      std::forward_list<T> c(in);
+      (void)c;
+    });
+
+    // forward_list(const forward_list& x, const allocator_type& a);
+    test_exception_safety_throwing_copy_container<C, ThrowOn, Size>([](C&& in) {
+      std::forward_list<T> c(in, Alloc());
+      (void)c;
+    });
+
+    // forward_list& operator=(const forward_list& x);
+    test_exception_safety_throwing_copy_container<C, ThrowOn, Size>([](C&& in) {
+      std::forward_list<T> c;
+      c = in;
+    });
+
+    // template <class InputIterator>
+    //     void assign(InputIterator first, InputIterator last);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T* to) {
+      std::forward_list<T> c;
+      c.assign(from, to);
+    });
+
+    // void assign(size_type n, const value_type& v);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*) {
+      std::forward_list<T> c;
+      c.assign(Size, *from);
+    });
+
+    // iterator insert_after(const_iterator p, size_type n, const value_type& v);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*) {
+      std::forward_list<T> c;
+      c.insert_after(c.before_begin(), Size, *from);
+    });
+
+    // template <class InputIterator>
+    //     iterator insert_after(const_iterator p,
+    //                           InputIterator first, InputIterator last);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T* to) {
+      std::forward_list<T> c;
+      c.insert_after(c.before_begin(), from, to);
+    });
+
+    // void resize(size_type n, const value_type& v);
+    test_exception_safety_throwing_copy<ThrowOn, Size>([](T* from, T*) {
+      std::forward_list<T> c;
+      c.resize(Size, *from);
+    });
+  }
+
+  return 0;
+}

libcxx/test/std/containers/sequences/from_range_sequence_containers.h

 #include <algorithm>
 #include <array>
 #include <cassert>
 #include <cstddef>
 #include <iterator>
 #include <ranges>
 #include <utility>
 
+#include "../exception_safety_helpers.h"
 #include "../from_range_helpers.h"
 #include "MoveOnly.h"
 #include "almost_satisfies_types.h"
 #include "count_new.h"
 #include "test_iterators.h"
 #include "test_macros.h"
 
 template <class T>
constexpr void test_vector_bool(ValidateFunc validate) {
   test_sequence_container_with_input<std::vector, bool, Iter, Sent, Alloc>(std::array<bool, 0>{}, validate);
   // Single-element input.
   test_sequence_container_with_input<std::vector, bool, Iter, Sent, Alloc>(std::array{true}, validate);
 }
 
 template <template <class ...> class Container>
 void test_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
-    Container<T> c(std::from_range, in);
-    assert(false); // The constructor call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
+    [[maybe_unused]] Container<T> c(std::from_range, std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Container, class T>
 void test_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 

libcxx/test/std/containers/sequences/insert_range_sequence_containers.h

 #include <cassert>
 #include <concepts>
 #include <cstddef>
 #include <initializer_list>
 #include <ranges>
 #include <type_traits>
 #include <vector>
 
+#include "../exception_safety_helpers.h"
 #include "../from_range_helpers.h"
 #include "../insert_range_helpers.h"
 #include "MoveOnly.h"
 #include "almost_satisfies_types.h"
 #include "count_new.h"
 #include "min_allocator.h"
 #include "test_allocator.h"
 #include "test_iterators.h"
constexpr void test_sequence_assign_range_move_only() {
   c.assign_range(in);
 }
 
 // Exception safety.
 
 template <template <class ...> class Container>
 void test_insert_range_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
     Container<T> c;
-    c.insert_range(c.end(), in);
-    assert(false); // The function call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+    c.insert_range(c.end(), std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Container, class T>
 void test_insert_range_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 
try {
     assert(globalMemCounter.new_called == globalMemCounter.delete_called);
   }
 #endif
 }
 
 template <template <class ...> class Container>
 void test_prepend_range_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
     Container<T> c;
-    c.prepend_range(in);
-    assert(false); // The function call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+    c.prepend_range(std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Container, class T>
 void test_prepend_range_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 
try {
     assert(globalMemCounter.new_called == globalMemCounter.delete_called);
   }
 #endif
 }
 
 template <template <class ...> class Container>
 void test_append_range_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
     Container<T> c;
-    c.append_range(in);
-    assert(false); // The function call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+    c.append_range(std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Container, class T>
 void test_append_range_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};
 
try {
     assert(globalMemCounter.new_called == globalMemCounter.delete_called);
   }
 #endif
 }
 
 template <template <class ...> class Container>
 void test_assign_range_exception_safety_throwing_copy() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
-  using T = ThrowingCopy<3>;
-  T::reset();
-  T in[5];
-
-  try {
+  constexpr int ThrowOn = 3;
+  using T = ThrowingCopy<ThrowOn>;
+  test_exception_safety_throwing_copy<ThrowOn, /*Size=*/5>([](T* from, T* to) {
     Container<T> c;
-    c.assign_range(in);
-    assert(false); // The function call above should throw.
-
-  } catch (int) {
-    assert(T::created_by_copying == 3);
-    assert(T::destroyed == 2); // No destructor call for the partially-constructed element.
-  }
+    c.assign_range(std::ranges::subrange(from, to));
+  });
 #endif
 }
 
 template <template <class ...> class Container, class T>
 void test_assign_range_exception_safety_throwing_allocator() {
 #if !defined(TEST_HAS_NO_EXCEPTIONS)
   T in[] = {0, 1};