id	summary	reporter	owner	description	type	status	milestone	component	version	severity	resolution	keywords	cc
7903	boost::heap::fibonacci_heap::erase() does not reset top_element after the last element is erased	Yin Qiu <qiuyi.n@…>	timblechmann	"When a fibonacci heap contains only one element, calling `fibonacci_heap::erase()` deallocates that element's memory, changes the heap size to 0, but does not reset the `top_element` member, leaving it a dangling pointer.

This member is however used in the `push()` function:

{{{#!cpp
  if (!top_element || super_t::operator()(top_element->value, n->value))
      top_element = n;
}}}

Calling the comparison operator would result in an invalid read.

Code to reproduce (confirmed by valgrind memcheck):

{{{#!cpp
using namespace boost::heap;

fibonacci_heap<int> fh;
fh.erase(fh.push(1));
fh.push(2); // invalid memory access here
}}}

I don't know if the heap is supposed to be used like this, but I've attached a patch anyway, which simply resets `top_element` in the `consolidate()` function.

Thanks."	Bugs	closed	To Be Determined	heap	Boost Development Trunk	Problem	fixed