Even if an element is popped from a queue, crossbeam would run its destructor inside the epoch-based garbage collector. This is a source of double frees.
The flaw was corrected by wrapping elements inside queues in a
ManuallyDrop
.
Thanks to @c0gent for reporting the issue.
{ "license": "CC0-1.0" }