LinkedList corrupted in .split_off()

[bluss]

User seppo0010 in #rust irc found this corruption and crasher bug in LinkedList::split_off()

Exists in rustc 1.0 and nightly

(playpen link)

use std::collections::LinkedList;

fn main() {
    let mut v1 = LinkedList::new();
    v1.push_front(1u8);
    v1.push_front(1u8);
    v1.push_front(1u8);
    v1.push_front(1u8);
    let _ = v1.split_off(3);
    assert_eq!(v1.len(), 3);
    //assert_eq!(v2.len(), 1);

    println!("{}", v1.iter().len());
    println!("{}", v1.iter().collect::<Vec<_>>().len());
}

Corruption is visible when you let the split off vector drop at once.

It's too late for me to analyze this right now, but I suspect a backlink is not being updated correctly.

[Gankra]

Found it. Missing nulling of a ptr.