copy fill value before reallocation in array::insert/resize

[Ramya-9353]

Repro: on a full array, a.insert(a.begin(), n, a[0]) or a.resize(n, a[1]) reads freed memory (ASAN heap-use-after-free in the value copy constructor).
Cause: revert_insert relocates the elements into a newly allocated table and frees the old one before the fill loop runs, so a value that aliases an existing element is left dangling.
Fix: copy the value into a local before constructing revert_insert, the same snapshot object::emplace_impl and array::emplace already take. std::vector defines these self-referential fills, so the copy overloads should honour it too.

[cppalliance-bot]

An automated preview of the documentation is available at https://1167.json.prtest2.cppalliance.org/libs/json/doc/html/index.html

If more commits are pushed to the pull request, the docs will rebuild at the same URL.

2026-07-07 07:42:49 UTC

[cppalliance-bot]

GCOVR code coverage report https://1167.json.prtest2.cppalliance.org/gcovr/index.html
LCOV code coverage report https://1167.json.prtest2.cppalliance.org/genhtml/index.html
Coverage Diff Report https://1167.json.prtest2.cppalliance.org/diff-report/index.html

Build time: 2026-07-07 07:51:37 UTC

[cppalliance-bot]

Benchmark test results. More info at https://benchmark.cppalliance.org/jsonbenchmarks-pullrequests/1167/pullrequest.html

[grisumbras]

Thank you for catching this. I suspect the ideal solution is actually to change the API to accept by value and then eliminate the problem entirely. But since we're hours before the beta cutoff, I'm going to merge this now.