Joseph Ferano
e6af2d3f77
flan_merged_park called flan_dyn_root_reset, which emptied the collector's root stack. The frames' roots had to go — main is left by longjmp, so they name stack the next run overwrites — but the dyn globals' roots are on that same stack, pushed once by the emitted main and never popped, and the park took them with the frames. The park is not a quiet state. It services evaluated thunks, a thunk allocates, and an allocation collects. So a program with (defvar config dyn) answered (get config :s) with its string before any thunk ran and with nil after one that allocated past the heap's floor — a read of memory the sweep had freed, answering nil by luck of what the freed words decoded as. The emitted main now brackets its global pushes: flan_dyn_root_globals_begin empties the stack, the pushes go on, flan_dyn_root_globals_end records how many of them there are, and the park resets to that line instead of to zero. Nothing between the two allocates, which is what keeps the globals from being swept in the window where they are unrooted — and [begin] emptying the stack rather than adding to it is what makes a re-entered main re-root the same globals rather than push a second copy of each, which also closes the other half: a re-run used to re-push roots over slots left dangling by the park. Both emitters, because the dev loop's default backend is x86 and a fix in one lowering is not a fix. A program with no dyn globals emits neither call and its root stack still resets to empty, which is what an empty push list should leave behind. flan_dyn_root_pop now clamps at the globals rather than at zero. An over-popping frame eating the globals is the one way that clamp could turn a miscount into this same use-after-free. Covered twice. test/dyn_ops.c's park mode is the runtime's half — a run, a park with a collecting thunk in it, and another run, three times over, asserting both that the global survives and that the frame's five hundred objects do not. Under ASan the old reset reports heap-use-after-free in flan_dyn_tag with the free in gc_sweep; under memcheck it reports 24 errors and still prints the right answer, which is the shape of the bug. test_dev.ml drives the whole daemon over its socket on both backends against programs/dev-dyn-global.flan. Not touched, and it wants a decision rather than a patch: a re-run re-enters flan_program_main, which re-runs the lifted startup function, so every global with a computed initialiser is reset by a re-run. That contradicts dev.ml's own note and FIX.org item 1. It is independent of this — the roots are right whether or not the values are re-initialised. Nor is this the reload path. A defvar added by an evaluation gets its storage from flan_dev_global (emit.ml's new_globals, x86.ml's counterpart) and there is no flan_dyn_root_push anywhere on that path in either backend, so a dyn global added to a live session is unrooted. That is a separate defect with a separate fix, and nothing here makes it better or worse.
25 lines
1.1 KiB
Plaintext
25 lines
1.1 KiB
Plaintext
;;;; A dyn global that outlives the run that filled it.
|
|
;;;;
|
|
;;;; The park is not a quiet state: the daemon services evaluated thunks on
|
|
;;;; the parked thread, a thunk allocates, and an allocation collects. So the
|
|
;;;; question this program is built to ask is whether the roots the emitted
|
|
;;;; main pushed for its dyn globals are still on the collector's stack after
|
|
;;;; the run that pushed them has finished — because the park cuts that stack
|
|
;;;; back, and cutting it back to empty took the globals with the frames.
|
|
;;;;
|
|
;;;; [config] is a map rather than a number on purpose: a dyn number is an
|
|
;;;; immediate word and survives an unrooted heap by not being on it, so it
|
|
;;;; would answer the same whether or not the root was there. What is stored
|
|
;;;; is a heap object, and reading it back is a read of heap memory.
|
|
;;;;
|
|
;;;; main returns immediately: the run has nothing to do but fill the global,
|
|
;;;; and everything this fixture is for happens after it.
|
|
(import agent "vendor:agent")
|
|
|
|
(defvar config dyn)
|
|
|
|
(defn main [] i32
|
|
(agent/start "/tmp/flan-dev-dyn-global-fallback.sock")
|
|
(set config {:s "kept" :n 1})
|
|
0)
|