Skip to content

-mm=own: a Shared<T> parameter the body assigns is a counted local of its own - #675

Merged
ASDAlexander77 merged 1 commit into
mainfrom
own-shared-param-assigned
Oct 23, 2026
Merged

ASDAlexander77 merged 1 commit into
mainfrom
own-shared-param-assigned

Conversation

@ASDAlexander77

Copy link
Copy Markdown
Owner

What

Under -mm=own, a Shared<T> parameter the body assigns is now copied into a counted local of the same name, as rc does for every assigned parameter and own already did for string parameters.

Why

Own steps aside for Shared handles, so it accepted p = new Shared(..) on a parameter, but the parameter's slot only borrowed the new handle. Assigned in a loop, on one branch, in a try, or before a closure captured it, the handle was released at the end of the block that made it, and a later p.value read freed memory. This was fuzzer finding O4: own crashed (exit 139/134 on Linux with MALLOC_PERTURB_, and a segfault on Windows for the loop form) while gc and rc printed the right value.

Tests

  • own_shared_param_assigned covers the loop, branch (taken and not taken), try and closure forms, plus the caller handle's count. It runs under gc, none, rc and own, and under --verify-ownership for rc and own. Without the fix it fails under own with "assigned in a loop".
  • Full suite: Windows 5466/5466, Linux 5445/5445. All four fuzzer O4 repros pass under own on Linux.

🤖 Generated with Claude Code

… its own

Own steps aside for Shared handles, so it accepted `p = new Shared(..)` on a
parameter, but the parameter's slot only borrowed the new handle: assigned in a
loop, on a branch, in a try or before a closure captured it, the handle was
released at the end of the block that made it and a later `p.value` read freed
memory (fuzzer finding O4). Such a parameter is now copied into a local of the
same name, as rc and own's string parameters already are.

Test own_shared_param_assigned under gc, none, rc and own (+ --verify-ownership).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ASDAlexander77
ASDAlexander77 merged commit 23683f6 into main Oct 23, 2026
2 checks passed
@ASDAlexander77
ASDAlexander77 deleted the own-shared-param-assigned branch October 23, 2026 20:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant