Repository navigation
Conversation
Channel::send() / close(), TfBuffer::check_pending() and send_goal's goal response take the waiter and post its resumption. If the waiting task is destroyed between the post and its run, the frame was resumed anyway. The awaiter's destructor cannot withdraw a waiter that has already been taken. Each of these awaiters now owns a token while suspended, and the posted resumption only runs while the token is alive (post_resume). Add tests that destroy the task between the post and the resumption. Without the fix they segfault in a Debug build and report heap-use-after-free under ASan.
Owner
Author
|
Superseded by #60, which fixes the ownership rule in Task instead of guarding each posted resumption. The tests from this PR are included there. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #56.
Channel::send()/close(),TfBuffer::check_pending()andsend_goal's goal response take the waiter and post its resumption. If the waiting task is destroyed between the post and its run, the destroyed frame was resumed anyway. The awaiter destructors added in #56 can't help here, since the waiter has already been taken.Each of these awaiters now owns a token while suspended. The posted resumption goes through a new
post_resume(), which only resumes while that token is alive.New tests destroy the task between the post and the resumption:
ChannelTest.SendThenWaiterDestroyed/CloseThenWaiterDestroyedTfBufferTest.TransformThenWaiterDestroyedTaskDestroyTest.GoalResponseThenRequesterDestroyed(the client's callback group is spun by a separate executor, so its goal response posts the resumption without running it)On main they segfault in a Debug build (3/3 runs each) and report heap-use-after-free under ASan; with this change they pass. The full suite passes in Debug.