concread
concread copied to clipboard
Stack overflow when dropping long `LinCowCell` chains under AddressSanitizer
Whenever an old reader / snapshot is still alive after a huge amount of commit() calls, dropping that reader crashes an ASan build with a stack overflow (highly unlikely to reproduce on a non-ASAN execution).
==ERROR: AddressSanitizer: stack-overflow on address <addr>
#0 alloc::sync::Arc::drop_slow alloc/src/sync.rs:*
#1 <Arc<T> as Drop>::drop alloc/src/sync.rs:*
#2 core::ptr::drop_in_place<Arc<LinCowCellInner<…>>> core/src/ptr.rs:*
#3 core::ptr::drop_in_place<Option<Arc<LinCowCellInner<…>>>> …
#4 core::ptr::drop_in_place<Mutex<Option<Arc<LinCowCellInner<…>>>>> …
#5 core::ptr::drop_in_place<LinCowCellInner<…>> lincowcell/mod.rs:*
#6 alloc::sync::Arc::drop_slow …
....
(frames #1‒#6 repeat a lot)
Each generation (LinCowCellInner) stores an Option<Arc<…>> pointing to the next generation. When the oldest link finally drops, Rust recursively drops the entire chain (v0 → v1 → v2 → …) and exhausts the thread stack.
Potential (rare) undefined behaviour in release builds if the chain is long enough.