concread icon indicating copy to clipboard operation
concread copied to clipboard

Stack overflow when dropping long `LinCowCell` chains under AddressSanitizer

Open droideck opened this issue 5 months ago • 0 comments

Whenever an old reader / snapshot is still alive after a huge amount of commit() calls, dropping that reader crashes an ASan build with a stack overflow (highly unlikely to reproduce on a non-ASAN execution).

==ERROR: AddressSanitizer: stack-overflow on address <addr>
    #0 alloc::sync::Arc::drop_slow               alloc/src/sync.rs:*
    #1 <Arc<T> as Drop>::drop                    alloc/src/sync.rs:*
    #2 core::ptr::drop_in_place<Arc<LinCowCellInner<…>>>  core/src/ptr.rs:*
    #3 core::ptr::drop_in_place<Option<Arc<LinCowCellInner<…>>>>  …
    #4 core::ptr::drop_in_place<Mutex<Option<Arc<LinCowCellInner<…>>>>> …
    #5 core::ptr::drop_in_place<LinCowCellInner<…>>      lincowcell/mod.rs:*
    #6 alloc::sync::Arc::drop_slow               …
....      
(frames #1‒#6 repeat a lot)

Each generation (LinCowCellInner) stores an Option<Arc<…>> pointing to the next generation. When the oldest link finally drops, Rust recursively drops the entire chain (v0 → v1 → v2 → …) and exhausts the thread stack.

Potential (rare) undefined behaviour in release builds if the chain is long enough.

droideck avatar Jul 03 '25 21:07 droideck