Skip to content

Fix integer underflow in RawIter::size_hint#89

Merged
Amanieu merged 1 commit into
Amanieu:masterfrom
nwtnni:master
Sep 28, 2025
Merged

Fix integer underflow in RawIter::size_hint#89
Amanieu merged 1 commit into
Amanieu:masterfrom
nwtnni:master

Conversation

@nwtnni
Copy link
Copy Markdown
Contributor

@nwtnni nwtnni commented Sep 24, 2025

I encountered this bug while trying to collect ThreadLocal::iter into a Vec and occasionally getting a capacity overflow error (backtrace attached below). The root cause is that RawIter yields based on Entry.present, which is updated before ThreadLocal.values; this means it's possible for self.yielded > thread_local.values.

I wasn't able to reproduce the problem in a unit test (tried under miri as well) since the conflict window is so short--would probably need loom or some other adversarial scheduler.

Vec overflow backtrace
thread '<unnamed>' panicked at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:558:17:
capacity overflow
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:697:5
   1: core::panicking::panic_fmt
             at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/core/src/panicking.rs:75:14
   2: alloc::raw_vec::capacity_overflow
             at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/alloc/src/raw_vec/mod.rs:29:5
   3: alloc::raw_vec::handle_error
             at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/alloc/src/raw_vec/mod.rs:797:29
   4: alloc::raw_vec::RawVecInner<A>::reserve::do_reserve_and_handle
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:558:17
   5: alloc::raw_vec::RawVecInner<A>::reserve
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:563:13
   6: alloc::raw_vec::RawVec<T,A>::reserve
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/raw_vec/mod.rs:331:20
   7: alloc::vec::Vec<T,A>::reserve
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:1297:18
   8: alloc::vec::Vec<T,A>::extend_desugared
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3550:17
   9: <alloc::vec::Vec<T,A> as alloc::vec::spec_extend::SpecExtend<T,I>>::spec_extend
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/spec_extend.rs:19:9
  10: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter_nested.rs:42:9
  11: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter.rs:34:9
  12: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3438:9
  13: core::iter::traits::iterator::Iterator::collect
             at /nix/store/yhsr8dw2nyhga4jy8bif080kazd3syh6-rust-default-1.88.0/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2001:9

@Amanieu Amanieu merged commit fdf06db into Amanieu:master Sep 28, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants