GH-1310 Loosen validation for freed objects in dictionary/array#1311
GH-1310 Loosen validation for freed objects in dictionary/array#1311JoltedJon wants to merge 2 commits into
Conversation
WalkthroughAdds lookup-specific typed container validation that permits previously freed object instances, then applies it across typed array and dictionary lookup, membership, erasure, search, and iteration paths. ChangesFreed Object Lookup Validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@core/variant/dictionary.cpp`:
- Around line 254-256: Update the typed validation used by Array::erase, find,
rfind, count, has, and bsearch, plus Dictionary::find_key, to call the
corresponding lookup validator instead of the regular validate method. Preserve
existing search and return behavior while allowing freed object variants in
these lookup paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 59f853dc-4e4d-4f33-b509-595c216bd1f2
📒 Files selected for processing (2)
core/variant/container_type_validate.hcore/variant/dictionary.cpp
Fixes #1310
Dictionary access will completely fail if the key is a node that has been freed has been freed in a typed dictionary. The node is still valid as a key even though it has been freed since the underlying data that is used as the key is still present. This loosens the validation to allow for any thing reads only to use the freed node as a key.
Summary by CodeRabbit