Repository navigation
fix(hy-emit,hy-check): fix O8 slot-loan rebind/branch races and A3/T24 soundness gaps (#603) - #604
Open
sonson0910 wants to merge 1 commit into
Conversation
sonson0910
force-pushed
the
fix/o8-slot-loan-rebind-branch-and-t24-soundness
branch
from
October 18, 2026 11:44
e231560 to
8b83602
Compare
…4 soundness gaps
- hy-emit: stop remaining_stmts_use_loan at unshadowed Ident `=` rebinds so a plain-value rebind (`n = item{...}`) followed by reads of `n` does not keep the old slot loan alive past `move m` or emit a duplicate store-back of the rebound value into the map slot.
- hy-emit: hand off active slot loans into `if` / nested blocks that rebind the loan variable, and do not consume `branch_inherit` inside closures evaluated in an `if` condition.
- hy-emit: preserve `pointer_vars` and `shadowed_since_loan` across lexical block scopes so inner-block shadowing does not leak into outer slot-loan flushes.
- hy-check: reject container rebinds (`h = holder{...}`) during a live field-map slot loan (`&h.m[k]`) with HYB-E3102, and check user-defined methods and inline closure calls `(fn(x) { ... })(m)` for A3 map mutations during a live slot loan.
- hy-check: track `&s.field` slot loans and multi-return reassignments in `addr_loan.rs` (T24 HYB-E3104).
sonson0910
force-pushed
the
fix/o8-slot-loan-rebind-branch-and-t24-soundness
branch
from
October 18, 2026 23:34
8b83602 to
6731250
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes three related P0 soundness holes in O8 slot-loan lowering (
hy-emit) and A3/T24 slot-loan checking (hy-check):hy-emit(compiler/crates/hy-emit/src/stmt.rs,expr.rs,lib.rs):remaining_stmts_use_loanwhen an unshadowedStmt::Assign(AssignOp::Assign) overwritesPlaceKind::Ident(name)(after checking RHS values and non-ident target sub-expressions), and delegateblock_mentions_identtoremaining_stmts_use_loanso a plain-value or slot-loan rebind inside a block does not falsely keep the old loan alive pastmove m.Stmt::If,Stmt::Block, andStmt::Managedwhen the construct rebinds the loan variable or moves its base map, and updateflush_loan_for_nameto return the frame index so rebinding an outer slot loan to a new slot loan updates the loan in place after flushing the old slot.branch_inheritinemit_fn_lit(expr.rs) so closures evaluated inside anifcondition do not consume the enclosingifstatement'sbranch_inherithandoff.pointer_varsandshadowed_since_loaninsave_scope/restore_scope(lib.rs) so inner-block shadowing does not leak into outer slot-loan flushes.hy-check(compiler/crates/hy-check/src/loans.rs):a3_path_is_prefix_or_eqso rebinding an enclosing struct container (h = holder{...}) while a slot loan on a nested field map (&h.m[k]) is live is rejected withHYB-E3102.check_a3_method_or_inline_callfromResolved::MethodandResolved::Noneinprocess_callso user-defined methods (h.drop_a(),b.put(m)) and immediately-invoked closure literals ((fn(x) { delete(x, "a") })(m)) that mutate a map during a live slot loan are rejected withHYB-E3102.hy-check(compiler/crates/hy-check/src/addr_loan.rs):is_slot_loan_exprto recognize&s.field(Expr::Field) slot loans alongside&m[k](Expr::Index), clearslot_loanon multi-return reassignments (n, ok = f()), and reject&n.arr[0](Expr::Indexprojections rooted at a slot loan) withHYB-E3104(T24).Verification
cargo test --workspace --quietpython3 tools/check_test_registration.pypython3 tools/check_conflict_markers.pyhyb check,hyb generate, andCGO_ENABLED=1 CC=gcc go run -race .on reproducersFixes #603