Skip to content

fix(oneshot): allow reclamation after sender handoff - #361

Merged
tisonkun merged 2 commits into
apache:mainfrom
tisonkun:codex/oneshot-reclamation
Oct 11, 2026
Merged

tisonkun merged 2 commits into
apache:mainfrom
tisonkun:codex/oneshot-reclamation

Conversation

@tisonkun

@tisonkun tisonkun commented Oct 11, 2026 •

Copy link
Copy Markdown
Member

Summary

Fix undefined behavior when a oneshot receiver frees the channel after the sender publishes MESSAGE or DISCONNECTED, while finish_sender_awakening still holds its &self argument. Pass the original NonNull<Channel<T>> instead, and stop using the local channel reference at publication so it does not outlive the ownership handoff.

Add coverage for concurrently dropping a waiting receiver and its sender, retain the existing completion-race regression tests, and update the changelog because the faulty implementation is present in v0.7.3.

Document the crate-rooted import convention in AGENTS.md and apply it throughout the oneshot module.

Validation:

  • Reproduced the CI failure on unmodified main at 6e8762c, using nightly-2026-10-11 and the Linux x86_64 Miri target: seed 1 invalidates the protected &self argument during receiver-side Box::from_raw.
  • cargo x test: 594 tests passed; cargo x lint: passed.
  • Full cargo x miri: passed on nightly-2026-10-11, targeting x86_64-unknown-linux-gnu, with the original strict-provenance and symbolic-alignment flags and seeds 0..4.
  • The 20-test oneshot integration suite also passed all 64 seeds in 0..64 with the same toolchain, target, and checks.

@orthur2

orthur2 commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

The fix looks right to me. I just ran into the same Miri failure on #359 and ended up with essentially the same change.

One concern is that nothing here would catch this if it came back. With asyncband/src/oneshot reverted to main, this branch's oneshot_test still passes all 16 seeds I tried under the CI setup. The window is only between the final swap and the helper's return, and a single race rarely lands in it. A test that registers the waker first, races the sender against the receiver completing, and drops the receiver before joining the sender hits it much more often when it repeats under Miri. In my run, 128 rounds failed the reverted code at about half the seeds, including two of the four that CI runs, at about 6 seconds per seed. Would it be worth adding something along those lines here? Not blocking.

@tisonkun
tisonkun marked this pull request as ready for review October 11, 2026 10:07
@tisonkun

Copy link
Copy Markdown
Member Author

Would it be worth adding something along those lines here? Not blocking.

You can draft a PR and I'll read it out.

@tisonkun
tisonkun merged commit 621fb8d into apache:main Oct 11, 2026
9 checks passed
@tisonkun
tisonkun deleted the codex/oneshot-reclamation branch October 11, 2026 10:19
@orthur2

orthur2 commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

Would it be worth adding something along those lines here? Not blocking.

You can draft a PR and I'll read it out.

Sure, opened #363.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants