You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(oneshot): allow reclamation after sender handoff - #361
Fix undefined behavior when a oneshot receiver frees the channel after the sender publishes MESSAGE or DISCONNECTED, while finish_sender_awakening still holds its &self argument. Pass the original NonNull<Channel<T>> instead, and stop using the local channel reference at publication so it does not outlive the ownership handoff.
Add coverage for concurrently dropping a waiting receiver and its sender, retain the existing completion-race regression tests, and update the changelog because the faulty implementation is present in v0.7.3.
Document the crate-rooted import convention in AGENTS.md and apply it throughout the oneshot module.
Validation:
Reproduced the CI failure on unmodified main at 6e8762c, using nightly-2026-10-11 and the Linux x86_64 Miri target: seed 1 invalidates the protected &self argument during receiver-side Box::from_raw.
cargo x test: 594 tests passed; cargo x lint: passed.
Full cargo x miri: passed on nightly-2026-10-11, targeting x86_64-unknown-linux-gnu, with the original strict-provenance and symbolic-alignment flags and seeds 0..4.
The 20-test oneshot integration suite also passed all 64 seeds in 0..64 with the same toolchain, target, and checks.
The fix looks right to me. I just ran into the same Miri failure on #359 and ended up with essentially the same change.
One concern is that nothing here would catch this if it came back. With asyncband/src/oneshot reverted to main, this branch's oneshot_test still passes all 16 seeds I tried under the CI setup. The window is only between the final swap and the helper's return, and a single race rarely lands in it. A test that registers the waker first, races the sender against the receiver completing, and drops the receiver before joining the sender hits it much more often when it repeats under Miri. In my run, 128 rounds failed the reverted code at about half the seeds, including two of the four that CI runs, at about 6 seconds per seed. Would it be worth adding something along those lines here? Not blocking.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix undefined behavior when a oneshot receiver frees the channel after the sender publishes
MESSAGEorDISCONNECTED, whilefinish_sender_awakeningstill holds its&selfargument. Pass the originalNonNull<Channel<T>>instead, and stop using the local channel reference at publication so it does not outlive the ownership handoff.Add coverage for concurrently dropping a waiting receiver and its sender, retain the existing completion-race regression tests, and update the changelog because the faulty implementation is present in
v0.7.3.Document the crate-rooted import convention in
AGENTS.mdand apply it throughout the oneshot module.Validation:
6e8762c, using nightly-2026-10-11 and the Linux x86_64 Miri target: seed 1 invalidates the protected&selfargument during receiver-sideBox::from_raw.cargo x test: 594 tests passed;cargo x lint: passed.cargo x miri: passed on nightly-2026-10-11, targetingx86_64-unknown-linux-gnu, with the original strict-provenance and symbolic-alignment flags and seeds0..4.0..64with the same toolchain, target, and checks.