Merge branch 'master' into comparators

Author: matthew-mcallister

crossbeam-channel/CHANGELOG.md

@@ -1,16 +1,26 @@
+# Version 0.5.15
+
+- Fix regression introduced in 0.5.12 that can lead to a double free when dropping unbounded channel. (#1187)
+
 # Version 0.5.14
 
+**Note:** This release has been yanked due to bug fixed in 0.5.15.
+
 - Fix stack overflow when sending large value to unbounded channel. (#1146, #1147)
 - Add `Select::new_biased` function. (#1150)
 - Remove inefficient spinning. (#1154)
 - Suppress buggy `clippy::zero_repeat_side_effects` lint in macro generated code. (#1123)
 
 # Version 0.5.13
 
+**Note:** This release has been yanked due to bug fixed in 0.5.15.
+
 - Add `select_biased!` macro. (#1040)
 
 # Version 0.5.12
 
+**Note:** This release has been yanked due to bug fixed in 0.5.15.
+
 - Fix memory leak in unbounded channel. (#1084)
 
 # Version 0.5.11

crossbeam-channel/Cargo.toml

@@ -4,7 +4,7 @@ name = "crossbeam-channel"
 # - Update CHANGELOG.md
 # - Update README.md (when increasing major or minor version)
 # - Run './tools/publish.sh crossbeam-channel <version>'
-version = "0.5.14"
+version = "0.5.15"
 edition = "2021"
 rust-version = "1.60"
 license = "MIT OR Apache-2.0"

crossbeam-channel/src/flavors/list.rs

@@ -613,7 +613,7 @@ impl<T> Channel<T> {
             // In that case, just wait until it gets initialized.
             while block.is_null() {
                 backoff.snooze();
-                block = self.head.block.load(Ordering::Acquire);
+                block = self.head.block.swap(ptr::null_mut(), Ordering::AcqRel);
             }
         }
 

crossbeam-epoch/src/atomic.rs

@@ -63,26 +63,26 @@ fn ensure_aligned<T: ?Sized + Pointable>(raw: *mut ()) {
 /// `tag` is truncated to fit into the unused bits of the pointer to `T`.
 #[inline]
 fn compose_tag<T: ?Sized + Pointable>(ptr: *mut (), tag: usize) -> *mut () {
-    int_to_ptr_with_provenance(
-        (ptr as usize & !low_bits::<T>()) | (tag & low_bits::<T>()),
-        ptr,
-    )
+    map_addr(ptr, |a| (a & !low_bits::<T>()) | (tag & low_bits::<T>()))
 }
 
 /// Decomposes a tagged pointer `data` into the pointer and the tag.
 #[inline]
 fn decompose_tag<T: ?Sized + Pointable>(ptr: *mut ()) -> (*mut (), usize) {
     (
-        int_to_ptr_with_provenance(ptr as usize & !low_bits::<T>(), ptr),
+        map_addr(ptr, |a| a & !low_bits::<T>()),
         ptr as usize & low_bits::<T>(),
     )
 }
 
-// HACK: https://github.com/rust-lang/miri/issues/1866#issuecomment-985802751
+// FIXME: This is exactly <https://doc.rust-lang.org/nightly/std/primitive.pointer.html#method.map_addr-1>,
+// which we cannot use yet due to the MSRV.
 #[inline]
-fn int_to_ptr_with_provenance<T>(addr: usize, prov: *mut T) -> *mut T {
-    let ptr = prov.cast::<u8>();
-    ptr.wrapping_add(addr.wrapping_sub(ptr as usize)).cast()
+fn map_addr<T>(ptr: *mut T, f: impl FnOnce(usize) -> usize) -> *mut T {
+    let new_addr = f(ptr as usize);
+    ptr.cast::<u8>()
+        .wrapping_add(new_addr.wrapping_sub(ptr as usize))
+        .cast::<T>()
 }
 
 /// Types that are pointed to by a single word.
@@ -190,7 +190,6 @@ impl<T> Pointable for T {
 /// along with pointer as in `Box<[T]>`).
 ///
 /// Elements are not present in the type, but they will be in the allocation.
-/// ```
 #[repr(C)]
 struct Array<T> {
     /// The number of elements (not the number of bytes).
@@ -640,9 +639,7 @@ impl<T: ?Sized + Pointable> Atomic<T> {
             let fetch_order = strongest_failure_ordering(order);
             Shared::from_ptr(
                 self.data
-                    .fetch_update(order, fetch_order, |x| {
-                        Some(int_to_ptr_with_provenance(x as usize & val, x))
-                    })
+                    .fetch_update(order, fetch_order, |x| Some(map_addr(x, |a| a & val)))
                     .unwrap(),
             )
         }
@@ -687,9 +684,7 @@ impl<T: ?Sized + Pointable> Atomic<T> {
             let fetch_order = strongest_failure_ordering(order);
             Shared::from_ptr(
                 self.data
-                    .fetch_update(order, fetch_order, |x| {
-                        Some(int_to_ptr_with_provenance(x as usize | val, x))
-                    })
+                    .fetch_update(order, fetch_order, |x| Some(map_addr(x, |a| a | val)))
                     .unwrap(),
             )
         }
@@ -734,9 +729,7 @@ impl<T: ?Sized + Pointable> Atomic<T> {
             let fetch_order = strongest_failure_ordering(order);
             Shared::from_ptr(
                 self.data
-                    .fetch_update(order, fetch_order, |x| {
-                        Some(int_to_ptr_with_provenance(x as usize ^ val, x))
-                    })
+                    .fetch_update(order, fetch_order, |x| Some(map_addr(x, |a| a ^ val)))
                     .unwrap(),
             )
         }

crossbeam-skiplist/src/base.rs

@@ -107,7 +107,7 @@ impl<K, V> Node<K, V> {
             }
 
             ptr::addr_of_mut!((*ptr).refs_and_height)
-                .write(AtomicUsize::new((height - 1) | ref_count << HEIGHT_BITS));
+                .write(AtomicUsize::new((height - 1) | (ref_count << HEIGHT_BITS)));
             ptr::addr_of_mut!((*ptr).tower.pointers)
                 .cast::<Atomic<Self>>()
                 .write_bytes(0, height);