You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Reported by @TrueDoctor following the rank polymorphism PR (#4335). Three existing mechanisms combine into an unsound API surface:
The borrow tree launders lifetimes: NodeContainer derefs *const TypeErasedNode<'static> to &'static, so references handed out inside the graph (the &PlatformEditorApi scope wire, &WgpuExecutor, or any reference to node-owned state) are typed 'static but actually live only until the next graph recompilation deallocates their owner.
Contexts escape the graph: the Monitor node snapshots IORecord { input: Context, output } into an Arc<dyn Any> that the editor introspects and can retain across recompiles.
Combined: a node stores a laundered reference as a vararg, a Monitor captures the context, the graph recompiles and frees the referent, and the editor reads freed memory through entirely safe code (vararg() + downcast_ref). A vararg with interior mutability would similarly let context readers mutate graph-owned state as a covert return channel.
All current with_vararg callers box owned data, so no UB exists in the code today. But the risk remains for the API permitting it silently.
Reported by @TrueDoctor following the rank polymorphism PR (#4335). Three existing mechanisms combine into an unsound API surface:
NodeContainerderefs*const TypeErasedNode<'static>to&'static, so references handed out inside the graph (the&PlatformEditorApiscope wire,&WgpuExecutor, or any reference to node-owned state) are typed'staticbut actually live only until the next graph recompilation deallocates their owner.OwnedContextImpl::with_varargaccepts anyBox<dyn AnyHash + Send + Sync>. Its'staticbound cannot distinguish real ownership from a laundered reference, so safe code in any node can store such a reference into a context. Make the data model use Item and List types universally, with nodes authored as rank-polymorphic kernels #4335 made this channel idiomatic (render boundary config, per-item lambda rows).IORecord { input: Context, output }into anArc<dyn Any>that the editor introspects and can retain across recompiles.Combined: a node stores a laundered reference as a vararg, a Monitor captures the context, the graph recompiles and frees the referent, and the editor reads freed memory through entirely safe code (
vararg()+downcast_ref). A vararg with interior mutability would similarly let context readers mutate graph-owned state as a covert return channel.All current
with_varargcallers box owned data, so no UB exists in the code today. But the risk remains for the API permitting it silently.