Skip to content

v2026.06.15.00

v2026.06.15.00: Stop mutating dynamic object keys in config macros
@stswidwinski stswidwinski tagged this 13 Jun 00:35 
Summary:
## Goal.

Replace UB behavior of `const_cast`-ing elements which may be `const`-storage allocated with a proper drain semantics.

## Context.

The current implementation of mcrouter performs operations of the form:

```
for (auto& item : object.items()) {
  auto& key = const_cast<folly::dynamic&>(item.first);
  auto& value = item.second;
  output.insert(std::move(key), std::move(value));
}
```

As explained in D108334544 this can generally be a UB and cause bad outcomes since the compiler is free to optimize away the const storage such that any mutation of it can lead to an undefined behavior. In production we have found clusters of cores and ASAN failures which show invalid memory being accessed within the keys of objects which implies that this may have production impact. Even if that is not the case, avoiding UB is a strict improvement and hardening.

## This diff

`const_cast` is used as a crutch since there are no extraction semantics supported within `folly::object::dictionary`. The diff below adds such semantics and allows safe, zero-copy move out of one container into another. This diff introduces no behavioral changes at all, but it does improve safety.

## Cores and more context

Direct ASAN core analysis of ASAN-instrumented `thatch_vm` tasks shows crashes while mcrouter is preprocessing config macros on the config thread. Cores `lzunp38fulwr6r2k` and `r93hc7pfo7ex3tcs` abort while destroying a `folly::dynamic::object` from `facebook::memcache::ConfigPreprocessor::expandMacros`; core `279y5ckx34qb9q67` separately reaches a bad/end F14 iterator dereference in `ConfigPreprocessor::Context::expandRawArg` through `BuiltIns::ifMacro`. Production core stack paste: https://www.internalfb.com/intern/paste/P2374616358/

Inline production stack summary:
```
operator delete
folly::f14::detail::F14Table<folly::dynamic, folly::dynamic>::reset
folly::dynamic::destroy
folly::dynamic::ObjectMaker::~ObjectMaker

Reviewed By: snarkmaster

Differential Revision: D108301752

fbshipit-source-id: aad384111cd8c80f01788c6a9692f83fa993627b
Assets 2
Loading