Skip to content

Fix UB in retain_with_order()#48

Merged
djc merged 1 commit into
mainfrom
fix-retain-ub
Jun 5, 2026
Merged

Fix UB in retain_with_order()#48
djc merged 1 commit into
mainfrom
fix-retain-ub

Conversation

@djc

@djc djc commented Jun 5, 2026

Copy link
Copy Markdown
Owner

Fixes #42.

@djc djc requested a review from Copilot June 5, 2026 12:25
@djc djc merged commit f273cb2 into main Jun 5, 2026
12 checks passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes UB in LinkedHashMap::retain_with_order() when keys can mutate their hash/equality via interior mutability during the user callback (issue #42), preventing the hash table from ending up pointing at a freed/moved-out node.

Changes:

  • In retain_with_order(), compute the node’s hash before invoking the callback and remove the hash-table entry by pointer identity (not key equality) to ensure the removed table entry matches the freed list node.
  • Add a regression test that triggers the reported scenario (key mutated to compare equal to another key inside the callback) and exercises a subsequent lookup under miri.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
src/linked_hash_map.rs Makes retain_with_order() remove the exact node being filtered (pre-hash + pointer-identity match) to avoid stale table pointers / UB.
tests/linked_hash_map.rs Adds a regression test covering the interior-mutability key mutation case from issue #42.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread tests/linked_hash_map.rs
Comment on lines +924 to +925
// Looking up a stale key must not dereference a freed node.
let _ = map.contains_key(&Key::new("a"));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

retain_with_order() is unsound for types with interior mutability

2 participants