fix: 生成器状态盒深拷贝消除 sweep/promote 共享所有权 UAF,full_reset 补释放 session 堆数据

GeneratorState 状态盒此前由 epoch 原对象独占释放,promote 与 sweep 克隆
浅拷贝 native_data 共享同一盒,旧对象 drop 即悬垂。新增 clone 深拷贝
(参照 async_generator),promote/sweep 两处接入,恢复执行读新盒;
full_reset 在 session arena 重置前遍历 session 对象释放堆数据,
配合深拷贝形成单所有权。补 sweep/promote/full_reset 三回归与
生成器捕获闭包跨 GC 回归。
This commit is contained in:
2026-08-15 19:02:39 +08:00
parent 4373b88303
commit 9e8ee96491
5 changed files with 149 additions and 3 deletions
+2
View File
@@ -434,6 +434,8 @@ impl SessionGc {
crate::async_func::clone_async_native_with_rewrite(old_ref, new_ref, |value| value);
} else if old_ref.is_async_generator_obj() {
crate::async_generator::clone_async_generator_native_with_rewrite(old_ref, new_ref, |value| value);
} else if old_ref.is_generator_obj() {
crate::generator::clone_generator_native_with_rewrite(old_ref, new_ref, |value| value);
}
forwarding.insert(old_ptr, new_ptr);
freed_bytes += Self::drop_session_object_heap_data(old_ptr);