From b479fb4a4dd69fa32692e3908054729e8d47cf9c Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Sat, 15 Aug 2026 04:05:16 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20rebuild=20=E6=97=B6=E6=B3=84=E6=BC=8F?=
 =?UTF-8?q?=E4=BF=9D=E6=B4=BB=E6=97=A7=20function/object=20=E5=AE=B6?=
 =?UTF-8?q?=E6=97=8F=E6=B6=88=E9=99=A4=20wrapper=20=E6=82=AC=E5=9E=82?=
 =?UTF-8?q?=E5=8E=9F=E5=9E=8B=20UAF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_kernel/src/builtin.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/crates/oxide_kernel/src/builtin.rs b/crates/oxide_kernel/src/builtin.rs
index cf968ea7..80397b25 100644
--- a/crates/oxide_kernel/src/builtin.rs
+++ b/crates/oxide_kernel/src/builtin.rs
@@ -879,6 +879,18 @@ impl BuiltinWorld {
     ) -> BuiltinWorld {
         let labels = builtin_labels(string_forge);
 
+        // 方法 wrapper（Box::into_raw 永久泄漏）的 proto 持有旧 function_proto 裸指针，
+        // 旧 function_proto 又经 proto/constructor 引用旧 object 家族。function/object
+        // 重建时这 4 个对象若随 Arc 归零释放，保留 wrapper 会沿悬垂原型链
+        // use-after-free：泄漏保活旧家族对，与 wrapper 的永久泄漏同一约定
+        // （每次 dirty rebuild 至多泄漏 4 个对象，低频可接受）。
+        if dirty.function || dirty.object {
+            std::mem::forget(current.function_proto.clone());
+            std::mem::forget(current.function_constructor.clone());
+            std::mem::forget(current.object_proto.clone());
+            std::mem::forget(current.object_constructor.clone());
+        }
+
         let (object_proto, object_constructor) = if dirty.object {
             make_named_pair(string_forge, shape_forge, labels, "Object")
         } else {