[std.snapshot] doc: warn that cas() is ABA-unsafe for multi-writer reclaim - #2113
Merged
paul-hammant merged 1 commit intoSep 19, 2026
Merged
Conversation
…writer reclaim `snapshot.cas` is a plain pointer-value CAS with no generation tag. That is correct for the single-writer-actor + defer-one-generation pattern the header already documents, but it silently breaks a MULTI-writer reclaiming CAS-COW: once displaced values are actually freed, a recycled address lets a slow writer's stale cas() spuriously succeed and clobber a committed value (ABA). This is orthogonal to reader use-after-free — a reader grace epoch (std.sync, aether-lang-dev#2082) closes reader UAF but does nothing for writer ABA. Comment-only: adds an ABA WARNING to the reclamation contract pointing at the fix (serialize writers) and at aether-lang-dev#2112. No code change. Surfaced by selaenium's grid registry, which hit exactly this the instant it stopped leaking displaced tables; it works around it with a writer spinlock. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N1Vjg3yn7uc7uMXNmyJz1e
paul-hammant
force-pushed
the
snapshot-cas-aba-note
branch
from
September 19, 2026 10:45
ee89fe3 to
1c9125d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Comment-only change to
std/snapshot/module.ae. Adds an ABA WARNING to the reclamation-contract block in the header.snapshot.casis a plain pointer-value CAS (no generation tag). Correct for the single-writer-actor / defer-one-generation pattern the header already describes — but a multi-writer reclaiming CAS-COW silently breaks: once displaced values are actually freed, a recycled address lets a slow writer's stalecas()spuriously succeed and clobber a committed value. This is orthogonal to reader UAF (a reader grace epoch closes that, not this).The note points readers at the fix (serialize writers, or single owner) and at #2112 (which offers a tagged-CAS as the deeper option). No code change — this is the cheap "document the contract" half of #2112 so the next multi-writer reclaimer doesn't rediscover it under contention.
Surfaced by selaenium's grid registry, which hit exactly this the instant it stopped leaking displaced tables; it works around it with a writer spinlock.
Follow-up to #2082 (the std.sync primitive that made real reclamation possible). Fixes the documentation gap tracked in #2112.
🤖 Generated with Claude Code
https://claude.ai/code/session_01N1Vjg3yn7uc7uMXNmyJz1e