diff options
| author |  zinc <zinc@downsta.ir>
| 2026-10-14 19:36:30 +0330 |
|---|---|---|
| committer | zinc <zinc@downsta.ir>
| 2026-10-14 19:36:30 +0330 |
| commit | 7e9abb014169b77cba5174ae92ddc3d1eca4d667 (patch) | |
| tree | b7a9b0dd17c1c9fea7b94f9ba7ad115bf2f7470b /tests/conformance/8-runtime/stale_index_after_free_memdebug.zc | |
| parent | merge work/bench: make bench, bench-check, bench-selftest; baseline at 89f35bd (diff) | |
| parent | rt: exact-size heap bounds; n, the words new asked for, lives in bits 32..62 ... (diff) | |
merge work/exactsize: exact-size heap bounds
Diffstat (limited to 'tests/conformance/8-runtime/stale_index_after_free_memdebug.zc')
| -rw-r--r-- | tests/conformance/8-runtime/stale_index_after_free_memdebug.zc | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc b/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc new file mode 100644 index 0000000..69dc5e3 --- /dev/null +++ b/tests/conformance/8-runtime/stale_index_after_free_memdebug.zc @@ -0,0 +1,17 @@ +// expect error: zy: use after free from line 9 +// spec 3.7.4 and 4.11: under memdebug the same stale index is a use after free +memdebug +on; +include rt; +void pn(int x) { rt.put_n(x); rt.put_c(10); } +int g; +// unchecked: the analyzer stays out, so the block is freed (quarantined, with its check word) rather than recycled +unchecked int make() { let p = rt.new(5); p[4] = 1; g = p; return 0; } +unchecked int drop() { let p = g; rt.free(p); return 0; } +fn main() { + word* q; int i = 4; + make(); q = g as word*; pn(q[i]); + drop(); q = g as word*; pn(q[i]); + return 0; +} +// zc0: skip |