• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/ucode/tests/custom/99_bugs/56_socket_poll_use_after_free

  1 Test that `socket.poll()` survives a `gc("collect")` triggered from the
  2 user's `fileno()` method. The result array is held in a C local while 
  3 user code runs to resolve each polled handle's fd, and a GC sweep frees
  4 it mid-loop.
  5 
  6 -- Testcase --
  7 {%
  8         import * as socket from 'socket';
  9 
 10         let s = socket.create(socket.AF_INET, socket.SOCK_STREAM, 0);
 11         let real_fd = s.fileno();
 12 
 13         let obj = {};
 14         obj.fileno = function() {
 15                 gc("collect");
 16                 let trash = [];
 17                 for (let i = 0; i < 256; i++)
 18                         push(trash, sprintf("clobber_%04d", i));
 19                 return real_fd;
 20         };
 21 
 22         let r = socket.poll(0, [obj, socket.POLLIN]);
 23 
 24         printf("type=%s len=%d first_is_obj=%s\n",
 25                 type(r), length(r), (length(r) > 0 && r[0][0] === obj) ? "yes" : "no");
 26 %}
 27 -- End --
 28 
 29 -- Expect stdout --
 30 type=array len=1 first_is_obj=yes
 31 -- End --

This page was automatically generated by LXR 0.3.1.  •  OpenWrt