Skip to content

Hold the owner of a borrowed GraphBLAS handle in TypedOpBase - #587

Merged
eriknw merged 2 commits into
mainfrom
07-selectop-borrowed-handle-lifetime
Sep 18, 2026
Merged

eriknw merged 2 commits into
mainfrom
07-selectop-borrowed-handle-lifetime

Conversation

@eriknw

@eriknw eriknw commented Aug 4, 2026

Copy link
Copy Markdown
Member

SelectOp._from_indexunary reuses the IndexUnaryOp's GrB_IndexUnaryOp
rather than allocating a second one, and marked the borrowing typed op
_owns_gb_obj_inst = False so that only one side would free it. Nothing
kept the owner alive, though: register_anonymous drops the IndexUnaryOp
on the way out, so its typed op is collected and frees the handle while the
SelectOp is still pointing at it.

The result is a dangling pointer rather than a NULL one. __del__ frees
through a synthesized cell, ffi.new(f"{c_type_name}*", gb_obj), so
GrB_*_free clears that temporary and leaves the op's own gb_obj holding
the old address.

Reproduced at 6f1eb02:

def _ne_thunk(x, i, j, thunk):
    return x != thunk
sel = SelectOp.register_anonymous(_ne_thunk)
gc.collect()
Vector.from_coo([0, 1, 2], [1, 5, 9]).select(sel, 5).new()
-> UninitializedObject

Whether it raises depends on whether anything happens to retain the
IndexUnaryOp. With x > thunk it survives, because a traceback caught
inside the per-dtype compile loop keeps a frame that references it.

Replace the per-instance opt-out with _gb_obj_owner, naming the owning
typed op. That suppresses our free and keeps the handle alive for as long
as we can reach it; disclaiming ownership without naming an owner is what
left the handle dangling. The opt-out being replaced was added in 6f1eb02
to stop a double free, so the sequence is leak, double free, opt-out,
dangling handle, and now an owned reference.


Stack created with GitHub Stacks CLI • Give Feedback 💬

@eriknw
eriknw marked this pull request as ready for review August 4, 2026 16:07
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 5c6a883 to 62aa452 Compare August 4, 2026 16:12
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch 2 times, most recently from 011d167 to bdfc46d Compare August 5, 2026 03:18
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from bdfc46d to 99a59d4 Compare August 5, 2026 17:44
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 99a59d4 to 67a9305 Compare August 5, 2026 18:03
Base automatically changed from 06-numpy-monoid-identities to main August 5, 2026 18:05
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 67a9305 to 1c41f2b Compare August 5, 2026 18:05
@eriknw
eriknw changed the base branch from main to 42-arm-pickle3-numpy1-skip August 6, 2026 07:58
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 1c41f2b to cfb2cb7 Compare August 6, 2026 07:59
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from cfb2cb7 to 886374b Compare August 6, 2026 15:39
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 886374b to 0eff3f4 Compare August 6, 2026 15:41
@eriknw
eriknw changed the base branch from 42-arm-pickle3-numpy1-skip to 43-ci-local-rng August 6, 2026 20:35
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 0eff3f4 to e1d701a Compare August 6, 2026 20:36
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from e1d701a to 092ab62 Compare August 6, 2026 20:42
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 092ab62 to 252c82c Compare August 7, 2026 02:48
Base automatically changed from 43-ci-local-rng to main August 7, 2026 05:09
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 252c82c to 22af6b1 Compare August 7, 2026 05:09
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 22af6b1 to 4f0dabb Compare August 26, 2026 17:30
`SelectOp._from_indexunary` reuses the IndexUnaryOp's `GrB_IndexUnaryOp`
rather than allocating a second one, and marked the borrowing typed op
`_owns_gb_obj_inst = False` so that only one side would free it. Nothing
kept the owner alive, though: `register_anonymous` drops the IndexUnaryOp
on the way out, so its typed op is collected and frees the handle while the
SelectOp is still pointing at it.

The result is a dangling pointer rather than a NULL one. `__del__` frees
through a synthesized cell, `ffi.new(f"{c_type_name}*", gb_obj)`, so
`GrB_*_free` clears that temporary and leaves the op's own `gb_obj` holding
the old address.

Reproduced at 6f1eb02:

    def _ne_thunk(x, i, j, thunk):
        return x != thunk
    sel = SelectOp.register_anonymous(_ne_thunk)
    gc.collect()
    Vector.from_coo([0, 1, 2], [1, 5, 9]).select(sel, 5).new()
    -> UninitializedObject

Whether it raises depends on whether anything happens to retain the
IndexUnaryOp. With `x > thunk` it survives, because a traceback caught
inside the per-dtype compile loop keeps a frame that references it.

Replace the per-instance opt-out with `_gb_obj_owner`, naming the owning
typed op. That suppresses our free and keeps the handle alive for as long
as we can reach it; disclaiming ownership without naming an owner is what
left the handle dangling. The opt-out being replaced was added in 6f1eb02
to stop a double free, so the sequence is leak, double free, opt-out,
dangling handle, and now an owned reference.
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 01245a0 to 249a147 Compare September 18, 2026 03:09
Read on its own, `_owns_gb_obj = True` says every TypedUserSelectOp frees
its handle. The ones `_from_indexunary` builds do not: they borrow the
IndexUnaryOp's `GrB_IndexUnaryOp` and set `_gb_obj_owner`, which suppresses
the free.

Worth a comment because the mistake is silent. Freeing from both sides is a
use-after-free, and a freed handle usually still reads as valid: with the
ownership removed, select kept returning correct results even after 30
fresh allocations churned the allocator. No test would catch it.
@eriknw
eriknw merged commit 6a967a7 into main Sep 18, 2026
27 of 28 checks passed
@eriknw
eriknw deleted the 07-selectop-borrowed-handle-lifetime branch September 18, 2026 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant