add overflow guard to inc(), #[must_use] on dec()/safe_inc(), trashcan debug_assert, weakref generic re-check

youknowone · youknowone · commit 797474d3bb26 · 2026-02-22T18:48:08.000+09:00
diff --git a/crates/common/src/refcount.rs b/crates/common/src/refcount.rs
@@ -99,7 +99,7 @@ impl RefCount {
     #[inline]
     pub fn inc(&self) {
         let val = State::from_raw(self.state.fetch_add(COUNT, Ordering::SeqCst));
-        if val.destructed() {
+        if val.destructed() || (val.strong() as usize) > STRONG - 1 {
             refcount_overflow();
         }
         if val.strong() == 0 {
@@ -211,8 +211,9 @@ impl Drop for DeferredDropGuard {
         IN_DEFERRED_CONTEXT.with(|in_ctx| {
             in_ctx.set(self.was_in_context);
         });
-        // Only flush if we're the outermost context
-        if !self.was_in_context {
+        // Only flush if we're the outermost context and not already panicking
+        // (flushing during unwinding risks double-panic → process abort).
+        if !self.was_in_context && !std::thread::panicking() {
             flush_deferred_drops();
         }
     }
diff --git a/crates/vm/src/object/core.rs b/crates/vm/src/object/core.rs
@@ -127,7 +127,9 @@ mod trashcan {
     #[inline]
     pub(super) unsafe fn end() {
         let depth = DEALLOC_DEPTH.with(|d| {
-            let depth = d.get() - 1;
+            let depth = d.get();
+            debug_assert!(depth > 0, "trashcan::end called without matching begin");
+            let depth = depth - 1;
             d.set(depth);
             depth
         });
@@ -434,6 +436,21 @@ impl WeakRefList {
         // Re-acquire lock for linked list insertion
         let _lock = weakref_lock::lock(obj as *const PyObject as usize);
 
+        // Re-check: another thread may have inserted a generic ref while we
+        // were allocating outside the lock. If so, reuse it and drop ours.
+        if is_generic {
+            let generic_ptr = self.generic.load(Ordering::Relaxed);
+            if !generic_ptr.is_null() {
+                let generic = unsafe { &*generic_ptr };
+                if generic.0.ref_count.safe_inc() {
+                    // Nullify wr_object so drop_inner won't unlink an
+                    // uninserted node (which would corrupt the list head).
+                    weak.wr_object.store(ptr::null_mut(), Ordering::Relaxed);
+                    return unsafe { PyRef::from_raw(generic_ptr) };
+                }
+            }
+        }
+
         // Insert into linked list under stripe lock
         let node_ptr = NonNull::from(&*weak);
         unsafe {
