Skip to main content

Module vec_into_sexp

Module vec_into_sexp 

Source
Expand description

into_sexp() inside a vec!/array literal โ€” use-after-free idiom.

  • MXL302: Warns on into_sexp() / into_sexp_unchecked() calls that appear as elements inside a vec! or &[...] literal.

    Each into_sexp allocates a fresh SEXP. When several occur in one literal (vec![(k, a.into_sexp()), (k, b.into_sexp())]), nothing roots the earlier elements until the whole Vec reaches List::from_raw_pairs, so building a later element can trigger a GC that collects an earlier, still-unprotected one โ€” a use-after-free. This recurred enough (#307, the 2026-05-07 gctorture audit) that the IntoList / DataFrameRow derives now wrap every element in __scope.protect_raw(...); this lint stops new hand-written sites from reintroducing the raw form silently.

Functionsยง

check