Expand description
into_sexp() inside a vec!/array literal โ use-after-free idiom.
-
MXL302: Warns on
into_sexp()/into_sexp_unchecked()calls that appear as elements inside avec!or&[...]literal.Each
into_sexpallocates a fresh SEXP. When several occur in one literal (vec![(k, a.into_sexp()), (k, b.into_sexp())]), nothing roots the earlier elements until the wholeVecreachesList::from_raw_pairs, so building a later element can trigger a GC that collects an earlier, still-unprotected one โ a use-after-free. This recurred enough (#307, the 2026-05-07 gctorture audit) that theIntoList/DataFrameRowderives now wrap every element in__scope.protect_raw(...); this lint stops new hand-written sites from reintroducing the raw form silently.