From d5e92ce97a55c39158329257dd80dc6a24f393ad Mon Sep 17 00:00:00 2001 From: Stefan Boberg Date: Fri, 17 Apr 2026 16:36:10 +0200 Subject: zenbase hardening (#971) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A series of correctness and API hygiene fixes to the intrusive refcount primitives in `zenbase`, culminating in the removal of `RefPtr` in favour of a single unified `Ref` smart pointer. The changes are motivated by two pieces of latent UB sitting under every `Ref` / `TRefCounted` in the codebase, plus a handful of API footguns on the smart-pointer side (silent raw-pointer decay, missing converting moves, unconstrained conversions from unrelated types). ## Correctness fixes - **Strict-aliasing UB in atomic helpers** — `AtomicIncrement`/`Decrement`/`Add` took a `volatile uint32_t&` and reinterpret-cast it to `std::atomic*`. The object was never constructed as a `std::atomic`, so the access was type-punning UB. Fixed by changing `m_RefCount` to `std::atomic` directly in `RefCounted`, `TRefCounted` and `IoBufferCore`. The helpers (and `zenbase/atomic.h`) are later removed entirely — the three callers now invoke `fetch_add`/`fetch_sub` directly. - **const_cast of non-mutable member** — `AddRef()` / `Release()` are `const` but mutated `m_RefCount` via `const_cast`. Since `m_RefCount` wasn't `mutable`, writing through the cast was UB for any `const`-qualified holder (e.g. a `static const` refcounted singleton). Fixed by marking `m_RefCount` `mutable` and dropping the `const_cast` in `AddRef`/`Release`. - **Public non-virtual `TRefCounted` destructor** — allowed `delete basePtr;` to slice past the CRTP `DeleteThis()` contract. Moved to `protected`. ## Memory-ordering cleanup - `AddRef` weakened from seq_cst to **relaxed** (a thread can only take a new reference via one it already holds; nothing needs to synchronize). - `Release` weakened from seq_cst to **acq_rel** (sufficient to order prior writes before the destructor, and make the decrement visible to observers). - Diagnostic `RefCount()` / `GetRefCount()` reads made **relaxed** and spelled out as explicit `.load()` — the returned value is stale the moment it's observed, so stronger ordering gives no guarantee. - No-op on x86 (`lock xadd` either way), but removes a full barrier on every `Ref` copy on ARM64 (Apple silicon / Windows-on-ARM). ## `RefPtr` / `Ref` unification Before this branch, `RefPtr` and `Ref` were subtly different in ways that made the safer of the two (`Ref`) harder to use and the looser one (`RefPtr`) dangerous: - `RefPtr::operator T*()` was implicit — `delete refPtr;` compiled silently (double-delete), and the raw pointer could outlive the temporary `RefPtr` it was extracted from. Made `explicit`, then removed entirely once call sites were migrated to `.Get()`. - `RefPtr(T*)` was implicit while `RefPtr(RefPtr&&)` was `explicit` — exactly the opposite of the safety intent. Reversed. - `RefPtr`'s converting move was unconstrained (any `RefPtr` with an implicitly-convertible `U*` satisfied it, including `void*` and multiple-inheritance base offsets). Added a `DerivedFrom` constraint matching `Ref`. - `Ref` was missing a converting move ctor / move-assignment from `Ref` — upcasts of rvalues were going through `AddRef`+`Release` instead of a pointer steal. Added. - `Release()` and the non-move smart-pointer ops were not `noexcept`, despite being so in practice. Marked `noexcept` throughout. After all of the above, the two types were functionally identical. The final commit deletes `RefPtr` and rewrites the ~10 consumer files to use `Ref`. --- src/zencore/refcount.cpp | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) (limited to 'src/zencore/refcount.cpp') diff --git a/src/zencore/refcount.cpp b/src/zencore/refcount.cpp index f19afe715..674b154e0 100644 --- a/src/zencore/refcount.cpp +++ b/src/zencore/refcount.cpp @@ -35,29 +35,29 @@ refcount_forcelink() TEST_SUITE_BEGIN("core.refcount"); -TEST_CASE("RefPtr") +TEST_CASE("Ref") { - RefPtr Ref; - Ref = new TestRefClass; + Ref RefA; + RefA = new TestRefClass; bool IsDestroyed = false; - Ref->OnDestroy = [&] { IsDestroyed = true; }; + RefA->OnDestroy = [&] { IsDestroyed = true; }; CHECK(IsDestroyed == false); - CHECK(Ref->RefCount() == 1); + CHECK(RefA->RefCount() == 1); - RefPtr Ref2; - Ref2 = Ref; + Ref RefB; + RefB = RefA; CHECK(IsDestroyed == false); - CHECK(Ref->RefCount() == 2); + CHECK(RefA->RefCount() == 2); - RefPtr Ref3; - Ref2 = Ref3; + Ref RefC; + RefB = RefC; CHECK(IsDestroyed == false); - CHECK(Ref->RefCount() == 1); - Ref = Ref3; + CHECK(RefA->RefCount() == 1); + RefA = RefC; CHECK(IsDestroyed == true); } -- cgit v1.2.3