Skip to content

fix potential null deref in merge_vararg_unions #59525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 10, 2025
Merged

fix potential null deref in merge_vararg_unions #59525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ace8225
fix potential null deref in merge_vararg_unions
adienes Sep 9, 2025
7a648b3
fix test
adienes Sep 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/jltypes.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,7 +614,7 @@ STATIC_INLINE void merge_vararg_unions(jl_value_t **temp, size_t nt)
size_t min_elements = nfields-1;
for (long j = i-1; j >= 0; j--) {
jl_value_t *ttj = temp[j];
if (!jl_is_tuple_type(ttj)) break;
if (!(ttj && jl_is_tuple_type(ttj))) break;
size_t nfieldsj = jl_nparams(ttj);
if (nfieldsj >= min_elements) continue;
if (nfieldsj != min_elements-1) break;
Expand Down
7 changes: 7 additions & 0 deletions test/subtype.jl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,13 @@ function test_2()
@test !(Tuple{Int,Vararg{Int,2}} <: Tuple{Int,Int,Int,Vararg{Int,1}})
@test Tuple{Int,Vararg{Int}} == Tuple{Int,Vararg{Int}}
@test (@UnionAll N Tuple{Int,Vararg{Int,N}}) == (@UnionAll N Tuple{Int,Vararg{Int,N}})
@test Union{Tuple{}, Tuple{Int}, Tuple{UInt}} <: Union{
Copy link
Contributor

@Seelengrab Seelengrab Sep 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
@test Union{Tuple{}, Tuple{Int}, Tuple{UInt}} <: Union{
# This is a regression test against a nullcheck/segfault in jltypes.c
@test Union{Tuple{}, Tuple{Int}, Tuple{UInt}} <: Union{

Copy link
Member Author

@adienes adienes Sep 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's also a correct test, right? I mean I'm not opposed to such a comment per se it just seems maybe unnecessary, especially since the cause of the crash is "typo" not "design failure"

Copy link
Member

@vtjnash vtjnash Sep 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Preferably it would have been added to the list of tests for this function, with a comment noting the issue number or PR, though both are commonly extracted from git praise anyways d4362e4#diff-90c3a7a047872b9929e6577e16ad589a77552d0de0400c98cf303b6b7204e683R8257

Tuple{},
Tuple{Int},
Tuple{UInt},
Tuple{UInt, Vararg{UInt}},
Tuple{Int, Int, Vararg{Int}}
}

@test issub_strict(Tuple{Tuple{Int,Int},Tuple{Int,Int}}, Tuple{NTuple{N,Int},NTuple{N,Int}} where N)
@test !issub(Tuple{Tuple{Int,Int},Tuple{Int,}}, Tuple{NTuple{N,Int},NTuple{N,Int}} where N)
Expand Down