LibWeb: Accept an empty override span from C++ in the style FFI - #11233
LibWeb: Accept an empty override span from C++ in the style FFI#11233sideshowbarker wants to merge 1 commit into
Conversation
Problem: Rust panic in Debug builds: “unsafe precondition(s) violated: slice::from_raw_parts requires the pointer to be aligned and non-null”. Cause: create_internal() collects the effective longhand overrides into plain AK::Vectors and passes their data() and size() to the table-group builder. collect_effective_longhand_overrides() returns early without touching either vector when there’s nothing to collect. So a vector that never allocated stays empty — and a Vector with no inline capacity returns its null outline buffer straight from data(). The Rust side then borrows the span with slice::from_raw_parts — which requires a non-null aligned pointer even for a zero-length slice. So the empty span on its own is UB, and trips a check compiled in only under debug_assertions. Fix: Borrow the span through a slice_from_raw() helper that yields an empty slice for a zero length without reading the pointer — the way bytes_from_raw() already treats an empty byte span. C++ represents an empty range as a null pointer with length zero. So the FFI boundary is where that convention has to be accepted — rather than at every caller.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughAdded Possibly related PRs
Suggested reviewers: Merge Risk: ⚪ Minimal · up to This localized change allows empty style override spans to be handled safely without changing non-empty behavior; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Problem: Rust panic in Debug builds: “unsafe precondition(s) violated: slice::from_raw_parts requires the pointer to be aligned and non-null”.
Cause:
create_internal()collects the effective longhand overrides into plainAK::Vectors and passes theirdata()andsize()to the table-group builder.collect_effective_longhand_overrides()returns early without touching either vector when there’s nothing to collect. So a vector that never allocated stays empty — and aVectorwith no inline capacity returns its null outline buffer straight fromdata(). The Rust side then borrows the span withslice::from_raw_parts— which requires a non-null aligned pointer even for a zero-length slice. So the empty span on its own is UB, and trips a check compiled in only underdebug_assertions.Fix: Borrow the span through a
slice_from_raw()helper that yields an empty slice for a zero length without reading the pointer — the waybytes_from_raw()already treats an empty byte span. C++ represents an empty range as a null pointer with length zero. So the FFI boundary is where that convention has to be accepted — rather than at every caller.The problem was reported on Discord: https://discord.com/channels/1247070541085671459/1247070543136690270/1539926273294336061