From edd842b6af4c886bbef000356b1add68d03bf552 Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Wed, 19 Aug 2026 07:34:57 +0800 Subject: [PATCH] =?UTF-8?q?fix(phase2):=20free=5Fllc=5Ftask=20=E8=AF=AF=20?= =?UTF-8?q?free=20=E4=BB=BB=E5=8A=A1=E6=A7=BD=E5=AF=BC=E8=87=B4=20double-f?= =?UTF-8?q?ree?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit LlcTask 记录是 llc_tasks 数组的连续槽（非独立 malloc），free_llc_task 此前对槽调 stdlib.free，循环后又对数组整体 free -> 同一 32 字节区域 double-free（ASan）。修复：free_llc_task 只释放命令串并置 None，记录 由调用方随数组整体释放。 --- App/lib/core/BuildPipeline.vp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/App/lib/core/BuildPipeline.vp b/App/lib/core/BuildPipeline.vp index 84bbf92..ce6d5e2 100644 --- a/App/lib/core/BuildPipeline.vp +++ b/App/lib/core/BuildPipeline.vp @@ -490,16 +490,19 @@ def init_llc_task(task: LlcTask | t.CPtr, ir_path: str, output_dir: str, def free_llc_task(task: LlcTask | t.CPtr): - """释放任务（命令串 + 记录）""" + """释放任务的命令串；记录本身是任务数组的连续槽（非独立 malloc）， + 由调用方对数组整体 stdlib.free（此前对槽 free 导致 double-free）""" if task is None: return if task.OptCmd is not None: stdlib.free(task.OptCmd) + task.OptCmd = None if task.LlcCmd is not None: stdlib.free(task.LlcCmd) + task.LlcCmd = None if task.ModuleSha1 is not None: stdlib.free(task.ModuleSha1) - stdlib.free(task) + task.ModuleSha1 = None def _llc_task_worker(arg: t.CPtr) -> t.CPtr: