From e3cdb190dc5bbaf33dea54226a62a902d2bf42da Mon Sep 17 00:00:00 2001
From: TermiNexus <wyt18222152539wyt@163.com>
Date: Thu, 8 Oct 2026 12:10:30 +0800
Subject: [PATCH] =?UTF-8?q?fix(os):=20=5Fposix.=5Fstat=20=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=20=5Fmbuddy=20=E5=A0=86=E5=88=86=E9=85=8D=EF=BC=8C?=
 =?UTF-8?q?=E6=B6=88=E9=99=A4=E8=BF=94=E5=9B=9E=E6=A0=88=E5=9C=B0=E5=9D=80?=
 =?UTF-8?q?=E7=9A=84=E6=82=AC=E5=9E=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_stat 原在栈上构造 posix.Stat 并返回其地址，函数返回后指针悬垂（与其 docstring 声明的 '_mbuddy 分配、调用方 free' 不一致）。改为按契约堆分配，失败时 free。
---
 os/_posix.vp | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/os/_posix.vp b/os/_posix.vp
index 268130d..af1ef06 100644
--- a/os/_posix.vp
+++ b/os/_posix.vp
@@ -19,11 +19,18 @@ _mbuddy: memhub.MemBuddy*
 def _stat(path: str) -> posix.Stat*:
     """Call stat and return a Stat struct pointer. Return None on failure.
     Note: the Stat struct is allocated via _mbuddy; the caller must free it."""
-    st: posix.Stat = posix.Stat()
-    result: INT = posix.stat(path, &st)
-    if result != 0:
+    if _mbuddy is None:
         return None
-    return &st
+    # 不能在栈上构造后返回其地址：栈对象随本帧失效（栈地址逃逸）。
+    # 按本函数契约改为 _mbuddy 堆分配，由调用方 free。
+    st: posix.Stat* = _mbuddy.alloc(posix.Stat.__sizeof__())
+    if st is None:
+        return None
+    result: INT = posix.stat(path, st)
+    if result != 0:
+        _mbuddy.free(st)
+        return None
+    return st
 
 
 def exists(path: str) -> bool: