Instagram / IGListKit / 25202427585

99%

master: 100%

push

github

Fix heap corruption crash from concurrent array mutation during diff (#1578)

Summary:
Fixes https://github.com/Instagram/IGListKit/issues/1578

Callers of `IGListDiff`/`IGListDiffPaths` may pass `NSMutableArray` instances backed by collections that are mutated on other threads. Because the diffing algorithm uses `__unsafe_unretained` pointers internally for performance, concurrent mutation can cause use-after-free heap corruption — typically manifesting as:

```
malloc: Incorrect checksum for freed object: probably modified after being freed.
```

inside `std::deque::push_back` during the entry `oldIndexes` stack growth.

This change adds `[oldArray copy]` and `[newArray copy]` at the top of `IGListDiffing()`. For immutable `NSArray` inputs this is a no-op retain with zero overhead. For `NSMutableArray` inputs it creates an immutable snapshot, narrowing the race window from the entire O(n+m) diff to just the `-copy` call.

This is a best-effort mitigation — callers are still responsible for not mutating the source array concurrently since `-[NSMutableArray copy]` itself is not atomic.

Differential Revision: D101205956

fbshipit-source-id: 514ebbef1

2 of 2 new or added lines in 1 file covered. (100.0%)

4508 of 4562 relevant lines covered (98.82%)

703.73 hits per line