ossia / libossia / 33336873879

52%

Build Type

push

github

Committed by jcelerier

Commit Message

editor: stop expression observation in time_sync reset() and set_expression()

time_sync::reset() only cleared m_observe and left the dummy expression
callback registered, so after a scenario stop (scenario::stop,
reset_subgraph, exclusive-mode resets) a not-yet-fired trigger's
expression atom stayed subscribed to the device parameters it observes.
Destroying a device before the scenario graph then made
~expression_atom -> on_removing_last_callback() -> parameter
remove_callback() read freed memory: the heap-use-after-free seen on a
174-score ASan corpus run in ossia/score
(#0 callback_container.hpp:117,
 #1 expression_atom.cpp:118, freed by ~generic_parameter).

set_expression() also replaced the expression while m_callback could
still be engaged (reset() used to leave it so), leaving m_callback
pointing into the destroyed expression's callback storage; the next
observe_expression() handed that stale iterator to the new expression's
remove_callback.

Both paths now detach the stored callback from the expression first.

The callback_container hook pairing itself is sound:
on_first_callback_added / on_removing_last_callback fire exactly on the
0<->1 size transitions, so no guard was added there; the control test
documents that.

The new ExpressionObservationLifetimeTest was verified to fail before
the fix under ASan (heap-use-after-free with the corpus frames for the
reset case; out-of-range static_vector erase aborts for the stale
iterator cases) and passes after.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014rZgzE8JjWvHDtaVUhxpLE

Coverage Stats

64 of 64 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

30611 of 59582 relevant lines covered (51.38%)

178415.55 hits per line