Track deque mutations and release removed items outside locks - #8847

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

Deque mutations now update mutation state in additional cases, detect changes during remove comparisons, and drop removed elements after releasing the lock. Initialization clears prior contents before converting its iterable. Regression tests cover these behaviors with iterators, finalizers, and bounded deques.

Changes

Deque mutation behavior

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Suggested reviewers: youknowone

Security Blast Radius

• inferred — The demonstrated reentrancy path affects the targeted deque’s capacity invariant. The inspected entrypoints show no new privilege, tenant boundary, service dependency, or independently reachable sink.

Trust Boundaries and Controls

• observed — remove checks mutation state after rich comparison and again under the removal lock. That control does not govern maxlen changes made by callbacks during initialization.

Resilience and Maintainability Implications

• inferred — Releasing removed objects after unlocking reduces reentrant-finalizer lock risk, while the initializer’s split transition leaves its capacity bound vulnerable to a nested initialization during iterable conversion.

Hardening Proposals

• proposed — Define which initialization owns maxlen after reentrancy, then validate the effective limit when committing converted elements so the resulting deque cannot exceed its reported bound.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn