Skip to content

Context varargs can smuggle graph-runtime references past the borrow tree's lifetime discipline #4358

Description

@Keavon

Reported by @TrueDoctor following the rank polymorphism PR (#4335). Three existing mechanisms combine into an unsound API surface:

  1. The borrow tree launders lifetimes: NodeContainer derefs *const TypeErasedNode<'static> to &'static, so references handed out inside the graph (the &PlatformEditorApi scope wire, &WgpuExecutor, or any reference to node-owned state) are typed 'static but actually live only until the next graph recompilation deallocates their owner.
  2. OwnedContextImpl::with_vararg accepts any Box<dyn AnyHash + Send + Sync>. Its 'static bound cannot distinguish real ownership from a laundered reference, so safe code in any node can store such a reference into a context. Make the data model use Item and List types universally, with nodes authored as rank-polymorphic kernels #4335 made this channel idiomatic (render boundary config, per-item lambda rows).
  3. Contexts escape the graph: the Monitor node snapshots IORecord { input: Context, output } into an Arc<dyn Any> that the editor introspects and can retain across recompiles.

Combined: a node stores a laundered reference as a vararg, a Monitor captures the context, the graph recompiles and frees the referent, and the editor reads freed memory through entirely safe code (vararg() + downcast_ref). A vararg with interior mutability would similarly let context readers mutate graph-owned state as a covert return channel.

All current with_vararg callers box owned data, so no UB exists in the code today. But the risk remains for the API permitting it silently.

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrapheneInvolves the node graph system/engine used by Graphite

    Projects

    Status
    Short-Term

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions