Skip to content

fix(lazy): clear the key buffer before a nested get_many lookup - #244

Open
yuefdev wants to merge 1 commit into
cloudwego:mainfrom
yuefdev:fix-get-many-stale-key-buf
Open

yuefdev wants to merge 1 commit into
cloudwego:mainfrom
yuefdev:fix-get-many-stale-key-buf

Conversation

@yuefdev

@yuefdev yuefdev commented Sep 14, 2026

Copy link
Copy Markdown

Fixes #241.

parse_str only clears the key buffer right before it copies an escaped key into it. A key with a simple escape (\f, \n, \) leaves its unescaped bytes in the buffer, and when get_many_keys is entered again with that buffer, debug_assert!(strbuf.is_empty()) fires. There are two ways to get there:

  • a later key in the same object has no escape (so it's borrowed), matches, and recurses: {"\f":9,"c":{"d":1}} with c/d, as in the issue
  • the escaped key is the last one read in an earlier array element, and a later element is looked up: {"a":[{"x":1,"\f":2},{"y":3}]} with a/0/x and a/1/y

Clearing the buffer only before the recursion in get_many_keys would miss the second case, so this clears it on entry to get_many_keys in place of the assert. Nothing reads a key's bytes after its own lookup, so the result is unchanged. Release builds were already returning the right values.

Added test_get_many_after_escaped_key covering both cases for get_many and get_many_unchecked. It panics on main with debug assertions and passes with the fix. cargo test and cargo clippy --all-targets --all-features -- -D warnings pass locally.

`parse_str` only clears the key buffer right before copying an escaped key
into it. A key with a simple escape (`\f`, `\n`, `\`) therefore leaves its
unescaped bytes behind, and when a later borrowed key (or a later array
element) leads into `get_many_keys`, the `debug_assert!(strbuf.is_empty())`
there fires. Release builds return the right result, but any caller
testing with debug assertions panics on such input.

Clear the buffer on entry to `get_many_keys` instead of asserting it is
empty; nothing reads a key's bytes past its own lookup.

Fixes cloudwego#241
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

get_many: debug_assert!(strbuf.is_empty()) fires after a sibling key with a simple escape

2 participants