fix(compress): keep Fast dictionary projection live

The Fast dictionary-table projection was populated before the Rust
orchestrator ran its window-update and match-state publication callbacks.
That left base and nextToUpdate pointing at the initial sentinel for MT
prefix jobs, which caused ZSTD_rust_fillHashTable to dereference an invalid
range. Project pointers to the live match-state fields so Rust reads the
same values the former C adapter would have read at the Fast branch.

Test Plan:
- git diff --check
- ulimit -v 41943040; CARGO_BUILD_JOBS=1 cargo check --manifest-path rust/Cargo.toml --tests
- ulimit -v 41943040; make -j1
- capped 4 MiB -T0 compress/decompress round trip with cmp
This commit is contained in:
2026-07-21 20:52:27 +02:00
parent 4a3d5b9d27
commit 846e18f6d9
2 changed files with 63 additions and 60 deletions
+45 -43
View File
@@ -141,17 +141,17 @@ type LoadDictionaryContentOverflowCorrectFn =
unsafe extern "C" fn(context: *mut c_void, ip: *const c_void, iend: *const c_void);
/// Direct projection for the Fast dictionary-table leaf.
///
/// C copies `nextToUpdate` rather than exposing a pointer into the private
/// match state. `fullTableLoad` and `forCDict` are normalized from the C enum
/// inputs after their original validity assertion has run.
/// C exposes pointers to the live scalar fields needed by the Fast leaf.
/// `fullTableLoad` and `forCDict` are normalized from the C enum inputs after
/// their original validity assertion has run.
#[repr(C)]
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
struct ZSTD_rust_loadDictionaryContentFastTableState {
hash_table: *mut c_uint,
base: *const u8,
next_to_update: c_uint,
hash_log: c_uint,
min_match: c_uint,
hash_table: *const *mut c_uint,
base: *const *const u8,
next_to_update: *const c_uint,
hash_log: *const c_uint,
min_match: *const c_uint,
full_table_load: c_int,
for_cdict: c_int,
}
@@ -229,28 +229,25 @@ const _: () = {
);
assert!(
offset_of!(ZSTD_rust_loadDictionaryContentFastTableState, hash_log)
== 2 * size_of::<usize>() + size_of::<c_uint>()
== 3 * size_of::<usize>()
);
assert!(
offset_of!(ZSTD_rust_loadDictionaryContentFastTableState, min_match)
== 2 * size_of::<usize>() + 2 * size_of::<c_uint>()
== 4 * size_of::<usize>()
);
assert!(
offset_of!(
ZSTD_rust_loadDictionaryContentFastTableState,
full_table_load
) == 2 * size_of::<usize>() + 3 * size_of::<c_uint>()
) == 5 * size_of::<usize>()
);
assert!(
offset_of!(ZSTD_rust_loadDictionaryContentFastTableState, for_cdict)
== 2 * size_of::<usize>() + 3 * size_of::<c_uint>() + size_of::<c_int>()
== 5 * size_of::<usize>() + size_of::<c_int>()
);
assert!(
size_of::<ZSTD_rust_loadDictionaryContentFastTableState>()
== (offset_of!(ZSTD_rust_loadDictionaryContentFastTableState, for_cdict)
+ size_of::<c_int>())
.div_ceil(size_of::<usize>())
* size_of::<usize>()
== 5 * size_of::<usize>() + 2 * size_of::<c_int>()
);
assert!(size_of::<LoadDictionaryContentLoadMatchFn>() == size_of::<usize>());
assert!(size_of::<LoadDictionaryContentLoadTreeFn>() == size_of::<usize>());
@@ -369,6 +366,25 @@ fn dictionary_table_policy(
}
}
#[inline]
unsafe fn fill_fast_dictionary_table(
fast_table: &ZSTD_rust_loadDictionaryContentFastTableState,
end: *const c_void,
) {
unsafe {
ZSTD_rust_fillHashTable(
*fast_table.hash_table,
*fast_table.base,
*fast_table.next_to_update,
end,
*fast_table.hash_log,
*fast_table.min_match,
fast_table.full_table_load,
fast_table.for_cdict,
)
}
}
unsafe fn load_dictionary_content(
state: &ZSTD_rust_loadDictionaryContentState,
src: *const c_void,
@@ -446,16 +462,7 @@ unsafe fn load_dictionary_content(
) {
DictionaryTablePolicy::Fast => unsafe {
let fast_table = &*state.fast_table;
ZSTD_rust_fillHashTable(
fast_table.hash_table,
fast_table.base,
fast_table.next_to_update,
iend.cast(),
fast_table.hash_log,
fast_table.min_match,
fast_table.full_table_load,
fast_table.for_cdict,
)
fill_fast_dictionary_table(fast_table, iend.cast())
},
DictionaryTablePolicy::DoubleFast => unsafe {
(state.fill_double_hash_table)(
@@ -6467,31 +6474,26 @@ mod tests {
for (index, byte) in input.iter_mut().enumerate() {
*byte = (index as u8).wrapping_mul(37).wrapping_add(11);
}
let hash_table_ptr = hash_table.as_mut_ptr();
let base_ptr = input.as_ptr();
let next_to_update = 17u32;
let min_match = 4u32;
let projection = ZSTD_rust_loadDictionaryContentFastTableState {
hash_table: hash_table.as_mut_ptr(),
base: input.as_ptr(),
next_to_update: 17,
hash_log,
min_match: 4,
hash_table: &hash_table_ptr,
base: &base_ptr,
next_to_update: &next_to_update,
hash_log: &hash_log,
min_match: &min_match,
full_table_load: 1,
for_cdict: 1,
};
unsafe {
ZSTD_rust_fillHashTable(
projection.hash_table,
projection.base,
projection.next_to_update,
input.as_ptr().wrapping_add(input.len()).cast(),
projection.hash_log,
projection.min_match,
projection.full_table_load,
projection.for_cdict,
)
};
fill_fast_dictionary_table(&projection, input.as_ptr().wrapping_add(input.len()).cast())
}
assert!(hash_table.iter().any(|&entry| entry != 0));
assert_eq!(projection.next_to_update, 17);
assert_eq!(unsafe { *projection.next_to_update }, 17);
assert_eq!(projection.full_table_load, 1);
assert_eq!(projection.for_cdict, 1);
}