mark_sweep: run destructors for live values on collector drop

oscars/src/collectors/mark_sweep/mod.rs

@@ -124,11 +124,19 @@ impl Drop for MarkSweepGarbageCollector {
 
         // SAFETY:
         // `Gc<T>` pointers act as if they live forever (`'static`).
-        // if the GC drops while they exist, we leak the memory to prevent a UAF
-        if self.pools_len() > 0
-            && (!self.root_queue.borrow().is_empty()
-                || !self.pending_root_queue.borrow().is_empty())
-        {
+        // if the GC drops while rooted values still exist, we leak memory to prevent UAF.
+        let has_rooted_values = self
+            .root_queue
+            .borrow()
+            .iter()
+            .any(|node| unsafe { node.as_ref().value().is_rooted() })
+            || self
+                .pending_root_queue
+                .borrow()
+                .iter()
+                .any(|node| unsafe { node.as_ref().value().is_rooted() });
+
+        if self.pools_len() > 0 && has_rooted_values {
             // Unrooted items are NOT swept here so they intentionally leak
             // instead of triggering a Use-After-Free.
             // The underlying arena pools WILL be dropped (and OS memory reclaimed)

oscars/src/collectors/mark_sweep/tests.rs

@@ -634,3 +634,93 @@ mod gc_edge_cases {
         collector.collect();
     }
 }
+
+#[test]
+fn collector_drop_runs_destructors_for_live_gc_values() {
+    use core::cell::Cell;
+    use rust_alloc::rc::Rc;
+
+    struct DropSpy {
+        drops: Rc<Cell<u32>>,
+    }
+
+    impl Drop for DropSpy {
+        fn drop(&mut self) {
+            self.drops.set(self.drops.get() + 1);
+        }
+    }
+
+    impl Finalize for DropSpy {}
+
+    // SAFETY: `DropSpy` has no traceable children.
+    unsafe impl Trace for DropSpy {
+        crate::empty_trace!();
+    }
+
+    let drops = Rc::new(Cell::new(0));
+    {
+        let collector = &mut MarkSweepGarbageCollector::default()
+            .with_page_size(128)
+            .with_heap_threshold(256);
+
+        let _gc = Gc::new_in(
+            DropSpy {
+                drops: Rc::clone(&drops),
+            },
+            collector,
+        );
+
+        assert_eq!(drops.get(), 0);
+    }
+
+    assert_eq!(drops.get(), 1, "collector drop should run value destructor");
+}
+
+#[test]
+fn collector_drop_runs_ephemeron_value_destructors_for_live_values() {
+    use core::cell::Cell;
+    use rust_alloc::rc::Rc;
+
+    struct DropSpy {
+        drops: Rc<Cell<u32>>,
+    }
+
+    impl Drop for DropSpy {
+        fn drop(&mut self) {
+            self.drops.set(self.drops.get() + 1);
+        }
+    }
+
+    impl Finalize for DropSpy {}
+
+    // SAFETY: `DropSpy` has no traceable children.
+    unsafe impl Trace for DropSpy {
+        crate::empty_trace!();
+    }
+
+    let drops = Rc::new(Cell::new(0));
+    {
+        let collector = &mut MarkSweepGarbageCollector::default()
+            .with_page_size(128)
+            .with_heap_threshold(256);
+
+        let mut map = WeakMap::new(collector);
+        let key = Gc::new_in(1u64, collector);
+
+        map.insert(
+            &key,
+            DropSpy {
+                drops: Rc::clone(&drops),
+            },
+            collector,
+        );
+
+        assert_eq!(drops.get(), 0);
+    }
+
+    assert_eq!(
+        drops.get(),
+        1,
+        "collector drop should run ephemeron value destructor"
+    );
+}