Fix use-after-free between ZipperHead readers and writers

benches/zipper_head_owned.rs

@@ -33,6 +33,22 @@ where
     });
 }
 
+fn bench_head_read_at_path<'trie, H>(bencher: Bencher, head: &H, path: &[u8])
+where
+    H: ZipperCreation<'trie, usize>,
+{
+    bencher.bench_local(|| {
+        let mut observed = 0usize;
+        for _ in 0..REPEATS {
+            let reader = head.read_zipper_at_borrowed_path(black_box(path)).unwrap();
+            observed += reader.val().copied().unwrap_or_default();
+            observed += reader.child_count();
+            drop(reader);
+        }
+        black_box(observed);
+    });
+}
+
 fn bench_head_write_creation_cleanup<'trie, H, const CHECKED: bool>(bencher: Bencher, head: &H)
 where
     H: ZipperCreation<'trie, usize>,
@@ -72,6 +88,118 @@ fn owned_head_read_creation(bencher: Bencher) {
     bench_head_read_creation(bencher, &head);
 }
 
+#[divan::bench]
+fn borrowed_head_read_value_in_shared_parent(bencher: Bencher) {
+    let mut map = PathMap::<usize>::new();
+    map.set_val_at([0x22u8], 22);
+    map.set_val_at([0x22u8, 0x01], 1);
+    let head = black_box(&mut map).zipper_head();
+    let _writer = head.write_zipper_at_exclusive_path([0x11u8]).unwrap();
+    bench_head_read_at_path(bencher, &head, &[0x22]);
+}
+
+#[divan::bench]
+fn borrowed_head_read_missing_path(bencher: Bencher) {
+    let mut map = zipper_head_fixture();
+    let head = black_box(&mut map).zipper_head();
+    let _writer = head.write_zipper_at_exclusive_path([0x11u8]).unwrap();
+    bench_head_read_at_path(bencher, &head, &[0xee, 0x00]);
+}
+
+const READ_ACCESS_REPEATS: usize = 1000;
+
+fn bench_shared_parent_reader_access<const OP: u8>(bencher: Bencher) {
+    let mut map = PathMap::<usize>::new();
+    map.set_val_at([0x22u8], 22);
+    map.set_val_at([0x22u8, 0x01], 1);
+    let head = black_box(&mut map).zipper_head();
+    let _writer = head.write_zipper_at_exclusive_path([0x11u8]).unwrap();
+    let reader = head.read_zipper_at_borrowed_path(&[0x22u8]).unwrap();
+    assert_eq!(reader.val(), Some(&22));
+    assert_eq!(reader.child_count(), 1);
+    bencher.bench_local(|| {
+        let mut observed = 0usize;
+        for _ in 0..READ_ACCESS_REPEATS {
+            let reader = black_box(&reader);
+            if OP == 0 {
+                observed += reader.val().copied().unwrap_or_default();
+            } else if OP == 1 {
+                observed += reader.is_val() as usize;
+            } else if OP == 2 {
+                observed += reader.is_shared() as usize;
+            } else {
+                black_box(reader.get_focus());
+            }
+        }
+        black_box(observed);
+    });
+}
+
+#[divan::bench]
+fn shared_parent_reader_val(bencher: Bencher) {
+    bench_shared_parent_reader_access::<0>(bencher);
+}
+
+#[divan::bench]
+fn shared_parent_reader_is_val(bencher: Bencher) {
+    bench_shared_parent_reader_access::<1>(bencher);
+}
+
+#[divan::bench]
+fn shared_parent_reader_is_shared(bencher: Bencher) {
+    bench_shared_parent_reader_access::<2>(bencher);
+}
+
+#[divan::bench]
+fn shared_parent_reader_get_focus(bencher: Bencher) {
+    bench_shared_parent_reader_access::<3>(bencher);
+}
+
+fn bench_map_reader_access<const OP: u8>(bencher: Bencher) {
+    let mut map = PathMap::<usize>::new();
+    map.set_val_at([0x22u8], 22);
+    map.set_val_at([0x22u8, 0x01], 1);
+    let reader = map.read_zipper_at_path([0x22u8]);
+    assert_eq!(reader.val(), Some(&22));
+    assert_eq!(reader.child_count(), 1);
+    bencher.bench_local(|| {
+        let mut observed = 0usize;
+        for _ in 0..READ_ACCESS_REPEATS {
+            let reader = black_box(&reader);
+            if OP == 0 {
+                observed += reader.val().copied().unwrap_or_default();
+            } else if OP == 1 {
+                observed += reader.is_val() as usize;
+            } else if OP == 2 {
+                observed += reader.is_shared() as usize;
+            } else {
+                black_box(reader.get_focus());
+            }
+        }
+        black_box(observed);
+    });
+}
+
+#[divan::bench]
+fn map_reader_val(bencher: Bencher) {
+    bench_map_reader_access::<0>(bencher);
+}
+
+#[divan::bench]
+fn map_reader_is_val(bencher: Bencher) {
+    bench_map_reader_access::<1>(bencher);
+}
+
+#[divan::bench]
+fn map_reader_is_shared(bencher: Bencher) {
+    bench_map_reader_access::<2>(bencher);
+}
+
+#[divan::bench]
+fn map_reader_get_focus(bencher: Bencher) {
+    bench_map_reader_access::<3>(bencher);
+}
+
 #[divan::bench]
 fn borrowed_head_write_creation_cleanup(bencher: Bencher) {
     let mut map = zipper_head_fixture();