From 15affff087c84d3709ac9145a2f92b8bc109a8d8 Mon Sep 17 00:00:00 2001 From: on8st <258096273+on8st@users.noreply.github.com> Date: Sun, 4 Oct 2026 20:57:15 +0200 Subject: [PATCH] test(offline-health): recorder outlives its factory. Principle VIII. Refs #6154 (finding 1). Section 5 re-declares the `hl2` offline-health factory with a lambda that captures `RecorderState rec` by reference, and leaves it installed for the rest of the process on purpose: section 6 needs `hl2` to keep building the socket-free double. `rec` was declared inside section 5's block, so section 6's rebuild of `hl2` built a RecordingOfflineSource on a dead stack slot and wrote through it (noteOfflineDemand, and the destructor). ASan reports stack-use-after-scope. `rec` is now declared at main scope, before any RadioModel, so it outlives every source the factory can build. The factory stays installed: restoring the real declaration would make section 6 aim the real telemetry service, which binds a socket. Test only. No product code changes. Co-Authored-By: Claude Opus 5.5 --- tests/offline_health_registry_test.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/offline_health_registry_test.cpp b/tests/offline_health_registry_test.cpp index 55bdf60efe..3b50bae4d4 100644 --- a/tests/offline_health_registry_test.cpp +++ b/tests/offline_health_registry_test.cpp @@ -133,6 +133,11 @@ int main(int argc, char** argv) { QCoreApplication app(argc, argv); + // Declared at main scope because the `hl2` factory section 5 installs + // captures it by reference and stays installed until the process exits: + // every later rebuild of `hl2` writes through it. + RecorderState rec; + // ---- 1. the declaration exists at all ---- check(OfflineHealthRegistry::declaredFor(QStringLiteral("hl2")), "hl2 declared an offline health source (registrar was linked in)"); @@ -194,7 +199,6 @@ int main(int argc, char** argv) // resolves. OfflineHealthRegistry::declare() warns on a re-declaration -- // that warning is this line, and it is expected output. { - RecorderState rec; OfflineHealthRegistry::declare( QStringLiteral("hl2"), [&rec](QObject*) { return std::unique_ptr(