crates/vm/src/builtins/tuple.rs (1)

110-130: ⚠️ Potential issue | 🔴 Critical

Per-size tuple freelist is effectively bypassed at push time.

At Line 112, bucket selection uses py_tuple.elements.len(), but default_dealloc (in core.rs:191-194) calls tp_clear before freelist_push. The PyTuple::clear implementation (lines 52-55) does core::mem::take(&mut self.elements), which empties the elements. When freelist_push runs, len == 0, so lines 113-114 return false and tuples are never cached in size buckets.

To fix this, the tuple length must be captured before tp_clear runs. One approach is to store the original size in the PyTuple payload (e.g., an original_len: usize field set at construction) or pass the pre-clear size into freelist_push via a different mechanism.

,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/builtins/tuple.rs` around lines 110 - 130, freelist_push
currently reads the tuple length from py_tuple.elements, but PyTuple::clear
(called by default_dealloc) empties elements before freelist_push runs so len is
always 0; fix by capturing the tuple size before clearing and passing it to
freelist_push (or storing it in the PyTuple payload set at construction) so
bucket selection uses the pre-clear size. Update freelist_push signature (or add
original_len field) and all call sites (notably default_dealloc / tp_clear path)
to supply the original length, and keep the existing bounds check against
TupleFreeList::MAXSAVESIZE and TUPLE_FREELIST bucket logic.

crates/vm/src/builtins/tuple.rs (1)

62-63: Store NonNull<PyObject> in the buckets.

That makes the non-null invariant explicit and removes the unchecked conversion on Line 148.

♻️ Suggested cleanup

 struct TupleFreeList {
-    buckets: [Vec<*mut PyObject>; Self::MAXSAVESIZE],
+    buckets: [Vec<NonNull<PyObject>>; Self::MAXSAVESIZE],
 }
...
                 let bucket = &mut list.buckets[len - 1];
                 let stored = if bucket.len() < Self::MAX_FREELIST {
-                    bucket.push(obj);
+                    bucket.push(NonNull::new_unchecked(obj));
                     true
                 } else {
                     false
                 };
...
-                let result = list.buckets[len - 1]
-                    .pop()
-                    .map(|p| unsafe { NonNull::new_unchecked(p) });
+                let result = list.buckets[len - 1].pop();

             for ptr in bucket.drain(..) {
                 unsafe {
-                    alloc::alloc::dealloc(ptr as *mut u8, layout);
+                    alloc::alloc::dealloc(ptr.as_ptr() as *mut u8, layout);
                 }
             }

Also applies to: 125-127, 146-148

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/builtins/tuple.rs` around lines 62 - 63, Change the buckets
field from Vec<*mut PyObject> to Vec<NonNull<PyObject>> (keeping the array type
[Vec<...>; Self::MAXSAVESIZE]) and update all places that push or construct
entries (e.g., where raw pointers are inserted) to create NonNull values via
NonNull::new(ptr).expect("non-null pointer") or otherwise handle the Option
instead of storing raw *mut; likewise replace the unchecked conversion at its
usage site with NonNull::as_ptr() (or .get()) to obtain a *mut when needed and
adjust any initializations/clears to work with NonNull<PyObject> instead of
*mut.