#36183 span: diagnose dangling views from MakeByteSpan/MakeUCharSpan

ReviewabilityReviewsAgreementSize
#36183 kevkevinpal span: diagnose dangling views from MakeByteSpan/MakeUCharSpanWaiting on author0Blocked23
  • Warn developers at compile time when non-owning views bind to temporary containers
  • Prevents accidental dangling memory bugs before code reaches runtime
  • Ready to review
  • Blocked by an unaddressed objection that dangling views still go undiagnosed (maflcko)
  • Concept approval without stated reasons (jeanpablojp)
  • 23 lines added or modified outside tests
  • 0 lines added or modified in tests
  • 1 lines removed in total
  • 2 files, 1 commits
Utilities (logging, arguments, libraries)#49 of 59
P3 · cleanup
  • P3 because compile-time checks on utility helpers prevent subtle dangling pointer bugs
  • Improves internal safety across the codebase but is reasonably deferrable
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

This change adds Clang lifetime annotations to MakeByteSpan and MakeUCharSpan when called on temporary owning containers. It constrains the functions with concepts so that inputs satisfying std::ranges::borrowed_range do not trigger lifetime warnings, and explicitly marks leveldb::Slice as a borrowed range in dbwrapper.

Problem: MakeByteSpan and MakeUCharSpan return non-owning views into input containers, allowing developers to accidentally bind views to temporary owning objects that immediately dangle without any compiler warnings.

Evidence of importance:

  • Follow-up to merged PR #36164 ('util: diagnose dangling views of temporary strings') as suggested in review discussion.
  • PR description: 'A temporary container can leave those views dangling. Add LIFETIMEBOUND to the overload taking non-borrowed_range types, so Clang diagnoses the misuse on owning containers without flagging correct code that passes a view.'

Reviewability

Paused · Waiting on author

Open objection from maflcko with no author reply for 39 days; review would repeat what has been asked.

Waiting on (from the thread read):

  • author: address maflcko's objection that UCharSpanCast drops the lifetime annotation 2026-09-23

Agreement

Blocked

objection that needs a change, nobody has replied (maflcko)

Thread notes: maflcko reviewed and pointed out that UCharSpanCast loses the lifetime annotation, making the PR incomplete; awaiting author response.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
jeanpablojp (contributor)objection, correctnessunconditional LIFETIMEBOUND emits false warnings on correct code returning or passing non-owning viewsfixed · fix pushed · addressed by author in rc:4041209891 · v1, not yet re-checkedansweredyes2026-09-07: 'the annotation also fires on correct code'
Status from: 2026-09-17: kevkevinpal: 'Taken as-is, with `#include <ranges>` added.'
jeanpablojp (contributor)objection, scopeunnecessary workaround in serialize_tests since UncopyableStream copies into vchfixed · fix pushed · reverted by author in rc:4041198153 · v1, not yet re-checkedansweredyes2026-09-07: 'no view is kept here. Reverted, the file still compiles clean.'
Status from: 2026-09-17: kevkevinpal: 'Reverted, thanks, you're right that `UncopyableStream` copies into `vch`'
maflcko (member)objection, correctnessUCharSpanCast drops the lifetime annotation so dangling views still go undiagnosedopen · v1, not yet re-checkedchangedno2026-09-23: 'UCharCast will eat the annotation anyway right now... So this pull is incomplete anyway'

Support:

  • jeanpablojp (contributor) (Concept ACK, 2026-09-07): no reason given [not substantive]

Participants:

  • jeanpablojp (contributor, objection, 4 statements 2026-09-07 to 2026-09-07): Concept ACK, but noted LIFETIMEBOUND causes false warnings on non-owning views and pointed out an unnecessary test change
  • maflcko (member, objection, 3 statements 2026-09-23 to 2026-09-23): noted that UCharSpanCast drops the lifetime annotation so dangling views are still undetected, calling the PR incomplete

Files

0 lines under test/bench/ci.

  • src/span.h +16/-1
  • src/dbwrapper.cpp +7/-0

Card

The short text the ranking pass compares across PRs.

This PR adds Clang lifetimebound annotations to MakeByteSpan and MakeUCharSpan overloads for owning containers, allowing compilers to diagnose dangling views created from temporaries. To avoid false positives on valid view types, it splits the helpers using std::ranges::borrowed_range and specializes std::ranges::enable_borrowed_range for leveldb::Slice. It follows up on merged PR 36164, which added similar diagnostics to string helpers in util/string.h.

Data

dossier JSON · extract JSON · model ledger, generated 2026-09-24T01:20, confidence high, input hash 3f8c1bbd0cb30447
thread read through 2026-09-23 (10 statements), head b5a86b5745
Discussion read under schema 1 rules: suggestions and questions may be missing, and an objection may combine several harms (schema history).
labels: Needs rebase

Categories

Utilities (logging, arguments, libraries)

P3 · cleanup

Adds Clang lifetimebound annotations to MakeByteSpan and MakeUCharSpan to diagnose dangling views from temporary containers. Per the description, this prevents developers from 'accidentally bind[ing] views to temporary owning objects that immediately dangle without any compiler warnings.' It improves compile-time safety across shared utilities, but is reasonably deferrable internal hygiene.

Membership: Modifies src/span.h to add compile-time lifetime annotations to core span utility functions

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0