crates/vm/src/object/core.rs (1)

2426-2441: Use the computed weakref offset in the bootstrap allocator.

alloc_type_with_prefixes() already asks Layout::extend() where the WeakRefList lands, but then writes it at alloc_ptr.add(EXT_OFFSET) anyway. That duplicates the no-padding assumption instead of reusing the actual layout result, so this path can drift first if WeakRefList's alignment ever changes.

♻️ Proposed change

-            let (layout, _ext_offset) = ext_layout.extend(weakref_layout).unwrap();
+            let (layout, weakref_offset) = ext_layout.extend(weakref_layout).unwrap();
             let (combined, inner_offset) = layout.extend(inner_layout).unwrap();
             let combined = combined.pad_to_align();
@@
-                let weakref_ptr = alloc_ptr.add(EXT_OFFSET) as *mut WeakRefList;
+                let weakref_ptr = alloc_ptr.add(weakref_offset) as *mut WeakRefList;
                 weakref_ptr.write(WeakRefList::new());

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/object/core.rs` around lines 2426 - 2441, The code ignores the
computed weakref offset and uses the hardcoded EXT_OFFSET; change the binding
let (layout, _ext_offset) = ext_layout.extend(weakref_layout).unwrap() to
capture the offset (e.g. ext_offset) and use that value when computing the
weakref pointer (replace alloc_ptr.add(EXT_OFFSET) with alloc_ptr.add(ext_offset
as usize) or equivalent), so alloc_type_with_prefixes() uses the actual layout
result; ensure the variable name matches uses and types (usize) for pointer
arithmetic.

crates/vm/src/object/core.rs (1)

322-335: ⚠️ Potential issue | 🟠 Major

Derive the prefix offsets from Layout::extend, not size_of.

The fixed EXT_OFFSET / WEAKREF_OFFSET math is still only proven against PyInner<()>, but the unsafe consumers here operate on arbitrary PyInner<T>. If any payload pushes align_of::<PyInner<T>>() above 8, these subtractions land before the real prefix and turn ext_ref(), weakref_list_ref(), and gc_clear_raw() into invalid reads/writes. Please compute the negative offsets from Layout::extend(..., Layout::new::<Self>()) instead of hard-coding size_of::<ObjExt>() / size_of::<WeakRefList>().

Also applies to: 376-392, 395-410, 1759-1772

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/object/core.rs` around lines 322 - 335, Compute the prefix
offsets using Layout::extend rather than size_of so they account for arbitrary
PyInner<T> alignments: replace the hard-coded EXT_OFFSET and WEAKREF_OFFSET
calculations with values derived from Layout::extend(Layout::new::<ObjExt>(),
Layout::new::<PyInner<()>>()) (and similarly for WeakRefList) then subtract the
size/offset returned by extend for the PyInner layout to produce the negative
offsets used by ext_ref(), weakref_list_ref(), and gc_clear_raw(); ensure the
new asserts validate using Layout::extend results (referencing EXT_OFFSET,
WEAKREF_OFFSET, ObjExt, WeakRefList, PyInner, ext_ref, weakref_list_ref,
gc_clear_raw) so offsets remain correct for any PyInner<T> alignment.

crates/vm/src/object/core.rs (1)

322-326: ⚠️ Potential issue | 🔴 Critical

The prefix offsets are still assuming a padding-free layout.

new()/dealloc() build the allocation with Layout::extend, but the read/clear paths recover prefixes by subtracting size_of::<WeakRefList>() / size_of::<ObjExt>(). That is only correct when Layout::extend inserts no padding before PyInner<T>. For a more-aligned payload, inner_offset can exceed those raw sizes, so ext_ref(), weakref_list_ref(), and gc_clear_raw() can read the wrong address.

💡 Minimal direction

-const EXT_OFFSET: usize = core::mem::size_of::<ObjExt>();
-const WEAKREF_OFFSET: usize = core::mem::size_of::<WeakRefList>();
+#[inline(always)]
+fn weakref_to_inner_offset<T>() -> usize {
+    core::alloc::Layout::new::<WeakRefList>()
+        .extend(core::alloc::Layout::new::<PyInner<T>>())
+        .unwrap()
+        .1
+}
+
+#[inline(always)]
+fn ext_to_inner_offset<T>(has_weakref: bool) -> usize {
+    if has_weakref {
+        let (layout, _) = core::alloc::Layout::new::<ObjExt>()
+            .extend(core::alloc::Layout::new::<WeakRefList>())
+            .unwrap();
+        layout.extend(core::alloc::Layout::new::<PyInner<T>>()).unwrap().1
+    } else {
+        core::alloc::Layout::new::<ObjExt>()
+            .extend(core::alloc::Layout::new::<PyInner<T>>())
+            .unwrap()
+            .1
+    }
+}

Use those computed offsets everywhere prefix pointers are reconstructed.

Also applies to: 376-410, 1759-1772

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/object/core.rs` around lines 322 - 326, The code incorrectly
reconstructs prefix pointer addresses by subtracting raw sizes
(size_of::<ObjExt>() / size_of::<WeakRefList>()) instead of using the computed
allocation offsets—update all places that recover prefixes (e.g., in new(),
dealloc(), ext_ref(), weakref_list_ref(), gc_clear_raw(), and the similar blocks
around lines 376-410 and 1759-1772) to use the precomputed
inner_offset/EXT_OFFSET/WEAKREF_OFFSET values produced when building the Layout
(or the computed inner_offset variable) so the pointer arithmetic accounts for
any padding inserted by Layout::extend; replace any direct size_of::<...>()
subtractions with the corresponding computed offset variables when
reconstructing prefix pointers.