⚠️ Potential issue | 🔴 Critical

# Find the linked_list module and inspect Pointers::new()
fd "linked_list" -t f -e rs

# Read the actual code at the specified location in core.rs
cat -n crates/vm/src/object/core.rs | sed -n '410,450p'

# Get more context on the WeakRefList::add method to understand the full flow
cat -n crates/vm/src/object/core.rs | sed -n '400,460p'

# Read the Pointers struct and new() implementation in linked_list.rs
cat -n crates/common/src/linked_list.rs | head -100

# Search for Pointers::new() definition
rg "impl.*Pointers|fn new\(\)" crates/common/src/linked_list.rs -A 5

# Search for unlink_weakref function in core.rs to verify the corruption path
rg "fn unlink_weakref" crates/vm/src/object/core.rs -A 20

Dropping the uninserted weak in the re-check path corrupts wrl.head and causes a subsequent use-after-free.

Rust drops locals in reverse declaration order. _lock (line 437) is declared after weak (line 434), so on the return at line 446 the drop sequence is:

1. _lock dropped → stripe lock released.
2. weak dropped → PyWeak::drop_inner runs → acquires the stripe lock (succeeds; _lock already gone) → calls unlink_weakref(wrl, node_ptr).

weak was never inserted into the list, so its Pointers fields are in their Pointers::new() initial state (both prev and next are None). unlink_weakref interprets prev == None as "this node is the head" and executes:

wrl.head.store(ptr::null_mut(), Ordering::Relaxed); // ← corrupts the list

This wipes wrl.head to null while the real list nodes are still alive. When obj is eventually deallocated, wrl.clear iterates from head == null and skips every existing weakref. Those weakrefs retain a non-null wr_object pointing to the now-freed obj memory. Their eventual drop_inner then acquires a stripe lock based on a dangling pointer and calls unlink_weakref on already-freed memory → use-after-free.

Fix: before the early return, null out wr_object so drop_inner exits at its first guard check:

         if is_generic {
             let generic_ptr = self.generic.load(Ordering::Relaxed);
             if !generic_ptr.is_null() {
                 let generic = unsafe { &*generic_ptr };
                 if generic.0.ref_count.safe_inc() {
+                    // `weak` was never inserted; nullify wr_object so drop_inner
+                    // returns early and does not call unlink_weakref.
+                    weak.wr_object.store(ptr::null_mut(), Ordering::Relaxed);
                     return unsafe { PyRef::from_raw(generic_ptr) };
                 }
             }
         }

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/object/core.rs` around lines 441 - 449, In the re-check path
where you return a resurrected generic (the block using is_generic, generic_ptr,
generic and calling generic.0.ref_count.safe_inc()), clear the weak's wr_object
before the early return so drop of the local weak won't call unlink_weakref on
an uninserted node; i.e., set the weak/inner wr_object to null (use the same
atomic store semantics as other places, e.g., Ordering::Relaxed) on generic.0
(the PyWeak inner) immediately prior to returning PyRef::from_raw(generic_ptr).