YT-28305: Fix UAF in TAtomicPtr hazard-pointer publish for virtually-derived types

For types that inherit TRefCountedBase virtually the original GetBasePtr implicitly converted T* to TRefCountedBase*, which requires reading the vptr of |*ptr| to find the vbase offset. The hazard protocol calls this with a ptr that another thread may have already retired, so the dereference was a heap-use-after-free.

Fix: TAtomicPtr now stores the typed pointer packed with the vbase offset (TPackedPtr / TTaggedPtr). The offset is computed once at Store time, when the caller still owns a strong reference and the vbase lookup is safe. Readers and the Drop path compute the canonical TRefCountedBase* address as |ptr + offset| without ever dereferencing |*ptr|.

THazardPtr::Acquire's T* overload is constrained to reject types that virtually inherit TRefCountedBase; such types must go through TAtomicPtr.

Adds a ASan regression test that triggered heap-use-after-free reliably on the buggy code with barrier-synchronised reader/writer threads.
commit_hash:0f15888a6224c9fbcf810d9093d82e3265a7210e

0 files changed, 0 insertions, 0 deletions