diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ca4d150..89909886 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,22 @@ All notable changes to EigenScript are documented here. ## [Unreleased] +## [0.45.1] - 2026-10-07 + +### Fixed + +- **An unsent parameter is null-filled at every call entry, with or without + defaults (#1661).** A 2+-parameter callee without defaults, called with + fewer arguments than it takes, left the unsent parameters unbound. Once the + JIT compiled the callee, reading one read a stale slot of a recycled call + env: a heap-use-after-free that aborted release builds in `malloc` (seen in + recursion around depth 1000 or more), or a stale non-null value. Even + without the JIT, a closure over an unsent parameter resolved the name in an + outer scope instead of reading `null`. Direct calls, JIT-to-JIT calls, + `dispatch` (both forms) and `task_spawn` now bind every unsent parameter to + `null`, as SPEC.md and `docs/llms.txt` already promised. The bug was also + present in v0.44.0. + ## [0.45.0] - 2026-10-07 ### Breaking changes diff --git a/VERSION b/VERSION index bcce5d06..ff12df2f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.45.0 +0.45.1 diff --git a/changes/fixed/1661-underarity-param-null-fill.md b/changes/fixed/1661-underarity-param-null-fill.md deleted file mode 100644 index 3dbf3daa..00000000 --- a/changes/fixed/1661-underarity-param-null-fill.md +++ /dev/null @@ -1,11 +0,0 @@ -- **An unsent parameter is null-filled at every call entry, with or without - defaults (#1661).** A 2+-parameter callee without defaults, called with - fewer arguments than it takes, left the unsent parameters unbound. Once the - JIT compiled the callee, reading one read a stale slot of a recycled call - env: a heap-use-after-free that aborted release builds in `malloc` (seen in - recursion around depth 1000 or more), or a stale non-null value. Even - without the JIT, a closure over an unsent parameter resolved the name in an - outer scope instead of reading `null`. Direct calls, JIT-to-JIT calls, - `dispatch` (both forms) and `task_spawn` now bind every unsent parameter to - `null`, as SPEC.md and `docs/llms.txt` already promised. The bug was also - present in v0.44.0.