Struct LowFdGuard 

pub struct LowFdGuard { /* private fields */ }

Occupies every currently-free descriptor below [FIRST_INTERNAL_FD] so that opens performed while it is alive are pushed above the user’s fd range. Releases them on drop.

Descriptors that are ALREADY open are left alone — they may be the user’s (zshrs 3>&1 -c '…' is legal), and stealing them would be the very bug this exists to prevent.

Thread safety

Claiming is done exclusively through fcntl(F_DUPFD_CLOEXEC), which asks the kernel for the lowest free descriptor and allocates it in one atomic step. The guard therefore only ever owns descriptors the kernel just handed it, and never names a target descriptor.

The previous implementation probed each slot with fcntl(fd, F_GETFD) and then dup2’d onto it. Those are two syscalls with a gap in between, and dup2 silently closes whatever occupies its target. Under the interactive boot — where compinit ships its cache rebuild to a zshrs-worker-N thread (ext_builtins.rs, worker_pool.submit) while the main thread is still sourcing the user’s rc files — a concurrent File::open could land on a slot this guard had already probed as free. The dup2 then closed a live OwnedFd out from under its owner, and drop on that owner tripped std’s debug_assert_fd_is_open, aborting with IO Safety violation: owned file descriptor already closed.

Implementations

impl LowFdGuard

pub fn new() -> Self

Reserve the free script descriptors. Cheap: one open of /dev/null plus at most [SCRIPT_FD_SLOTS] fcntl calls, and only for slots that are actually free.

Trait Implementations

impl Default for LowFdGuard

fn default() -> Self

Returns the “default value” for a type.

impl Drop for LowFdGuard

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.