rt: fix queue regression (#2362)

The new queue uses `u8` to track offsets. Cursors are expected to wrap.
An operation was performed with `+` instead of `wrapping_add`. This was
not _obviously_ issue before as it is difficult to wrap a `usize` on
64bit platforms, but wrapping a `u8` is trivial.

The fix is to use `wrapping_add` instead of `+`. A new test is added
that catches the issue.

Fixes #2361

1 files changed, 2 insertions, 6 deletions

diff --git a/tokio/src/runtime/queue.rs b/tokio/src/runtime/queue.rs
index 81408135..dc78dbd0 100644
--- a/tokio/src/runtime/queue.rs
+++ b/tokio/src/runtime/queue.rs
@@ -209,8 +209,8 @@ impl<T> Local<T> {
         for i in 0..n {
             let j = i + 1;
 
-            let i_idx = (i + head) as usize & MASK;
-            let j_idx = (j + head) as usize & MASK;
+            let i_idx = i.wrapping_add(head) as usize & MASK;
+            let j_idx = j.wrapping_add(head) as usize & MASK;
 
             // Get the next pointer
             let next = if j == n {
@@ -319,10 +319,6 @@ impl<T> Steal<T> {
             return Some(ret);
         }
 
-        // Synchronize with stealers
-        let (dst_steal, dst_real) = unpack(dst.inner.head.load(Acquire));
-        assert_eq!(dst_steal, dst_real);
-
         // Make the stolen items available to consumers
         dst.inner.tail.store(dst_tail.wrapping_add(n), Release);