Match async client channel declaration to definition

Summary:
Every thrift-python async client crashes with a heap-use-after-free under libc++ on its first RPC. This is a latent bug for any service that does a Thrift RPC over ServiceRouter / get_client faults inside the native client dispatch.

Root cause: `thrift/lib/python/client/async_client.pxd` declared `cdef bind_client(self, cRequestChannel_ptr&& channel)`, but `async_client.pyx` defined it by value as `cdef bind_client(self, cRequestChannel_ptr channel)`. Cross-module callers such as `requestchannel_callback` in `async_client_factory.pyx` compile against the `.pxd`, so they emit the vtable slot as Ptr&& and pass a reference to the channel `unique_ptr`, which lives inside the resolved `folly::Future` Core. The by-value function body then reads that reference as if it were the `unique_ptr` object, so `OmniClient::channel_` ends up pointing at the Core storage instead of the channel. The real channel stays owned by the Core and is freed by `~Core`, so the first RPC reads freed memory.

Fix: drop the `&&` from the `.pxd` declaration so it matches the by-value `.pyx` definition, which is also consistent with the neighboring `bind_client_shared` signature style. The channel is still moved end-to-end: callers pass `cmove(channel._cpp_obj)`, `bind_client` receives the move-only `cRequestChannel_ptr` by value, and then moves it into `OmniClient`.

Also adds a named regression test exercising async `get_client` plus first RPC, which heap-use-after-frees under libc++ without this fix. The BUCK change is autodeps making the pre-existing `thrift.python.common` import explicit on the client test targets.

Reviewed By: iahs

Differential Revision: D109862203

fbshipit-source-id: 83ef740c3c41f8b9fd04e6376c265147b3d56d6f

Author: yuxuanchen1997

thrift/lib/python/client/async_client.pxd

@@ -29,6 +29,6 @@ cdef class AsyncClient:
     cdef unique_ptr[cOmniClient] _omni_client
     cdef unordered_map[string, string] _persistent_headers
     cdef vector[shared_ptr[cTProcessorEventHandler]] _deferred_event_handlers
-    cdef bind_client(self, cRequestChannel_ptr&& channel)
+    cdef bind_client(self, cRequestChannel_ptr channel)
     cdef bind_client_shared(self, shared_ptr[cRequestChannel] channel)
     cdef add_event_handler(self, const shared_ptr[cTProcessorEventHandler]& handler)

thrift/lib/python/client/test/async_client_test.py

@@ -439,3 +439,28 @@ async def test_protocol_id_retrieval_with_compact_protocol(self) -> None:
                 # an exception before the request is sent
                 result = await client.add(1, 2)
                 self.assertEqual(3, result)
+
+    async def test_async_channel_bind_first_rpc_no_use_after_free(self) -> None:
+        """Regression: async get_client must bind the channel by move, not alias
+        the folly Future Core's storage.
+
+        async_client.pxd must declare `bind_client` by value, matching the
+        async_client.pyx definition. When the declaration used `&&`, the
+        cross-module requestchannel_callback (async_client_factory.pyx) passed a
+        reference to the channel unique_ptr -- which lives inside the folly
+        Future Core -- through an rvalue-ref vtable slot into a by-value body.
+        OmniClient::channel_ ended up pointing at the Core's storage instead of
+        the channel. The real channel was left in the Core and freed by ~Core, so
+        the first RPC's getChannelProtocolId() read freed memory: a
+        heap-use-after-free under libc++. Exercising the async connect + first
+        RPC over the asyncio bridge catches any regression of the signature
+        mismatch.
+        """
+        # pyre-fixme[16]: `AsyncContextManager` has no attribute `__aenter__`.
+        async with server_in_event_loop() as addr:
+            async with get_client(TestService, host=addr.ip, port=addr.port) as client:
+                # First RPC reads the freshly bound channel; a channel_ that
+                # dangled into a freed Core would fault here under libc++.
+                self.assertEqual(3, await client.add(1, 2))
+                # A second RPC confirms the channel stayed valid after binding.
+                self.assertEqual(5, await client.add(2, 3))