42 lines
1.1 KiB
Markdown
42 lines
1.1 KiB
Markdown
|
# Bug Flow Diagram: P0 Batch Refill Active Counter Underflow
|
||
|
|
|
||
|
|
Legend
|
||
|
|
- Box 2: Remote Queue (push/drain)
|
||
|
|
- Box 3: Ownership (owner_tid)
|
||
|
|
- Box 4: Publish/Adopt + Refill boundary (superslab_refill)
|
||
|
|
|
||
|
|
Flow (before fix)
|
||
|
|
```
|
||
|
|
free(ptr)
|
||
|
|
-> Box 2 remote_push (cross-thread)
|
||
|
|
- active-- (on free) [OK]
|
||
|
|
- goes into SS freelist [no active change]
|
||
|
|
|
||
|
|
refill (P0 batch)
|
||
|
|
-> trc_pop_from_freelist(meta, want)
|
||
|
|
- splice to TLS SLL [OK]
|
||
|
|
- MISSING: active += taken [BUG]
|
||
|
|
|
||
|
|
alloc() uses SLL
|
||
|
|
|
||
|
|
free(ptr) (again)
|
||
|
|
-> active-- (but not incremented before) → double-decrement
|
||
|
|
-> active underflow → OOM perceived
|
||
|
|
-> superslab_refill returns NULL → crash path (free(): invalid pointer)
|
||
|
|
```
|
||
|
|
|
||
|
|
After fix
|
||
|
|
```
|
||
|
|
refill (P0 batch)
|
||
|
|
-> trc_pop_from_freelist(...)
|
||
|
|
- splice to TLS SLL
|
||
|
|
- active += from_freelist [FIX]
|
||
|
|
-> trc_linear_carve(...)
|
||
|
|
- active += batch [asserted]
|
||
|
|
```
|
||
|
|
|
||
|
|
Verification Hooks
|
||
|
|
- One-shot OOM prints from superslab_refill
|
||
|
|
- Optional: `HAKMEM_TINY_DEBUG_REMOTE_GUARD=1` and `HAKMEM_TINY_TRACE_RING=1`
|
||
|
|
|