tomoaki/hakmem
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
64ed3d8d8cebae7dc5a3d12e2e7ea549635c34da
hakmem/pool_tls_remote.d

29 lines
1.1 KiB
D
Raw Normal View History

Fix C7 TLS SLL header restoration regression + Document Larson MT race condition ## Bug Fix: Restore C7 Exception in TLS SLL Push **File**: `core/box/tls_sll_box.h:309` **Problem**: Commit 25d963a4a (Code Cleanup) accidentally reverted the C7 fix by changing: ```c if (class_idx != 0 && class_idx != 7) { // CORRECT (commit 8b67718bf) if (class_idx != 0) { // BROKEN (commit 25d963a4a) ``` **Impact**: C7 (1024B class) header restoration in TLS SLL push overwrote next pointer at base[0], causing corruption. **Fix**: Restored `&& class_idx != 7` check to prevent header restoration for C7. **Why C7 Needs Exception**: - C7 uses offset=0 (stores next pointer at base[0]) - User pointer is at base+1 - Next pointer MUST NOT be overwritten by header restoration - C1-C6 use offset=1 (next at base[1]), so base[0] header restoration is safe ## Investigation: Larson MT Race Condition (SEPARATE ISSUE) **Finding**: Larson still crashes with 3+ threads due to UNRELATED multi-threading race condition in unified cache freelist management. **Root Cause**: Non-atomic freelist operations in `TinySlabMeta`: ```c typedef struct TinySlabMeta { void* freelist; // ❌ NOT ATOMIC uint16_t used; // ❌ NOT ATOMIC } TinySlabMeta; ``` **Evidence**: ``` 1 thread: ✅ PASS (1.88M - 41.8M ops/s) 2 threads: ✅ PASS (24.6M ops/s) 3 threads: ❌ SEGV (race condition) 4+ threads: ❌ SEGV (race condition) ``` **Status**: C7 fix is CORRECT. Larson crash is separate MT issue requiring atomic freelist implementation. ## Documentation Added Created comprehensive investigation reports: - `LARSON_CRASH_ROOT_CAUSE_REPORT.md` - Full technical analysis - `LARSON_DIAGNOSTIC_PATCH.md` - Implementation guide - `LARSON_INVESTIGATION_SUMMARY.md` - Executive summary - `LARSON_QUICK_REF.md` - Quick reference - `verify_race_condition.sh` - Automated verification script ## Next Steps Implement atomic freelist operations for full MT safety (7-9 hour effort): 1. Make `TinySlabMeta.freelist` atomic with CAS loop 2. Audit 87 freelist access sites 3. Test with Larson 8+ threads 🔧 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-22 02:15:34 +09:00
pool_tls_remote.o: core/pool_tls_remote.c core/pool_tls_remote.h \
core/box/tiny_next_ptr_box.h core/hakmem_tiny_config.h \
core/tiny_nextptr.h core/hakmem_build_flags.h core/tiny_region_id.h \
core/tiny_box_geometry.h core/hakmem_tiny_superslab_constants.h \
core/hakmem_tiny_config.h core/ptr_track.h core/hakmem_super_registry.h \
core/hakmem_tiny_superslab.h core/superslab/superslab_types.h \
core/hakmem_tiny_superslab_constants.h core/superslab/superslab_inline.h \
Cleanup: Remove unused hakmem_libc.c (duplicate of hakmem_syscall.c) - File was not included in Makefile OBJS_BASE - Functions already implemented in hakmem_syscall.c - Size: 361 bytes removed
2025-11-26 13:03:17 +09:00
core/superslab/superslab_types.h core/superslab/../tiny_box_geometry.h \
core/tiny_debug_ring.h core/tiny_remote.h
Fix C7 TLS SLL header restoration regression + Document Larson MT race condition ## Bug Fix: Restore C7 Exception in TLS SLL Push **File**: `core/box/tls_sll_box.h:309` **Problem**: Commit 25d963a4a (Code Cleanup) accidentally reverted the C7 fix by changing: ```c if (class_idx != 0 && class_idx != 7) { // CORRECT (commit 8b67718bf) if (class_idx != 0) { // BROKEN (commit 25d963a4a) ``` **Impact**: C7 (1024B class) header restoration in TLS SLL push overwrote next pointer at base[0], causing corruption. **Fix**: Restored `&& class_idx != 7` check to prevent header restoration for C7. **Why C7 Needs Exception**: - C7 uses offset=0 (stores next pointer at base[0]) - User pointer is at base+1 - Next pointer MUST NOT be overwritten by header restoration - C1-C6 use offset=1 (next at base[1]), so base[0] header restoration is safe ## Investigation: Larson MT Race Condition (SEPARATE ISSUE) **Finding**: Larson still crashes with 3+ threads due to UNRELATED multi-threading race condition in unified cache freelist management. **Root Cause**: Non-atomic freelist operations in `TinySlabMeta`: ```c typedef struct TinySlabMeta { void* freelist; // ❌ NOT ATOMIC uint16_t used; // ❌ NOT ATOMIC } TinySlabMeta; ``` **Evidence**: ``` 1 thread: ✅ PASS (1.88M - 41.8M ops/s) 2 threads: ✅ PASS (24.6M ops/s) 3 threads: ❌ SEGV (race condition) 4+ threads: ❌ SEGV (race condition) ``` **Status**: C7 fix is CORRECT. Larson crash is separate MT issue requiring atomic freelist implementation. ## Documentation Added Created comprehensive investigation reports: - `LARSON_CRASH_ROOT_CAUSE_REPORT.md` - Full technical analysis - `LARSON_DIAGNOSTIC_PATCH.md` - Implementation guide - `LARSON_INVESTIGATION_SUMMARY.md` - Executive summary - `LARSON_QUICK_REF.md` - Quick reference - `verify_race_condition.sh` - Automated verification script ## Next Steps Implement atomic freelist operations for full MT safety (7-9 hour effort): 1. Make `TinySlabMeta.freelist` atomic with CAS loop 2. Audit 87 freelist access sites 3. Test with Larson 8+ threads 🔧 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-22 02:15:34 +09:00
core/pool_tls_remote.h:
core/box/tiny_next_ptr_box.h:
core/hakmem_tiny_config.h:
core/tiny_nextptr.h:
core/hakmem_build_flags.h:
core/tiny_region_id.h:
core/tiny_box_geometry.h:
core/hakmem_tiny_superslab_constants.h:
core/hakmem_tiny_config.h:
core/ptr_track.h:
core/hakmem_super_registry.h:
core/hakmem_tiny_superslab.h:
core/superslab/superslab_types.h:
core/hakmem_tiny_superslab_constants.h:
core/superslab/superslab_inline.h:
core/superslab/superslab_types.h:
Cleanup: Remove unused hakmem_libc.c (duplicate of hakmem_syscall.c) - File was not included in Makefile OBJS_BASE - Functions already implemented in hakmem_syscall.c - Size: 361 bytes removed
2025-11-26 13:03:17 +09:00
core/superslab/../tiny_box_geometry.h:
Fix C7 TLS SLL header restoration regression + Document Larson MT race condition ## Bug Fix: Restore C7 Exception in TLS SLL Push **File**: `core/box/tls_sll_box.h:309` **Problem**: Commit 25d963a4a (Code Cleanup) accidentally reverted the C7 fix by changing: ```c if (class_idx != 0 && class_idx != 7) { // CORRECT (commit 8b67718bf) if (class_idx != 0) { // BROKEN (commit 25d963a4a) ``` **Impact**: C7 (1024B class) header restoration in TLS SLL push overwrote next pointer at base[0], causing corruption. **Fix**: Restored `&& class_idx != 7` check to prevent header restoration for C7. **Why C7 Needs Exception**: - C7 uses offset=0 (stores next pointer at base[0]) - User pointer is at base+1 - Next pointer MUST NOT be overwritten by header restoration - C1-C6 use offset=1 (next at base[1]), so base[0] header restoration is safe ## Investigation: Larson MT Race Condition (SEPARATE ISSUE) **Finding**: Larson still crashes with 3+ threads due to UNRELATED multi-threading race condition in unified cache freelist management. **Root Cause**: Non-atomic freelist operations in `TinySlabMeta`: ```c typedef struct TinySlabMeta { void* freelist; // ❌ NOT ATOMIC uint16_t used; // ❌ NOT ATOMIC } TinySlabMeta; ``` **Evidence**: ``` 1 thread: ✅ PASS (1.88M - 41.8M ops/s) 2 threads: ✅ PASS (24.6M ops/s) 3 threads: ❌ SEGV (race condition) 4+ threads: ❌ SEGV (race condition) ``` **Status**: C7 fix is CORRECT. Larson crash is separate MT issue requiring atomic freelist implementation. ## Documentation Added Created comprehensive investigation reports: - `LARSON_CRASH_ROOT_CAUSE_REPORT.md` - Full technical analysis - `LARSON_DIAGNOSTIC_PATCH.md` - Implementation guide - `LARSON_INVESTIGATION_SUMMARY.md` - Executive summary - `LARSON_QUICK_REF.md` - Quick reference - `verify_race_condition.sh` - Automated verification script ## Next Steps Implement atomic freelist operations for full MT safety (7-9 hour effort): 1. Make `TinySlabMeta.freelist` atomic with CAS loop 2. Audit 87 freelist access sites 3. Test with Larson 8+ threads 🔧 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-22 02:15:34 +09:00
core/tiny_debug_ring.h:
core/tiny_remote.h:
Reference in New Issue Copy Permalink