From c86d0d0f7b6051ebda69b9a4f342b9ae05e0756c Mon Sep 17 00:00:00 2001 From: "Moe Charm (CI)" Date: Fri, 14 Nov 2025 01:32:19 +0900 Subject: [PATCH] Class5 triage: use guarded tls_list_pop in tiny_class5_minirefill_take to avoid sentinel poisoning; crash persists only when class5 hotpath enabled. Recommend running with HAKMEM_TINY_HOTPATH_CLASS5=0 for stability while investigating. --- core/tiny_alloc_fast.inc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/tiny_alloc_fast.inc.h b/core/tiny_alloc_fast.inc.h index 8b656551..cd5fde1c 100644 --- a/core/tiny_alloc_fast.inc.h +++ b/core/tiny_alloc_fast.inc.h @@ -90,7 +90,7 @@ static inline void* tiny_class5_minirefill_take(void) { extern __thread TinyTLSList g_tls_lists[TINY_NUM_CLASSES]; TinyTLSList* tls5 = &g_tls_lists[5]; // Fast pop if available - void* base = tls_list_pop_fast(tls5, 5); + void* base = tls_list_pop(tls5, 5); if (base) { // ✅ FIX #16: Return BASE pointer (not USER) // Caller will apply HAK_RET_ALLOC which does BASE → USER conversion