Phase 7 follow-up: header-aware in BG spill, TLS drain, and aggressive inline macros

- bg_spill: link/traverse next at base+1 for C0–C6, base for C7
- lifecycle: drain TLS SLL and fast caches reading next with header-aware offsets
- tiny_alloc_fast_inline: POP/PUSH macros made header-aware to match tls_sll_box rules
- add optional FREE_WRAP_ENTER trace (HAKMEM_FREE_WRAP_TRACE) for early triage

Result: 0xa0/…0099 bogus free logs gone; remaining SIGBUS appears in free path early. Next: instrument early libc fallback or guard invalid pointers during init to pinpoint source.
This commit is contained in:
Moe Charm (CI)
2025-11-10 18:21:32 +09:00
parent dde490f842
commit d5302e9c87
5 changed files with 62 additions and 11 deletions

View File

@ -24,7 +24,13 @@ static inline void bg_spill_push_one(int class_idx, void* p) {
uintptr_t old_head;
do {
old_head = atomic_load_explicit(&g_bg_spill_head[class_idx], memory_order_acquire);
*(void**)p = (void*)old_head;
// Phase 7: header-aware next placement (C0-C6: base+1, C7: base)
#if HAKMEM_TINY_HEADER_CLASSIDX
const size_t next_off = (class_idx == 7) ? 0 : 1;
#else
const size_t next_off = 0;
#endif
*(void**)((uint8_t*)p + next_off) = (void*)old_head;
} while (!atomic_compare_exchange_weak_explicit(&g_bg_spill_head[class_idx], &old_head,
(uintptr_t)p,
memory_order_release, memory_order_relaxed));
@ -36,7 +42,13 @@ static inline void bg_spill_push_chain(int class_idx, void* head, void* tail, in
uintptr_t old_head;
do {
old_head = atomic_load_explicit(&g_bg_spill_head[class_idx], memory_order_acquire);
*(void**)tail = (void*)old_head;
// Phase 7: header-aware next placement for tail link
#if HAKMEM_TINY_HEADER_CLASSIDX
const size_t next_off = (class_idx == 7) ? 0 : 1;
#else
const size_t next_off = 0;
#endif
*(void**)((uint8_t*)tail + next_off) = (void*)old_head;
} while (!atomic_compare_exchange_weak_explicit(&g_bg_spill_head[class_idx], &old_head,
(uintptr_t)head,
memory_order_release, memory_order_relaxed));