🎯 ROOT CAUSE: Internal allocation helpers were prematurely converting BASE → USER pointers before returning to caller. The caller then applied HAK_RET_ALLOC/tiny_region_id_write_header which performed ANOTHER BASE→USER conversion, resulting in double offset (BASE+2) and header written at wrong location. 📦 BOX THEORY SOLUTION: Establish clean pointer conversion boundary at tiny_region_id_write_header, making it the single source of truth for BASE → USER conversion. 🔧 CHANGES: - Fix #16: Remove premature BASE→USER conversions (6 locations) * core/tiny_alloc_fast.inc.h (3 fixes) * core/hakmem_tiny_refill.inc.h (2 fixes) * core/hakmem_tiny_fastcache.inc.h (1 fix) - Fix #12: Add header validation in tls_sll_pop (detect corruption) - Fix #14: Defense-in-depth header restoration in tls_sll_splice - Fix #15: USER pointer detection (for debugging) - Fix #13: Bump window header restoration - Fix #2, #6, #7, #8: Various header restoration & NULL termination 🧪 TEST RESULTS: 100% SUCCESS - 10K-500K iterations: All passed - 8 seeds × 100K: All passed (42,123,456,789,999,314,271,161) - Performance: ~630K ops/s average (stable) - Header corruption: ZERO 📋 FIXES SUMMARY: Fix #1-8: Initial header restoration & chain fixes (chatgpt-san) Fix #9-10: USER pointer auto-fix (later disabled) Fix #12: Validation system (caught corruption at call 14209) Fix #13: Bump window header writes Fix #14: Splice defense-in-depth Fix #15: USER pointer detection (debugging tool) Fix #16: Double conversion fix (FINAL SOLUTION) ✅ 🎓 LESSONS LEARNED: 1. Validation catches bugs early (Fix #12 was critical) 2. Class-specific inline logging reveals patterns (Option C) 3. Box Theory provides clean architectural boundaries 4. Multiple investigation approaches (Task/chatgpt-san collaboration) 📄 DOCUMENTATION: - P0_BUG_STATUS.md: Complete bug tracking timeline - C2_CORRUPTION_ROOT_CAUSE_FINAL.md: Detailed root cause analysis - FINAL_ANALYSIS_C2_CORRUPTION.md: Investigation methodology 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Task Agent <task@anthropic.com> Co-Authored-By: ChatGPT <chatgpt@openai.com>
181 lines
6.1 KiB
C
181 lines
6.1 KiB
C
// hakmem_tiny_fastcache.inc.h
|
|
// Phase 2D-1: Hot-path inline functions - Fast cache and quick slot operations
|
|
//
|
|
// This file contains fast cache and quick slot inline functions.
|
|
// These functions are extracted from hakmem_tiny.c to improve maintainability and
|
|
// reduce the main file size by approximately 53 lines.
|
|
//
|
|
// Functions handle:
|
|
// - tiny_fast_pop/push: Fast TLS cache operations (lines 377-404)
|
|
// - fastcache_pop/push: Frontend fast cache (lines 873-888)
|
|
// - quick_pop: Quick slot pop operation (line 892-896)
|
|
|
|
#ifndef HAKMEM_TINY_FASTCACHE_INC_H
|
|
#define HAKMEM_TINY_FASTCACHE_INC_H
|
|
|
|
#include "hakmem_tiny.h"
|
|
#include <stdint.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <stdatomic.h>
|
|
|
|
// External TLS variables
|
|
extern int g_fast_enable;
|
|
extern uint16_t g_fast_cap[TINY_NUM_CLASSES];
|
|
extern __thread void* g_fast_head[TINY_NUM_CLASSES];
|
|
extern __thread uint16_t g_fast_count[TINY_NUM_CLASSES];
|
|
|
|
// Fast cache capacity
|
|
#define TINY_FASTCACHE_CAP 128
|
|
|
|
// Quick slot capacity
|
|
#define QUICK_CAP 6
|
|
|
|
// External variable declarations
|
|
// Note: TinyFastCache and TinyQuickSlot types must be defined before including this file
|
|
extern int g_fastcache_enable;
|
|
extern __thread TinyFastCache g_fast_cache[TINY_NUM_CLASSES];
|
|
extern int g_quick_enable;
|
|
extern __thread TinyQuickSlot g_tls_quick[TINY_NUM_CLASSES];
|
|
extern unsigned long long g_free_via_fastcache[];
|
|
extern unsigned long long g_fast_push_hits[];
|
|
extern unsigned long long g_fast_push_full[];
|
|
extern unsigned long long g_fast_push_disabled[];
|
|
extern unsigned long long g_fast_push_zero_cap[];
|
|
|
|
static int g_fast_debug_mode = -1;
|
|
static int g_fast_debug_limit = 8;
|
|
static _Atomic int g_fast_debug_seen[TINY_NUM_CLASSES];
|
|
|
|
static inline void tiny_fast_debug_log(int class_idx, const char* event, uint16_t count, uint16_t cap) {
|
|
if (__builtin_expect(g_fast_debug_mode == -1, 0)) {
|
|
const char* e = getenv("HAKMEM_TINY_FAST_DEBUG");
|
|
g_fast_debug_mode = (e && atoi(e) != 0) ? 1 : 0;
|
|
const char* limit_env = getenv("HAKMEM_TINY_FAST_DEBUG_MAX");
|
|
if (limit_env && *limit_env) {
|
|
int v = atoi(limit_env);
|
|
if (v > 0) g_fast_debug_limit = v;
|
|
}
|
|
}
|
|
if (!g_fast_debug_mode) return;
|
|
int limit = g_fast_debug_limit;
|
|
if (limit <= 0) limit = 8;
|
|
int seen = atomic_fetch_add_explicit(&g_fast_debug_seen[class_idx], 1, memory_order_relaxed);
|
|
if (seen < limit) {
|
|
fprintf(stderr, "[FASTDBG] class=%d event=%s count=%u cap=%u\n",
|
|
class_idx, event, (unsigned)count, (unsigned)cap);
|
|
}
|
|
}
|
|
|
|
// Tracepoint macros (no-op if not defined)
|
|
#ifndef HAK_TP1
|
|
#define HAK_TP1(name, idx) do { (void)(idx); } while(0)
|
|
#endif
|
|
|
|
// Basic fast cache operations
|
|
static inline __attribute__((always_inline)) void* tiny_fast_pop(int class_idx) {
|
|
if (!g_fast_enable) return NULL;
|
|
uint16_t cap = g_fast_cap[class_idx];
|
|
if (cap == 0) return NULL;
|
|
void* head = g_fast_head[class_idx];
|
|
if (!head) return NULL;
|
|
// Phase 7: header-aware next pointer (C0-C6: base+1, C7: base)
|
|
#if HAKMEM_TINY_HEADER_CLASSIDX
|
|
const size_t next_offset = (class_idx == 7) ? 0 : 1;
|
|
#else
|
|
const size_t next_offset = 0;
|
|
#endif
|
|
// Use safe unaligned load for "next" to avoid UB when offset==1
|
|
void* next = NULL;
|
|
{
|
|
#include "tiny_nextptr.h"
|
|
next = tiny_next_load(head, class_idx);
|
|
}
|
|
g_fast_head[class_idx] = next;
|
|
uint16_t count = g_fast_count[class_idx];
|
|
if (count > 0) {
|
|
g_fast_count[class_idx] = (uint16_t)(count - 1);
|
|
} else {
|
|
g_fast_count[class_idx] = 0;
|
|
}
|
|
// CRITICAL FIX: Convert base -> user pointer for classes 0-6
|
|
// Headerless class (1KB): clear embedded next pointer before returning to user
|
|
if (__builtin_expect(class_idx == 7, 0)) {
|
|
*(void**)head = NULL;
|
|
return head; // C7: return base (headerless)
|
|
}
|
|
// C0-C6: return user pointer (base+1)
|
|
return (void*)((uint8_t*)head + 1);
|
|
}
|
|
|
|
static inline __attribute__((always_inline)) int tiny_fast_push(int class_idx, void* ptr) {
|
|
if (!g_fast_enable) {
|
|
g_fast_push_disabled[class_idx]++;
|
|
tiny_fast_debug_log(class_idx, "disabled", 0, 0);
|
|
return 0;
|
|
}
|
|
uint16_t cap = g_fast_cap[class_idx];
|
|
if (cap == 0) {
|
|
g_fast_push_zero_cap[class_idx]++;
|
|
tiny_fast_debug_log(class_idx, "zero_cap", g_fast_count[class_idx], cap);
|
|
return 0;
|
|
}
|
|
uint16_t count = g_fast_count[class_idx];
|
|
if (count >= cap) {
|
|
g_fast_push_full[class_idx]++;
|
|
tiny_fast_debug_log(class_idx, "full", count, cap);
|
|
return 0;
|
|
}
|
|
// Phase 7: header-aware next pointer (C0-C6: base+1, C7: base)
|
|
#if HAKMEM_TINY_HEADER_CLASSIDX
|
|
const size_t next_offset2 = (class_idx == 7) ? 0 : 1;
|
|
#else
|
|
const size_t next_offset2 = 0;
|
|
#endif
|
|
{
|
|
#include "tiny_nextptr.h"
|
|
tiny_next_store(ptr, class_idx, g_fast_head[class_idx]);
|
|
}
|
|
g_fast_head[class_idx] = ptr;
|
|
g_fast_count[class_idx] = (uint16_t)(count + 1);
|
|
g_fast_push_hits[class_idx]++;
|
|
tiny_fast_debug_log(class_idx, "hit", (uint16_t)(count + 1), cap);
|
|
return 1;
|
|
}
|
|
|
|
// Frontend fast cache operations
|
|
static inline void* fastcache_pop(int class_idx) {
|
|
TinyFastCache* fc = &g_fast_cache[class_idx];
|
|
if (__builtin_expect(fc->top > 0, 1)) {
|
|
void* base = fc->items[--fc->top];
|
|
// ✅ FIX #16: Return BASE pointer (not USER)
|
|
// FastCache stores base pointers. Caller will apply HAK_RET_ALLOC
|
|
// which does BASE → USER conversion via tiny_region_id_write_header
|
|
return base;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static inline int fastcache_push(int class_idx, void* ptr) {
|
|
TinyFastCache* fc = &g_fast_cache[class_idx];
|
|
if (__builtin_expect(fc->top < TINY_FASTCACHE_CAP, 1)) {
|
|
fc->items[fc->top++] = ptr;
|
|
g_free_via_fastcache[class_idx]++;
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
// Quick slot pop operation
|
|
static inline void* quick_pop(int class_idx) {
|
|
TinyQuickSlot* qs = &g_tls_quick[class_idx];
|
|
if (__builtin_expect(qs->top > 0, 1)) {
|
|
void* p = qs->items[--qs->top];
|
|
HAK_TP1(quick_pop, class_idx);
|
|
return p;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
#endif // HAKMEM_TINY_FASTCACHE_INC_H
|