Files
hakmem/core/box
Moe Charm (CI) 846daa3edf Cleanup: Fix 2 additional Class 0/7 header bugs (correctness fix)
Task Agent Investigation:
- Found 2 more instances of hardcoded `class_idx != 7` checks
- These are real bugs (C0 also uses offset=0, not just C7)
- However, NOT the root cause of 12% crash rate

Bug Fixes (2 locations):
1. tls_sll_drain_box.h:190
   - Path: TLS SLL drain → tiny_free_local_box()
   - Fix: Use tiny_header_write_for_alloc() (ALL classes)
   - Reason: tiny_free_local_box() reads header for class_idx

2. hakmem_tiny_refill.inc.h:384
   - Path: SuperSlab refill → TLS SLL push
   - Fix: Use tiny_header_write_if_preserved() (C1-C6 only)
   - Reason: TLS SLL push needs header for validation

Test Results:
- Before: 12% crash rate (88/100 runs successful)
- After: 12% crash rate (44/50 runs successful)
- Conclusion: Correctness fix, but not primary crash cause

Analysis:
- Bugs are real (incorrect Class 0 handling)
- Fixes don't reduce crash rate → different root cause exists
- Heisenbug characteristics (disappears under gdb)
- Likely: Race condition, uninitialized memory, or use-after-free

Remaining Work:
- 12% crash rate persists (requires different investigation)
- Next: Focus on TLS initialization, race conditions, allocation paths

Design Note:
- tls_sll_drain_box.h uses tiny_header_write_for_alloc()
  because tiny_free_local_box() needs header to read class_idx
- hakmem_tiny_refill.inc.h uses tiny_header_write_if_preserved()
  because TLS SLL push validates header (C1-C6 only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-29 08:12:08 +09:00
..