Skip to content

Fix mixed-prefix drain in reuse_storage_immediate - #475

Open
lightsighter wants to merge 1 commit into
mainfrom
mbauer-bug7-reuse-drain
Open

Fix mixed-prefix drain in reuse_storage_immediate#475
lightsighter wants to merge 1 commit into
mainfrom
mbauer-bug7-reuse-drain

Conversation

@lightsighter

Copy link
Copy Markdown
Contributor

The oldest-entry drain loop applied the offsets-flavor PendingRelease::release() to every entry it drained, but the allocated/offsets outputs are only meaningful for old_inst's own redistrict entry. A ready follower swept up by the drain misbehaved:

  • a plain destroy (empty redistrict_tags) trips the assert(!redistrict_tags.empty()) in debug builds; in release builds split_range returns 0 and clobbers 'allocated', mis-notifying old_inst's already-placed children as ALLOC_EVENTUAL_FAILURE while their tags stay live in current_allocator (leaked ranges)
  • a redistrict follower with more children than old_inst overflows the offsets vector inside split_range (out-of-bounds write)

Apply the offsets-flavor release only to old_inst's own entry and drain followers with the void flavor, matching the equivalent drain in release_storage_immediate.

Adds two DeferredAllocBadPathTest units covering both follower shapes; on the unfixed code they reproduce the two assertion failures exactly.

Adjudicated as BUG-7 in tla/allocation/bugs/BUG-7.md (checked in separately with the deferred-allocation verification campaign).

The oldest-entry drain loop applied the offsets-flavor
PendingRelease::release() to every entry it drained, but the
allocated/offsets outputs are only meaningful for old_inst's own
redistrict entry. A ready follower swept up by the drain misbehaved:

 - a plain destroy (empty redistrict_tags) trips the
   assert(!redistrict_tags.empty()) in debug builds; in release builds
   split_range returns 0 and clobbers 'allocated', mis-notifying
   old_inst's already-placed children as ALLOC_EVENTUAL_FAILURE while
   their tags stay live in current_allocator (leaked ranges)
 - a redistrict follower with more children than old_inst overflows
   the offsets vector inside split_range (out-of-bounds write)

Apply the offsets-flavor release only to old_inst's own entry and
drain followers with the void flavor, matching the equivalent drain
in release_storage_immediate.

Adds two DeferredAllocBadPathTest units covering both follower shapes;
on the unfixed code they reproduce the two assertion failures exactly.

Adjudicated as BUG-7 in tla/allocation/bugs/BUG-7.md (checked in
separately with the deferred-allocation verification campaign).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@lightsighter lightsighter self-assigned this Aug 31, 2026
@github-actions github-actions Bot added bug Something isn't working labels Aug 31, 2026
@codecov

codecov Bot commented Aug 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.54%. Comparing base (15b3e9b) to head (be8d624).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #475      +/-   ##
==========================================
+ Coverage   30.41%   30.54%   +0.13%     
==========================================
  Files         199      199              
  Lines       41282    41322      +40     
  Branches    14779    14776       -3     
==========================================
+ Hits        12554    12621      +67     
+ Misses      27488    27373     -115     
- Partials     1240     1328      +88     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant