fix(jit): release recorder token before native parks

Author: Frityet

notes/jit-recorder-token-native-park-liveness-2026-07-13.md

@@ -0,0 +1,84 @@
+## Recorder-token ownership at blocking native parks
+
+The b1.2.0 heavy threaded-flush gate exposed a recorder-token liveness cycle.
+A main TG entered `threading.thread:join()` while it still owned the global JIT
+recorder token. A child running `jit.flush()` asynchronously changed the
+recorder state from active `LJ_TRACE_RECORD` to aborted `LJ_TRACE_RECORD`, then
+waited to acquire that token. The owner was already parked waiting for the
+child, and only the owner could finish recorder cleanup and release the token:
+
+```
+main:  thread:join -> native futex park (owns jit_token)
+child: jit.flush   -> lj_jit_token_acquire_wait (must finish before exit)
+```
+
+This was not a slow stress case. The exact heavy case failed twice at its
+60-second join timeout; GDB showed `jit_token == main_tid`, `J->L == main`,
+`J->state == LJ_TRACE_RECORD` with `LJ_TRACE_ACTIVE` cleared, the main TG in
+`threading_futex_wait_l()`, and the sole live child spinning in
+`lj_jit_token_acquire_wait()`.
+
+### Rule
+
+A Lua/TG owner must not enter a potentially blocking native park while it owns
+unpublished recorder state. Immediately before the actual park it calls
+`lj_trace_abort_owner()`, which discards that owner's unpublished trace state
+and releases the token. Published traces are unaffected.
+
+The threading library applies the rule in its common futex-wait wrapper, which
+covers contended join, spawn/activation, mutex, and lifecycle waits.
+
+The rule is kept at concrete blocking sites instead of in
+`lj_native_enter_l()`. That helper publishes a native stack snapshot and is not
+itself a promise that its caller will block; making every future native-entry
+caller abort would unnecessarily constrain nonblocking C paths.
+
+### Channel audit and reentrant recorder boundary
+
+Channels have a separate futex substrate in `lj_chan.c`, so ordinary blocking
+and timed channel waits apply the same pre-park owner teardown after their
+optimistic spin fails. Try operations, zero-timeout operations, and handoffs
+completed during the spin remain untouched.
+
+A direct, unguarded application of `lj_trace_abort_owner()` was tested and
+rejected: a trace `start` event callback can block while `trace_state()` is
+still on the C stack. Tearing down `J->cur` reentrantly from that callback
+caused an immediate production-build segmentation fault. This applies equally
+to channel and threading-library parks.
+
+Each concrete park therefore compares the current TG id with
+`vmevent_owner_acq(g)`. The exact VM-event callback owner keeps the token and
+lets the outer recorder frame perform cleanup after it unwinds; all ordinary
+parks abort and release before sleeping. The guard is deliberately not folded
+into `lj_trace_abort_owner()`, whose detach/teardown callers have different
+lifetime obligations.
+
+The safe follow-up boundary is one of:
+
+- make contended JIT control logically invalidate/queue work without waiting
+  for a token held by the callback; or
+- publish an explicit recorder-callback/reentrancy state, request abort, avoid
+  the park, and finish cleanup only after `trace_state()` unwinds.
+
+The guarded callback still cannot synchronously wait for a peer whose
+`jit.flush()` must acquire its token. A bounded channel receive or timed join
+returns first, after which recorder unwind lets the peer finish. Making that
+cross-TG dependency synchronous requires the broader nonblocking JIT-control
+protocol above and remains b1.2.1 debt.
+
+### Validation
+
+- The pre-fix heavy case reproduced the join timeout twice.
+- The fixed production build completed the exact heavy threaded-flush case in
+  five runs, including three consecutive repetitions.
+- The normal threaded-flush, safepoint-handshake, and recorder-token gates were
+  rerun after the fix.
+- A deterministic join reducer keeps one single-round background worker and
+  repeats the existing hot churn/flush loop. The unfixed exact source failed at
+  round 40 in three consecutive runs; the fixed build completed all 96 joins.
+- A production Lua regression enters both a timed channel receive and a timed
+  join from a trace `start` callback. Both waits return their bounded timeout,
+  preserve the active recorder frame, and allow the peer flusher to complete
+  after callback unwind; this catches the unguarded teardown crash.
+- The focused join and VM-event park regressions also pass a clean
+  `-DLUA_USE_ASSERT` build.

src/lib_threading.c

@@ -439,11 +439,22 @@ static int64_t threading_native_wait_slice(int has_timeout, int64_t ns)
 static uint32_t threading_futex_wait_l(lua_State *L, uint32_t *addr,
 				       uint32_t expect, int64_t ns)
 {
+  global_State *g = G(L);
+  uint32_t tid = lj_thr_current_id(g);
   uint32_t actions;
   /*
   ** Public blocking waits are native parks, but the waiting TG must still be
-  ** visible to soft handshakes while parked.
+  ** visible to soft handshakes while parked. A C library call can be entered
+  ** while its owner still holds an asynchronously abortable recorder token.
+  ** Never park with that token: a peer which needs it may be the very thread
+  ** this wait is joining, creating an owner-token/join cycle with no runnable
+  ** side left to finish recorder cleanup.
   */
+  /* A VM-event callback is still executing inside trace_state() and therefore
+  ** cannot tear down J->cur reentrantly. Its bounded wait remains native, but
+  ** cleanup is deferred until that recorder frame unwinds. */
+  if (tid == 0 || vmevent_owner_acq(g) != tid)
+    lj_trace_abort_owner(L);
   lj_native_enter(L2TG(L));
   (void)la_futex_wait(addr, expect, ns);
   actions = lj_native_leave(L);

src/lj_chan.c

@@ -14,6 +14,7 @@
 #include "lj_safepoint.h"
 #include "lj_thr.h"
 #include "lj_tg.h"
+#include "lj_trace.h"
 
 #include <errno.h>
 #include <limits.h>
@@ -112,9 +113,14 @@ static void chan_wait(lua_State *L, LJChan *ch)
     lj_safepoint_checkstop_fresh(L, 0, had_stopreq);
     return;
   }
-  if (L)
+  if (L) {
+    global_State *g = G(L);
+    uint32_t tid = lj_thr_current_id(g);
+    /* Preserve an active VM-event recorder frame; see the timed twin below. */
+    if (tid == 0 || vmevent_owner_acq(g) != tid)
+      lj_trace_abort_owner(L);
     lj_native_enter_l(L, &frame);  /* 09 section 9.5: channel park is native. */
-  else if (tg)
+  } else if (tg)
     lj_native_enter(tg);
   (void)la_futex_wait(&ch->futex, f, 1000000);
   if (L)
@@ -161,9 +167,16 @@ static int chan_wait_timeout(lua_State *L, LJChan *ch, int64_t ns)
     lj_safepoint_checkstop_fresh(L, 0, had_stopreq);
     return 0;
   }
-  if (L)
+  if (L) {
+    global_State *g = G(L);
+    uint32_t tid = lj_thr_current_id(g);
+    /* trace_state() owns J->cur across VM-event callbacks. Never destroy that
+    ** state reentrantly; the callback's bounded park instead leaves cleanup to
+    ** the outer recorder unwind. Ordinary channel parks release ownership. */
+    if (tid == 0 || vmevent_owner_acq(g) != tid)
+      lj_trace_abort_owner(L);
     lj_native_enter_l(L, &frame);  /* 09 section 9.5: timed channel park. */
-  else if (tg)
+  } else if (tg)
     lj_native_enter(tg);
   rc = la_futex_wait(&ch->futex, f, ns);
   if (L)

tests/suites/m6_jit.lua

@@ -39,6 +39,8 @@ local m6_cases = {
   "m6_jit_flush_gc_current_stack",
   "m6_jit_util_flush_race",
   "m6_jit_flush_thread_stress",
+  "m6_jit_flush_join_token_liveness",
+  "m6_jit_park_vmevent_reentrant",
   "m6_jit_flush_thread_heavy_stress",
   "m6_jit_mt_activation_flush",
   "m6_jit_gcworkers_activation_flush",
@@ -2229,6 +2231,39 @@ assert(live >= 4, live)
     end
   })
 
+  add({
+    name = "m6_jit_flush_join_token_liveness",
+    description = "blocking join releases asynchronously aborted recorder ownership",
+    run = function(t)
+      build_default(t)
+      -- This is the deterministic reducer for the heavy stress failure: the
+      -- top-level churn FORL owns the recorder token at round 40 while its
+      -- short-lived peer enters jit.flush() and must finish before join.
+      luajit_file(t, t:path("tests", "t-jit-flush-thread-stress.lua"), {
+        lua_path = true,
+        timeout = "20s",
+        env = {
+          LJ_M6_JIT_FLUSH_THREAD_THREADS = "1",
+          LJ_M6_JIT_FLUSH_THREAD_ROUNDS = "1",
+          LJ_M6_JIT_FLUSH_THREAD_CHURN = "96",
+          LJ_M6_JIT_FLUSH_THREAD_JOIN_TIMEOUT = "5"
+        }
+      })
+      print("M6 JIT blocking-join recorder-token liveness passed")
+    end
+  })
+
+  add({
+    name = "m6_jit_park_vmevent_reentrant",
+    description = "blocking parks preserve active VM-event recorder frames",
+    run = function(t)
+      build_default(t)
+      luajit_file(t, t:path("tests", "t-jit-park-vmevent-reentrant.lua"),
+                  { lua_path = true, timeout = "20s" })
+      print("M6 JIT VM-event park reentrancy passed")
+    end
+  })
+
   add({
     name = "m6_jit_flush_thread_heavy_stress",
     description = "heavier threaded JIT flush stress with progress diagnostics",

tests/t-jit-park-vmevent-reentrant.lua

@@ -0,0 +1,86 @@
+local th = require"threading"
+
+local function make_trace(n)
+  local sum = 0
+  for i = 1, n do sum = sum + i end
+  return sum
+end
+
+local function trigger_trace()
+  for _ = 1, 40 do assert(make_trace(80) == 3240) end
+end
+
+local function channel_park_from_trace_event()
+  local entered = th.channel(1)
+  local release = th.channel(1)
+  local armed = true
+  local saw_timeout = false
+
+  local function trace_hook(ev)
+    if armed and ev == "start" then
+      armed = false
+      assert(entered:send("entered", 1) == true)
+      local token, status = release:recv(0.05)
+      saw_timeout = token == nil and status == "timeout"
+    end
+  end
+  jit.off(trace_hook, true)
+
+  jit.flush()
+  jit.opt.start("hotloop=1", "hotexit=1")
+  jit.attach(trace_hook, "trace")
+  local peer = th.spawn(function(entered_ch, release_ch)
+    local token, ok = entered_ch:recv(1)
+    assert(ok == true and token == "entered")
+    jit.flush()
+    assert(release_ch:send("release", 1) == true)
+    return true
+  end, entered, release)
+
+  trigger_trace()
+  jit.attach(trace_hook)
+  local joined, result = peer:join(5)
+  assert(joined == true and result == true,
+         "channel-event peer did not finish after recorder unwind")
+  assert(saw_timeout,
+         "channel event park unexpectedly crossed synchronous peer flush")
+end
+
+local function join_park_from_trace_event()
+  local entered = th.channel(1)
+  local armed = true
+  local saw_timeout = false
+  local peer
+
+  local function trace_hook(ev)
+    if armed and ev == "start" then
+      armed = false
+      assert(entered:send("entered", 1) == true)
+      local joined, status = peer:join(0.05)
+      saw_timeout = joined ~= true and status == "timeout"
+    end
+  end
+  jit.off(trace_hook, true)
+
+  jit.flush()
+  jit.opt.start("hotloop=1", "hotexit=1")
+  jit.attach(trace_hook, "trace")
+  peer = th.spawn(function(entered_ch)
+    local token, ok = entered_ch:recv(1)
+    assert(ok == true and token == "entered")
+    jit.flush()
+    return true
+  end, entered)
+
+  trigger_trace()
+  jit.attach(trace_hook)
+  local joined, result = peer:join(5)
+  assert(joined == true and result == true,
+         "join-event peer did not finish after recorder unwind")
+  assert(saw_timeout,
+         "join event park unexpectedly crossed synchronous peer flush")
+end
+
+channel_park_from_trace_event()
+join_park_from_trace_event()
+print("t-jit-park-vmevent-reentrant OK: parks defer owner teardown")