test(gc2): cover saturated sweep admission

Author: Frityet

notes/gc2-sweep-saturation-and-tsan-gate-2026-07-14.md

@@ -0,0 +1,61 @@
+# GC2 saturated Huge admission and TSAN gate repair (2026-07-14)
+
+The plan files are unchanged. This checkpoint adds the last combined stress
+case requested by the independent review of SWEEP-stable Huge admission and
+repairs a stale boundary assertion exposed by the post-integration TSAN run.
+
+## Saturated Huge admission during SWEEP
+
+`tests/t-gc2-recovery.c` now drives all of the bounded fallback mechanisms to
+their limit in one deterministic process-isolated fixture:
+
+- an unmarked Huge userdata has already supplied the SWEEP writer with a stale
+  retirement ticket;
+- all 65,535 representable Huge body-reader tokens are held;
+- the 1,024-entry production SSB is full and its only spare node is withheld;
+- a real physical SWEEP reclaimer holds `LJ_GC2_SMR_SWEEP_STABLE`; and
+- the allocation page is changed to `PROT_NONE` before the late semantic mark.
+
+The late marker can still atomically publish the exact Huge-slot `MARK`, but it
+cannot obtain a body reader or enqueue the object. It must return without
+reading either the GC header or payload, set the sticky recovery-failure latch,
+and pin the activation in `LJ_GC2_ACT_NO_RECLAIM`. The fixture verifies that no
+recovery locator was fabricated, releases every reader, and only then wakes the
+stale writer. Durable `MARK` remains sufficient for the stale ticket to lose;
+the object never enters `FREEING`.
+
+This is deliberately a correctness proof, not a realistic load. The bounded
+reader counter and SSB are both exhausted to prove that their simultaneous
+failure remains non-dropping and fail-closed.
+
+## Thread-id sentinel boundary
+
+The first post-integration `m4_tsan_drivers` run stopped in
+`tests/t-thr-substrate.c` before TSAN reported any race. The fixture still
+treated `LJ_THREAD_GCSCAN - 1` as the last process-issued owner id. Since the
+addition of the distinct `LJ_THREAD_GCPREP` sentinel, the last valid owner is
+instead `LJ_THREAD_GCPREP - 1`.
+
+The runtime allocator already enforced the correct boundary. The fixture now
+uses `LJ_THREAD_GCPREP` consistently for both sequential and concurrent
+saturation, and explicitly proves that neither reserved sentinel can be passed
+to `lj_thr_create` as an owner id.
+
+## Verification
+
+- `m3_gc2_recovery`: passed in the normal helper build and the
+  assertion/paranoia helper build, including the `PROT_NONE` saturated case.
+- `m4_tsan_drivers`: passed after the fixture correction; both the thread/TG
+  substrate and bounded MPMC channel driver ran against a fully TSAN-instrumented
+  LuaJIT target with `halt_on_error=1`.
+- `m7_ffi_jit_cnew`: passed, including real CNEW, CNEWI, large CNEW traces and
+  the spawned-thread collection path.
+- `m6_jit_flush_thread_stress`: passed at 3 workers, 16 rounds and 32
+  short-lived threads.
+- `m6_jit_flush_thread_heavy_stress`: passed at 4 workers, 96 rounds and 192
+  short-lived threads.
+
+The wider post-integration ASAN/UBSAN and stress matrix remains a separate
+b1.2.0 release-gate activity. Ordinary performance differences remain b1.2.1
+work unless they are catastrophic (roughly 100x, runaway resource use, or an
+effective hang).

tests/t-gc2-recovery.c

@@ -11,6 +11,8 @@
 #include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
 #include <sys/resource.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -1474,6 +1476,124 @@ static void test_huge_sweep_stable_preadmission_arbitrates_stale_writer(void)
   assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
 }
 
+static void test_huge_sweep_saturated_reader_failclosed(void)
+{
+  pid_t child = fork();
+  int status = 0;
+  assert(child >= 0);
+  if (child == 0) {
+    struct rlimit core_limit = {0, 0};
+    RecoveryFixture f = recovery_fixture_open();
+    RecoverySweepReclaimCtx reclaim = {0};
+    LJHugeReader *readers;
+    GC2SSBNode *held;
+    GCRef *end;
+    GCstr *filler;
+    GCudata *ud = recovery_make_unlinked_huge_udata(&f);
+    LJHugeInfo hi;
+    LJGC2ActivationSnap activation;
+    pthread_t thread;
+    long pagesize;
+    void *body_page;
+    uint32_t i;
+    assert(setrlimit(RLIMIT_CORE, &core_limit) == 0);
+    alarm(10);
+
+    /* Take the stale unmarked retirement snapshot first. Slot readers may be
+    ** admitted behind its stable TICKET, but retirement itself quite properly
+    ** refuses to start while any of those body tokens already exists. */
+    lj_arena_hugetab_prepare_sweep(&f.tg->huge);
+    assert(lj_arena_hugetab_retire(
+	 &f.tg->huge, ud, ud, 2u, &reclaim.stale) == 1);
+    assert((reclaim.stale.flags &
+	    (LJ_HUGEF_SWEEP_OLD|LJ_HUGEF_RETIRED|LJ_HUGEF_TICKET)) ==
+	   (LJ_HUGEF_SWEEP_OLD|LJ_HUGEF_RETIRED|LJ_HUGEF_TICKET));
+    assert((reclaim.stale.flags & LJ_HUGEF_MARK) == 0);
+
+    readers = (LJHugeReader *)calloc(0xffffu, sizeof(*readers));
+    assert(readers != NULL);
+    for (i = 0; i < 0xffffu; i++)
+      assert(lj_arena_hugetab_reader_acquire(
+	       &f.tg->huge, ud, &readers[i], NULL) ==
+	     LJ_ARENA_HUGE_READER_ACQUIRED);
+    assert(lj_arena_hugetab_lookup(&f.tg->huge, ud, &hi) == 1);
+    assert(hi.readers == 0xffffu && (hi.flags & LJ_HUGEF_MARK) == 0);
+
+    /* Remove the only spare node and fill the production SSB. A saturated
+    ** semantic mark can therefore neither take a body token nor enqueue its
+    ** retry through the ordinary fast path. */
+    held = lj_tg_ssb_free_pop(f.tg);
+    assert(held != NULL && lj_tg_ssb_free_acq(f.tg) == NULL);
+    end = lj_tg_ssb_end_acq(f.tg);
+    lua_pushliteral(f.L, "gc2 saturated sweep admission filler");
+    filler = strV(f.L->top - 1);
+    for (i = 0; i < TG_GC2_SSB_SLOTS; i++)
+      assert(lj_gc2_test_ssb_push(f.g, obj2gco(filler)) == 1);
+    assert(lj_tg_ssb_next_acq(f.tg) == end);
+
+    recovery_publish_sweep_phase(f.g);
+    gc2_worker_active_rel(f.g, 1);
+    reclaim.g = f.g;
+    reclaim.tg = f.tg;
+    reclaim.p = ud;
+    assert(pthread_create(&thread, NULL,
+	   recovery_sweep_reclaim_thread, &reclaim) == 0);
+    while (la_load32_acq(&reclaim.ready) == 0)
+      la_cpu_pause();
+    assert(reclaim.entered == 1);
+    assert(gc2_smr_reclaiming_acq(f.g) == LJ_GC2_SMR_SWEEP_STABLE);
+
+    /* Make any GC-header or payload inspection immediately observable. The
+    ** full-slot MARK_SATURATED CAS is allowed to publish liveness, but without
+    ** a reader token the semantic marker must return before touching bytes. */
+    pagesize = sysconf(_SC_PAGESIZE);
+    assert(pagesize > 0 &&
+	   ((uintptr_t)pagesize & ((uintptr_t)pagesize - 1u)) == 0);
+    body_page = (void *)((uintptr_t)ud & ~((uintptr_t)pagesize - 1u));
+    assert(mprotect(body_page, (size_t)pagesize, PROT_NONE) == 0);
+    assert(lj_gc2_markobj(f.g, obj2gco(ud)) == 0);
+    assert(gc2_recovery_failed_acq(f.g) == 1u);
+    assert(gc2_recovery_items_acq(f.g) == 0);
+    assert(gc2_recovery_huge_items_acq(f.g) == 0);
+    assert(lj_tg_ssb_next_acq(f.tg) == end);
+    activation = lj_gc2_activation_snapshot(&f.g->gc2.activation);
+    assert(activation.state == LJ_GC2_ACT_NO_RECLAIM);
+    assert(lj_gc2_activation_reclaim_veto(f.g));
+    assert(lj_arena_hugetab_lookup(&f.tg->huge, ud, &hi) == 1);
+    assert(hi.readers == 0xffffu);
+    assert((hi.flags & (LJ_HUGEF_MARK|LJ_HUGEF_RETIRED|
+			 LJ_HUGEF_FREEING)) == LJ_HUGEF_MARK);
+    assert(lj_arena_huge_recovery_state(hi.flags) ==
+	   LJ_ARENA_RECOVERY_IDLE);
+
+    /* Remove reader saturation before waking the stale writer so the tokens
+    ** themselves cannot explain its loss. Durable MARK plus sticky
+    ** NO_RECLAIM must remain sufficient after the final release. */
+    for (i = 0; i < 0xffffu; i++)
+      assert(lj_arena_hugetab_reader_release(&readers[i], NULL) ==
+	     LJ_ARENA_HUGE_READER_RELEASED);
+    free(readers);
+    assert(lj_arena_hugetab_lookup(&f.tg->huge, ud, &hi) == 1);
+    assert(hi.readers == 0u);
+    assert((hi.flags & (LJ_HUGEF_MARK|LJ_HUGEF_FREEING)) ==
+	   LJ_HUGEF_MARK);
+
+    la_store32_rel(&reclaim.run, 1);
+    assert(pthread_join(thread, NULL) == 0);
+    assert(la_load32_acq(&reclaim.done) == 1);
+    assert(reclaim.result == 0 && reclaim.pending == 1);
+    assert(gc2_smr_reclaiming_acq(f.g) == LJ_GC2_SMR_OPEN);
+    assert(lj_arena_hugetab_lookup(&f.tg->huge, ud, &hi) == 1);
+    assert(hi.readers == 0u);
+    assert((hi.flags & (LJ_HUGEF_MARK|LJ_HUGEF_FREEING)) ==
+	   LJ_HUGEF_MARK);
+    alarm(0);
+    _exit(0);  /* PROT_NONE body and fail-closed activation stay isolated. */
+  }
+  assert(waitpid(child, &status, 0) == child);
+  assert(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+}
+
 static void test_huge_sweep_reader_keeps_pre_destructor_retryable(void)
 {
   pid_t child = fork();
@@ -2028,6 +2148,7 @@ int main(void)
   test_huge_recovery_exact_lane_accounting();
   test_huge_reader_recovery_bypasses_smr_writer();
   test_huge_sweep_stable_preadmission_arbitrates_stale_writer();
+  test_huge_sweep_saturated_reader_failclosed();
   test_huge_sweep_reader_keeps_pre_destructor_retryable();
   test_huge_deferred_free_recovery_is_bounded();
   test_empty_huge_lane_is_skipped();
@@ -2040,7 +2161,7 @@ int main(void)
   test_terminal_preflight_preserves_mismatch_locator();
   test_sticky_failure_without_items_is_bounded();
   printf("t-gc2-recovery OK: no-drop SSB/recovery, exact huge-lane "
-	 "accounting/skip, SWEEP-stable late admission, retryable Huge "
+	 "accounting/skip, SWEEP-stable late/saturated admission, retryable Huge "
 	 "destructors, held-reader SMR bypass, bounded terminal free, "
 	 "cyclic private/metadata edges, free/lifetime races, constructor "
 	 "overlap, closure vetoes, empty-string SWEEP, sticky failure, and "

tests/t-thr-substrate.c

@@ -174,16 +174,22 @@ int main(void)
   uint64_t epoch0;
 
   {
-    uint32_t counter = LJ_THREAD_GCSCAN - 3u;
+    uint32_t counter = LJ_THREAD_GCPREP - 3u;
     LJThr invalid = {0};
-    assert(lj_thr_id_alloc(&counter) == LJ_THREAD_GCSCAN - 2u);
-    assert(lj_thr_id_alloc(&counter) == LJ_THREAD_GCSCAN - 1u);
+    assert(lj_thr_id_alloc(&counter) == LJ_THREAD_GCPREP - 2u);
+    assert(lj_thr_id_alloc(&counter) == LJ_THREAD_GCPREP - 1u);
     assert(lj_thr_id_alloc(&counter) == 0);
     assert(lj_thr_id_alloc(&counter) == 0);
-    assert(counter == LJ_THREAD_GCSCAN - 1u);
+    assert(counter == LJ_THREAD_GCPREP - 1u);
+    counter = LJ_THREAD_GCPREP;
+    assert(lj_thr_id_alloc(&counter) == 0);
+    assert(counter == LJ_THREAD_GCPREP);
     counter = LJ_THREAD_GCSCAN;
     assert(lj_thr_id_alloc(&counter) == 0);
     assert(counter == LJ_THREAD_GCSCAN);
+    invalid.tid = LJ_THREAD_GCPREP;
+    assert(lj_thr_create(&invalid, id_stress_main, NULL) == EAGAIN);
+    assert(invalid.tid == 0);
     invalid.tid = LJ_THREAD_GCSCAN;
     assert(lj_thr_create(&invalid, id_stress_main, NULL) == EAGAIN);
     assert(invalid.tid == 0);
@@ -192,7 +198,7 @@ int main(void)
     IdStressCtx idctx = {0};
     LJThr idthr[ID_STRESS_THREADS] = {{0}};
     uint32_t i;
-    idctx.counter = LJ_THREAD_GCSCAN - 1u - ID_STRESS_COUNT;
+    idctx.counter = LJ_THREAD_GCPREP - 1u - ID_STRESS_COUNT;
     idctx.first = idctx.counter + 1u;
     for (i = 0; i < ID_STRESS_THREADS; i++)
       assert(lj_thr_create(&idthr[i], id_stress_main, &idctx) == 0);
@@ -202,7 +208,7 @@ int main(void)
     for (i = 0; i < ID_STRESS_THREADS; i++)
       assert(lj_thr_join(&idthr[i], NULL) == 0);
     assert(la_load32_acq(&idctx.successes) == ID_STRESS_COUNT);
-    assert(la_load32_acq(&idctx.counter) == LJ_THREAD_GCSCAN - 1u);
+    assert(la_load32_acq(&idctx.counter) == LJ_THREAD_GCPREP - 1u);
     for (i = 0; i < ID_STRESS_COUNT; i++)
       assert(la_load32_acq(&idctx.seen[i]) == 1);
   }