rusty_racer 0.1.14 → 0.1.16

data/ext/rusty_racer/src/stack.rs

@@ -151,40 +151,141 @@ fn native_stack_bounds() -> (usize, usize) {
     (0, 0)
 }
 
-// Lower bound (and upper, for caching) of the memory region containing `addr`
-// — i.e. the BOTTOM of the stack `addr` is on. Used for a Ruby Fiber, whose
-// mmap'd stack pthread can't see: V8's limit must sit ABOVE this bottom or a
-// deep fiber recursion overflows the real stack and SEGVs the unmapped guard.
-// Cached per native thread keyed by the region (parsing /proc/self/maps is
-// slow): reused while successive ops stay on the same fiber. (0, 0) if unknown.
+// Lower bound (and upper, for the cache test) of the memory region containing
+// `addr` — i.e. the BOTTOM of the stack `addr` is on. Used for a Ruby Fiber,
+// whose mmap'd stack pthread can't see: V8's limit must sit ABOVE this bottom or
+// a deep fiber recursion overflows the real stack and SEGVs the unmapped guard.
+// (0, 0) if unknown.
+//
+// Cached per native thread, several regions at a time, because a miss asks the
+// OS for the whole memory map and costs far more than the op it serves: with ONE
+// slot
+// a workload that alternates between fibers missed on every single op, and an
+// eval went from 1.2us to 31us as soon as two fibers took turns (measured on a
+// 212-line maps; a Rails process has many times that). Ruby pools fiber stacks,
+// so the live set is small and stable — one Enumerator per Capybara result, say
+// — and a handful of slots turns that back into hits.
+//
+// Eviction is RANDOM, not round-robin (or LRU, which behaves the same here):
+// ops cycling through more fibers than there are slots are exactly the pattern
+// those policies handle worst, since each eviction takes the entry needed next
+// and the hit rate collapses to zero — one fiber over the size measured as slow
+// as having no cache at all. Evicting at random keeps roughly
+// slots/live-fibers of the accesses, so going over the size degrades gradually
+// instead of falling off a cliff. Empty slots are filled before anything is
+// evicted. Entries are never invalidated: a dead fiber's keeps its slot until
+// some miss draws it, and with a live set that fits there are no misses at all
+// — which is why a hit has to be self-justifying rather than merely plausible.
+//
+// So the mapping's top is never used, or even kept, as an upper bound. A fiber
+// stack's mapping can extend far above the stack itself, where the kernel merged
+// it with an adjacent anonymous mapping of the same protection that has nothing
+// to do with the fiber pool (measured: a 644KB stack inside an 8840KB mapping,
+// with an unrelated 400MB mapping directly above). An entry that answered on the
+// strength of that top would let a later allocation in the neighbour's range
+// inherit a bottom megabytes below its own, and V8 would be told it has that
+// much headroom on a 644KB stack.
+//
+// Each entry instead carries `seen`: the highest address a V8 op has ACTUALLY
+// run at on that stack. It is both the top of the matching window and the bound
+// returned to callers, so the scan-start test in StackScope::enter — "is this
+// enclosing op's marker on the stack I am on?" — rests on an address we watched
+// an op occupy rather than on the kernel's idea of where the mapping ends. A
+// frame higher than anything seen so far misses once and widens the window in
+// place, and a miss always re-queries, so it is only HITS that this has to keep
+// honest.
+//
+// What it does not do is tell two stacks apart that genuinely share one mapping,
+// since entries are keyed by the mapping's bottom: an op running higher up such
+// a mapping re-queries, gets the same bottom back, and widens that one entry.
+// Both then get the lower bottom and a window that spans both. That stays
+// SAFE — one mapping means no guard page in between, so neither the limit nor a
+// scan can walk into an unmapped page — but the upper stack is handed more
+// headroom than it owns. It needs a stack with no guard page below it, which
+// Ruby's fiber pool and pthread both rule out for the stacks we run on.
+//
+// Within that window a cached bottom is the fiber's real bottom: Ruby brackets
+// every fiber stack with PROT_NONE guard pages, so the mapping cannot start
+// below the stack, and a pooled slot is handed to the next fiber with identical
+// bounds.
+const FIBER_REGION_SLOTS: usize = 16;
+
+#[derive(Clone, Copy)]
+struct FiberRegion {
+    // The mapping's bottom, and the key: 0 marks the slot unused.
+    lo: usize,
+    // Highest address a V8 op has run at on this stack.
+    seen: usize,
+}
+
+#[derive(Clone, Copy)]
+struct FiberRegions {
+    slots: [FiberRegion; FIBER_REGION_SLOTS],
+    // xorshift64 state for picking a victim. Seeded to a fixed nonzero constant
+    // (the golden-ratio one): nothing here needs unpredictability, only that the
+    // eviction order doesn't line up with the caller's rotation through fibers.
+    rng: u64,
+}
+
 thread_local! {
-    static FIBER_REGION: std::cell::Cell<(usize, usize)> = const { std::cell::Cell::new((0, 0)) };
+    static FIBER_REGIONS: std::cell::RefCell<FiberRegions> = const {
+        std::cell::RefCell::new(FiberRegions {
+            slots: [FiberRegion { lo: 0, seen: 0 }; FIBER_REGION_SLOTS],
+            rng: 0x9E37_79B9_7F4A_7C15,
+        })
+    };
 }
 
+// (bottom, highest-address-seen) of the stack `addr` is on. `addr` must be an
+// address the CALLER knows is on that stack and as high up it as it can offer —
+// it both answers the lookup and becomes the entry's `seen` on a miss, so a
+// caller that passes its topmost frame gets the widest sound window. A RefCell
+// rather than a Cell so a hit reads the slots in place instead of copying the
+// whole table out on every fiber op.
 fn current_region_bounds_cached(addr: usize) -> (usize, usize) {
-    FIBER_REGION.with(|c| {
-        let (lo, hi) = c.get();
-        if lo != 0 && addr >= lo && addr < hi {
-            return (lo, hi);
+    FIBER_REGIONS.with(|c| {
+        if let Some(r) = c
+            .borrow()
+            .slots
+            .iter()
+            .find(|r| r.lo != 0 && addr >= r.lo && addr <= r.seen)
+        {
+            return (r.lo, r.seen);
         }
-        let bounds = query_region_bounds(addr);
-        if bounds.0 != 0 {
-            c.set(bounds);
+        let (lo, _) = query_region_bounds(addr);
+        if lo == 0 {
+            return (0, 0);
         }
-        bounds
+        let mut cache = c.borrow_mut();
+        // Prefer the entry for a stack we already know (a frame above anything
+        // seen on it so far, which just widens the window), then an empty slot,
+        // and only then evict.
+        let slot = cache
+            .slots
+            .iter()
+            .position(|r| r.lo == lo)
+            .or_else(|| cache.slots.iter().position(|r| r.lo == 0))
+            .unwrap_or_else(|| {
+                cache.rng ^= cache.rng << 13;
+                cache.rng ^= cache.rng >> 7;
+                cache.rng ^= cache.rng << 17;
+                (cache.rng % FIBER_REGION_SLOTS as u64) as usize
+            });
+        cache.slots[slot] = FiberRegion { lo, seen: addr };
+        (lo, addr)
     })
 }
 
-// The [start, end) of the /proc/self/maps mapping containing `addr`. Linux only;
-// (0, 0) elsewhere (and the caller falls back). Reads the file fresh — slow, so
-// only called on a cache miss (a new fiber).
+// The [start, end) of the mapping containing `addr`, or (0, 0) when it can't be
+// established. Only called on a cache miss (a new fiber), because it is slow.
 //
-// Everything that needs a FIBER's real bounds degrades on the (0, 0) platforms,
-// macOS being the shipped one: the stack limit drops to a fixed budget below the
-// SP (see StackScope::enter), and a nested op can no longer widen its GC-scan
-// start to the enclosing op's, so it narrows to its own frame. Both are the
-// pre-fiber-support behaviour rather than a crash, but a darwin implementation
-// (mach_vm_region on the current task) would close the gap.
+// (0, 0) is the fail-safe answer, not an error: every caller falls back to a
+// fixed budget below the SP, which is what this gem did on every platform before
+// any of these lookups existed. So a platform without an implementation, or a
+// lookup that returns something we can't vouch for, degrades to a smaller JS
+// stack rather than to a wrong one.
+//
+// Linux reads /proc/self/maps fresh each time.
 #[cfg(target_os = "linux")]
 fn query_region_bounds(addr: usize) -> (usize, usize) {
     use std::io::Read;
@@ -203,19 +304,84 @@ fn query_region_bounds(addr: usize) -> (usize, usize) {
         let Some((lo, hi)) = range.split_once('-') else {
             continue;
         };
-        if let (Ok(lo), Ok(hi)) = (
-            usize::from_str_radix(lo, 16),
-            usize::from_str_radix(hi, 16),
-        ) {
-            if addr >= lo && addr < hi {
-                return (lo, hi);
-            }
+        let (Ok(lo), Ok(hi)) = (usize::from_str_radix(lo, 16), usize::from_str_radix(hi, 16))
+        else {
+            continue;
+        };
+        if addr >= lo && addr < hi {
+            return (lo, hi);
         }
     }
     (0, 0)
 }
 
-#[cfg(not(target_os = "linux"))]
+// macOS has no /proc, so ask the Mach VM directly. mach_vm_region reports the
+// region containing `addr` — or, when `addr` sits in a hole, the next one ABOVE
+// it — so the answer is checked for containment rather than trusted. It is also
+// checked for being readable and writable: a stack always is, and a protection
+// that isn't tells us we either walked into something that is not a stack or
+// misread the reply, in which case the fixed-budget fallback is the safer answer.
+#[cfg(target_os = "macos")]
+fn query_region_bounds(addr: usize) -> (usize, usize) {
+    // Not in libc, which points at the `mach2` crate instead; these are the only
+    // entry points we need, so declare them here rather than take the dependency.
+    // (libc does carry mach_task_self_, but deprecated for the same reason.)
+    unsafe extern "C" {
+        static mach_task_self_: libc::mach_port_t;
+        fn mach_vm_region(
+            target_task: libc::vm_map_t,
+            address: *mut libc::mach_vm_address_t,
+            size: *mut libc::mach_vm_size_t,
+            flavor: libc::c_int,
+            info: *mut u32,
+            info_count: *mut libc::mach_msg_type_number_t,
+            object_name: *mut libc::mach_port_t,
+        ) -> libc::kern_return_t;
+        fn mach_port_deallocate(
+            task: libc::mach_port_t,
+            name: libc::mach_port_t,
+        ) -> libc::kern_return_t;
+    }
+    // VM_REGION_BASIC_INFO_64, and the width of vm_region_basic_info_data_64_t
+    // in u32s. Only `protection` (its first field) is read.
+    const VM_REGION_BASIC_INFO_64: libc::c_int = 9;
+    const VM_REGION_BASIC_INFO_COUNT_64: libc::mach_msg_type_number_t = 9;
+    const KERN_SUCCESS: libc::kern_return_t = 0;
+    const VM_PROT_READ_WRITE: u32 = 0x1 | 0x2;
+
+    unsafe {
+        let mut start = addr as libc::mach_vm_address_t;
+        let mut size: libc::mach_vm_size_t = 0;
+        let mut info = [0u32; VM_REGION_BASIC_INFO_COUNT_64 as usize];
+        let mut count = VM_REGION_BASIC_INFO_COUNT_64;
+        let mut object_name: libc::mach_port_t = 0;
+        let kr = mach_vm_region(
+            mach_task_self_,
+            &mut start,
+            &mut size,
+            VM_REGION_BASIC_INFO_64,
+            info.as_mut_ptr(),
+            &mut count,
+            &mut object_name,
+        );
+        // Documented to come back MACH_PORT_NULL for this flavor, but a leaked
+        // port name in a per-fiber path would accumulate, so hand it back.
+        if object_name != 0 {
+            mach_port_deallocate(mach_task_self_, object_name);
+        }
+        if kr != KERN_SUCCESS || size == 0 || info[0] & VM_PROT_READ_WRITE != VM_PROT_READ_WRITE {
+            return (0, 0);
+        }
+        let (lo, hi) = (start as usize, start.saturating_add(size) as usize);
+        if addr >= lo && addr < hi {
+            (lo, hi)
+        } else {
+            (0, 0) // `addr` was in a hole; this is the region after it
+        }
+    }
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "macos")))]
 fn query_region_bounds(_addr: usize) -> (usize, usize) {
     (0, 0)
 }
@@ -238,8 +404,8 @@ pub(crate) static STACK_DEBUG: AtomicBool = AtomicBool::new(false);
 //   * Too low (below the real bottom) and a deep recursion grows past the
 //     mapped stack and SEGVs the unmapped guard page below it.
 // So detect the stack by comparing the SP to the cached native bounds: on the
-// native stack, anchor to its pthread bottom; on a fiber, find the bottom of the
-// /proc/self/maps region holding the SP (the fiber's real bottom — anchoring to
+// native stack, anchor to its pthread bottom; on a fiber, look up the bottom of
+// the mapping holding the SP (the fiber's real bottom — anchoring to
 // SP minus a fixed guard punched through the bottom of Avo's small/deep Capybara
 // fibers and SEGV'd).
 //
@@ -334,37 +500,44 @@ impl<'a> StackScope<'a> {
         let limit = if on_native {
             nbottom + NATIVE_GUARD
         } else {
-            // Anchor to the FIBER's real bottom (the /proc/self/maps region
-            // holding the SP), not the SP: SP - fixed_guard can punch through the
+            // Anchor to the FIBER's real bottom (the mapping holding the SP),
+            // not the SP: SP - fixed_guard can punch through the
             // bottom of a small/deep fiber stack and SEGV (Avo's deep Capybara
             // filter chain). Reserve FIBER_RESERVE above the bottom for the
             // throw, but keep the limit below the SP so we don't false-overflow;
             // on a nearly-full fiber that clamps the headroom down (an early but
             // CLEAN RangeError).
-            region = current_region_bounds_cached(sp);
+            // Look it up by `stack_top`, not the SP: it is this op's highest
+            // frame, so it widens the cache's window as far as this op honestly
+            // can, and the scan-start test below then has a bound it can trust.
+            // Falls back to the SP if the caller had no marker to offer.
+            region = current_region_bounds_cached(if stack_top != 0 { stack_top } else { sp });
             if region.0 != 0 {
                 (region.0 + FIBER_RESERVE).min(sp.saturating_sub(8 * 1024))
             } else {
-                // Region unknown — only Linux can look a fiber's bounds up (see
-                // query_region_bounds), so this is the macOS path. Best effort:
-                // hand JS a fixed budget below the SP and hope the fiber is that
+                // Region unknown. Both shipped platforms implement the lookup,
+                // so reaching this on one of them means the lookup FAILED (see
+                // query_region_bounds for what it refuses to vouch for) — worth
+                // chasing rather than assuming, since the budget here is only a
+                // guess: a fixed reserve below the SP, hoping the fiber is that
                 // deep. It usually is for an OUTERMOST fiber op, whose SP sits
                 // near the fiber's top, and much less reliably for a NESTED one,
                 // whose SP is already far down the fiber — there this can land
                 // below the fiber's mapped bottom, and V8 then grows through the
-                // guard page (SEGV) instead of throwing. Fixing that properly
-                // means a mach_vm_region lookup for darwin.
+                // guard page (SEGV) instead of throwing.
                 sp.saturating_sub(64 * 1024)
             }
         };
         // Opt-in diagnostics (RUSTY_RACER_STACK_DEBUG): the SP vs the native
-        // stack [nbottom, ntop], the fiber region (if any), the per-op limit, and
+        // stack [nbottom, ntop], the fiber window (if any), the per-op limit, and
         // whether the SP is above the limit. A crash with sp_above_limit=false
-        // means the limit is wrong for the current stack.
+        // means the limit is wrong for the current stack. The window is printed
+        // CLOSED because its top is the highest address an op was seen at on that
+        // stack, not the mapping's end — see current_region_bounds_cached.
         if STACK_DEBUG.load(Ordering::Relaxed) {
             eprintln!(
                 "[rusty stack] sp={sp:#x} nbottom={nbottom:#x} ntop={ntop:#x} \
-                 region=[{:#x},{:#x}) limit={limit:#x} fiber={} sp_above_limit={} \
+                 window=[{:#x},{:#x}] limit={limit:#x} fiber={} sp_above_limit={} \
                  fiber_above_native={}",
                 region.0,
                 region.1,
@@ -399,7 +572,11 @@ impl<'a> StackScope<'a> {
         }
         // Only a nested op owes anything back: at the outermost op prev_limit is
         // the previous, already-finished op's, which describes no live frame.
-        let restore_limit = if nested && changed_limit { prev_limit } else { 0 };
+        let restore_limit = if nested && changed_limit {
+            prev_limit
+        } else {
+            0
+        };
         // Point V8's conservative-GC-scan start at the stack we're on. The
         // scanner walks [marker, start), so on a fiber a native start runs it off
         // the fiber's mapped top into unmapped memory and SEGVs (Avo's Capybara
@@ -410,14 +587,24 @@ impl<'a> StackScope<'a> {
         //   * a fiber we ENTERED (the enclosing op is elsewhere) — this op's
         //     `stack_top`, which keeps the range between two real stack pointers
         //     (marker..stack_top) and so guaranteed mapped. We can't use the
-        //     /proc/maps region top: that mapping isn't reliably contiguous, so
+        //     looked-up region's top: that mapping isn't reliably contiguous, so
         //     the scan could still hit a hole below it.
         //   * a fiber we were ALREADY on (a nested op under a host callback that
         //     didn't switch stacks) — the enclosing op's start, which is above
-        //     ours and in the same mapping, so it covers both ops' frames.
+        //     ours and covers both ops' frames. Accepted only when it is at or
+        //     below the highest address an op has been seen running at on this
+        //     stack (the cache's `seen`, NOT the mapping top, which can reach far
+        //     into an unrelated neighbour — see current_region_bounds_cached);
+        //     otherwise we cannot tell it is on our stack at all, and adopting it
+        //     would send the scan up through our guard page. Since that window
+        //     lives in a cache with random eviction, the test can also fail
+        //     because the entry was evicted between the two ops — the scan then
+        //     narrows to this op's own frame, i.e. the same residual documented
+        //     there for a real stack switch, now reachable at random once more
+        //     fiber stacks are live than the cache holds.
         let new_scan_start = if on_native {
             unsafe { v8__base__Stack__GetStackStart() }
-        } else if nested && region.0 != 0 && prev_scan_start > sp && prev_scan_start < region.1 {
+        } else if nested && region.0 != 0 && prev_scan_start > sp && prev_scan_start <= region.1 {
             prev_scan_start
         } else {
             stack_top
@@ -463,7 +650,8 @@ impl Drop for StackScope<'_> {
         }
         if self.restore_limit != 0 {
             unsafe { v8__Isolate__SetStackLimit(self.real_isolate, self.restore_limit) };
-            self.installed_limit.store(self.restore_limit, Ordering::Relaxed);
+            self.installed_limit
+                .store(self.restore_limit, Ordering::Relaxed);
         }
     }
 }

data/ext/rusty_racer/src/watchdog.rs

@@ -224,7 +224,10 @@ fn capture_js_backtrace(scope: &mut v8::PinScope<'_, '_>, max_frames: usize) ->
 // bloat the error.
 fn clamp_name(mut s: String) -> String {
     if s.len() > MAX_FRAME_NAME {
-        let end = (0..=MAX_FRAME_NAME).rev().find(|&i| s.is_char_boundary(i)).unwrap_or(0);
+        let end = (0..=MAX_FRAME_NAME)
+            .rev()
+            .find(|&i| s.is_char_boundary(i))
+            .unwrap_or(0);
         s.truncate(end);
         s.push('…');
     }
@@ -255,7 +258,10 @@ pub(crate) fn arm_watchdog(scope: &mut v8::PinScope<'_, '_, ()>, timeout_ms: u64
 // Terminated and the outermost frame sweeps the leftover terminate via
 // WATCHDOG_FIRED; removing only this frame keeps a late terminate from
 // poisoning the next request without clobbering a still-running outer op.
-pub(crate) fn disarm_watchdog(scope: &mut v8::PinScope<'_, '_, ()>, generation: Option<u64>) -> bool {
+pub(crate) fn disarm_watchdog(
+    scope: &mut v8::PinScope<'_, '_, ()>,
+    generation: Option<u64>,
+) -> bool {
     let Some(generation) = generation else {
         return false;
     };

data/lib/rusty_racer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RustyRacer
-  VERSION = "0.1.14"
+  VERSION = "0.1.16"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rusty_racer
 version: !ruby/object:Gem::Version
-  version: 0.1.14
+  version: 0.1.16
 platform: ruby
 authors:
 - Keita Urashima