@ttsc/darwin-x64 0.10.0 → 0.10.2

package/bin/go/src/runtime/malloc.go

@@ -788,7 +788,7 @@ func (h *mheap) sysAlloc(n uintptr, hintList **arenaHint, arenaList *[]arenaIdx)
 		// particular, this is already how Windows behaves, so
 		// it would simplify things there.
 		if v != nil {
-			sysFreeOS(v, n)
+			sysUnreserve(v, n)
 		}
 		*hintList = hint.next
 		h.arenaHintAlloc.free(unsafe.Pointer(hint))
@@ -921,58 +921,6 @@ mapped:
 	return
 }
 
-// sysReserveAligned is like sysReserve, but the returned pointer is
-// aligned to align bytes. It may reserve either n or n+align bytes,
-// so it returns the size that was reserved.
-func sysReserveAligned(v unsafe.Pointer, size, align uintptr, vmaName string) (unsafe.Pointer, uintptr) {
-	if isSbrkPlatform {
-		if v != nil {
-			throw("unexpected heap arena hint on sbrk platform")
-		}
-		return sysReserveAlignedSbrk(size, align)
-	}
-	// Since the alignment is rather large in uses of this
-	// function, we're not likely to get it by chance, so we ask
-	// for a larger region and remove the parts we don't need.
-	retries := 0
-retry:
-	p := uintptr(sysReserve(v, size+align, vmaName))
-	switch {
-	case p == 0:
-		return nil, 0
-	case p&(align-1) == 0:
-		return unsafe.Pointer(p), size + align
-	case GOOS == "windows":
-		// On Windows we can't release pieces of a
-		// reservation, so we release the whole thing and
-		// re-reserve the aligned sub-region. This may race,
-		// so we may have to try again.
-		sysFreeOS(unsafe.Pointer(p), size+align)
-		p = alignUp(p, align)
-		p2 := sysReserve(unsafe.Pointer(p), size, vmaName)
-		if p != uintptr(p2) {
-			// Must have raced. Try again.
-			sysFreeOS(p2, size)
-			if retries++; retries == 100 {
-				throw("failed to allocate aligned heap memory; too many retries")
-			}
-			goto retry
-		}
-		// Success.
-		return p2, size
-	default:
-		// Trim off the unaligned parts.
-		pAligned := alignUp(p, align)
-		sysFreeOS(unsafe.Pointer(p), pAligned-p)
-		end := pAligned + size
-		endLen := (p + size + align) - end
-		if endLen > 0 {
-			sysFreeOS(unsafe.Pointer(end), endLen)
-		}
-		return unsafe.Pointer(pAligned), size
-	}
-}
-
 // enableMetadataHugePages enables huge pages for various sources of heap metadata.
 //
 // A note on latency: for sufficiently small heaps (<10s of GiB) this function will take constant

package/bin/go/src/runtime/mem.go

@@ -120,14 +120,21 @@ func sysHugePageCollapse(v unsafe.Pointer, n uintptr) {
 //
 // sysStat must be non-nil.
 //
+// The size and start address must exactly match the size and returned address
+// from the original sysAlloc/sysReserve/sysReserveAligned call. That is,
+// sysFree cannot be used to free a subset of a memory region.
+//
 // Don't split the stack as this function may be invoked without a valid G,
 // which prevents us from allocating more stack.
 //
 //go:nosplit
 func sysFree(v unsafe.Pointer, n uintptr, sysStat *sysMemStat) {
-	// When using ASAN leak detection, the memory being freed is
-	// known by the sanitizer. We need to unregister it so it's
-	// not accessed by it.
+	// When using ASAN leak detection, the memory being freed is known by
+	// the sanitizer. We need to unregister it so it's not accessed by it.
+	//
+	// lsanunregisterrootregion matches regions by start address and size,
+	// so it is not possible to unregister a subset of the region. This is
+	// why sysFree requires the full region from the initial allocation.
 	if asanenabled {
 		lsanunregisterrootregion(v, n)
 	}
@@ -156,13 +163,12 @@ func sysFault(v unsafe.Pointer, n uintptr) {
 // (either via permissions or not committing the memory). Such a reservation is
 // thus never backed by physical memory.
 //
-// If the pointer passed to it is non-nil, the caller wants the
-// reservation there, but sysReserve can still choose another
-// location if that one is unavailable.
+// If the pointer passed to it is non-nil, the caller wants the reservation
+// there, but sysReserve can still choose another location if that one is
+// unavailable.
 //
-// NOTE: sysReserve returns OS-aligned memory, but the heap allocator
-// may use larger alignment, so the caller must be careful to realign the
-// memory obtained by sysReserve.
+// sysReserve returns OS-aligned memory. If a larger alignment is required, use
+// sysReservedAligned.
 func sysReserve(v unsafe.Pointer, n uintptr, vmaName string) unsafe.Pointer {
 	p := sysReserveOS(v, n, vmaName)
 
@@ -175,6 +181,95 @@ func sysReserve(v unsafe.Pointer, n uintptr, vmaName string) unsafe.Pointer {
 	return p
 }
 
+// sysReserveAligned transitions a memory region from None to Reserved.
+//
+// Semantics are equivlent to sysReserve, but the returned pointer is aligned
+// to align bytes. It may reserve either n or n+align bytes, so it returns the
+// size that was reserved.
+func sysReserveAligned(v unsafe.Pointer, size, align uintptr, vmaName string) (unsafe.Pointer, uintptr) {
+	if isSbrkPlatform {
+		if v != nil {
+			throw("unexpected heap arena hint on sbrk platform")
+		}
+		return sysReserveAlignedSbrk(size, align)
+	}
+	// Since the alignment is rather large in uses of this
+	// function, we're not likely to get it by chance, so we ask
+	// for a larger region and remove the parts we don't need.
+	retries := 0
+retry:
+	p := uintptr(sysReserve(v, size+align, vmaName))
+	switch {
+	case p == 0:
+		return nil, 0
+	case p&(align-1) == 0:
+		return unsafe.Pointer(p), size + align
+	case GOOS == "windows":
+		// On Windows we can't release pieces of a
+		// reservation, so we release the whole thing and
+		// re-reserve the aligned sub-region. This may race,
+		// so we may have to try again.
+		sysUnreserve(unsafe.Pointer(p), size+align)
+		p = alignUp(p, align)
+		p2 := sysReserve(unsafe.Pointer(p), size, vmaName)
+		if p != uintptr(p2) {
+			// Must have raced. Try again.
+			sysUnreserve(p2, size)
+			if retries++; retries == 100 {
+				throw("failed to allocate aligned heap memory; too many retries")
+			}
+			goto retry
+		}
+		// Success.
+		return p2, size
+	default:
+		// Trim off the unaligned parts.
+		pAligned := alignUp(p, align)
+		end := pAligned + size
+		endLen := (p + size + align) - end
+
+		// sysUnreserve does not allow unreserving a subset of the
+		// region because LSAN does not allow unregistering a subset.
+		// So we can't call sysUnreserve. Instead we simply unregister
+		// the entire region from LSAN and re-register with the smaller
+		// region before freeing the unecessary portions, which does
+		// allow subsets of the region.
+		if asanenabled {
+			lsanunregisterrootregion(unsafe.Pointer(p), size+align)
+			lsanregisterrootregion(unsafe.Pointer(pAligned), size)
+		}
+		sysFreeOS(unsafe.Pointer(p), pAligned-p)
+		if endLen > 0 {
+			sysFreeOS(unsafe.Pointer(end), endLen)
+		}
+		return unsafe.Pointer(pAligned), size
+	}
+}
+
+// sysUnreserve transitions a memory region from Reserved to None.
+//
+// The size and start address must exactly match the size and returned address
+// from sysReserve/sysReserveAligned. That is, sysUnreserve cannot be used to
+// unreserve a subset of a memory region.
+//
+// Don't split the stack as this function may be invoked without a valid G,
+// which prevents us from allocating more stack.
+//
+//go:nosplit
+func sysUnreserve(v unsafe.Pointer, n uintptr) {
+	// When using ASAN leak detection, the memory being freed is known by
+	// the sanitizer. We need to unregister it so it's not accessed by it.
+	//
+	// lsanunregisterrootregion matches regions by start address and size,
+	// so it is not possible to unregister a subset of the region. This is
+	// why sysUnreserve requires the full region from sysReserve.
+	if asanenabled {
+		lsanunregisterrootregion(v, n)
+	}
+
+	sysFreeOS(v, n)
+}
+
 // sysMap transitions a memory region from Reserved to Prepared. It ensures the
 // memory region can be efficiently transitioned to Ready.
 //

package/bin/go/src/runtime/metrics/doc.go

@@ -306,6 +306,11 @@ Below is the full list of supported metrics, ordered lexicographically.
 		The number of non-default behaviors executed by the go/types
 		package due to a non-default GODEBUG=gotypesalias=... setting.
 
+	/godebug/non-default-behavior/htmlmetacontenturlescape:events
+		The number of non-default behaviors executed by
+		the html/template package due to a non-default
+		GODEBUG=htmlmetacontenturlescape=... setting.
+
 	/godebug/non-default-behavior/http2client:events
 		The number of non-default behaviors executed by the net/http
 		package due to a non-default GODEBUG=http2client=... setting.

package/bin/go/src/runtime/os_linux.go

@@ -354,6 +354,7 @@ func osinit() {
 	numCPUStartup = getCPUCount()
 	physHugePageSize = getHugePageSize()
 	vgetrandomInit()
+	configure64bitsTimeOn32BitsArchitectures()
 }
 
 var urandom_dev = []byte("/dev/urandom\x00")
@@ -935,3 +936,64 @@ func mprotect(addr unsafe.Pointer, n uintptr, prot int32) (ret int32, errno int3
 	r, _, err := linux.Syscall6(linux.SYS_MPROTECT, uintptr(addr), n, uintptr(prot), 0, 0, 0)
 	return int32(r), int32(err)
 }
+
+type kernelVersion struct {
+	major int
+	minor int
+}
+
+// getKernelVersion returns major and minor kernel version numbers
+// parsed from the uname release field.
+func getKernelVersion() kernelVersion {
+	var buf linux.Utsname
+	if e := linux.Uname(&buf); e != 0 {
+		throw("uname failed")
+	}
+
+	rel := gostringnocopy(&buf.Release[0])
+	major, minor, _, ok := parseRelease(rel)
+	if !ok {
+		throw("failed to parse kernel version from uname")
+	}
+	return kernelVersion{major: major, minor: minor}
+}
+
+// parseRelease parses a dot-separated version number. It follows the
+// semver syntax, but allows the minor and patch versions to be
+// elided.
+func parseRelease(rel string) (major, minor, patch int, ok bool) {
+	// Strip anything after a dash or plus.
+	for i := 0; i < len(rel); i++ {
+		if rel[i] == '-' || rel[i] == '+' {
+			rel = rel[:i]
+			break
+		}
+	}
+
+	next := func() (int, bool) {
+		for i := 0; i < len(rel); i++ {
+			if rel[i] == '.' {
+				ver, err := strconv.Atoi(rel[:i])
+				rel = rel[i+1:]
+				return ver, err == nil
+			}
+		}
+		ver, err := strconv.Atoi(rel)
+		rel = ""
+		return ver, err == nil
+	}
+	if major, ok = next(); !ok || rel == "" {
+		return
+	}
+	if minor, ok = next(); !ok || rel == "" {
+		return
+	}
+	patch, ok = next()
+	return
+}
+
+// GE checks if the running kernel version
+// is greater than or equal to the provided version.
+func (kv kernelVersion) GE(x, y int) bool {
+	return kv.major > x || (kv.major == x && kv.minor >= y)
+}

package/bin/go/src/runtime/os_linux32.go

@@ -7,33 +7,31 @@
 package runtime
 
 import (
-	"internal/runtime/atomic"
 	"unsafe"
 )
 
+func configure64bitsTimeOn32BitsArchitectures() {
+	use64bitsTimeOn32bits = getKernelVersion().GE(5, 1)
+}
+
 //go:noescape
 func futex_time32(addr unsafe.Pointer, op int32, val uint32, ts *timespec32, addr2 unsafe.Pointer, val3 uint32) int32
 
 //go:noescape
 func futex_time64(addr unsafe.Pointer, op int32, val uint32, ts *timespec, addr2 unsafe.Pointer, val3 uint32) int32
 
-var isFutexTime32bitOnly atomic.Bool
+var use64bitsTimeOn32bits bool
 
 //go:nosplit
 func futex(addr unsafe.Pointer, op int32, val uint32, ts *timespec, addr2 unsafe.Pointer, val3 uint32) int32 {
-	if !isFutexTime32bitOnly.Load() {
-		ret := futex_time64(addr, op, val, ts, addr2, val3)
-		// futex_time64 is only supported on Linux 5.0+
-		if ret != -_ENOSYS {
-			return ret
-		}
-		isFutexTime32bitOnly.Store(true)
+	if use64bitsTimeOn32bits {
+		return futex_time64(addr, op, val, ts, addr2, val3)
 	}
 	// Downgrade ts.
 	var ts32 timespec32
 	var pts32 *timespec32
 	if ts != nil {
-		ts32.setNsec(ts.tv_sec*1e9 + ts.tv_nsec)
+		ts32.setNsec(ts.tv_sec*1e9 + int64(ts.tv_nsec))
 		pts32 = &ts32
 	}
 	return futex_time32(addr, op, val, pts32, addr2, val3)
@@ -45,34 +43,26 @@ func timer_settime32(timerid int32, flags int32, new, old *itimerspec32) int32
 //go:noescape
 func timer_settime64(timerid int32, flags int32, new, old *itimerspec) int32
 
-var isSetTime32bitOnly atomic.Bool
-
 //go:nosplit
 func timer_settime(timerid int32, flags int32, new, old *itimerspec) int32 {
-	if !isSetTime32bitOnly.Load() {
-		ret := timer_settime64(timerid, flags, new, old)
-		// timer_settime64 is only supported on Linux 5.0+
-		if ret != -_ENOSYS {
-			return ret
-		}
-		isSetTime32bitOnly.Store(true)
+	if use64bitsTimeOn32bits {
+		return timer_settime64(timerid, flags, new, old)
 	}
 
 	var newts, oldts itimerspec32
 	var new32, old32 *itimerspec32
 
 	if new != nil {
-		newts.it_interval.setNsec(new.it_interval.tv_sec*1e9 + new.it_interval.tv_nsec)
-		newts.it_value.setNsec(new.it_value.tv_sec*1e9 + new.it_value.tv_nsec)
+		newts.it_interval.setNsec(new.it_interval.tv_sec*1e9 + int64(new.it_interval.tv_nsec))
+		newts.it_value.setNsec(new.it_value.tv_sec*1e9 + int64(new.it_value.tv_nsec))
 		new32 = &newts
 	}
 
 	if old != nil {
-		oldts.it_interval.setNsec(old.it_interval.tv_sec*1e9 + old.it_interval.tv_nsec)
-		oldts.it_value.setNsec(old.it_value.tv_sec*1e9 + old.it_value.tv_nsec)
+		oldts.it_interval.setNsec(old.it_interval.tv_sec*1e9 + int64(old.it_interval.tv_nsec))
+		oldts.it_value.setNsec(old.it_value.tv_sec*1e9 + int64(old.it_value.tv_nsec))
 		old32 = &oldts
 	}
 
-	// Fall back to 32-bit timer
 	return timer_settime32(timerid, flags, new32, old32)
 }

package/bin/go/src/runtime/os_linux64.go

@@ -10,6 +10,8 @@ import (
 	"unsafe"
 )
 
+func configure64bitsTimeOn32BitsArchitectures() {}
+
 //go:noescape
 func futex(addr unsafe.Pointer, op int32, val uint32, ts *timespec, addr2 unsafe.Pointer, val3 uint32) int32
 

package/bin/go/src/runtime/print.go

@@ -122,23 +122,35 @@ func printbool(v bool) {
 	}
 }
 
+// float64 requires 1+17+1+1+1+3 = 24 bytes max (sign+digits+decimal point+e+sign+exponent digits).
+const float64Bytes = 24
+
 func printfloat64(v float64) {
-	var buf [20]byte
+	var buf [float64Bytes]byte
 	gwrite(strconv.AppendFloat(buf[:0], v, 'g', -1, 64))
 }
 
+// float32 requires 1+9+1+1+1+2 = 15 bytes max (sign+digits+decimal point+e+sign+exponent digits).
+const float32Bytes = 15
+
 func printfloat32(v float32) {
-	var buf [20]byte
+	var buf [float32Bytes]byte
 	gwrite(strconv.AppendFloat(buf[:0], float64(v), 'g', -1, 32))
 }
 
+// complex128 requires 24+24+1+1+1 = 51 bytes max (paren+float64+float64+i+paren).
+const complex128Bytes = 2*float64Bytes + 3
+
 func printcomplex128(c complex128) {
-	var buf [44]byte
+	var buf [complex128Bytes]byte
 	gwrite(strconv.AppendComplex(buf[:0], c, 'g', -1, 128))
 }
 
+// complex64 requires 15+15+1+1+1 = 33 bytes max (paren+float32+float32+i+paren).
+const complex64Bytes = 2*float32Bytes + 3
+
 func printcomplex64(c complex64) {
-	var buf [44]byte
+	var buf [complex64Bytes]byte
 	gwrite(strconv.AppendComplex(buf[:0], complex128(c), 'g', -1, 64))
 }
 

package/bin/go/src/runtime/race/README

@@ -4,16 +4,16 @@ the LLVM project (https://github.com/llvm/llvm-project/tree/main/compiler-rt).
 
 To update the .syso files use golang.org/x/build/cmd/racebuild.
 
-internal/amd64v1/race_darwin.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-internal/amd64v1/race_freebsd.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-internal/amd64v1/race_linux.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
+internal/amd64v1/race_darwin.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch internal/amd64v1/race_darwin.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+internal/amd64v1/race_freebsd.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch internal/amd64v1/race_freebsd.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+internal/amd64v1/race_linux.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch internal/amd64v1/race_linux.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
 internal/amd64v1/race_netbsd.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
 internal/amd64v1/race_openbsd.syso built with LLVM fcf6ae2f070eba73074b6ec8d8281e54d29dbeeb and Go 8f2db14cd35bbd674cb2988a508306de6655e425.
-internal/amd64v1/race_windows.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-internal/amd64v3/race_linux.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-race_darwin_arm64.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-race_linux_arm64.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
-race_linux_loong64.syso built with LLVM 83fe85115da9dc25fa270d2ea8140113c8d49670 and Go 037112464b4439571b45536de9ebe4bc9e10ecb7.
+internal/amd64v1/race_windows.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch internal/amd64v1/race_windows.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+internal/amd64v3/race_linux.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch internal/amd64v3/race_linux.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+race_darwin_arm64.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch race_darwin_arm64.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+race_linux_arm64.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch race_linux_arm64.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
+race_linux_loong64.syso built with LLVM 83fe85115da9dc25fa270d2ea8140113c8d49670 with patch race_linux_loong64.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.
 race_linux_ppc64le.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
 race_linux_riscv64.syso built with LLVM c3c24be13f7928460ca1e2fe613a1146c868854e and Go a21249436b6e1fd47356361d53dc053bbc074f90.
-race_linux_s390x.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 and Go e7d582b55dda36e76ce4d0ce770139ca0915b7c5.
+race_linux_s390x.syso built with LLVM 51bfeff0e4b0757ff773da6882f4d538996c9b04 with patch race_linux_s390x.patch and Go a61fd428974822a8c57a2b2840fc237e6711b24d.

package/bin/go/src/runtime/race/internal/amd64v1/race_darwin.patch

@@ -0,0 +1,63 @@
+From cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca Mon Sep 17 00:00:00 2001
+From: Michael Pratt <michael@prattmic.com>
+Date: Fri, 12 Dec 2025 16:31:44 +1100
+Subject: [PATCH] [TSan] Zero-initialize Trace.local_head
+
+Trace.local_head is currently uninitialized when Trace is created. It is
+first initialized when the first event is added to the trace, via the
+first call to TraceSwitchPartImpl.
+
+However, ThreadContext::OnFinished uses local_head, assuming that it is
+initialized. If it has not been initialized, we have undefined behavior,
+likely crashing if the contents are garbage. The allocator (Alloc)
+reuses previously allocations, so the contents of the uninitialized
+memory are arbitrary.
+
+In a C/C++ TSAN binary it is likely very difficult for a thread to start
+and exit without a single event inbetween. For Go programs, code running
+in the Go runtime itself is not TSan-instrumented, so goroutines that
+exclusively run runtime code (such as GC workers) can quite reasonably
+have no TSan events.
+
+The addition of such a goroutine to the Go test.c is sufficient to
+trigger this case, though for reliable failure (segfault) I've found it
+necessary to poison the ThreadContext allocation like so:
+
+(Example patch redacted because patch tries to apply this as a real
+patch. See full commit at
+https://github.com/llvm/llvm-project/commit/cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca).
+
+The fix is trivial: local_head should be zero-initialized.
+---
+ compiler-rt/lib/tsan/go/test.c        | 4 ++++
+ compiler-rt/lib/tsan/rtl/tsan_trace.h | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/compiler-rt/lib/tsan/go/test.c b/compiler-rt/lib/tsan/go/test.c
+index d328ab1b331d7..fcd396227a4ab 100644
+--- a/compiler-rt/lib/tsan/go/test.c
++++ b/compiler-rt/lib/tsan/go/test.c
+@@ -91,6 +91,10 @@ int main(void) {
+   __tsan_go_start(thr0, &thr1, (char*)&barfoo + 1);
+   void *thr2 = 0;
+   __tsan_go_start(thr0, &thr2, (char*)&barfoo + 1);
++  // Goroutine that exits without a single event.
++  void *thr3 = 0;
++  __tsan_go_start(thr0, &thr3, (char*)&barfoo + 1);
++  __tsan_go_end(thr3);
+   __tsan_func_exit(thr0);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+diff --git a/compiler-rt/lib/tsan/rtl/tsan_trace.h b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+index 01bb7b34f43a2..1e791ff765fec 100644
+--- a/compiler-rt/lib/tsan/rtl/tsan_trace.h
++++ b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+@@ -190,7 +190,7 @@ struct Trace {
+   Mutex mtx;
+   IList<TraceHeader, &TraceHeader::trace_parts, TracePart> parts;
+   // First node non-queued into ctx->trace_part_recycle.
+-  TracePart* local_head;
++  TracePart* local_head = nullptr;
+   // Final position in the last part for finished threads.
+   Event* final_pos = nullptr;
+   // Number of trace parts allocated on behalf of this trace specifically.

package/bin/go/src/runtime/race/internal/amd64v1/race_freebsd.patch

@@ -0,0 +1,63 @@
+From cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca Mon Sep 17 00:00:00 2001
+From: Michael Pratt <michael@prattmic.com>
+Date: Fri, 12 Dec 2025 16:31:44 +1100
+Subject: [PATCH] [TSan] Zero-initialize Trace.local_head
+
+Trace.local_head is currently uninitialized when Trace is created. It is
+first initialized when the first event is added to the trace, via the
+first call to TraceSwitchPartImpl.
+
+However, ThreadContext::OnFinished uses local_head, assuming that it is
+initialized. If it has not been initialized, we have undefined behavior,
+likely crashing if the contents are garbage. The allocator (Alloc)
+reuses previously allocations, so the contents of the uninitialized
+memory are arbitrary.
+
+In a C/C++ TSAN binary it is likely very difficult for a thread to start
+and exit without a single event inbetween. For Go programs, code running
+in the Go runtime itself is not TSan-instrumented, so goroutines that
+exclusively run runtime code (such as GC workers) can quite reasonably
+have no TSan events.
+
+The addition of such a goroutine to the Go test.c is sufficient to
+trigger this case, though for reliable failure (segfault) I've found it
+necessary to poison the ThreadContext allocation like so:
+
+(Example patch redacted because patch tries to apply this as a real
+patch. See full commit at
+https://github.com/llvm/llvm-project/commit/cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca).
+
+The fix is trivial: local_head should be zero-initialized.
+---
+ compiler-rt/lib/tsan/go/test.c        | 4 ++++
+ compiler-rt/lib/tsan/rtl/tsan_trace.h | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/compiler-rt/lib/tsan/go/test.c b/compiler-rt/lib/tsan/go/test.c
+index d328ab1b331d7..fcd396227a4ab 100644
+--- a/compiler-rt/lib/tsan/go/test.c
++++ b/compiler-rt/lib/tsan/go/test.c
+@@ -91,6 +91,10 @@ int main(void) {
+   __tsan_go_start(thr0, &thr1, (char*)&barfoo + 1);
+   void *thr2 = 0;
+   __tsan_go_start(thr0, &thr2, (char*)&barfoo + 1);
++  // Goroutine that exits without a single event.
++  void *thr3 = 0;
++  __tsan_go_start(thr0, &thr3, (char*)&barfoo + 1);
++  __tsan_go_end(thr3);
+   __tsan_func_exit(thr0);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+diff --git a/compiler-rt/lib/tsan/rtl/tsan_trace.h b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+index 01bb7b34f43a2..1e791ff765fec 100644
+--- a/compiler-rt/lib/tsan/rtl/tsan_trace.h
++++ b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+@@ -190,7 +190,7 @@ struct Trace {
+   Mutex mtx;
+   IList<TraceHeader, &TraceHeader::trace_parts, TracePart> parts;
+   // First node non-queued into ctx->trace_part_recycle.
+-  TracePart* local_head;
++  TracePart* local_head = nullptr;
+   // Final position in the last part for finished threads.
+   Event* final_pos = nullptr;
+   // Number of trace parts allocated on behalf of this trace specifically.

package/bin/go/src/runtime/race/internal/amd64v1/race_linux.patch

@@ -0,0 +1,63 @@
+From cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca Mon Sep 17 00:00:00 2001
+From: Michael Pratt <michael@prattmic.com>
+Date: Fri, 12 Dec 2025 16:31:44 +1100
+Subject: [PATCH] [TSan] Zero-initialize Trace.local_head
+
+Trace.local_head is currently uninitialized when Trace is created. It is
+first initialized when the first event is added to the trace, via the
+first call to TraceSwitchPartImpl.
+
+However, ThreadContext::OnFinished uses local_head, assuming that it is
+initialized. If it has not been initialized, we have undefined behavior,
+likely crashing if the contents are garbage. The allocator (Alloc)
+reuses previously allocations, so the contents of the uninitialized
+memory are arbitrary.
+
+In a C/C++ TSAN binary it is likely very difficult for a thread to start
+and exit without a single event inbetween. For Go programs, code running
+in the Go runtime itself is not TSan-instrumented, so goroutines that
+exclusively run runtime code (such as GC workers) can quite reasonably
+have no TSan events.
+
+The addition of such a goroutine to the Go test.c is sufficient to
+trigger this case, though for reliable failure (segfault) I've found it
+necessary to poison the ThreadContext allocation like so:
+
+(Example patch redacted because patch tries to apply this as a real
+patch. See full commit at
+https://github.com/llvm/llvm-project/commit/cdfdb06c9155080ec97d6e4f4dd90b6e7cefb0ca).
+
+The fix is trivial: local_head should be zero-initialized.
+---
+ compiler-rt/lib/tsan/go/test.c        | 4 ++++
+ compiler-rt/lib/tsan/rtl/tsan_trace.h | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/compiler-rt/lib/tsan/go/test.c b/compiler-rt/lib/tsan/go/test.c
+index d328ab1b331d7..fcd396227a4ab 100644
+--- a/compiler-rt/lib/tsan/go/test.c
++++ b/compiler-rt/lib/tsan/go/test.c
+@@ -91,6 +91,10 @@ int main(void) {
+   __tsan_go_start(thr0, &thr1, (char*)&barfoo + 1);
+   void *thr2 = 0;
+   __tsan_go_start(thr0, &thr2, (char*)&barfoo + 1);
++  // Goroutine that exits without a single event.
++  void *thr3 = 0;
++  __tsan_go_start(thr0, &thr3, (char*)&barfoo + 1);
++  __tsan_go_end(thr3);
+   __tsan_func_exit(thr0);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+   __tsan_func_enter(thr1, (char*)&foobar + 1);
+diff --git a/compiler-rt/lib/tsan/rtl/tsan_trace.h b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+index 01bb7b34f43a2..1e791ff765fec 100644
+--- a/compiler-rt/lib/tsan/rtl/tsan_trace.h
++++ b/compiler-rt/lib/tsan/rtl/tsan_trace.h
+@@ -190,7 +190,7 @@ struct Trace {
+   Mutex mtx;
+   IList<TraceHeader, &TraceHeader::trace_parts, TracePart> parts;
+   // First node non-queued into ctx->trace_part_recycle.
+-  TracePart* local_head;
++  TracePart* local_head = nullptr;
+   // Final position in the last part for finished threads.
+   Event* final_pos = nullptr;
+   // Number of trace parts allocated on behalf of this trace specifically.