From 880dc5100742df7e469a923d3562c0ae97d91ebb Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Tue, 29 Sep 2026 08:51:16 +0000 Subject: [PATCH] chore(buglog): bug-1884 partial (9b61fd99) Co-Authored-By: Claude Opus 5.5 (1M context) --- .wolf/bugs/bug-1884.md | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/.wolf/bugs/bug-1884.md b/.wolf/bugs/bug-1884.md index a0f1b446..55e8e2a4 100644 --- a/.wolf/bugs/bug-1884.md +++ b/.wolf/bugs/bug-1884.md @@ -1,8 +1,8 @@ --- id: "bug-1884" -status: "open" +status: "partial" status_updated: "2026-09-29" -status_note: "newly logged" +status_note: "part 1 (9b61fd99): sim teardown + core registries, 17.2 MB -> 75 KB at exit; part 2: replay-event payload release, core->config, job/resource destructors, snapshot-load data" component: "scheduler" severity: "leak" timestamp: "2026-09-29T08:20:03Z" @@ -66,10 +66,34 @@ default-settings replay, 2026-09-29) - Evidence: /home/claude/tmp/bug-1884/lsan-report.txt (full report), /home/claude/tmp/bug-1884/scheduler-replay-20260929-064412.replay ## Root cause -TODO: required for fixed/partial +Nothing tears the simulator down: sched_sim_driver_run() never joined its +picker/allocator threads and main() exited without finalizing the core. On +top of that, several ownership gaps only show once teardown runs: +- xce_sched_core_fini() never destroyed the plugin/job/worker/queue/user/ + project registries or the shared-resource arrays that init creates. +- sim_alloc.c's two sched_make_allocs() stand-ins each ran a full + xce_sched_core_init(): a whole unused core, plus a re-init of the + process-wide string-intern and selector tables (two 8 MB tables leaked). +- plugin_unregister() (the plugin registry's datakiller, never run before) + key_del()'d from the registry being destroyed and skipped fini_fn for + plugins registered with plugin_register_core(). +- The limit plugin's usage-instance table had kill_limit as datakiller for + xce_vres_t records (bad free on destroy); kill_vres() was an empty stub. +- Remaining (part 2): replay-event payloads are never released after + xce_core_push_events() (sim_loop.c: documented "accepted leak"), unlike + driver.c's release_translated_payload(); the adopted core->config is never + freed (and a CONFIG_PUSH replaces it without freeing the old one); + kill_sched_job() is shallow; resmgr has no datakiller; snapshot-load data, + the builtin_fcfs plugin struct and some allocator scratch are not freed. ## Fix -TODO: required for fixed/partial +Part 1 (9b61fd99): sched_sim_driver_fini() -- cancel/join the threads the +way sched_fini() does (thread ids now in core.jobpicker/allocator), close +the files, finalize the core; main() calls it after a clean run. Core fini +destroys every registry init makes. The allocator stand-ins set up only +lock, nextid and the aliased resmgr. plugin_unregister() only runs fini_fn. +Usage instances use kill_vres(), which frees the record. Leak at exit on the +reproduction replay: 17,041,405 -> 75,495 bytes. ## Verification - Test: TODO: name + file; RED before the fix, GREEN after