Clone, Memory, And Sanitizer Stability#212
Open
zayenz wants to merge 31 commits into
Open
Conversation
added 30 commits
July 6, 2026 16:54
Close follow-up gaps found while validating the local clone, IntSet, and MiniModel exception-safety invariants. In particular, recover advisor-copy state on failure, keep IntSet fault accounting consistent when allocation throws, and make MiniModel ownership cleanup robust under injected heap failures. Reference: #211
Pass the incumbent best solution as an optional pointer during BAB path recomputation. Recompute can run before an incumbent exists; the previous reference parameter forced callers to dereference a null best pointer and tripped UBSan.
Replace shared volatile search flags and stop limits with atomics, and close a racy path-steal check. TSan reported concurrent reads and writes in parallel engines and portfolio stop propagation; these fields are cross-thread coordination state.
Delete portfolio slave engines in the PBS destructor before freeing the slave pointer array. This closes the lifetime leak exposed by sanitizer runs.
Address the remaining findings from the larger sanitizer matrix: harden integer-domain width arithmetic, avoid invalid marked-link casts, protect RBS stop state, and make thread-runner cleanup tolerate null terminators.
Add release-note entries and file-header attribution for the clone, IntSet, MiniModel, fault-injection, and sanitizer-stability changes. PR 211 is kept as release-note issue metadata and as a reference for original patch authorship where that context matters. Reference: #211
Use relaxed atomics for the fault-injection live-allocation counters used by IntSet and MiniModel leak checks. These counters are diagnostics only, but fault-enabled TSan search runs can construct and destroy the instrumented objects concurrently.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch fixes several exception-safety and sanitizer-detected failures in Gecode's clone, allocation, MiniModel, and search code.
The clone and allocation work is based on the issues reported in Gecode/gecode#211.
Changes
Spacecopying throws.AP_DISPOSEregistration failures follow the ownership boundary: the space disposes an actor only after registration succeeds.IntSetObjectallocation initializes cleanup state before range allocation and releases the object if range allocation fails.LinIntExpr()zero-expression behavior.IntSet, MiniModel, and heap-allocation failure paths deterministically.Relationship To PR 211
PR 211 identified real problems , several parts carry over closely, especially the
IntSetObjectcleanup rule, early initialization of clone fields, and guarded MiniModel ownership transfers.Some parts changed after testing made the ownership boundary more explicit. The clearest case is
AP_DISPOSE: PR 211 disposed the actor when registration allocation failed, but the fault test shows that the space does not own the actor until registration succeeds.Two PR 211 changes are not included. The propagation-statistics virtual hook is not needed for the clone/allocation fixes and adds dispatch to a hot path. The broad locking-scope patch is also left out as a unit; the synchronization changes here are the narrower ones exercised by TSan.
Validation
Multiple local runs of ASan, UBSan, and TSan, plus targeted UBSan replays for wide integer-domain arithmetic and
no-good accounting.