gc2: guard weak writes during weak drain

Author: Frityet

etc/threading.lua

@@ -1,7 +1,7 @@
 ---@meta threading
 
 ---@alias threading.timeout_error "timeout"
----@alias threading.thread_fn fun(...):...
+---@alias threading.thread_fn fun(...: any): ...
 ---@alias threading.recv_status true|false|"timeout"
 ---@alias threading.peek_status true|false
 ---@alias threading.send_result true|nil
@@ -159,9 +159,8 @@ function threading_mutex:unlock() end
 ---@nodiscard
 function threading_mutex:__tostring() end
 
----@generic T
 ---@class threading.channel<T>: userdata
----@field send fun(self: threading.channel<T>, value: T, timeout?: number): threading.send_result, threading.timeout_error|nil
+---@field send fun(self: threading.channel<T>, value: T, timeout?: number): threading.send_result, threading.timeout_error?
 ---@field recv fun(self: threading.channel<T>, timeout?: number): T|nil, threading.recv_status
 ---@field peek fun(self: threading.channel<T>): T|nil, threading.peek_status
 ---@field close fun(self: threading.channel<T>): nil
@@ -171,7 +170,6 @@ local threading_channel = {}
 ---
 ---Errors if the channel is closed. If this is a rendezvous channel, success
 ---means a receiver has taken the value.
----@generic T
 ---@overload fun(self: threading.channel<T>, value: T): true
 ---@overload fun(self: threading.channel<T>, value: T, timeout: number): true
 ---@overload fun(self: threading.channel<T>, value: T, timeout: number): nil, threading.timeout_error
@@ -185,7 +183,6 @@ function threading_channel:send(value, timeout) end
 ---
 ---Returns `value, true` on success, `nil, false` when the channel is closed, or
 ---`nil, "timeout"` when a timeout is supplied and no value is available.
----@generic T
 ---@overload fun(self: threading.channel<T>): T, true
 ---@overload fun(self: threading.channel<T>): nil, false
 ---@overload fun(self: threading.channel<T>, timeout: number): T, true
@@ -200,7 +197,6 @@ function threading_channel:recv(timeout) end
 ---
 ---Returns `value, true` on success, or `nil, false` when the channel is empty
 ---or closed.
----@generic T
 ---@overload fun(self: threading.channel<T>): T, true
 ---@overload fun(self: threading.channel<T>): nil, false
 ---@return T|nil value
@@ -215,7 +211,7 @@ function threading_channel:close() end
 ---@nodiscard
 function threading_channel:__tostring() end
 
----@class threadinglib
+---@class threading
 local threading = {}
 
 ---@return integer count
@@ -254,7 +250,6 @@ function threading.gcmode(mode) end
 ---@param fn threading.thread_fn
 ---@param ... any
 ---@return threading.thread thread
----@nodiscard
 function threading.spawn(fn, ...) end
 
 ---@return threading.thread thread
@@ -269,10 +264,8 @@ function threading.mutex() end
 ---
 ---Capacity 0 creates a rendezvous channel. Buffered channels have at least the
 ---requested capacity.
----@generic T
 ---@param capacity? integer buffered slot count; defaults to 0.
----@return threading.channel<T> channel
----@nodiscard
+---@return threading.channel<any> channel
 function threading.channel(capacity) end
 
 return threading

notes/m3.md

@@ -2410,3 +2410,24 @@ GC2 weak drain in-flight completion guard:
   - `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m3_gc2_paranoia`
   - `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m6_jit_gc2_readiness`
   - `make -C src clean && make -C src && LUA=luajit tools/ci/lua_test.sh run_stock_tests -- src/luajit --quiet`
+
+GC2 weak write in-flight completion guard:
+
+- Added `GC2State.weak_write_active` and public
+  `lj_gc2_weak_write_begin/end()` helpers. Mutator stores into weak tables now
+  publish an active writer while they pre-mark the weak key/value, CAS-publish
+  the slot, and run the post-store weak/parent barrier. Weak snapshot clearing
+  and bridge coverage now wait for both active clear reservations and active
+  weak writers before declaring the snapshot complete. The weak drain/write
+  active increments use acquire-release fetch-adds, matching the release on
+  decrement and acquire completion checks.
+- The guard is wired through C API setters/raw setters, VM/JIT table store
+  helpers, table-valued `__newindex`, and FFI metatype `__newindex` stores. The
+  non-weak table path keeps the previous post-store barrier shape.
+- `t-gc2-traverse` now pins the race by holding `weak_write_active` across a
+  `P_WEAK` drain attempt, verifying the clear cursor does not advance and the
+  late weak entry survives until the writer releases.
+- Verification:
+  - `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m3_gc2_paranoia`
+  - `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m8_weak`
+  - `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh m6_jit_gc2_readiness`

notes/m8.md

@@ -941,3 +941,11 @@ Weak modes and current finalizer semantics:
   scheduler gate now rejects raw finalizer queue, owner, and counter access in
   that fixture too.
   Verification: `tools/ci/m3_gc2_worker_scheduler.sh` passed.
+- Follow-up coroutine callback-state fix: `lj_gc2_finalizer_dispatch_one()` now
+  uses `lj_state_resumeclaim()`/`lj_state_dropresumeclaim()` for the outer
+  callback stack claim. Suspended coroutines normally have `tg_hint == NULL`;
+  attaching the current TG for the duration of finalizer dispatch gives the x64
+  VM call prologue a valid per-TG dispatch table while preserving the
+  resume-release cleanup used by normal coroutine resume.
+  Verification: `LUA=luajit LJ_TEST_DISABLE_BUILD_CACHE=1 tools/ci/lua_test.sh
+  m8_weak` passed.

plan/05_gc_concurrent.md

@@ -486,7 +486,12 @@ weak-value array insertion both keep late `P_WEAK` keys/values alive through
 the same bridge. During weak clearing, a current-cycle GC2 mark produced by one
 of these late writes wins over stale legacy white while `GCSatomic` remains
 open, so queued weak snapshots cannot clear a value that was just rescued by the
-P_WEAK bridge.
+P_WEAK bridge. Mutator stores into weak tables also hold
+`GC2State.weak_write_active` from the pre-publication weak barrier until the
+post-publication weak/parent barrier is complete. Bounded weak clearing checks
+that counter before and after reserving a clear cursor batch, and snapshot
+completion/bridge coverage require it to reach zero, so a weak clear cannot race
+past a just-published but not-yet-post-barriered weak entry.
 `weak_keys_marked` and `weak_values_marked` expose first-time marks from these
 bridges for follow-up tests. x64 VM single-value fast table stores now route
 their GC2 barrier through `lj_gc2_barrier_tv_pair_g()` with the destination
@@ -550,8 +555,12 @@ instead of waiting forever for `mt_live == 0`, and explicit
 `collectgarbage("step", ...)` keeps `GCSfinalize` open instead of reporting a
 completed cycle while that worker is still live. User finalizer callbacks now
 run on the owner-claimed collector caller `lua_State` instead of the shared
-`vmthread(g)` stack. Pending finalizer objects are retained through dedicated
-GC2 queue nodes and marked through `lj_gc2_finalizer_mark_all()`, whose GC2
+`vmthread(g)` stack. The dispatch claim uses the same resume-style TG attachment
+as coroutine resume, so suspended coroutine callback stacks have a valid
+`tg_hint` while the VM enters the `__gc` function and are detached again when
+the finalizer dispatch claim is released. Pending finalizer objects are retained
+through dedicated GC2 queue nodes and marked through
+`lj_gc2_finalizer_mark_all()`, whose GC2
 side owns the owner-drained queue scanner, but full
 scheduler-owned string/root/finalizer sweep driving and FINREG/finqueue
 execution remain follow-up work. Legacy root-chain splice retry losers and GC2

src/lib_ffi.c

@@ -1007,9 +1007,22 @@ static int ffi_index_meta(lua_State *L, CTState *cts, CTypeID id, MMS mm)
       GCtab *owner;
       TValue *o = lj_meta_tset_owner(L, tv, base+1, &owner);
       if (o) {
+	int weakwr = lj_gc2_weak_write_begin(L, owner);
+	if (weakwr) {
+	  lj_gc2_barrier_weak_key(L, owner, base+1);
+	  lj_gc2_barrier_weak_value(L, owner, base+2);
+	  lj_gc2_barrier_tv_pair(L, obj2gco(owner), base+2);
+	}
 	copyTVrel(L, o, base+2);
-	lj_gc2_barrier_weak_write(L, owner, base+1, base+2);
-	lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+	if (weakwr) {
+	  lj_gc2_barrier_weak_key(L, owner, base+1);
+	  lj_gc2_barrier_weak_value(L, owner, base+2);
+	  lj_gc2_barrier_tv_pair(L, obj2gco(owner), base+2);
+	  lj_gc2_weak_write_end(L, weakwr);
+	} else {
+	  lj_gc2_barrier_weak_write(L, owner, base+1, base+2);
+	  lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+	}
 	return 0;
       }
     }

src/lj_api.c

@@ -1167,10 +1167,21 @@ LUA_API void lua_settable(lua_State *L, int idx)
     o = lj_meta_tset_owner(L, t, L->top-2, &owner);
     if (o) {
       TValue *key = L->top-2, *val = L->top-1;
-      if (lj_tab_trystoretv_cas_keyed(L, owner, o, key, val) ==
-	  LJ_TAB_STORE_CAS_OK) {
+      int weakwr = lj_gc2_weak_write_begin(L, owner);
+      int rc;
+      if (weakwr)
 	lj_gc2_barrier_weak_write(L, owner, key, val);
-	lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+      rc = lj_tab_trystoretv_cas_keyed(L, owner, o, key, val);
+      if (weakwr) {
+	lj_gc2_barrier_weak_write(L, owner, key, val);
+	lj_gc2_barrier_tv_pair(L, obj2gco(owner), val);
+	lj_gc2_weak_write_end(L, weakwr);
+      }
+      if (rc == LJ_TAB_STORE_CAS_OK) {
+	if (!weakwr) {
+	  lj_gc2_barrier_weak_write(L, owner, key, val);
+	  lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+	}
 	L->top = key;
 	return;
       }
@@ -1199,10 +1210,21 @@ LUA_API void lua_setfield(lua_State *L, int idx, const char *k)
     o = lj_meta_tset_owner(L, t, &key, &owner);
     if (o) {
       TValue *val = L->top-1;
-      if (lj_tab_trystoretv_cas_keyed(L, owner, o, &key, val) ==
-	  LJ_TAB_STORE_CAS_OK) {
+      int weakwr = lj_gc2_weak_write_begin(L, owner);
+      int rc;
+      if (weakwr)
 	lj_gc2_barrier_weak_write(L, owner, &key, val);
-	lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+      rc = lj_tab_trystoretv_cas_keyed(L, owner, o, &key, val);
+      if (weakwr) {
+	lj_gc2_barrier_weak_write(L, owner, &key, val);
+	lj_gc2_barrier_tv_pair(L, obj2gco(owner), val);
+	lj_gc2_weak_write_end(L, weakwr);
+      }
+      if (rc == LJ_TAB_STORE_CAS_OK) {
+	if (!weakwr) {
+	  lj_gc2_barrier_weak_write(L, owner, &key, val);
+	  lj_gc2_barrier_tv_pair(L, obj2gco(owner), o);
+	}
 	L->top = val;
 	return;
       }
@@ -1223,17 +1245,32 @@ LUA_API void lua_rawset(lua_State *L, int idx)
   TValue snap;
   GCtab *t = tabV(index2adr_read(L, idx, &snap));
   TValue *dst, *key;
+  int barrier_done = 0;
   lj_checkapi_slot(2);
   key = L->top-2;
   for (;;) {
+    int weakwr, rc;
     dst = lj_tab_set(L, t, key);
-    if (lj_tab_trystoretv_cas_keyed(L, t, dst, key, key+1) ==
-	LJ_TAB_STORE_CAS_OK)
+    weakwr = lj_gc2_weak_write_begin(L, t);
+    if (weakwr)
+      lj_gc2_barrier_weak_write(L, t, key, key+1);
+    rc = lj_tab_trystoretv_cas_keyed(L, t, dst, key, key+1);
+    if (weakwr) {
+      lj_gc2_barrier_weak_write(L, t, key, key+1);
+      lj_gc2_barrier_tv_pair(L, obj2gco(t), key+1);
+      lj_gc_pubtab(L, t);
+      lj_gc2_weak_write_end(L, weakwr);
+      if (rc == LJ_TAB_STORE_CAS_OK)
+	barrier_done = 1;
+    }
+    if (rc == LJ_TAB_STORE_CAS_OK)
       break;
     lj_tab_store_wait_l(L);  /* C API rawset saw stale/FORWARD slot. */
   }
-  lj_gc2_barrier_weak_write(L, t, key, key+1);
-  lj_gc_pubtab(L, t);
+  if (!barrier_done) {
+    lj_gc2_barrier_weak_write(L, t, key, key+1);
+    lj_gc_pubtab(L, t);
+  }
   L->top = key;
 }
 
@@ -1243,18 +1280,33 @@ LUA_API void lua_rawseti(lua_State *L, int idx, int n)
   GCtab *t = tabV(index2adr_read(L, idx, &snap));
   TValue *dst, *src;
   TValue key;
+  int barrier_done = 0;
   lj_checkapi_slot(1);
   src = L->top-1;
   setintV(&key, n);
   for (;;) {
+    int weakwr, rc;
     dst = lj_tab_setint(L, t, n);
-    if (lj_tab_trystoretv_cas_keyed(L, t, dst, &key, src) ==
-	LJ_TAB_STORE_CAS_OK)
+    weakwr = lj_gc2_weak_write_begin(L, t);
+    if (weakwr)
+      lj_gc2_barrier_weak_write(L, t, &key, src);
+    rc = lj_tab_trystoretv_cas_keyed(L, t, dst, &key, src);
+    if (weakwr) {
+      lj_gc2_barrier_weak_write(L, t, &key, src);
+      lj_gc2_barrier_tv_pair(L, obj2gco(t), src);
+      lj_gc_pubtabtv(L, t, dst);
+      lj_gc2_weak_write_end(L, weakwr);
+      if (rc == LJ_TAB_STORE_CAS_OK)
+	barrier_done = 1;
+    }
+    if (rc == LJ_TAB_STORE_CAS_OK)
       break;
     lj_tab_store_wait_l(L);  /* C API rawseti saw stale/FORWARD slot. */
   }
-  lj_gc2_barrier_weak_write(L, t, &key, src);
-  lj_gc_pubtabtv(L, t, dst);
+  if (!barrier_done) {
+    lj_gc2_barrier_weak_write(L, t, &key, src);
+    lj_gc_pubtabtv(L, t, dst);
+  }
   L->top = src;
 }
 

src/lj_atomic.h

@@ -95,6 +95,7 @@ LA_INLINE int la_cas128(la_u128 *p, la_u128 *exp, la_u128 des)
 
 /* ---- fetch ops ------------------------------------------------------ */
 LA_INLINE uint32_t la_add32_rlx(uint32_t *p,uint32_t v){return __atomic_fetch_add(p,v,__ATOMIC_RELAXED);}
+LA_INLINE uint32_t la_add32_acqrel(uint32_t *p,uint32_t v){return __atomic_fetch_add(p,v,__ATOMIC_ACQ_REL);}
 LA_INLINE uint64_t la_add64_rlx(uint64_t *p,uint64_t v){return __atomic_fetch_add(p,v,__ATOMIC_RELAXED);}
 LA_INLINE uint32_t la_sub32_rlx(uint32_t *p,uint32_t v){return __atomic_fetch_sub(p,v,__ATOMIC_RELAXED);}
 LA_INLINE uint64_t la_sub64_rlx(uint64_t *p,uint64_t v){return __atomic_fetch_sub(p,v,__ATOMIC_RELAXED);}

src/lj_gc.h

@@ -300,6 +300,8 @@ LJ_FUNC void lj_gc2_barrier_weak_key(lua_State *L, GCtab *t, cTValue *key);
 LJ_FUNC void lj_gc2_barrier_weak_value(lua_State *L, GCtab *t, cTValue *val);
 LJ_FUNC void lj_gc2_barrier_weak_write(lua_State *L, GCtab *t, cTValue *key,
 				       cTValue *val);
+LJ_FUNC int lj_gc2_weak_write_begin(lua_State *L, GCtab *t);
+LJ_FUNC void lj_gc2_weak_write_end(lua_State *L, int active);
 LJ_FUNCA void lj_gc_barrierback_tab_g(global_State *g, GCtab *t);
 
 /* Move the GC propagation frontier back for tables (make it gray again). */