From d9345555c0a2aa1bcea9df8999077ec189789b42 Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Sun, 24 May 2026 07:15:38 +0900 Subject: [PATCH] rt: bump-over-mmap allocator (rt_segmalloc + rt_free no-op) rt_malloc was a bare mmap-per-call wrapper: every allocation, even a 32-72B AST/symbol node, consumed a page-rounded 4KB region and was never freed. w6a/w6c emit ~4 such nodes per .s line, so assembling a 145K-line file burned ~625K pages (~2.5GB); test 995's 5 concurrent self-rebuilds then OOM'd. The defect is linear and str-independent -- the str->24B codegen merely enlarged .s files past the cliff. Replace it with the no-free SUBSET of Hare's allocator (ref/hare/rt/malloc.ha): 2MiB chunk-bump (CHUNKSZ malloc.ha:24, ALIGN malloc.ha:14), oversized (>CHUNKSZ) requests direct-mmap'd. The bin/freelist/META machinery exists only to support free, which ww does not have, so it is omitted. Policy lives in rt/malloc.ww; the raw mmap primitive stays in rt/alloc.s as rt_segmalloc -- Hare's malloc/segmalloc split. rt_free becomes a documented no-op (os.free re-exports it for the public API, so the symbol must stay); rt/ensure.ww drops its now-impossible reclaim. Zero-init is preserved: the bump never reuses memory, so every byte is fresh MAP_ANONYMOUS-zeroed. w6a_ww on a 145K-line .s: 2165MB -> 28MB (~glibc parity, C w6a 24MB). .o output byte-identical; both stages emit identical asm. make test 134/134. --- Makefile | 2 +- rt/alloc.s | 30 ++++++++++++++++-------------- rt/ensure.ww | 6 ++---- rt/malloc.ww | 44 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 63 insertions(+), 19 deletions(-) create mode 100644 rt/malloc.ww diff --git a/Makefile b/Makefile index 31d6bb62..b3117918 100644 --- a/Makefile +++ b/Makefile @@ -39,7 +39,7 @@ W6L_SRC = cmd/w6l/main.c cmd/w6l/obj.c cmd/w6l/sym.c cmd/w6l/pass.c cmd/w6l/out. W6L_OBJ = $(W6L_SRC:cmd/w6l/%.c=$(OBJ)/w6l/%.o) RT_S = rt/start.s rt/syscall.s rt/alloc.s rt/streq.s rt/abort.s -RT_WW = rt/ensure.ww +RT_WW = rt/ensure.ww rt/malloc.ww RT_OBJ = $(RT_S:rt/%.s=$(OBJ)/rt/%.o) $(RT_WW:rt/%.ww=$(OBJ)/rt/%.o) # Cstage: one-time C bootstrap (see BOOTSTRAP.md). Built by `cc`. diff --git a/rt/alloc.s b/rt/alloc.s index ad0dc01f..4673bace 100644 --- a/rt/alloc.s +++ b/rt/alloc.s @@ -1,18 +1,18 @@ -// rt/alloc.s — page allocator via the mmap syscall. +// rt/alloc.s — raw page primitive via the mmap syscall. // -// rt_malloc(n: u64) returns a *void aligned at a page boundary, sized -// to the next page multiple. Pair with rt_free(p, n). +// rt_segmalloc(n: u64) returns a *void aligned at a page boundary, sized +// to the next page multiple. It is the primitive under rt/malloc.ww's +// bump allocator (renamed from rt_malloc, task #8) — callers use the +// bump rt_malloc, not this directly. // // We pin to PROT_READ|PROT_WRITE and MAP_PRIVATE|MAP_ANONYMOUS so // callers never have to plumb file descriptors through. // -// On mmap failure the raw syscall returns -errno (negative). Task #30 -// graduated the `alloc` builtin to a fallible `(*T | nomem)` / -// `([]T | nomem)` signature whose cgen branches on a null return, so -// the failure path here returns 0 instead of a poisoned pointer. The -// builtin's caller is expected to `!`/`?` the result. +// On mmap failure the raw syscall returns -errno (negative); we map +// that to 0 so the bump allocator's null-check (and the alloc builtin's +// `!`/`?` lowering, task #30) sees a clean nil. -TEXT rt_malloc,$0 +TEXT rt_segmalloc,$0 MOVQ DI, SI // arg 1: length = caller's n MOVQ $0, DI // arg 0: addr = NULL (kernel chooses) MOVQ $3, DX // arg 2: prot = R|W @@ -22,13 +22,15 @@ TEXT rt_malloc,$0 MOVQ $9, AX // syscall: mmap SYSCALL CMPQ $0, AX - JGE rt_malloc_ok + JGE rt_segmalloc_ok XORQ AX, AX -rt_malloc_ok: +rt_segmalloc_ok: RET +// rt_free is a no-op: ww is a no-free runtime. rt/malloc.ww bumps over +// shared 2MiB chunks, so a mid-chunk pointer cannot be unmapped without +// corrupting its neighbours; all memory is reclaimed at process exit. +// Kept as a symbol because os.free re-exports it (lib/os/os.ww) for the +// public API — callers' frees become harmless leaks. (task #8) TEXT rt_free,$0 - // DI already holds ptr, SI already holds length - MOVQ $11, AX // syscall: munmap - SYSCALL RET diff --git a/rt/ensure.ww b/rt/ensure.ww index ef19140b..f8fa8def 100644 --- a/rt/ensure.ww +++ b/rt/ensure.ww @@ -20,7 +20,6 @@ // bare symbol name so the linker resolves it. @symbol("rt_malloc") fn malloc(n: u64) *void; -@symbol("rt_free") fn free(p: *void, n: u64) void; // Mirrors ww's []T header layout: 24 bytes with 8-byte slots. // ww's source uses i32 for len/cap but the compiler stores them in @@ -46,9 +45,8 @@ export fn rt_ensure(s: *slice, membsz: u64) void = { np[i] = s.ptr[i]; i += 1u64; }; - if (s.cap > 0i64) { - free(s.ptr: *void, (s.cap: u64) * membsz); - }; + // No free: the bump allocator (rt/malloc.ww) can't reclaim a + // mid-chunk region; the old buffer leaks until process exit. (#8) s.ptr = np; s.cap = nc; }; diff --git a/rt/malloc.ww b/rt/malloc.ww new file mode 100644 index 00000000..770b525a --- /dev/null +++ b/rt/malloc.ww @@ -0,0 +1,44 @@ +// rt/malloc.ww — bump allocator over 2MiB chunks. Archived into +// libwwrt.a, compiled standalone (no `module`) with bare symbols, like +// rt/ensure.ww. +// +// WHY bump, replacing the page-per-call mmap (rt_segmalloc, ex-rt_malloc): +// the old rt_malloc page-rounded every request, so a 32-72B node cost a +// whole 4KiB page. w6a/w6c emit ~4 such nodes per .s line; a 145K-line +// assembly burned ~625K pages (~2.5GB) vs C w6a's 24MB. Packing nodes +// into shared chunks collapses that to the live set. (task #8) +// +// Mirrors Hare rt::malloc's chunk-bump (ref/hare/rt/malloc.ha:52-66, +// CHUNKSZ :24, ALIGN :14), minus the bin/freelist machinery — that +// exists only to support free, which ww does not have. +// +// Zero-init is preserved: every byte handed out is fresh from +// MAP_ANONYMOUS (kernel-zeroed) and never reused, so alloc(T{})'s +// zero-fill still holds. Lazy first chunk falls out of cur=rem=0. + +def CHUNKSZ: u64 = 2097152u64; // 1<<21, ref/hare/rt/malloc.ha:24 +def ALIGN: u64 = 16u64; // ref/hare/rt/malloc.ha:14 + +@symbol("rt_segmalloc") fn segmalloc(n: u64) *void; + +let cur: u64 = 0u64; +let rem: u64 = 0u64; + +@symbol("rt_malloc") export fn rt_malloc(n: u64) *void = { + let need: u64 = (n + (ALIGN - 1u64)) & ~(ALIGN - 1u64); + // Oversized requests bypass the chunk so one huge alloc can't + // strand most of a chunk (ref/hare/rt/malloc.ha:38). + if (need > CHUNKSZ) { return segmalloc(need); }; + if (rem < need) { + let c: *void = segmalloc(CHUNKSZ); + // mmap failure: keep the nomem null contract that the + // alloc-builtin `!`/`?` lowering checks. + if (c == nil) { return nil; }; + cur = c: u64; + rem = CHUNKSZ; + }; + let p: u64 = cur; + cur += need; + rem -= need; + return p: *void; +};