test(fspy): add an access-relative benchmark suite - #602
Merged
Conversation
The existing access suite opens an absolute path, which the tracker serves with a borrowed pointer — the code that resolves a file descriptor's directory and joins it with a relative pathname never runs, so that lane was unmeasured. The new suite opens a bare filename with the filesystem root as the working directory, forcing the working-directory lookup and the join. Root makes the resolved path byte-identical to the absolute suite's, so the two rows differ only in the work being priced, not in what gets captured, and validation asserts the same captured path in both modes. The launcher grows a --relative flag instead of a new binary; the harness compares two builds of the same launcher source, so one parameterized binary keeps both suites measured by identical code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Member
Author
|
Recreating this PR through gh stack so it joins stack #598 properly. |
fspy benchmarklinuxmacoswindows |
wan9chi
added a commit
that referenced
this pull request
Aug 9, 2026
Part of #605 — this lands the malloc-class fix (the largest of the hazards there); the lazy-dlsym, hot-path panic, TLS reentrancy, and posix_spawn-thread items remain follow-ups. The benchmark suite that prices this change merged in #602. ## Motivation The preload library runs inside libc calls such as `open`, `stat`, and `execve`. Programs are allowed to make these calls from a signal handler, or in the child of `fork()` in a program with many threads. In both situations, using libc's `malloc` can hang the program forever: the lock inside `malloc` may be held by a thread that is paused or no longer exists. The preload library still allocates through `malloc` today, so a traced program can hang in exactly these situations. ## What this does Adds a new crate, `sigsafe`: Unix syscall wrappers that are safe to call where libc is not — in signal handlers, in fork children, before libc has finished initializing. Its [README](https://github.com/voidzero-dev/vite-task/blob/claude/fspy-libc-async-signal-safe-129134/crates/sigsafe/README.md) states the three rules everything in it follows: syscalls only (never through libc on Linux), no locks and no hidden state, and no global allocation. **The no-libc rule is enforced at compile time.** rustix can be built with a libc backend, and anything in the dependency graph — including crates outside this repository — can select it; no build script can detect the feature-unification case. So `sigsafe`'s `lib.rs` references `rustix::runtime`, a module that exists only in rustix's raw-syscall build: selecting the libc backend makes the crate fail to compile instead of silently losing the guarantee. On top of the first wrappers (`mm::mmap_anonymous`, `mm::munmap`, `param::page_size`) sits `sigsafe::alloc`, allocation that never touches malloc, in three layers with only the top exposed: - `MmapAllocator` — every allocation asks the kernel for fresh memory pages through `sigsafe::mm`. It keeps no state of its own, so there is nothing a signal or a `fork()` can catch locked or half-written. - `ChunkPool` — keeps up to 64 freed 64 KiB chunks in a fixed array of atomic pointers, so the next call can reuse memory without asking the kernel again. Taking or returning a chunk is one atomic swap per slot, never a lock, and a thread that disappears mid-operation can strand at most the one chunk it held. - `alloc::arena()` — the only public function. It hands one intercepted call its own bump arena (a `bump_scope::Bump`) that draws chunks from the pool and returns them when the call ends. Values allocated in the arena cannot outlive the call; the borrow checker enforces it. Uses the arena in one place to start: `RawExec::to_c_str_array`, which builds the NULL-terminated argv/envp pointer arrays that an intercepted exec hands to the real call, then drops them when it returns. That temporary's lifetime is already exactly a bump arena's, so the change is nine lines and adds no `unsafe`. It has to come off malloc because exec runs in the child of `fork()` in multithreaded programs — `posix_spawn` forks then execs — where malloc's lock may be held by a thread that no longer exists. Both platforms take this path on every intercepted exec. The strings the array points at are still owned by `Exec` and still come from malloc, as does the rest of the preload; converting them is follow-up. This change establishes the crate, the layers, and the lifetime discipline in the smallest place all three apply. ## Benchmark The `access-relative` suite (#602) was added while this PR still used the arena for the fd-relative join, and it earned its keep twice: an early run showed **+29%** on Linux, which turned out to be the preload building without optimizations (fixed by #597), and the corrected runs showed the arena join costing ~+3% over `PathBuf::push` — which is why the join reverted and the arena moved to `execveat`. The investigation is written up in [this comment](#596 (comment) thread. With the join reverted, both suites should sit at baseline. ## Commits The first commit is an earlier version of the allocator — one lock-free size-class allocator installed as the preload's `#[global_allocator]` — kept so the two designs can be compared; #599 measured that design end to end and lost. The second commit replaces it with the arena design above. The third moves the allocator into the new `sigsafe` crate as `sigsafe::alloc`, adds `mm`/`param` and the compile-time backend enforcement, and adds the README. The fourth moves the arena use from the join to `execveat` and fixes the dangling pointer there. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The
accesssuite opens an absolute path, which the tracker serves with a borrowed pointer — the code that resolves a file descriptor's directory and joins it with a relative pathname never runs, so that lane has been unmeasured. Upcoming changes (#596) modify exactly that lane, so it needs a benchmark row before those land.What this does
Adds an
access-relativesuite: the target opens a bare filename with the filesystem root as its working directory, forcing the working-directory lookup and the join. Root as the working directory makes the resolved path byte-identical to the absolute suite's, so the two rows differ only in the work being priced, not in what gets captured — and validation asserts the same captured path in both modes.The launcher grows a
--relativeflag instead of a new binary: the harness compares two builds of the same launcher source, so one parameterized binary keeps both suites measured by identical code.🤖 Generated with Claude Code