Release v0.5.0: Fuzzing Infrastructure and Core Stability
This release focuses on establishing a robust fuzzing pipeline using libFuzzer. Continuous execution of randomized, concurrent allocation cycles helped identify and resolve several complex architectural edge cases related to ABI-masquerading, alignment padding, and boundary conditions.
Fuzzing Suite
fuzz_core: Tests the Triple-Key LLRB tree, block splitting, and merging.fuzz_bump&fuzz_slab: Isolates and verifies the sub-allocator state machines.fuzz_chaos: Simulates concurrent lifecycles of nested sub-allocators, dynamically creating and destroying arenas to verify isolation and detect Use-After-Free scenarios.
Core Bug Fixes
- ABI Padding Desync: Sub-allocators (Bump/Slab) previously failed to account for 8-byte alignment padding injected by
em_allocon 64-bit systems. Fixed by utilizing the XOR-magic detector across allcreate_internalfunctions to accurately locate block headers. - Tail OOM Absorption: Prevented the allocator from incorrectly absorbing an occupied tail block during adjacent deallocation when the arena is completely full.
- Scratch Garbage Leaf in LLRB: Cleared union pointers in freed scratchpads to prevent wild pointer dereferencing (
0xdeadbeef...) if a dirty tail is later sliced for padding and inserted into the free tree. - Zero-Capacity Bump Trim: Trimming an empty bump allocator previously calculated a 0-byte payload, corrupting the heap layout. Fixed by enforcing
EM_MIN_BUFFER_SIZElimits.
Developer Experience
- Added
Makefileintegration for fuzzing:make fuzz_[name]to run specific targets.make replay_[name] CRASH=...to replay crash inputs with step-by-step ASCII visual debugging (print_fancy).
- Added explicit regression tests for all newly discovered edge cases to
validation_test.c.
Complex inside. Simple outside.