v0.6.0

rustfs-mimalloc v0.6.0

mimalloc V3 (v3.5.4) bindings for Rust.

Changed

• Pin mimalloc to upstream dev3 commit 6f45cc52 (2026-10-16 review), after the
  v3.5.4 interim tag. The C source version remains 30504. This includes
  allocation/free improvements, adaptive full-page retention, cross-thread page
  reclamation, the arena/bitmap source reorganization, and bitmap rollback
  fixes through the 2026-10-16 review. Includes naturally aligned allocation
  size-class improvements, cache offsets, OS-page heap lifecycle/visiting fixes,
  and quiescent fork support. The large-range immediate-purge default is 32 MiB.
  Workload-specific throughput and RSS still require measurement.
• Breaking: match the experimental profiler ABI: add on_snapshot and use
  mutable heap pointers in allocation/free callbacks.
• Breaking: make runtime option setters/toggles unsafe because upstream
  option storage is non-atomic. Configure before starting threads or exclude
  all concurrent mimalloc accesses.
• Remove rust-version from the workspace and member manifests as requested;
  retain Rust 1.96.0 as an explicit CI compatibility check, not a Cargo MSRV.

Added

• Add the independent rustfs-mimalloc-profiling companion crate, extracted
  from grafana/pyroscope-rs#572. It owns the sampling allocator, bounded event
  recorder, opt-in live allocation tracking, symbol/mapping resolution and
  pprof encoder. Profiler controls one recording session and returns owned
  profile bytes without an uploader or dependency on Pyroscope.

• Move allocator behavior, optimized profile quality, stress and benchmark
  validation alongside the profiling implementation. Keep the base allocator
  dependency graph free of profiling dependencies.

• Bound all four new upstream public APIs: mi_thread_id_of,
  mi_heap_set_debug_fill_preserve, mi_theap_delete, and
  mi_theap_quiescent_abandon. Added MiMalloc::thread_id_of,
  Heap::set_debug_fill_preserve, and unsafe ThreadHeap::quiescent_abandon.
  Context deletion remains raw FFI because it invalidates all cached aliases.

• Added a runnable custom allocation-tracking hook example for upstream #1396,
  enabled with CFLAGS=-DMI_TRACK_CUSTOM, with no default hot-path overhead.

• Added owner-query, quiescent foreign-context cleanup, context deletion,
  zero-initialization and direct-OS-page lifecycle regression checks.

• Added MiMalloc::{expand,rezalloc,rezalloc_aligned}, heap zero-allocation
  and reallocation helpers, and cached ThreadHeap::{calloc,malloc_csize, zalloc_csize,realloc,rezalloc}. Added 13 previously unbound public C
  allocation APIs; zero-growth, alignment and overflow behavior are tested.

• Added a public-header API inventory and option-ID parity check to CI,
  covering 130 Rust function names and 45 option IDs at the current pin.

• Opt-in no_profile builds to remove allocation profiling sampling and automatic
  MIMALLOC_PROFILE startup. Statistics, alignment, security/debug checks and raw
  profiler control ABI remain available; explicit snapshots have no allocation samples.

• MiMalloc::profiling_enabled() and MI_PROFILE_ENABLED capability queries that
  respect the linked sys crate's unified Cargo features.

• Default/no-profile ABBA driver and tests for disabled sampling, environment
  startup, feature unification, and retained secure/debug/statistics behavior.

• Heap::thread_local() and borrowed ThreadHeap allocation methods to avoid
  repeated TLS lookups when a worker alternates between heaps. The view cannot
  outlive its parent or be sent/shared across threads; allocations may still be
  freed on other threads. Global allocator and retention defaults are unchanged.

• Single-heap and alternating-heap benchmarks plus an A/B/B/A driver that
  checks baseline drift and candidate repeatability before reporting a speedup.

• Alignment, zeroing, cross-thread free, parent-deletion and compile-fail tests
  for cached heap views.

• Raw callback registration: mi_register_error, mi_register_output, and
  mi_register_deferred_free, with lifetime/concurrency contracts.

• Cross-thread free batch benchmarks and a Windows clang-cl C11 test job.

• Raw mi_profiler_snapshot, mi_pprof_profiler_new, and
  mi_pprof_profiler_delete; all four profiling interval/sample-rate options.

• Raw mi_arenas_purge and safe MiMalloc::arenas_purge() to process pending
  arena purges in the main subprocess. Expose mi_option_stats_merge_threshold
  and mi_option_arena_purge_immediate_size, plus renamed purge/stat-merge
  options and compatibility aliases for the prior Rust option names.

• Unsafe MiMalloc::free_small_local{,_nonnull} and matching raw FFI. The
  allocation's small page must still be owned by the calling thread.

• Aligned heap zero-allocation and reallocation, additional thread-local FFI,
  capacity hints, option diagnostics, and default/clamped option access.

• Integration tests for profiler callback ABI, sampled pprof output, effective
  malloc override and THP defaults; benchmark comparisons against System and
  the generic/local small-free paths.

Fixed

• Require reporter-visible TLS registration before accepting allocation events;
  count registration contention and unavailable TLS as drops. Remove the
  allocation-side flush notification protocol and its hidden pending buffers.

• Correct allocation object counts by sharing the inclusion-probability weights
  with live heap tracking and rounding after stack aggregation. The former
  per-event integer division underestimated object counts for allocation sizes
  near the sampling interval.

• Replace interval-crossing loops and their deterministic fallback with one
  memoryless sampling step. Keep the unsampled path to a TLS countdown and
  use a FIFO TLS ring so partial drains do not move retained stacks.

• Inherit upstream Windows console detachment, ProcessPrng/legacy RNG loading,
  naturally aligned allocation, direct-OS-page cleanup, and inline-linkage fixes.
  Upstream #1428 adds array-reallocation contract tests.

• Updated the Windows static-CRT compatibility source and drift tests for
  upstream moving src/theap.c to src/heap/theap.c.

• Clarified raw constant-size free alignment and arena memory ownership
  requirements, and heap reallocation failure/alignment contracts.

• Declare Windows __ImageBase with explicit extern in C builds. Upstream's
  C++ linkage macro expands to nothing in C and accidentally defined BSS storage,
  shadowing the linker-owned PE base. Static UCRT used that false base for RVA
  lookups and crashed in __acrt_tls2_supported before main. Verify the symbol
  matches the OS module handle and the PE header in the isolated startup test.

• Inherit upstream #1420: invalidate cached thread heaps on heap destruction
  and collect pending cross-thread frees before resetting a destroyed page.

• Inherit upstream #1416: make the already-declared mi_malloc_size and
  mi_malloc_usable_size available even without malloc override; test their
  actual linkage and values.

• Inherit upstream #1419: use C11 atomics for clang C builds targeting MSVC,
  fixing ARM64EC ordering and avoiding unnecessary ARM64 barriers.

• Inherit upstream fixes for mi_free_size size-mismatch checks, Windows
  forced-exit handling and UWP compilation, Android syscall avoidance, and
  profiling-disabled builds. Keep the built-in pprof implementation enabled in
  no_profile so explicit raw snapshots remain functional.

• Defer full Windows static CRT initialization and strong RNG reseeding from
  the pre-CRT TLS callback to .CRT$XCT, after UCRT initialization. Keep
  weak seeds for early allocation bootstrap and TLS thread-exit cleanup.

• Use one resolved CRT setting for MSVC compiler flags and startup compatibility;
  distinguish +crt-static from -crt-static and honor encoded Rust flags.

• Check static CRT startup ordering before main in an isolated regression
  executable, including secure/debug/no-profile and release CI coverage.

• Enable MI_MALLOC_OVERRIDE on non-Windows override builds.

• Set MI_DEFAULT_ALLOW_THP=0 with no_thp; disabling only explicit huge-page
  advice did not disable the runtime THP policy or its larger purge granularity.

• Track vendored C sources/headers for Cargo rebuilds and derive build metadata
  from MI_MALLOC_VERSION, preventing stale C objects after submodule updates.

• Configure pprof backtrace and file-output facilities for supported targets.

• Correct TLS/security documentation, remove the dead Windows TLS feature hook,
  strengthen small-free and borrowed-heap safety contracts, and reuse the text
  diagnostic buffer instead of copying valid UTF-8 output.

Known upstream limitation

• V3.5.4 interim copies profile_disabled=true into new thread heaps without
  clearing it. Dedicated-heap and worker-thread profiling can remain inactive.
  Profiling stays experimental raw FFI; the integration test proves main-heap
  sampling in an isolated single-threaded process only.

Installation

[dependencies]
rustfs-mimalloc = "0.6.0"
rustfs-mimalloc-profiling = "0.6.0"

Full Changelog: v0.5.6...v0.6.0