[alloc] Enhance allocator tests with fuzzing and fault injection, fixing failures in first_fit and ghost_tree - #28
Merged
Merged
Conversation
…ved error handling
…alloc/dealloc failures
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
williamwutq
marked this pull request as ready for review
July 24, 2026 06:19
williamwutq
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR modernizes allocator fuzzing infrastructure and adds deterministic fault-injection tests to exercise crash-consistency boundaries, while also fixing tail-shrink crash-atomicity issues in GhostTreeBstackAllocator::realloc and FirstFitBStackAllocator::realloc (with corresponding C allocator updates).
Changes:
- Refactor allocator fuzz tests to share common helpers/config via a new
alloc_test_commonmodule and extend fuzzing to include adversarial payloads and reopen verification. - Add a new fault-injection fuzz suite plus per-allocator white-box failure unit tests to pin the
BStackAllocError.handlecontract under injected I/O failures. - Fix crash-atomicity issues in GhostTree/FirstFit tail-shrink paths (Rust + C) and document them in the changelog.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/test.rs | Removes an in-place tail-shrink test that no longer matches FirstFit’s new tail-shrink behavior. |
| src/lib.rs | Wires in new allocator fault-fuzz and shared test-common modules behind feature/test cfgs. |
| src/alloc/slab.rs | Adds fault-injection unit tests for slab allocator failure boundaries and reopen integrity. |
| src/alloc/linear.rs | Adds fault-injection unit tests for linear allocator (non-atomic) paths. |
| src/alloc/ghost_tree.rs | Fixes atomic tail-shrink to be crash-atomic via process_gen + Atrunc; adds fault tests. |
| src/alloc/first_fit.rs | Changes tail-shrink to keep block oversized (no physical reclaim); adds fault tests. |
| src/alloc/checked_slab.rs | Adds fault-injection unit tests ensuring open/recover() reclaims orphaned/leaked blocks. |
| src/alloc_test_common.rs | New shared fuzz/fault test utilities (payloads, patterns, operation generator, policies). |
| src/alloc_fuzz_tests.rs | Refactors fuzz runners to use shared utilities and adds adversarial payload verification. |
| src/alloc_fault_tests.rs | New fault-injection fuzz driver that reopens/re-verifies after faulted operations. |
| PLANNED.md | Adds design notes for improving the C allocator API to signal survivor/lost on failed realloc/dealloc. |
| CHANGELOG.md | Documents the GhostTree and FirstFit crash-atomicity fixes in Unreleased notes. |
| c/bstack_alloc.c | Mirrors FirstFit tail-shrink change and implements crash-atomic GhostTree tail-shrink via process_gen. |
| .github/workflows/ci.yml | Skips alloc fault-fuzz in the main CI matrix (alongside alloc fuzz). |
| .github/workflows/alloc_fuzz.yml | Expands fuzz workflow triggers and adds dedicated fault-fuzz jobs (atomic + non-atomic). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
williamwutq
added a commit
that referenced
this pull request
Aug 23, 2026
Backport of two first_fit fixes to the 0.2.x line, both surfaced by the allocator fault-injection fuzz. #28 (crash-atomic realloc tail-shrink): reclaiming a shrunk tail block rewrote the block header and footer and discarded the tail as separate operations, so a fault mid-sequence left header, footer, and physical size disagreeing -- a state the block-walking recovery cannot repair (it would truncate the whole block, losing live data). A tail shrink now narrows only the user-visible length and keeps the block at its physical size (an oversized block, as a non-tail shrink already does); the tail is reclaimed on free. Behaviour change: a tail realloc shrink no longer returns space to the file immediately. #35 (two recovery bugs): * Interrupted tail *grow*: extend zero-fills the payload before the header/footer are rewritten, so a crash left a valid block followed by a headerless all-zero region that the recovery scan read as a size-0 block and rejected -- turning a recoverable crash into a hard open failure. Recovery now rolls an all-zero trailing region back by truncation (a real block is never all-zero); genuine mid-arena corruption still fails loudly. * Coalescing free commits the merged size to the header before the footer, so a crash left a stale footer that the header-following walk missed, later letting a neighbour's coalesce overlap two blocks and desync the walk into a hard open failure. Recovery now normalizes every block's footer to its authoritative header as it walks. Both fixes are self-contained recovery/realloc logic with no dependency on the 0.4.0 surviving-handle API or tail-replace primitives. Added two targeted recovery tests that construct the corrupted on-disk state directly (no fault-injection framework); updated realloc_tail_shrink to assert the new oversized-block behaviour. Tests (all green): Rust alloc,set / alloc,set,atomic; C test-first-fit / test-first-fit-atomic. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description: Modernize existing fuzzing infrastructure for allocators, add more comprehensive failure tests with
fault_injectionintroduced in0.4.0.New Feature: Internal. This is purely tests
Important Feature: No
Feature Flags:
alloc(testing usingfault_injectionandatomicis also concerned)Breaking change: No
New Types: None
Rust Only: No
Fuzz: Fuzzing