fix(sys): use THREAD_LOCAL TLS for mimalloc v3 on Apple

Author: shulaoda

libmimalloc-sys/build.rs

@@ -2,6 +2,82 @@ use std::env;
 
 use cmake::Config;
 
+/// Patch the vendored mimalloc v3 `prim.h` so that Apple targets select
+/// `MI_TLS_MODEL_THREAD_LOCAL` with `MI_TLS_RECURSE_GUARD` instead of the
+/// upstream default `MI_TLS_MODEL_FIXED_SLOT`.
+///
+/// Background:
+/// - FIXED_SLOT (default) hardcodes the per-thread `theap` pointer at
+///   TCB[108]/[109]. When multiple statically-linked instances of
+///   mimalloc-safe live in the same process (e.g. multiple Node.js
+///   napi addons), every instance reads and writes the same slot on
+///   any thread that calls into more than one of them (the main JS
+///   thread in particular) — instances overwrite each other's `theap`
+///   pointers and corrupt each other's heaps.
+/// - The other obvious workaround, `MI_TLS_MODEL_DYNAMIC_PTHREADS`
+///   (activated by passing `-DMI_HAS_TLS_SLOT=0`), turned out to have
+///   poor macOS testing for long-lived non-tokio threads — notably
+///   rayon workers pulled in via `oxc_cfg → oxc_index → rayon` — and
+///   caused SIGABRT crashes in rolldown's CLI tests.
+///
+/// THREAD_LOCAL + RECURSE_GUARD avoids both failure modes:
+/// - `__thread` + `mi_decl_hidden` (already how upstream declares
+///   `__mi_theap_default` / `__mi_theap_cached` in `init.c`) gives
+///   per-image per-thread storage allocated by dyld's TLV system — no
+///   FIXED_SLOT sharing across instances.
+/// - RECURSE_GUARD uses a non-TLS `_mi_process_is_initialized` bool to
+///   short-circuit the fast path before process init completes, so a
+///   first `__thread` access triggering dyld's TLV malloc cannot
+///   recurse into mimalloc itself.
+/// - `MI_HAS_TLS_SLOT` stays at default 1, so the *thread-id* fast
+///   path (`prim.h` line ~304) still uses `mi_prim_tls_slot(0)`
+///   (Apple's system-defined thread-id TSD slot, shared semantically
+///   across all consumers — no conflict).
+///
+/// Idempotent: detects an already-patched file by a marker comment and
+/// returns early. Panics loudly if the upstream selector block can't be
+/// located — that means mimalloc changed `prim.h` and this patch needs
+/// to be updated. Leaves the submodule's working tree marked dirty
+/// after a fresh clone+build; reset with `git submodule update --force`
+/// if needed (next build will re-apply the patch).
+fn patch_apple_tls_model_for_v3() {
+    let prim_h = "c_src/mimalloc3/include/mimalloc/prim.h";
+    let content = std::fs::read_to_string(prim_h).unwrap_or_else(|e| {
+        panic!(
+            "could not read {}: {} — is the mimalloc3 submodule initialized?",
+            prim_h, e
+        )
+    });
+
+    const MARKER: &str = "mimalloc-safe vendor patch: Apple uses THREAD_LOCAL";
+    if content.contains(MARKER) {
+        // Already patched — idempotent fast path.
+        return;
+    }
+
+    const OLD: &str = "#if defined(_WIN32)\n  #define MI_TLS_MODEL_DYNAMIC_WIN32        1    \n#elif defined(__APPLE__) && MI_HAS_TLS_SLOT && !defined(__POWERPC__)  // macOS on arm64 or x64\n  // #define MI_TLS_MODEL_DYNAMIC_PTHREADS  1    // also works but a bit slower\n  #define MI_TLS_MODEL_FIXED_SLOT           1\n  #define MI_TLS_MODEL_FIXED_SLOT_DEFAULT   108  // seems unused. @apple: it would be great to get 2 official slots for custom allocators :-)\n  #define MI_TLS_MODEL_FIXED_SLOT_CACHED    109\n  // we used before __PTK_FRAMEWORK_OLDGC_KEY9 (89) but that seems used now.\n  // see <https://github.com/rweichler/substrate/blob/master/include/pthread_machdep.h>\n#elif defined(__APPLE__) || defined(__OpenBSD__) || defined(__ANDROID__)\n  #define MI_TLS_MODEL_DYNAMIC_PTHREADS     1\n  // #define MI_TLS_MODEL_DYNAMIC_PTHREADS_DEFAULT_ENTRY_IS_NULL  1\n#else\n  #define MI_TLS_MODEL_THREAD_LOCAL         1\n#endif";
+
+    const NEW: &str = "#if defined(_WIN32)\n  #define MI_TLS_MODEL_DYNAMIC_WIN32        1\n// --- mimalloc-safe vendor patch: Apple uses THREAD_LOCAL + RECURSE_GUARD ---\n// See libmimalloc-sys/build.rs::patch_apple_tls_model_for_v3 for rationale.\n#elif defined(__APPLE__) && !defined(__POWERPC__)  // macOS on arm64 or x64\n  #define MI_TLS_MODEL_THREAD_LOCAL         1\n  #ifndef MI_TLS_RECURSE_GUARD\n  #define MI_TLS_RECURSE_GUARD              1\n  #endif\n// --- end mimalloc-safe vendor patch ---\n#elif defined(__OpenBSD__) || defined(__ANDROID__)\n  #define MI_TLS_MODEL_DYNAMIC_PTHREADS     1\n  // #define MI_TLS_MODEL_DYNAMIC_PTHREADS_DEFAULT_ENTRY_IS_NULL  1\n#else\n  #define MI_TLS_MODEL_THREAD_LOCAL         1\n#endif";
+
+    assert!(
+        content.contains(OLD),
+        "could not locate the Apple TLS_MODEL selector block in {}; \
+         upstream mimalloc may have changed the file structure. \
+         Update libmimalloc-sys/build.rs::patch_apple_tls_model_for_v3 to match.",
+        prim_h
+    );
+
+    let patched = content.replace(OLD, NEW);
+    std::fs::write(prim_h, patched)
+        .unwrap_or_else(|e| panic!("failed to write patched {}: {}", prim_h, e));
+
+    println!(
+        "cargo:warning=patched mimalloc3 prim.h for Apple THREAD_LOCAL+RECURSE_GUARD \
+         (multi-instance + rayon-worker safe)"
+    );
+    println!("cargo:rerun-if-changed={}", prim_h);
+}
+
 fn main() {
     #[cfg(not(feature = "v3"))]
     let mut cmake_config = Config::new("c_src/mimalloc");
@@ -76,33 +152,11 @@ fn main() {
         cmake_config.define("MI_LOCAL_DYNAMIC_TLS", "ON");
     }
 
-    // On Apple targets, mimalloc v3's `prim.h` selects
-    // `MI_TLS_MODEL_FIXED_SLOT` and hardcodes the per-thread `theap`
-    // pointer at TCB[108]/[109], reading/writing the slot directly
-    // through `tpidrro_el0` (arm64) or `%gs:` (x86_64) rather than
-    // through `pthread_setspecific`. The slot numbers are not allocated
-    // via `pthread_key_create`; the same header notes the caveat:
-    // "This goes wrong though if the OS or a library uses the same
-    // fixed slot."
-    //
-    // When a process loads more than one image that statically links
-    // mimalloc-safe (e.g. two napi addons in one Node.js process),
-    // each image has its own mimalloc state but every image's
-    // `_mi_theap_default()` reads and writes the same TCB[108] on any
-    // given thread — the instances overwrite each other's pointers.
-    //
-    // `-DMI_HAS_TLS_SLOT=0` makes the cascade in `prim.h` skip the
-    // FIXED_SLOT branch on Apple and fall through to
-    // `MI_TLS_MODEL_DYNAMIC_PTHREADS`, whose accessors use
-    // `pthread_{get,set}specific` with a key allocated per image via
-    // `pthread_key_create`. Different images then use distinct keys and
-    // no longer share TLS storage. `prim.h` notes this path is "a bit
-    // slower"; the impact has not been measured here.
-    //
-    // Gated on the `v3` feature: v2 has a separate Apple fast path
-    // controlled by `MI_TLS_SLOT` and is not affected by this define.
+    // On Apple targets with v3, patch the submodule's prim.h to select
+    // THREAD_LOCAL + RECURSE_GUARD instead of upstream's FIXED_SLOT.
+    // See `patch_apple_tls_model_for_v3` above for full rationale.
     if target_os == "macos" && env::var_os("CARGO_FEATURE_V3").is_some() {
-        cmake_config.cflag("-DMI_HAS_TLS_SLOT=0");
+        patch_apple_tls_model_for_v3();
     }
 
     if (target_os == "linux" || target_os == "android")