Harden symbol-dict resource teardown paths

Three defensive fixes on currently-unreachable teardown paths, each
guarding a future edit from a native-memory hazard:

- PersistedSymbolDict.close() now nulls loadedEntriesAddr/Len after
  freeing them (like scratchAddr), so a post-close read of the
  non-closed-guarded getters cannot dereference freed memory.

- CursorWebSocketSendLoop resets sentDictCount alongside the buffer in
  both mirror-free sites, keeping the mirror all-or-nothing. start() has
  no closed guard, so a hypothetical close()-then-start() would otherwise
  observe a non-zero count against a freed buffer and drive
  setWireBaselineWithCatchUp into a null-mirror catch-up.

- PersistedSymbolDict.openFresh() now closes the fd on any throw (the
  header malloc moves inside the try, plus a catch), mirroring
  openExisting; previously a throw in the header-write body freed the
  scratch buffer but leaked the fd.

Tests: testCloseNullsLoadedEntries asserts the getters read 0 after
close; the mirror-leak test now also asserts sentDictCount is reset.
Both fail before their fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/CursorWebSocketSendLoop.java

@@ -907,6 +907,11 @@ public synchronized void close() {
             sentDictBytesAddr = 0;
             sentDictBytesCapacity = 0;
             sentDictBytesLen = 0;
+            // Reset the count alongside the buffer so the mirror stays all-or-
+            // nothing: a hypothetical close()-then-start() (start() has no closed
+            // guard) must not observe a non-zero sentDictCount against a freed
+            // buffer and drive setWireBaselineWithCatchUp into a null-mirror catch-up.
+            sentDictCount = 0;
         }
     }
 
@@ -1793,6 +1798,7 @@ private void ioLoop() {
                 sentDictBytesAddr = 0;
                 sentDictBytesCapacity = 0;
                 sentDictBytesLen = 0;
+                sentDictCount = 0; // keep the mirror all-or-nothing (see close())
             }
             shutdownLatch.countDown();
             // Failed-stop hand-off (see delegateEngineClose): the owner could

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/PersistedSymbolDict.java

@@ -282,6 +282,11 @@ public synchronized void close() {
         closed = true;
         if (loadedEntriesAddr != 0L) {
             Unsafe.free(loadedEntriesAddr, loadedEntriesLen, MemoryTag.NATIVE_DEFAULT);
+            // Null after freeing (like scratchAddr below) so a future accessor that
+            // reads loadedEntriesAddr()/loadedEntriesLen() post-close cannot
+            // dereference freed native memory; the getters are not closed-guarded.
+            loadedEntriesAddr = 0L;
+            loadedEntriesLen = 0;
         }
         if (scratchAddr != 0L) {
             Unsafe.free(scratchAddr, scratchCap, MemoryTag.NATIVE_DEFAULT);
@@ -437,8 +442,9 @@ private static PersistedSymbolDict openFresh(String filePath) {
             LOG.warn("symbol dict {} could not be created (rc={}); proceeding without it", filePath, fd);
             return null;
         }
-        long hdr = Unsafe.malloc(HEADER_SIZE, MemoryTag.NATIVE_DEFAULT);
+        long hdr = 0L;
         try {
+            hdr = Unsafe.malloc(HEADER_SIZE, MemoryTag.NATIVE_DEFAULT);
             Unsafe.getUnsafe().putInt(hdr, FILE_MAGIC);
             Unsafe.getUnsafe().putByte(hdr + 4, VERSION);
             Unsafe.getUnsafe().putByte(hdr + 5, (byte) 0);
@@ -451,8 +457,18 @@ private static PersistedSymbolDict openFresh(String filePath) {
                 LOG.warn("symbol dict {} header write failed; proceeding without it", filePath);
                 return null;
             }
+        } catch (Throwable t) {
+            // Unreachable today (Files.write is native and returns -1 rather than
+            // throwing; the Unsafe puts target a valid 8-byte buffer and an 8-byte
+            // malloc cannot realistically OOM), but close the fd against a future
+            // edit so it cannot leak -- mirroring openExisting's error handling.
+            Files.close(fd);
+            LOG.warn("symbol dict {} creation failed ({}); proceeding without it", filePath, String.valueOf(t));
+            return null;
         } finally {
-            Unsafe.free(hdr, HEADER_SIZE, MemoryTag.NATIVE_DEFAULT);
+            if (hdr != 0L) {
+                Unsafe.free(hdr, HEADER_SIZE, MemoryTag.NATIVE_DEFAULT);
+            }
         }
         return new PersistedSymbolDict(fd, HEADER_SIZE, 0, 0L, 0);
     }

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/sf/cursor/CursorWebSocketSendLoopMirrorLeakTest.java

@@ -89,7 +89,15 @@ public void testSeededMirrorFreedWhenLoopClosedWithoutStart() throws Exception {
                             0, 0, 1);
                     // Close without start(): the ctor-seeded mirror is this
                     // thread's to free, since the I/O loop never ran.
+                    Assert.assertTrue("precondition: the ctor seeded a non-empty mirror",
+                            readInt(loop, "sentDictCount") > 0);
                     loop.close();
+                    // close() must reset sentDictCount alongside freeing the buffer,
+                    // so the mirror stays all-or-nothing: a hypothetical post-close
+                    // start() (no closed guard) cannot read a stale count against a
+                    // freed buffer and drive a null-mirror catch-up.
+                    Assert.assertEquals("close() must reset sentDictCount to 0",
+                            0, readInt(loop, "sentDictCount"));
                 }
             });
         } finally {

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/sf/cursor/PersistedSymbolDictTest.java

@@ -228,6 +228,32 @@ public void testBadMagicIsRecreatedEmpty() throws Exception {
         });
     }
 
+    @Test
+    public void testCloseNullsLoadedEntries() throws Exception {
+        // close() must null loadedEntriesAddr/Len after freeing them (like
+        // scratchAddr), so an accidental post-close read of the getters cannot
+        // dereference freed native memory. Pre-fix the pointer survived close()
+        // non-zero.
+        assertMemoryLeak(() -> {
+            Path dir = Files.createTempDirectory("qwp-symdict");
+            try {
+                PersistedSymbolDict d = PersistedSymbolDict.open(dir.toString());
+                d.appendSymbol("AAPL");
+                d.close();
+
+                // Reopen so recovery loads the entries into native memory.
+                PersistedSymbolDict re = PersistedSymbolDict.open(dir.toString());
+                Assert.assertTrue("recovery must load entries into native memory",
+                        re.loadedEntriesAddr() != 0L && re.loadedEntriesLen() > 0);
+                re.close();
+                Assert.assertEquals("close() must null loadedEntriesAddr", 0L, re.loadedEntriesAddr());
+                Assert.assertEquals("close() must null loadedEntriesLen", 0, re.loadedEntriesLen());
+            } finally {
+                rmDir(dir);
+            }
+        });
+    }
+
     @Test
     public void testEmptySymbolRoundTrips() throws Exception {
         assertMemoryLeak(() -> {