dangernoodle-io / breadboard / 28757445931

100%

push

github

fix: guard bb_pub sink-set mutators with s_tick_lock (B1-651) (#749)

- bb_pub_add_sink/bb_pub_set_sink/bb_pub_clear_sinks wrote s_sinks[]/
  s_sink_count without s_tick_lock while bb_pub_tick_once reads that
  same array under the lock (Phase 1's snap_sinks[] copy) - a TOCTOU /
  iterator-invalidation race that could skip, double-call, or torn-read
  a sink mid fan-out.
- guard all three mutators with s_tick_lock; bb_pub_set_sink now does
  the clear+add replace-all as a single critical section instead of two
  separate locked calls, so tick_once can never observe a transient
  empty sink set between them.
- lock is only held for the array write itself; no blocking I/O moves
  under s_tick_lock.
- reentrancy guard: s_tick_lock is a plain (non-recursive) mutex and
  Phase 1 of bb_pub_tick_once holds it across every source sample_fn
  and payload extender, so a callback calling a sink mutator from that
  same thread would otherwise self-deadlock the worker. track the
  tick-owning thread (s_tick_owner/s_tick_owner_valid, set/cleared only
  by the thread holding s_tick_lock) and have the three mutators check
  same-thread reentrancy before acquiring the lock, returning
  BB_ERR_INVALID_STATE instead of blocking. bb_pub_clear_sinks now
  returns bb_err_t to report this. documented the invariant in
  bb_pub.h.
- bb_pub_get_status folded its s_sink_count read into the s_tick_lock
  block already used for last_publish_ok/_ms/published_ever, and
  corrected the now-stale "no lock needed" comment.
- add host tests: the reentrancy guard from both a sample_fn and a
  payload extender (asserting BB_ERR_INVALID_STATE and that the tick
  completes without hanging), plus the existing 2000-iteration
  concurrent race test (test_bb_pub_sink_mutators_locked_against_concurrent_tick),
  now also asserting a genuinely different thread never observes
  BB_ERR_INVALID_STATE.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

3259 of 3259 branches covered (100.0%)

Branch coverage included in aggregate %.

5153 of 5153 relevant lines covered (100.0%)

10304.16 hits per line