Skip to content

Deflake guarded_page_allocator_profile_test: fix a rate-limiter counter race and a test stop condition. - #953

Merged
copybara-service[bot] merged 1 commit into
masterfrom
test_982762477
Sep 18, 2026
Merged

copybara-service[bot] merged 1 commit into
masterfrom
test_982762477

Conversation

@copybara-service

Copy link
Copy Markdown

Deflake guarded_page_allocator_profile_test: fix a rate-limiter counter race and a test stop condition.

Two independent flakes (~0.05% each, -c opt), both in the guarded-sample rate
limiter's accounting.

  1. GuardedPageAllocator::TrySample counter race (production fix).
    NeverRateLimited sets equal guarded and profile sampling intervals and asserts
    that no allocation is ever RateLimited. With equal intervals the rate-limit
    predicate reduces to num_sampled < num_guarded, which should be impossible
    because sampled allocations are a superset of guarded ones. However num_guarded
    (successful_allocations_) and num_sampled (total_sampled_count_) are incremented
    non-atomically, and by design num_sampled is incremented after num_guarded. A
    concurrent or reentrant guarded allocation can bump num_guarded before its
    num_sampled increment, so a racing TrySample reads num_sampled < num_guarded and
    spuriously returns RateLimited. Clamp the read to the documented invariant
    (num_sampled >= num_guarded). This is a no-op in steady state; at equal intervals
    it makes rate-limiting provably impossible, and it does not change behavior when
    guarded_interval > profile_interval (at the floor num_sampled == num_guarded the
    ratio is still 10, which rate-limits as intended).

  2. RateLimited test stop condition (test fix).
    The test looped until the first sampled-but-not-guarded allocation and assumed
    it must be RateLimited. TrySample also returns Filtered (probabilistic
    stacktrace filter) and NoAvailableSlots, so if the first non-guarded sample was
    Filtered the window contained no RateLimited sample and the assertion failed.
    Accumulate enough guarded allocations that the 2:1 rate limiter is guaranteed to
    have produced many RateLimited samples before stopping.

Both tests still assert their original invariants (Guarded+RateLimited present
under a 2:1 interval; never RateLimited under equal intervals).

@copybara-service
copybara-service Bot force-pushed the test_982762477 branch 3 times, most recently from 960c06d to 36f8ceb Compare September 18, 2026 16:40
…er race and a test stop condition.

Two independent flakes (~0.05% each, -c opt), both in the guarded-sample rate
limiter's accounting.

1) GuardedPageAllocator::TrySample counter race (production fix).
NeverRateLimited sets equal guarded and profile sampling intervals and asserts
that no allocation is ever RateLimited. With equal intervals the rate-limit
predicate reduces to num_sampled < num_guarded, which should be impossible
because sampled allocations are a superset of guarded ones. However num_guarded
(successful_allocations_) and num_sampled (total_sampled_count_) are incremented
non-atomically, and by design num_sampled is incremented after num_guarded. A
concurrent or reentrant guarded allocation can bump num_guarded before its
num_sampled increment, so a racing TrySample reads num_sampled < num_guarded and
spuriously returns RateLimited. Clamp the read to the documented invariant
(num_sampled >= num_guarded). This is a no-op in steady state; at equal intervals
it makes rate-limiting provably impossible, and it does not change behavior when
guarded_interval > profile_interval (at the floor num_sampled == num_guarded the
ratio is still 10, which rate-limits as intended).

2) RateLimited test stop condition (test fix).
The test looped until the first sampled-but-not-guarded allocation and assumed
it must be RateLimited. TrySample also returns Filtered (probabilistic
stacktrace filter) and NoAvailableSlots, so if the first non-guarded sample was
Filtered the window contained no RateLimited sample and the assertion failed.
Accumulate enough guarded allocations that the 2:1 rate limiter is guaranteed to
have produced many RateLimited samples before stopping.

Both tests still assert their original invariants (Guarded+RateLimited present
under a 2:1 interval; never RateLimited under equal intervals).

PiperOrigin-RevId: 983913752
@copybara-service
copybara-service Bot merged commit 146e84e into master Sep 18, 2026
1 check passed
@copybara-service
copybara-service Bot deleted the test_982762477 branch September 18, 2026 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant