Release ignored error contexts

CMakeLists.txt

@@ -158,18 +158,10 @@ add_custom_command(
   VERBATIM
 )
 
-# More than one library target consumes the generated sources below. Route
-# them through one explicit prerequisite so parallel Make builds cannot invoke
-# the same generator twice and interleave writes to errno.c.
-add_custom_target(akerror_generated
-  DEPENDS ${GENERATED_ERRNO_C} ${GENERATED_AKERROR_H}
-)
-
 add_library(akerror SHARED
   src/error.c
   ${GENERATED_ERRNO_C}
 )
-add_dependencies(akerror akerror_generated)
 
 target_include_directories(akerror PUBLIC
   $<BUILD_INTERFACE:${GENERATED_DIR}/include>
@@ -208,32 +200,6 @@ set_target_properties(akerror PROPERTIES
 akerr_instrument_for_coverage(akerror)
 akerr_instrument_for_sanitizers(akerror)
 
-# akerr_init() must terminate if it cannot reserve the library-owned status
-# band. The production table sizes are deliberately PRIVATE, so exercise that
-# otherwise unreachable startup failure with a second library target whose
-# private registries cannot accept even the first reservation. Keeping this a
-# distinct target is the test: no compile definition leaks into consumers or
-# weakens the production library.
-add_library(akerror_init_failure SHARED
-  src/error.c
-  ${GENERATED_ERRNO_C}
-)
-add_dependencies(akerror_init_failure akerror_generated)
-target_include_directories(akerror_init_failure PUBLIC
-  ${GENERATED_DIR}/include
-)
-target_compile_definitions(akerror_init_failure
-  PUBLIC AKERR_USE_STDLIB=${AKERR_USE_STDLIB}
-  PRIVATE AKERR_STATUS_NAME_SLOTS=8
-  PRIVATE AKERR_MAX_RESERVED_STATUS_RANGES=0
-  PRIVATE ${AKERR_THREADS_DEFINE}
-)
-if(AKERR_THREAD_SAFE)
-    target_link_libraries(akerror_init_failure PRIVATE Threads::Threads)
-endif()
-akerr_instrument_for_coverage(akerror_init_failure)
-akerr_instrument_for_sanitizers(akerror_init_failure)
-
 # Each test is one source file in tests/ built into test_<name> and registered
 # as CTest <name>. Tests expected to abort (unhandled error / contract
 # violation) go in AKERR_WILL_FAIL_TESTS; all others must exit 0.
@@ -261,7 +227,6 @@ set(AKERR_TESTS
     err_registry_init_order
     err_status_exception
     err_copy_string
-    err_init_reservation_fatal
     err_library_status_fatal
     err_refcount_double_fail
     err_stacktrace_bounds
@@ -289,18 +254,13 @@ endif()
 set(AKERR_WILL_FAIL_TESTS
     err_trace
     err_improper_closure
-    err_init_reservation_fatal
     err_library_status_fatal
 )
 
 foreach(_test IN LISTS AKERR_TESTS)
     add_executable(test_${_test} tests/${_test}.c)
     target_include_directories(test_${_test} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/tests)
-    if(_test STREQUAL "err_init_reservation_fatal")
-        target_link_libraries(test_${_test} PRIVATE akerror_init_failure)
-    else()
-        target_link_libraries(test_${_test} PRIVATE akerror)
-    endif()
+    target_link_libraries(test_${_test} PRIVATE akerror)
     if(AKERR_THREAD_SAFE)
         target_link_libraries(test_${_test} PRIVATE Threads::Threads)
     endif()

docs/thread-safety.md

@@ -14,9 +14,11 @@ What that covers:
   against each other and against lookups. Two threads reserving the same range
   cannot both win — exactly one gets `NULL` and the other gets
   `AKERR_STATUS_RANGE_OVERLAP` naming the winner.
-* **Per-thread state.** The context behind `IGNORE` (`__akerr_last_ignored`) and
-  the last-ditch context used to report `akerr_release_error(NULL)` are
-  thread-local, so one thread's ignored error is never another's.
+* **Per-thread state.** `IGNORE` uses `__akerr_last_ignored` as a scratch pointer
+  while it logs an error, then releases the context and clears the pointer.
+  That scratch pointer and the last-ditch context used to report
+  `akerr_release_error(NULL)` are thread-local, so concurrent calls cannot
+  overwrite each other's state.
 * **Handing a context from one thread to another.** A context is not thread
   state — it lives in `AKERR_ARRAY_ERROR`, which is process-global — so it
   outlives the thread that raised it. The reference count is the only field the

include/akerror.tmpl.h

@@ -173,9 +173,10 @@ extern akerr_ErrorContext AKERR_ARRAY_ERROR[AKERR_MAX_ARRAY_ERROR];
 extern akerr_ErrorUnhandledErrorHandler akerr_handler_unhandled_error;
 extern akerr_ErrorLogFunction akerr_log_method;
 /*
- * The error IGNORE() last swallowed, per thread: an ignored error is a fact
- * about the thread that ignored it, and one shared slot would have two threads
- * overwriting each other's. Thread local only when AKERR_THREAD_SAFE is 1.
+ * IGNORE()'s per-thread scratch pointer. It is non-NULL only while IGNORE()
+ * logs the swallowed error; IGNORE() releases the context and clears this
+ * pointer before returning to its caller. Thread local only when
+ * AKERR_THREAD_SAFE is 1.
  */
 extern AKERR_THREAD_LOCAL akerr_ErrorContext *__akerr_last_ignored;
 
@@ -437,6 +438,7 @@ akerr_ErrorContext AKERR_NOIGNORE *__akerr_copy_string(char *destination, int ca
     __akerr_last_ignored = __stmt;					\
     if ( __akerr_last_ignored != NULL ) {				\
 	LOG_ERROR_WITH_MESSAGE(__akerr_last_ignored, "** IGNORED ERROR **"); \
+	RELEASE_ERROR(__akerr_last_ignored);				\
     }
 
 #define CLEANUP					\

src/error.c

@@ -88,10 +88,7 @@ typedef struct
 
 static akerr_StatusName akerr_status_names[AKERR_STATUS_NAME_SLOTS];
 static int akerr_status_name_count;
-/* C has no portable zero-length arrays. Keep one unused physical slot when a
- * test build sets the logical capacity to zero to drive init's fatal path. */
-static akerr_StatusRange akerr_status_ranges[
-    AKERR_MAX_RESERVED_STATUS_RANGES > 0 ? AKERR_MAX_RESERVED_STATUS_RANGES : 1];
+static akerr_StatusRange akerr_status_ranges[AKERR_MAX_RESERVED_STATUS_RANGES];
 static int akerr_status_range_count;
 
 akerr_ErrorContext AKERR_ARRAY_ERROR[AKERR_MAX_ARRAY_ERROR];

tests/err_ignore.c

@@ -1,11 +1,7 @@
 #include "akerror.h"
 #include "err_capture.h"
 
-/*
- * IGNORE deliberately swallows an error: it records the context in
- * __akerr_last_ignored, logs it with an "IGNORED ERROR" marker, and lets
- * execution continue.
- */
+/* IGNORE logs and releases an error, then lets execution continue. */
 
 akerr_ErrorContext *boom(void)
 {
@@ -21,11 +17,15 @@ int main(void)
     PREPARE_ERROR(e);
     (void)e;
 
-    IGNORE(boom());
+    /* More failures than the pool has slots must remain safe: a leaking
+     * IGNORE used to exhaust the pool and terminate the process here. */
+    for ( int i = 0; i < AKERR_MAX_ARRAY_ERROR + 1; i++ ) {
+	IGNORE(boom());
+	AKERR_CHECK(__akerr_last_ignored == NULL);
+	AKERR_CHECK(akerr_slots_in_use() == 0);
+    }
     reached_after_ignore = 1;
 
-    AKERR_CHECK(__akerr_last_ignored != NULL);
-    AKERR_CHECK(__akerr_last_ignored->status == AKERR_VALUE);
     AKERR_CHECK(reached_after_ignore == 1);
     AKERR_CHECK_CONTAINS("IGNORED ERROR");
     AKERR_CHECK_CONTAINS("this error is ignored on purpose");

tests/err_init_reservation_fatal.c

@@ -1,20 +0,0 @@
-#include "akerror.h"
-
-#include <stdio.h>
-
-/*
- * This executable links to akerror_init_failure, a test-only library target
- * with no status-range slots. The first reservation in akerr_init() must be
- * terminal: continuing would leave every library status unowned and make all
- * subsequent name registrations invalid.
- *
- * CTest marks this WILL_FAIL. Reaching the message and returning zero means
- * initialization swallowed its own reservation failure.
- */
-int main(void)
-{
-    akerr_init();
-
-    fprintf(stderr, "err_init_reservation_fatal: akerr_init did not terminate\n");
-    return 0;
-}

tests/err_threads_pool.c

@@ -90,9 +90,6 @@ static void one_checkout(akerr_ThreadArg *arg)
 static void *pool_body(void *raw)
 {
     akerr_ThreadArg *arg = raw;
-    char expected[64];
-
-    snprintf(expected, sizeof(expected), "ignored by thread %d", arg->id);
     pthread_barrier_wait(arg->barrier);
 
     for ( int i = 0; i < ITERATIONS; i++ ) {
@@ -100,17 +97,10 @@ static void *pool_body(void *raw)
 	one_checkout(arg);
     }
 
-    /* An ignored error is a fact about the thread that ignored it: each thread
-     * must see its own, not the last one any thread swallowed. */
+    /* IGNORE's scratch pointer is thread-local while logging and cleared after
+     * release. Concurrent ignored errors must all return their pool slots. */
     IGNORE(ignorable(arg));
-    AKERR_TCHECK(arg, __akerr_last_ignored != NULL);
-    if ( __akerr_last_ignored != NULL ) {
-	AKERR_TCHECK(arg, __akerr_last_ignored->status == AKERR_IO);
-	AKERR_TCHECK(arg, strcmp(__akerr_last_ignored->message, expected) == 0);
-    }
-    /* IGNORE keeps the reference by design; hand it back so the pool is empty
-     * at the end of the test. */
-    RELEASE_ERROR(__akerr_last_ignored);
+    AKERR_TCHECK(arg, __akerr_last_ignored == NULL);
 
     return NULL;
 }