Skip to content

fix(cache): do not touch an expired object after cache_find_base removes it - #353

Open
SAY-5 wants to merge 2 commits into
1a1a11a:developfrom
SAY-5:fix-ttl-expired-find
Open

SAY-5 wants to merge 2 commits into
1a1a11a:developfrom
SAY-5:fix-ttl-expired-find

Conversation

@SAY-5

@SAY-5 SAY-5 commented Oct 18, 2026

Copy link
Copy Markdown

What does this PR do?

With -DSUPPORT_TTL=ON, cache_find_base sets cache_obj to NULL after it has removed an expired object and then writes next_access_vtime and freq through that pointer, so the first request for an expired object segfaults for every algorithm that goes through it. Return NULL right after the removal instead. Fixes #349.

Type of change

  • Bug fix
  • New eviction / admission / prefetch algorithm
  • New trace reader or trace format
  • Performance improvement
  • Documentation
  • Build / CI
  • Other:

How was it tested?

The new /libCacheSim/cacheAlgo_LRU_expired_object test inserts an object with a 10 second TTL and requests it again 20 seconds later. On develop it segfaults; with this change the second request is a miss and the object is reinserted. Built with -DSUPPORT_TTL=ON (Debug) for the new test and in plain Release for the CI configuration, ctest passes in both.

  • ctest --test-dir _build --output-on-failure passes
  • Build is warning-free (CI uses -Wall -Wextra -Werror)

Checklist

  • Formatted with clang-format (or the pre-commit hook from scripts/setup_hooks.sh)
  • Added or updated tests
  • Added or updated documentation
  • New algorithms are registered in the CLI and listed in the README

…ves it

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
@SAY-5
SAY-5 requested a review from haochengxia as a code owner October 18, 2026 18:34

@1a1a11a 1a1a11a left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed and independently validated commit 95b0820. The early return is the correct fix for #349; I found no blocking correctness issue in this patch.

Lookup semantics:

  • With update_cache=true, the algorithm's removal callback unlinks/deletes the expired object and updates object/byte counts. Returning immediately avoids both the NULL dereference and subsequent metadata updates on a removed object.
  • With update_cache=false, an expired object still returns NULL, remains resident, and retains its metadata and accounting. This matches the pre-patch non-updating behavior.
  • FIFO, LRU, Sieve, and the FIFO sub-caches used by S3FIFO accept NULL as a miss. cache_get_base then follows the normal insertion path. The existing strict expiry boundary (exp_time < clock_time) and zero-expiry sentinel are preserved.

Independent execution on Linux / GCC 13:

Configuration / check Result
Debug, -DSUPPORT_TTL=ON, full build + ctest --output-on-failure --parallel 4 10/10 CTest targets passed, including CLI; build warning-free
Default Release (SUPPORT_TTL=OFF), full build + same CTest command 10/10 CTest targets passed, including CLI; build warning-free
Added /libCacheSim/cacheAlgo_LRU_expired_object test, run directly Passed
Additional local TTL contract checks for FIFO, LRU, Sieve, and S3FIFO Passed, including request/default/zero TTL, exact expiry boundary, non-updating lookup without mutation, updating removal, accounting, repeated expiration/reinsertion, and S3FIFO main-queue expiration
Same contract checks with AddressSanitizer + UndefinedBehaviorSanitizer Passed
Baseline develop cache.c with the same sanitizer harness Reproduced the NULL dereference in cache_find_base for all four reported algorithms
clang-format 18.1.8 --dry-run --Werror, both changed files Passed

Execution limits: the Release build used the system allocator because optional tcmalloc was not discovered. LeakSanitizer could not enumerate sandboxed processes, so leak detection was disabled for the targeted ASan/UBSan harness. The additional contract harness was local validation, not an addition to this PR.

Non-blocking follow-up: parameterize the committed TTL regression over FIFO/LRU/Sieve/S3FIFO and include an expired find(..., false) case. A TTL-enabled CI configuration would keep this coverage active: the current build workflow uses TTL=OFF and compiles out the new regression.

Merge status: build, Code Quality, and CodeQL are currently action_required, each with zero jobs; only GitGuardian has passed. Please approve those first-time contributor workflow runs and obtain any required code-owner review before merging, consistent with CONTRIBUTING.md's green-CI requirement. The connected GitHub integration cannot read the full branch-protection settings, so this approval does not assert that every repository merge requirement is satisfied. Issue #349 can be closed when this fix reaches the default develop branch; the PR already contains Fixes #349.

@SAY-5

SAY-5 commented Oct 19, 2026

Copy link
Copy Markdown
Author

Added the follow-up coverage in 2879afb: FIFO, LRU, Sieve and both S3FIFO queues now exercise expired non-updating lookups, unchanged residency/accounting, the expiry boundary and repeated removal/reinsertion. Ubuntu CI now runs TTL OFF and ON, preserving the existing ubuntu check name.

All five regression cases pass on the repaired code and crash against the exact parent’s cache.c. Native Debug runs with TTL ON and OFF each passed nine CTest targets, including 204 CLI assertions. I left testUtils unrun locally because it deletes a pre-existing hardcoded temporary directory; it remains enabled in CI. These runs did not use sanitizers and reported three duplicate-static-library linker warnings.

The changes and verification were AI-assisted and independently reviewed.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SUPPORT_TTL: cache_find_base dereferences NULL after removing an expired object (segfault)

2 participants