From 40f10f6348392d79112cf125eee3e2da6a58b9fe Mon Sep 17 00:00:00 2001
From: TermiNexus <wyt18222152539wyt@163.com>
Date: Tue, 25 Aug 2026 15:39:09 +0800
Subject: [PATCH] =?UTF-8?q?fix(memhub):=20detection=20=E8=AE=B0=E5=BD=95?=
 =?UTF-8?q?=E8=A1=A8=E6=BB=A1=E6=97=B6=20realloc=20=E6=89=A9=E5=AE=B9=20-?=
 =?UTF-8?q?=20=E5=8E=9F=2032MB/16B=3D2M=20=E6=9D=A1=E6=BB=A1=E5=90=8E?=
 =?UTF-8?q?=E6=96=B0=20alloc=20=E6=97=A0=E8=AE=B0=E5=BD=95=EF=BC=8Cis=5Fal?=
 =?UTF-8?q?ive=20=E8=AF=AF=E6=8A=A5=E8=AF=BB=E5=8F=96=E6=82=AC=E7=A9=BA?=
 =?UTF-8?q?=EF=BC=88hdr=3D0x5=20=E6=B4=BB=E8=B7=83=E5=9D=97=E4=B8=8D?=
 =?UTF-8?q?=E5=9C=A8=E8=AE=B0=E5=BD=95=E8=A1=A8=EF=BC=89=EF=BC=9B=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=20stdlib.realloc=20=E7=BF=BB=E5=80=8D=E6=89=A9?=
 =?UTF-8?q?=E5=AE=B9=EF=BC=88=E5=AF=B9=E9=BD=90=20chk=5Fstack=EF=BC=89?=
 =?UTF-8?q?=EF=BC=8C=E4=BF=9D=E8=AF=81=20is=5Falive/=5Fdet=5Fprobe=20?=
 =?UTF-8?q?=E5=85=A8=E7=A8=8B=E8=A6=86=E7=9B=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 includes/memhub.vp | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/includes/memhub.vp b/includes/memhub.vp
index 7b4dc56..f6d63f1 100644
--- a/includes/memhub.vp
+++ b/includes/memhub.vp
@@ -323,6 +323,7 @@ class MemBuddy(MemManager):
     #   detection=1 → alloc 前后 2 字节 0xCDCD 标记 + 记录表 + 每次 alloc 后探测
     detection: t.CInt = 0
     detection_size: t.CSizeT = MEMBUDDY_DET_RECORD_SIZE
+    _det_arena: t.CVoid | t.CPtr = None        # 记录区基址（stdlib.malloc，供 realloc 扩容）
     _det_records: t.CUInt64T | t.CPtr = None   # 记录表（每 2×u64 = 1 条：{ptr, size}）
     _det_count: t.CSizeT = 0                   # 已记录条数
     _det_cap: t.CSizeT = 0                     # 记录容量（条）
@@ -410,6 +411,7 @@ class MemBuddy(MemManager):
             det_arena: t.CVoid | t.CPtr = t.CVoid(
                 stdlib.malloc(self.detection_size), t.CPtr)
             if det_arena is not None:
+                self._det_arena = det_arena
                 self._det_records = (t.CUInt64T | t.CPtr)(t.CVoid(det_arena, t.CPtr))
                 self._det_cap = self.detection_size // 16
             self._det_count = 0
@@ -657,10 +659,22 @@ class MemBuddy(MemManager):
             tail_d: t.CUInt64T = base_ret_d + 2 + t.CUInt64T(size)
             m_t_d: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(tail_d, t.CPtr))
             m_t_d[0] = t.CUInt16T(MEMBUDDY_DET_MARKER)
-            if self._det_records is not None and self._det_count < self._det_cap:
-                self._det_records[self._det_count * 2] = base_ret_d + 2
-                self._det_records[self._det_count * 2 + 1] = t.CUInt64T(size)
-                self._det_count += 1
+            if self._det_records is not None:
+                if self._det_count >= self._det_cap:
+                    # 记录表满：stdlib.realloc 翻倍扩容（防 is_alive/_det_probe
+                    # 因容量耗尽漏检——SlotsBugTest 编译 includes 超 2M 次 alloc，
+                    # 满后新块无记录 → is_alive 误报"读取悬空"）
+                    new_cap: t.CSizeT = self._det_cap * 2
+                    new_rec: t.CVoid | t.CPtr = t.CVoid(
+                        stdlib.realloc(self._det_arena, new_cap * 16), t.CPtr)
+                    if new_rec is not None:
+                        self._det_arena = new_rec
+                        self._det_records = (t.CUInt64T | t.CPtr)(t.CVoid(new_rec, t.CPtr))
+                        self._det_cap = new_cap
+                if self._det_count < self._det_cap:
+                    self._det_records[self._det_count * 2] = base_ret_d + 2
+                    self._det_records[self._det_count * 2 + 1] = t.CUInt64T(size)
+                    self._det_count += 1
             self._det_probe()
             result = t.CVoid(base_ret_d + 2, t.CPtr)
         if result is None: