fix(mimalloc): preserve pthread key ownership during process exit

[steipete]

jsc can enter exit() while a collector thread still allocates and parks. The vendored allocator deletes its pthread key, but late heap associations can still use the old number. ParkingLot can acquire that recycled key and then read a mi_theap_t* as its ThreadSpecific data: the heap's tld becomes a fake ThreadData, and parkingLock points into allocator metadata. This explains the intermittent glibc mutex-type and priority-ceiling assertions at shell exit.

Close admission to new setters and drain setters already in flight before invalidating and deleting the key. Add native regressions for a first allocation after shutdown and a setter paused at pthread_setspecific. The latter uses an explicit handshake, with no timer-based success condition. The native CI jobs execute both tests when the shell uses mimalloc. Existing JSC stress configurations remain unchanged.

This builds on Dylan Conway's diagnosis in #698, with contributor credit preserved. Invalidation alone leaves the already-loaded-key window open; the in-flight regression fails on that version as well as the original allocator.

Validation:

• Matched Linux ARM64 and x64 owner capture: original code has 2/1,200 and 1/1,200 invalid-mutex failures respectively; corrected code completes 1,200/1,200 cleanly on each architecture. Captures verify the reused key's sequence/destructor, allocator heap/TLS relationship, and exact ParkingLot mutex address.
• Unmodified-source diagnostic independently reproduces ordinary glibc aborts on both architectures.
• Native macOS ARM64: both regressions pass; standalone AddressSanitizer and ThreadSanitizer checks pass; 1,778 stress variants, 1,639 module variants, assembler/FFI, and five accounting/sampling modes pass.
• Exact-head fork qualification is green on the release line, main, and native Linux ARM64. The upstream native regression targets also build and pass on macOS ARM64.
• Scoped P2 review is clean.

The matched diagnostic retains the same 1 ms post-teardown scheduling window and pre-glibc trap in both arms. Neither diagnostic change is in this PR.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 24ffbcac-37da-4cb7-b1d3-0c9e29e9c1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 5718a6e and 3e9e911.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• Source/JavaScriptCore/shell/CMakeLists.txt
• Source/bmalloc/mimalloc/mimalloc/src/prim/unix/prim.c
• Source/bmalloc/mimalloc/test-exit-in-flight.c
• Source/bmalloc/mimalloc/test-exit.c

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

Walkthrough

The pthread TLS-key shutdown path now blocks new setters and waits for active setters before deleting the key. Two regression tests cover shutdown and thread-key association. CMake builds the tests, and CI runs them in eligible lanes.

Changes

Mimalloc TLS shutdown

Layer / File(s)	Summary
TLS setter admission and shutdown Source/bmalloc/mimalloc/mimalloc/src/prim/unix/prim.c	Shutdown closes admission to thread-key setters, waits for active setters to finish, and avoids deleting the key again on repeated shutdown calls. Setters return if shutdown has begun.
Exit regression scenarios Source/bmalloc/mimalloc/test-exit.c, Source/bmalloc/mimalloc/test-exit-in-flight.c	The tests check pthread key reuse after allocator shutdown and key deletion while a worker’s thread-key association is paused.
Build and CI integration Source/JavaScriptCore/shell/CMakeLists.txt, .github/workflows/ci.yml	CMake builds both tests when mimalloc and UNIX are enabled. CI runs them after a successful shell artifact download, except on Windows, debug, and ASan lanes.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 3e9e9

No demonstrated issue prevents merging, but the exit tests and CI integration should receive normal build and test checks before merge.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: preserving pthread-key ownership during process exit.
Description check	✅ Passed	The description gives a detailed explanation of the bug, the fix, and validation results. It does not include a Bugzilla issue link, a “Reviewed by” line, or the template’s changed-file entries, but t…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

_{Comment @coderabbitai help to get the list of available commands.}