arena: a zero-claim purge debits the committed stat the next allocation credits again (re-land of 74086412)

[robobun]

Re-land of 7408641 (reverted in 13eecae). Why the revert's objection no longer applies is under Fix.

Problem

• On Linux the committed stat grows by the size of every purge/reuse cycle and never comes down. 16 x 1 MiB blocks, freed and taken again, read 18 MiB, then 35, 51, and 149 MiB after 8 rounds. bun printed 28 GB "committed" against 0.6 GB resident after 8.8 days (abort() after 8.8 days in a standalone executable: Commit 28 GB with RSS 0.6 GB (4.4k spawns, idle-heavy) bun#42652). test-stress reported 15 GiB against a 171 MiB peak RSS.
• mi_arena_try_alloc_at (src/arena.c) credits a fully committed range by the slices it hands out for the first time (the dirty bits). A zero-claim purge (MADV_DONTNEED) keeps the range committed, so _mi_os_purge_zero debits nothing, then clears the dirty bits. The next allocation credits the same slices again.

Fix

• mi_arena_purge debits the slices it un-dirties, under the condition the allocation uses to credit them: the range stays committed, was fully committed, and mi_arena_stat_on_dirty holds (an eagerly committed arena, on an OS with overcommit, not pinned).
• 13eecae reverted 7408641 because the debit walked committed below zero: a slice debited twice and credited once. Two paths did that. An allocation that does not ask for commit (page_commit_on_demand) on a committed range credited nothing. And a range committed in part (MIMALLOC_ARENA_EAGER_COMMIT=0, or a Debug build, where a purge decommits) credited only the slices it committed while the purge debited the whole range. Both now credit what the purge debits: the first through mi_arena_stat_touched, the second by counting the clean slices among the committed ones. An arena that is not committed up front is counted on its commit bits alone, as upstream does.
• Verified: test/test-purge-committed.c, run by ctest with the defaults, MIMALLOC_PAGE_COMMIT_ON_DEMAND=1, and MIMALLOC_ARENA_EAGER_COMMIT=0. Before: 4 of 4 checks fail. After: pass in Release and Debug (MI_DEBUG_FULL), full ctest passes in both. test-stress: peak commit 250 MiB, peak RSS 180 MiB.

Background

• mi_arena_reserve mmaps an arena read-write up front on Linux (eager commit). The OS backs a page the first time it is written, so the reserve is not counted as committed. A slice is counted when it is handed out for the first time.
• slices_dirty records which slices were handed out since the arena was mapped or since the last zero-claim purge. The purge clears it so that the next mi_zalloc of the range can skip its memset.
• slices_committed is the commit state. On Linux release it is set for the whole of an eager arena at reserve time and stays set: MADV_DONTNEED needs no recommit. The decommit path debits on that bitmap, so it debits nothing here.

Notes

The stat for a slice of an eagerly committed arena under overcommit reads: counted if the commit bit and the dirty bit are both set. Every transition of that pair is accounted for:

• dirty 0 to 1 with the commit bit set: credit (mi_arena_stat_touched, all four allocation branches).
• commit 0 to 1 with the dirty bit set: credit (_mi_os_commit_ex, and the commit bits set at page free for a page committed on demand).
• dirty 1 to 0 with the commit bit kept: debit (the zero-claim purge).
• commit 1 to 0 with the dirty bit set: debit (_mi_os_purge_* when it decommits, and the no-commit allocation of a range committed in part, which now skips the slices that were not counted).

An arena that is not committed up front is counted on its commit bits alone. On Linux release a purge keeps those set, so its stat is a high-water mark: bounded by the arena size, never below zero. The test requires the stat to come back down after a purge only where it can: Linux, with eager commit.

(A) only run, MIMALLOC_PAGE_COMMIT_ON_DEMAND=1:

  16 x 64 KiB round 0: held 1344 KiB, after purge 320 KiB (base 1344 KiB)
  16 x 64 KiB round 7: held -5824 KiB, after purge -6848 KiB (base 1344 KiB)

First revision of this PR, MIMALLOC_ARENA_EAGER_COMMIT=0, growing blocks:

  1 MiB: held +512 KiB, after -512 KiB
 16 MiB: held +640 KiB, after -15744 KiB