Read the batched remote free ring's length word without domesticating it

[Sebastian Blessing (sblessing)]

Fixes #876.

Problem

BatchedRemoteMessage::mk_from_freelist_builder() closes the free ring by storing a bit-packed (displacement << MAX_CAPACITY_BITS) + length word in the ring's next field. On the receiving side, open_free_ring() and ring_size() read that word back through freelist::Object::T::read_next(), which passes the decoded value through the config's domesticator as if it were a pointer.

A domesticator that does its job and rejects anything outside the heap (FixedRangeConfig::capptr_domesticate() returns nullptr for out-of-range addresses) turns the word into 0. Every incoming ring then decodes as length 0, the slab's needed count is never decremented, and every batched remote deallocation is leaked. With FixedRangeConfig a fixed region is exhausted by remote frees alone even though the program frees everything it allocates. The default StandardConfig has an identity domesticator, which is why the mainstream configuration was unaffected.

Fix

• Add freelist::Object::T::read_next_raw(), which undoes the free-list encoding of the next field but does not domesticate the result. Per Nathaniel Wesley Filardo (@nwf)'s review comment on the issue, read_next() is now defined as domesticate(read_next_raw(...)), so the difference between the two is the single domestication call.
• open_free_ring() and ring_size() read the ring word with read_next_raw(). The pointer derived from the displacement is still domesticated separately, as before.

Test

src/test/func/fixed_region_remote_dealloc adds the reproducer from the issue to the test harness: allocator A allocates 64-byte objects from a 32 MiB FixedRangeConfig region, allocator B frees them and flushes, for twice as many rounds as would be needed to exhaust the region if the remote frees were lost. On the unpatched tree it aborts in round 8144 (the whole region leaked); with the fix it completes.

Existing fixed_region, fixed_region_alloc and domestication tests still pass in both the fast and check flavours. domesticate_count in the domestication test drops from 5 to 4, since the ring word is no longer domesticated; that test does not assert on the count.

[Sebastian Blessing (sblessing)]

@microsoft-github-policy-service agree

[Matthew Parkinson (mjp41)]

LGTM, Nathaniel Wesley Filardo (@nwf) are you happy with this.

[Nathaniel Wesley Filardo (nwf)]

LGTM. Thanks again!