radlink: perf + feature series — ICF/ICFSTATIC, GCTYPES, header-units, link-time + memory (rebased on dev, taken commits dropped)

[honkstar1]

What this is

The remaining radlink perf + feature contribution as a curated, reviewable series: 83 commits on top of dev (base c817d1f1), everything you've already taken dropped. History has been cleaned for review — iterative churn squashed (101 → 83; every "add X, then rework X" pair collapsed so each feature lands in its final shape), every commit message states what/why, the measured numbers, and how it was gated. Cherry-pick whatever you want; nothing here depends on being taken wholesale.

Everything was measured on UnrealEditorFortnite-Engine.dll (~751 MB DLL / 4.6 GB PDB, 20M+ type leaves, 64 workers, /OPT:ICFSTATIC /BREPRO). Perf numbers come from GetProcessTimes CPU, per-phase timers, and Superluminal captures — never wall-clock alone. Every change was gated on DLL byte-identity (back-to-back control links diff only in the ~18-byte /BREPRO timestamp/GUID band, all other bytes 0), per-stream PDB equality, and run-to-run determinism — except where a commit's whole point is to change bytes, and those say so in their messages.

Headline results (cumulative over the series, editor-scale link)

Area	Result
/OPT:ICF + /OPT:ICFSTATIC	.text 727→643 MiB, DLL −117 MB, PDB −481 MB; with the COMDAT-leader keying fix .text 623→536 MiB (−82.56 MiB, below link.exe)
Single-link wall	20.9 s → ~14.3 s over the campaign (64 cores)
Link CPU	~−35% total; largest single wins: symbol-name memo −63.8 s (−14.8%), ifc_redirect bitset filter −54.5 s, leaf-hash XXH3 −24 s, dedup-table sizing −25 s kernel, lib-search skip cache −10.4 s
Page faults	dedup-table sizing alone −866 K faults; KiPageFault inclusive 238 s → 155 s across the series; commit-prefault removal −2.0 M faults, −5.9 GB resident per link
Farm fault storms	4-concurrent convoy proxy: sum kernel 1330→535 s (−60%), max wall −37%; production FN build after deploy: 95-link stall window 83.5 s span → 8.9 s, kernel sum 1819 → 406 s
Commit charge	input views now map read-only: peak pagefile commit 50.9 → 28.8 GB (−22.1 GB) per link; 4-concurrent aggregate 205 → 116 GB — headroom for farm memory admission (80/90% gates)
Correctness	shared-pool PDB lane-drop fixed; schedule-dependent symrec order fixed; ICF unwind/handler over-fold fixed (your report); C++ header-units (LF_IFC_RECORD 0x1522) merge correctly instead of silently corrupting TPI

---

Correctness fixes

These are the commits I'd prioritize.

1. /OPT:ICF over-fold drops exception handlers — inside e9fff7f7 (your report)

The fold decision ignored COMDAT-associative .pdata/.xdata: two functions with byte-identical bodies but different exception handlers folded, and the follower's handler was silently dropped via associative dead-stripping. Fix: a candidate's non-debug associative children are gathered (recursively, cycle-guarded, deterministic per-obj order) and hashed into the ICF content key, their relocs join the candidate's reloc slice so refinement class-compares them, and fold-verify checks them pairwise before any fold. Identical code with identical handler/unwind data still folds, matching link.exe. Squashed into the /OPT:ICF commit so the series never presents the broken behavior.

• Repro included (funcs.s): MSVC keeps 3 RUNTIME_FUNCTIONs; the broken fold produced 2. Before: fold accepted (exit 105); after: refused (exit 5); positive control (identical handlers) still folds (exit 2), matching link.exe.
• Cost at editor scale: .text +318,544 bytes (+0.058%) from legitimately refused folds; CPU within noise. Still below MSVC .text.

2. /RAD_SHARED_THREAD_POOL silently loses PDB symbols under overlap — d988d84d

lnk_move_global_symbols_to_gsi indexed two fixed-width partitions (cv->symbol_input_ranges, symtab->chunks) directly by task_id. When the fair-share governor grants a cohort C < worker_count — i.e. whenever parallel links overlap in one shared pool — lanes [C, worker_count) were never visited: globals, publics, and proc-refs silently vanished from the PDB (observed: PDB 22.66 MB deficient — SYMREC −20.86 MB, PSI −1.40 MB, GSI −0.38 MB; e.g. missing public ??_C@_0O@CEGDGJCA@WidthOverride@). Fix: stride the fixed partitions by the cohort so every lane is processed exactly once for any C; at full cohort this degenerates to the old indexing (verified output-neutral: DLL 0 diff bytes, all 8247 PDB streams identical). Overlapped runs at observed C=30/C=32 now produce DLL+PDB per-stream identical to an isolated full-width link. All other barrier passes audited — they size partitions inside the bracket already.

3. Same-name global symbol order is schedule-dependent — 1f5c781f

Pre-existing and independent of the shared pool: the per-bucket GSI sort tie-broke same-name symbols on their dedup-table slot index, which is CAS-arrival order — same-name records with different content (duplicate S_UDTs with distinct TIs) could swap positions run to run. Fix: tie-break on a content hash of the raw record, so symrec order is a pure function of record bytes. PDB re-baseline #1: this reorders same-name groups (SYMREC/GSI/PSI streams only, sizes unchanged, DLL untouched); re-gated with isolated back-to-back relinks and 4/4 overlapped shared-pool links all per-stream identical.

Related robustness (small, standalone): 8e092551 unresolved-symbol reports printed garbage file/line references -- reloc apply_off was matched against an obj-wide lines accel built from unrelocated .debug$S, where every per-function COMDAT fragment reads sec_off 0, so all fragments overlap and the match is arbitrary (wrong files, :0 lines, several bogus rows per reloc); now mapped through the function's own associated .debug$S with a preceding-row lookup and duplicate collapse -- one reference, the right line; refs without line info (vftables/RTTI) name the section’s COMDAT symbol (??_7Foo@@6B@+8) instead of a raw section number. b509daba unknown /RAD_* switches now warn visibly and are ignored — previously the warning was muted by the release-default /RAD_IGNORE, so a stale binary silently dropped a requested mode with no trace in the build log; the warning is deliberately not a hard error so newer build scripts keep working against older radlink binaries (forward compatibility); also aliases RAD_TYPEHASHALG to the misspelled RAD_TPYE_HASH_ALG table entry — the spelling UnrealBuildTool actually passes. 29080fdd arena reserve/commit failure is a clean fatal: out of memory + exit instead of an AV — flagged for review: base_arena.c is shared infra (intentionally minimal: result checks + one early-out).

---

Features

/OPT:ICF + /OPT:ICFSTATIC (3 commits: e9fff7f7, 4aa92ad8, 956e059e)

Identical-COMDAT folding (code + read-only data), fully parallel, fold-verified by byte-compare + per-reloc target-color check so no hash collision can produce a bad fold. .text 727→643 MiB, .rdata 218→194 MiB, PDB 5562→5081 MB, DLL 999→882 MB, link time −13 s. /OPT:ICFSTATIC extends folding to internal-linkage COMDATs: DLL 925→844 MB.

C++ header-units / IFC (f5435d9c + perf follow-ups)

MSVC header-unit objs carry LF_IFC_RECORD (0x1522) placeholder leaves radlink couldn't merge — the TPI was silently corrupted and VS crashed on inspect (WrapSymbol AV). The fix resolves debug records from the .ifc's .msvc.trait.debug-records CV blob through the existing merge pipeline: BAD leaf count 921→0, 44/44 sampled types name-match MSVC output, validated by live editor boot + breakpoint/step. The same commit keys ICF non-candidate Regular COMDAT targets by their resolved leader (not per-obj identity), which is the .text −82.56 MiB result above — equivalent sections previously failed to fold whenever their targets resolved to different objs' copies of the same COMDAT.

/OPT:GCTYPES (3 commits: 024f1ed1, 1978c60a, ef3bd0a7)

Garbage-collects CodeView types unreferenced by any surviving symbol before PDB emit: PDB 5315→5081 MB (−234 MB). Shipped opt-in, default OFF — a GC'd type is unavailable to debugger watch-window casts of the form (SomeNeverReferencedType*)ptr, which is a real (if rare) debugging pattern; the switch exists for size-sensitive links.

/RAD_SHARED_THREAD_POOL (507244e4, absorbs #847)

Cross-process shared worker budget: a governor grants slots fairly across concurrent radlink processes (fair-share cohorts for barrier passes), capping total running workers near core count during farm convoys instead of workers × links oversubscription. Dual-path: without the switch the upstream barrier implementation runs verbatim. Soaks: 3216-link and 12K-link runs, zero hangs. This series absorbs the #847 commits — if you take this PR, #847 is redundant.

Switch / env summary

Switch	Default	Purpose
/OPT:ICF, /OPT:ICFSTATIC	off (opt-in)	COMDAT folding
/OPT:GCTYPES	off	CodeView type GC
/RAD_SHARED_THREAD_POOL:<name>	off	cross-process worker budget
unknown /RAD_*	warns, ignored	visible warning + link continues (forward compat; was silently-muted warning)
RADLINK_PHASE_LOG (env)	off	machine-parseable per-phase micros (diagnostic)

---

Performance (single link)

Each commit message carries its own measurement and gate note; the groups below are reading order, with the headline number per group.

ICF refine/fold (12 commits)

b66873a6 skip converged classes → 7cd878ec parallel round-loop in one persistent worker region (ICF ~35 s → 22–23 s) → 63379963 dirty-class worklist tail (lands default-off; first reverse index was 10 GB) → 63379963 re-enabled via 9.3× smaller reverse index (refine exclusive 68.2→28.1 s) → ce9ab472 seed from final-round splits + parallel reverse-index build (tail 2507.9→160.7 ms) → 8d48a4b6 parallel dirty-loop + region cap 8→4 (region+tail 879.8→518.7 ms) → 1b50b080 freeze all-inert classes (30.4% of actives leave refinement; →454.7 ms) → 1eaf5249 4-way refine interleave (region →334 ms) → 7374ceba key0 blake3→XXH3 (−8 s CPU; probabilistic-identity, partition proven identical at editor scale) → 1d298826 fold-apply staged into parallel verify (main-thread 778.5→79.3 ms) → plus c0d90db0, 0737f1f0. Net: refine ~880 → ~334 ms, roughly −40 s CPU across the worklist/refine work.

Type merge + PDB build (16 commits)

21ce8686 size dedup tables from a deterministic distinct-count estimate — TPI table 536M→67M slots, −866 K faults, −25 s kernel → b44e5e05 sample the estimator (182.6→38 ms) → 0d23caa2 leaf hashing blake3→XXH3 (−24 s CPU; PDB re-baseline #2: RRT format v2→3 with explicit hash_alg tag, caches rebuild once; forced back to blake3 automatically when .debug$H/RRT blake3 hashes are in play) → 5d4673ac static TI-offset descriptor tables (−5.3 s) → d988d84d GSI/PSI inserts sharded by bucket range (order-preserving, kills the task-0 serial funnel) → 344b9472 GSI insert balance + parallel compaction → 723bdf2e greedy-LPT obj distribution (Write Modules −12%) → 19ae680b parallel DBI section-contrib radix sort (157→28 ms, permutation-identical) → cb3c6053 coalesce DBI contribs 12.5M→2.0M (stream 367→72 MB) → plus 7d32fb1d, 8f8f2ef3, a892609c, 3c184f7b, 5f9614bb, 4e020dd7, 75021a47.

Symbol table / lib search / COFF parse (14 commits)

95a49a57 symbol-name length memo + _no_name accessors — names were being NUL-scan decoded per reloc across REF/ICF/resolve/patch: −63.8 s user CPU (−14.8%), the biggest single win of the campaign → 3e05dd25 + 3eedb35e parsed-symbol memo, slimmed and packed to 16 B (−2.1 GB peak) → 2edfd9f3 lib-search resolved-slot skip cache (−10.4 s) → 18cc2baa per-lib frontier cursor (lib-search phase 11.6→6 s) → cfbf5711, b67fc5f8 interp caching + redundant re-search elision → 8ebdd8ba packed-discriminator bsearch pre-filter → plus 7c6a858a, fbca33ce, 9c64504f, b23be588, a257375e, 05138390.

/OPT:REF (2 commits)

4fcabfbe memoized reloc-symbol resolution, flat visited sets, TTAS is_live; 98c23d07 parallel unreachable-section removal. REF phase −46%.

IFC apply (3 commits)

4dd80468, 729aeebe, 972aaa47: parallel discovery/read/parse/resolution with order-preserving replay (apply 4.3 s→~0.9 s) + exact per-obj bitset filter on ifc_redirect_hm (−54.5 s user CPU — the redirect map was probed per TI across all workers).

Memory peak + CoW-input hygiene (14 commits)

Input objs are FILE_MAP_COPY views; anything that writes them privatizes pages — soft faults during the link, a dirty-page rundown at teardown (46.7 s thread-time before this work), and lost cross-process page sharing on the farm. b62272a7/ff480397/abbc2d55/5e09a4ad keep input pages clean (reloc patching, TI fixup, /PDBSTRIPPED, exit unmap); 8dc958c5 background-releases scratch free-list blocks (decommit barrier 866→45 ms); 4783d22f background arena reaper; f251e96d 2 MB commit quantum (−90% MEM_COMMIT calls); plus c594e917, e7a0e5ef, e8d041be, db71a5b7, b9836b13, 0211c919. KiPageFault inclusive 238→155 s across the series. One negative result recorded honestly in 4783d22f: parallel chunked MEM_DECOMMIT is slower than serial (kernel address-space lock) — the reaper keeps it serial, just off the main thread.

72ce8a48 completes the arc: input views now map FILE_MAP_READ from the PAGE_WRITECOPY section instead of FILE_MAP_COPY, so an untouched view carries zero pagefile commit (FILE_MAP_COPY charges the entire view at map time — 22.4 GiB of a 49.7 GiB peak on the editor link, ×N for concurrent links). The few remaining in-place input writers are handled by a one-call VirtualProtect bulk promote on the known hot range (obj section-header patching, ~240 K pages — per-page faulting there cost ~25 s kernel) plus a vectored-exception fallback that promotes single faulting pages (~3.9 K pages/link; also the safety net for any future in-place writer). First-linker-member big-endian offsets convert on a private copy instead of dirtying archive pages. Measured: peak commit 50.9 → 28.8 GB single link, 205 → 116 GB aggregate over 4 concurrent (whose walls also dropped ~30% on a 192 GB box — the 4×51 GB commit demand was itself the pressure), wall/user/kernel parity single-link, outputs byte-identical, READ_WRITE/no-map modes untouched, same classic Win32 APIs under UBA detours.

Image write / misc (4 commits)

ab5e29d0 parallel align-byte first-touch fill, 2095cbef reloc apply sorted by offset, 154c1e59 non-temporal stores, ba64cb61 false-sharing pads.

---

Farm fault-storm mitigations (3 commits)

Production telemetry (from the summary line below) showed 100+ concurrent links convoying on kernel page-fault work: dbg phase 682 s kernel vs 303 s user, mcvi alone trapping 42M faults; in a 96-concurrent storm the pdb phase paid 125 µs/fault vs 2.3 µs post-storm (54×) for the same fault count — physical-memory exhaustion pushing commits onto the page-repurpose path.

• 89ed96e8 + 89ed96e8: batch PrefetchVirtualMemory of mapped .debug$S/$T before the first-touch walks, fanned over the pool. 4-concurrent convoy proxy: sum kernel 1330→535 s (−60%), max wall 57.5→36.5 s (−37%); pure paging hint, byte-neutral, silent fallthrough pre-Win8.

• 34c040e3: stop prefaulting every committed page. commit_memory ran RIORegisterBuffer+RIODeregisterBuffer over each committed range as a batched prefault trick — registration probe-and-locks every page, so every arena commit eagerly demand-zero faulted its full range, including pages never subsequently touched (the tail of each 512 MiB MSF page-data node, oversized table slots). The pdbg ini= bucket (prod SetThreadDescription doesn't appear to be respected #3 build-wide: 229 s wall / 195 s kernel / 44.5M faults over 681 links) was exactly this — the first MSF page-data node commit, 131,330 faults in a single push. Plain MEM_COMMIT + lazy first-touch faulting: single editor link pf 16.4M→14.4M (−12%), ws peak 51.4→45.4 GB (−5.9 GB), ini= 132 K faults→0; 4-concurrent convoy proxy max wall 62.1→28.5 s (−54%), sum kernel 1963→710 s (−64%), ws −5.5 GB per link. Byte-identical output (4-way base/head cross), determinism ×2. Flagged for review like the other win32_base.c change: shared infra, 3-line mechanical removal.

  Why this deserves attention: the RIO trick is base-layer code shared with the debugger, and there it makes sense — an interactive tool that fully uses its allocations wants ranges populated up front in one syscall rather than faulting on hot paths (and it predates PrefetchVirtualMemory availability). The trade inverts for the linker specifically: huge worst-case commits (512 MiB MSF nodes, estimate-sized tables) whose tails are never touched, times N linkers running concurrently on a build machine — eager population turns unused address space into resident memory and serialized fault storms. If the debugger wants the old behavior, this could become a per-tool policy flag instead of a removal; for link workloads the lazy path is strictly better (measured above). A NOTE at the site explains the history so it doesn't get reinstated unknowingly.

After deploying the prefetch round on the production FN build: the 95-link stall window collapsed from an 83.5 s span to 8.9 s, kernel sum 1819→406 s.

Telemetry (3 commits)

449fe37c opt-in one-line [radlink summary] (v=3), behind /RAD_LOG:Summary: wall/user/kern/ws/pf, cm= peak pagefile commit (what farm memory admission gates on), cowp= CoW-promoted page count (a regression canary — a new in-place input writer shows up as a page-count spike before it costs kernel time), t0=/t1= overlap timeline, per-phase wall/user/kernel/faults quadruples with dbgg[]/pdbg[] sub-buckets and other= residuals (local cross-check: sum + residual == phase within 0.2%), mem= available-physical samples, io=, pool grant_avg/park, procs=n/peak via a named semaphore (UBA virtualizes named sections per-process; semaphores pass through). The shared-pool cross-process counter detach runs unconditionally on every exit path — it is the only decrement site. This line is what found every storm above from build logs alone. 7f275912 ICF timers, 08770c43 env-gated phase log. All stdout-only, byte-neutral.

Debug fidelity under /OPT:ICF (2 commits)

A per-stream diff against a link.exe PDB of the same editor DLL showed the linkers agree on content except for ICF-folded functions: link.exe keeps every folded body's full record tree + line table (~29% of its module bytes here), radlink dropped everything — so a source or name breakpoint on any folded-away function (1.14M names on the editor DLL measured) silently failed to bind.

bbcbd014 publics: publish under the trie node's name. A folded external's node points at the leader's symbol while node->name keeps the folded name; emitting symbol->name produced the leader's name once per follower — ~1.4M byte-identical duplicate S_PUB32 (213 MB) on the editor DLL — and no publics at all for folded names. With the node name, each former duplicate becomes a distinct alias public at the leader address (name breakpoints bind), and an adjacent-duplicate guard drops any residual exact copies. Public count is byte-for-byte conserved: 3,044,475 before and after on the gate DLL — every duplicate replaced 1:1 by an alias.

218a0236 lines + watch-window labels: external folds are recorded in the per-section fold map (tagged is_extern, excluded from /OPT:REF's redirect paths), dead followers' sect_map entries redirect to the leader contrib, and each folded function's associated .debug$S is kept Lines-only: reloc-patched (the SECREL/SECTION pair resolves to the leader RVA through the aliased symbol) and merged into its module's C13 — symbol records stay dropped, which is the bulk of link.exe's cost for the same feature. Source breakpoints (F9) on folded bodies bind and hit at the shared address, same behavior as link.exe. Folds that join a different source location (source identity = FILECHKSMS content hash + first line of the function's Lines fragment, compared follower-vs-leader in the mark pass, O(1) per fold) and have locals escalate to the full record tree — so a folded frame's Locals panel shows that source's own variable names, like link.exe. Measured ~6.5% of folds differ in source and most of those are empty virtuals, so the escalation set is small.

Cost on the 408 MB gate DLL, all three commits together: PDB 2896.7→3023.1 MB (+4.4%: +25.6 MB folded Lines, +23 MB alias publics, +48.8 MB escalated record trees + their global refs — the 213 MB duplicate-publics removal offsets most of it; link.exe pays ~688 MB of module bytes for the same behaviors on the editor DLL). DLL byte-identical with and without the change; PDB deterministic across runs; minimal-repro validated (two identical functions in two objs, different files: both names public at the shared RVA, both source files' lines present, follower's own proc/locals tree in its module).

---

Validation discipline

• Byte-identity gate on every commit: base/head/base A/B with a same-binary control; diffs must be confined to the ~18-byte /BREPRO checksum/GUID band, OTHER=0. Gate scripts delete /OUT+/PDB between runs (a crash leaving a stale output once produced a false byte-identical).
• Per-stream PDB comparison (all ~8247 streams, sizes + SHA256) — the PDB embeds the /OUT name, so comparisons always use identical output names.
• Determinism: head×2 relinks; the two intentional PDB re-baselines are called out above (symrec ordering 1f5c781f; leaf-hash/RRT 0d23caa2) and each was re-gated after baselining.
• ICF: refuse/fold repro suite (unwind over-fold, exit 5/2 + link.exe parity) on every ICF commit; a selfcheck link mode asserts partition equality against the reference refinement path.
• Shared pool: 3216-link and 12K-link soaks, zero hangs; overlap regression (2- and 3-way) with per-stream PDB equality vs isolated full-width links; old/new exe coexistence on one pool name.
• Production: the summary line ran on real FN farm builds (504-link and 247-link jobs); the storm numbers above are from that telemetry, and the prefetch round's effect was confirmed on the next production build.
• Series tip is tree-identical to the integration branch validated at editor scale (live editor boot + debug + step).

Known issues / notes

• /PDBSTRIPPED at editor scale AVs at baseline (pre-existing, reproducible before this series; not addressed here).
• ICF fold-verify byte-compares candidates, but reloc targets class-compare via 64-bit key0 colors; a 64-bit collision between never-splitting candidates could in principle fold a wrong caller transitively. Pre-existing property of the key truncation, unchanged by this series (XXH3 swap keeps the width) — noted for awareness.
• 75021a47 (parse-time leaf prehash) is CPU-neutral on this workload (PCH consumers dominate) — kept as a hedge for /Z7-heavy inputs; the message says so plainly.