profile: drop nested timer callbacks

Author: Frityet

notes/profile-lifecycle-mt.md

@@ -13,6 +13,11 @@ active callback to leave, then clears callback data and the shared stack-dump
 buffer. Stale profile hooks check that the active profiler still belongs to the
 current VM before loading callback state.
 
+Callback delivery is single-entry across both profiler backends. The TG-local
+signal path and the non-TG-local timer-thread path CAS the callback count from
+zero to one before invoking user code; nested or concurrent samples are dropped
+instead of recursively entering callback state.
+
 The Lua `jit.profile.start()` wrapper first stops any old same-VM profiler
 session, clears old registry anchors, anchors the new hidden callback coroutine
 and Lua function in the registry, and only then starts the C profiler. The timer

src/lj_profile.c

@@ -146,24 +146,24 @@ static LJ_AINLINE int profile_state_active_g(ProfileState *ps, global_State *g)
 	 profile_g_load_acq(ps) == g;
 }
 
+static void profile_callback_leave(ProfileState *ps);
+
 #if !LJ_PROFILE_TGLOCAL
 static int profile_callback_enter(ProfileState *ps, global_State *g)
 {
+  uint32_t old = 0;
   if (!profile_state_active_g(ps, g))
     return 0;
+  if (!la_cas32(&ps->callbacks, &old, 1, LA_ACQ_REL, LA_ACQ))
+    return 0;
   la_store32_rel(&ps->callback_tid, lj_thr_current_id(g));
-  (void)la_add32_rlx(&ps->callbacks, 1);
   if (profile_state_active_g(ps, g))
     return 1;
-  if (la_sub32_acqrel(&ps->callbacks, 1) == 1)
-    la_futex_wake(&ps->callbacks, INT_MAX);
-  la_store32_rel(&ps->callback_tid, 0);
+  profile_callback_leave(ps);
   return 0;
 }
 #endif
 
-static void profile_callback_leave(ProfileState *ps);
-
 #if LJ_PROFILE_TGLOCAL
 static int profile_callback_tryenter(ProfileState *ps, global_State *g)
 {