radlink: drain shared barrier workers before reusing pass state (follow-up to #842)

[honkstar1]

September 8 refresh

This block supersedes older base-revision and validation notes below.

• Head: bec87b6924c6ef12367684b1c2d23a977dfff91b.
• Updated dependency/base: refreshed radlink: performance, memory, IFC/GDK fixes (refreshed on dev@47de6bf3) #842 (ad4d2169), including dev 47de6bf3; no radlink: portable compressed OBJ support (restacked on #842) #892/radlink: compressed debug relocation windows and cache cleanup (stacked on #892) #932 layers. The PR still targets upstream dev.
• Incremental review: ad4d2169...bec87b69.
• Local validation: Clang/LLD 20.1.8, Release -O2; 178 passed, 0 failed/crashed, 1 excluded in linker/* torture/* base/* eval2/*. Exclusion: ms_link_icf_section_flag_eligibility (the previously noted Microsoft-linker comparison). These counts were revalidated after the portability correction; no farm/runtime-soak result is claimed.
• Linux follow-up: CI exposed missing internal linkage on lnk_obj_dist_weight_is_before after the C99 portability refresh. This is corrected in radlink: performance, memory, IFC/GDK fixes (refreshed on dev@47de6bf3) #842 and inherited by all dependent layers. Local Linux debug builds with Clang 18 and GCC 13 succeeded, and the GitHub matrix has been rerun for these heads.
• Updated with merge commits and fast-forward pushes only; no force rewrite. Existing draft status is unchanged.

The incremental feature change remains three files: the barrier-worker drain and its regression coverage. Compressed-object, memory-cleanup and separate #939 changes were not folded into this PR.

Older text is retained below for historical context. Already-integrated upstream changes are behind the refreshed merge base rather than new standalone fixes in this refresh.

---

Scope and review order

One-commit correctness follow-up to #842. Review the incremental change here:

Diff against #842: 1 commit, 3 files, +27/-9.

This fixes the shared governor/barrier implementation introduced by #842. It does not depend on the compressed-object or later optimization PRs. GitHub targets EpicGames:dev because the dependency branch is in a fork, so the default Files changed view also includes #842. Please apply this follow-up after #842, or fold commit 7000a421 into that PR. #842 itself is unchanged.

Current merge status (September 4): GitHub reports conflicts against dev@706abca6. A local merge-tree check of both #842's head and this head reports the same ten conflicting files. The dependency stack needs an upstream refresh before direct merge; this PR intentionally keeps that separate from the one-commit correctness fix. No upstream CI result is claimed for this conflicted stack.

Problem

For a shared barrier pass, the last task posted main_semaphore before its background worker left tp_run_tasks_shared. The dispatcher could consume that notification and return while a worker was still about to read/decrement the task queue. A subsequent pass could then reset the queue or change the pass kind underneath that worker.

Ordinary governor dispatch already drains its outstanding grants before returning; task completion alone did not provide the equivalent guarantee for barrier dispatch.

Fix

• Initialize an atomic countdown for the barrier pass's woken background workers.
• Each worker acknowledges completion after leaving the task loop; the last worker posts the existing completion semaphore.
• Main leaves its own task loop and waits for that acknowledgement before returning or ending the cohort.
• Extend shared_pool_governor_repeated_passes to exercise four consecutive barrier passes per bracket, followed by ordinary governor dispatch, across 96 iterations.

No new semaphore, thread, polling loop or allocation. Normal governor scheduling, the cross-process budget protocol, cleanup options and stall assertions are unchanged. The added work is one counter initialization and one atomic decrement per woken worker per barrier pass. Waiting for a delayed worker is intentional: its previous early handoff was unsafe.

Validation

Fresh builds of this exact PR head (7000a421), using LLVM/Clang/LLD 20.1.8:

Configuration	Passed	Failed / crashed	Excluded
Release	158	0 / 0	12
Debug	158	0 / 0	12

The 12 exclusions are existing MSVC-invoking cases; no MSVC compiler/linker/assembler was used. These are local supported-subset results, not a claim that the full upstream CI matrix passes.

Additional validation of the identical patch in combined development commit 348ae713:

• An investigation-only scheduling hook paused the last background task before its next queue read. The old dispatcher returned while the worker was paused (probe failed); the fixed dispatcher waited (probe passed). The hook is not in this PR or the supplied binary. The committed test provides repeated-transition coverage without timing thresholds.
• Release and Debug: 163 passed, 0 failed/crashed, 12 excluded in each.
• A real shader-module link with compressed objects passed with one-shot cleanup both enabled and disabled; DLL/PDB bytes matched the previous binary's outputs.
• Small Windows A/B test, 12 interleaved links per version, four workers, isolated shared pool, identical flags: median process lifetime 151 ms before / 149 ms after; observed peak working set ~71.6 MiB and process commit ~222.6 MiB for both. This detects no regression in that small test, not a speedup or a large-link/Wine performance guarantee.

Investigation was prompted by rare 0xc000001d failures under Wine, but there is no dump/fault address and this has not been established as their cause. No Linux/Wine/UBA or large-link soak validation has been performed for this fix. This PR corrects the independently reproduced handoff race; it does not disable assertions, extend timeouts, or claim to resolve every farm failure.