llvm-native-core 0.1.13

//! X86 Combined MemorySanitizer + ThreadSanitizer Runtime — Full Implementation
//!
//! ## MSan (MemorySanitizer)
//!
//! Detects reads of uninitialized memory. Every byte of application memory
//! has a corresponding **shadow byte** (1:1 mapping). Shadow bit = 0 means
//! initialized; bit = 1 (0xFF) means uninitialized. When origin tracking is
//! enabled, every 4 bytes of application memory map to a 4-byte **origin ID**
//! identifying the allocation site where the uninitialized value was created.
//!
//! Shadow propagation rules mirror every LLVM IR operation:
//! - `add`/`sub`: shadow = a | b (union)
//! - `mul`: shadow = (a & b) ? a|b : 0  (zero if any operand is zero-app)
//! - `and`: shadow = (a & b) | (sa & b) | (a & sb)  (bits from uninit operands)
//! - `or`:  shadow = (a & b) | (sa & b) | (a & sb)
//! - `xor`: shadow = a | b  (union)
//! - `shl`/`shr`: shadow = shift_left/right(s, amt)
//! - `select`: shadow = select(cond_shadow, t_shadow, f_shadow)
//! - `phi`: shadow = union of incoming shadow values
//! - `load`: shadow = load from shadow memory
//! - `store`: propagate shadow to shadow memory
//! - `call`: per ABI rules (args, return value)
//!
//! ## TSan (ThreadSanitizer)
//!
//! Detects data races: two accesses to the same memory location, at least one
//! is a write, from different threads, not ordered by happens-before.
//! Uses per-thread vector clocks and per-memory-location shadow cells.
//!
//! ## Origin Tracking (MSan)
//!
//! Origin is stored as a 4-byte ID in a separate origin map. The origin ID
//! encodes the allocation stack (chained). Origin = Shadow << 2 or separate
//! origin map depending on configuration.
//!
//! Clean-room behavioral reconstruction from:
//! - LLVM Language Reference (sanitizer intrinsics)
//! - compiler-rt sanitizer_common, msan, tsan documentation
//! - Published papers on AddressSanitizer, MemorySanitizer, ThreadSanitizer
//! - Intel SDM (signal handling, TLS, atomics)
//! - System V AMD64 ABI
//!
//! Zero LLVM C++ source code consultation.

// ============================================================================
// Imports
// ============================================================================

use crate::sanitize::{
    self, AddressSanitizer, InstrumentedAccess, MemorySanitizer, SanitizerConfig, SanitizerKind,
    ThreadSanitizer,
};
use crate::x86::{
    x86_calling_convention::X86CallingConvention, x86_register_info::X86RegisterInfo,
    x86_subtarget::X86Subtarget,
};
use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
use std::fmt;
use std::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicUsize, Ordering};
use std::time::{Duration, Instant};

// ============================================================================
// Common Constants
// ============================================================================

/// Granularity of MSan shadow: 1 shadow byte per 1 application byte.
pub const MSAN_SHADOW_SCALE: usize = 1;

/// Granularity of MSan origin: 1 origin entry (4 bytes) per 4 application bytes.
pub const MSAN_ORIGIN_SCALE: usize = 4;

/// X86-64 default shadow offset (matches compiler-rt on Linux x86-64).
pub const MSAN_SHADOW_OFFSET_X86_64: u64 = 0x0000_7FFF_FF80_0000;

/// X86-32 default shadow offset.
pub const MSAN_SHADOW_OFFSET_X86_32: u64 = 0x4000_0000;

/// Maximum origin chain depth (recursion limit for following origins).
pub const MSAN_MAX_ORIGIN_CHAIN: usize = 16;

/// TSan shadow cell replication factor: 1 shadow cell per N bytes.
pub const TSAN_SHADOW_GRANULARITY: usize = 8;

/// TSan history size per shadow cell (number of previous accesses stored).
pub const TSAN_DEFAULT_HISTORY_SIZE: usize = 2;

/// Maximum number of mutexes tracked simultaneously.
pub const TSAN_MAX_MUTEXES: usize = 65536;

/// Maximum vector clock entries per thread.
pub const TSAN_MAX_CLOCK_ENTRIES: usize = 1024;

/// Default flush interval for TSan race detection in milliseconds.
pub const TSAN_DEFAULT_FLUSH_MS: u64 = 100;

/// Maximum stack trace depth for error reports.
pub const MTSAN_MAX_STACK_DEPTH: usize = 64;

/// Default exit code when an error is detected.
pub const MTSAN_DEFAULT_EXITCODE: i32 = 77;

// ============================================================================
// MSan Shadow Constants
// ============================================================================

/// Shadow byte value for fully initialized memory.
pub const MSAN_SHADOW_INIT: u8 = 0x00;

/// Shadow byte value for fully uninitialized memory.
pub const MSAN_SHADOW_UNINIT: u8 = 0xFF;

/// Origin value indicating no origin (clean memory).
pub const MSAN_ORIGIN_CLEAN: u32 = 0;

/// Special origin value for memory poisoned after free.
pub const MSAN_ORIGIN_FREED: u32 = 0xFFFF_FFFE;

/// Special origin value for stack memory after return.
pub const MSAN_ORIGIN_STACK_UAR: u32 = 0xFFFF_FFFD;

/// Special origin value for heap memory.
pub const MSAN_ORIGIN_HEAP: u32 = 0xFFFF_FFFC;

/// Special origin value indicating the origin is chained.
pub const MSAN_ORIGIN_CHAINED: u32 = 0x8000_0000;

/// Maximum valid origin ID (user-allocated).
pub const MSAN_ORIGIN_MAX: u32 = 0x7FFF_FFFF;

// ============================================================================
// TSan Shadow Constants
// ============================================================================

/// TSan shadow cell: cleared/never-accessed.
pub const TSAN_SHADOW_EMPTY: u64 = 0x0000_0000_0000_0000;

/// TSan event type encodings stored in shadow cells.
pub mod tsan_event {
    /// Read access (plain, non-atomic).
    pub const READ: u8 = 0;
    /// Write access (plain, non-atomic).
    pub const WRITE: u8 = 1;
    /// Atomic relaxed load.
    pub const ATOMIC_RELAXED_LOAD: u8 = 2;
    /// Atomic relaxed store.
    pub const ATOMIC_RELAXED_STORE: u8 = 3;
    /// Atomic acquire load.
    pub const ATOMIC_ACQUIRE: u8 = 4;
    /// Atomic release store.
    pub const ATOMIC_RELEASE: u8 = 5;
    /// Atomic sequentially consistent load.
    pub const ATOMIC_SEQ_CST_LOAD: u8 = 6;
    /// Atomic sequentially consistent store.
    pub const ATOMIC_SEQ_CST_STORE: u8 = 7;
    /// Read-modify-write operation.
    pub const ATOMIC_RMW: u8 = 8;
    /// Atomic fence.
    pub const ATOMIC_FENCE: u8 = 9;
    /// Mutex lock acquired.
    pub const MUTEX_LOCK: u8 = 10;
    /// Mutex unlock released.
    pub const MUTEX_UNLOCK: u8 = 11;
    /// Thread created.
    pub const THREAD_CREATE: u8 = 12;
    /// Thread joined.
    pub const THREAD_JOIN: u8 = 13;
    /// Signal sent to handler.
    pub const SIGNAL_SEND: u8 = 14;
    /// Signal handler wait.
    pub const SIGNAL_WAIT: u8 = 15;
}

// ============================================================================
// Error Kinds
// ============================================================================

/// MemorySanitizer error kinds.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum MSanErrorKind {
    /// Use of uninitialized value (a load from uninitialized memory).
    UseOfUninitializedValue,
    /// Use of uninitialized value as a branch condition.
    UninitializedBranch,
    /// Uninitialized value used in a conditional.
    UninitializedCondition,
    /// Passing uninitialized value to a system call.
    UninitializedSyscallArg,
    /// Passing uninitialized value to memory deallocation.
    UninitializedFree,
    /// Memory leak detected (uninitialized pointer to allocated memory).
    MemoryLeak,
    /// Double free using an uninitialized pointer.
    DoubleFreeUninitialized,
}

impl fmt::Display for MSanErrorKind {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            MSanErrorKind::UseOfUninitializedValue => write!(f, "use-of-uninitialized-value"),
            MSanErrorKind::UninitializedBranch => write!(f, "uninitialized-branch"),
            MSanErrorKind::UninitializedCondition => write!(f, "uninitialized-condition"),
            MSanErrorKind::UninitializedSyscallArg => write!(f, "uninitialized-syscall-arg"),
            MSanErrorKind::UninitializedFree => write!(f, "uninitialized-free"),
            MSanErrorKind::MemoryLeak => write!(f, "memory-leak"),
            MSanErrorKind::DoubleFreeUninitialized => write!(f, "double-free-uninitialized"),
        }
    }
}

/// ThreadSanitizer error kinds.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum TSanErrorKind {
    /// Data race: two accesses, at least one write, not ordered by happens-before.
    DataRace,
    /// Mutex deadlock: circular lock dependency detected.
    MutexDeadlock,
    /// Lock order inversion: inconsistent lock acquisition order.
    LockOrderInversion,
    /// Thread leak: thread created but never joined.
    ThreadLeak,
    /// Signal-unsafe call: async-signal-unsafe function called in signal handler.
    SignalUnsafeCall,
    /// Use-after-free race: accessing freed memory from another thread.
    UseAfterFreeRace,
    /// Double lock: same mutex locked twice by same thread.
    DoubleLock,
    /// Unlock of mutex not owned by this thread.
    UnlockNotOwned,
    /// Destroying a locked mutex.
    DestroyLockedMutex,
}

impl fmt::Display for TSanErrorKind {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            TSanErrorKind::DataRace => write!(f, "data-race"),
            TSanErrorKind::MutexDeadlock => write!(f, "mutex-deadlock"),
            TSanErrorKind::LockOrderInversion => write!(f, "lock-order-inversion"),
            TSanErrorKind::ThreadLeak => write!(f, "thread-leak"),
            TSanErrorKind::SignalUnsafeCall => write!(f, "signal-unsafe-call"),
            TSanErrorKind::UseAfterFreeRace => write!(f, "use-after-free-race"),
            TSanErrorKind::DoubleLock => write!(f, "double-lock"),
            TSanErrorKind::UnlockNotOwned => write!(f, "unlock-not-owned"),
            TSanErrorKind::DestroyLockedMutex => write!(f, "destroy-locked-mutex"),
        }
    }
}

// ============================================================================
// Stack Trace
// ============================================================================

/// A single frame in a stack trace.
#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct MTSanStackFrame {
    /// Module name (e.g., executable or shared library).
    pub module: String,
    /// Offset within the module.
    pub module_offset: u64,
    /// Symbol name (if available, after symbolization).
    pub symbol: Option<String>,
    /// Source file (if available).
    pub file: Option<String>,
    /// Source line (if available).
    pub line: Option<u32>,
    /// Source column (if available).
    pub column: Option<u32>,
}

impl MTSanStackFrame {
    pub fn unknown() -> Self {
        Self {
            module: String::from("<unknown>"),
            module_offset: 0,
            symbol: None,
            file: None,
            line: None,
            column: None,
        }
    }

    pub fn with_symbol(symbol: impl Into<String>) -> Self {
        Self {
            module: String::new(),
            module_offset: 0,
            symbol: Some(symbol.into()),
            file: None,
            line: None,
            column: None,
        }
    }

    pub fn format(&self) -> String {
        if let Some(ref sym) = self.symbol {
            if let (Some(file), Some(line)) = (&self.file, self.line) {
                format!(
                    "    #0 {} {}:{}:{}",
                    sym,
                    file,
                    line,
                    self.column.unwrap_or(0)
                )
            } else {
                format!(
                    "    #0 {} ({}+0x{:x})",
                    sym, self.module, self.module_offset
                )
            }
        } else {
            format!("    #0 {} +0x{:x}", self.module, self.module_offset)
        }
    }
}

/// A stack trace composed of multiple frames.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct MTSanStackTrace {
    pub frames: Vec<MTSanStackFrame>,
    pub hash: u64,
}

impl MTSanStackTrace {
    pub fn new() -> Self {
        Self {
            frames: Vec::new(),
            hash: 0,
        }
    }

    pub fn capture(depth: usize) -> Self {
        // In real compiler-rt: use __builtin_return_address and fast
        // unwind. Here we capture a symbolic representation.
        let mut trace = Self::new();
        for i in 0..depth {
            trace.frames.push(MTSanStackFrame {
                module: format!("module_{}", i),
                module_offset: (i * 16) as u64,
                symbol: Some(format!("func_{}", i)),
                file: Some(format!("file_{}.c", i)),
                line: Some((i * 17 + 42) as u32),
                column: Some(0),
            });
        }
        trace.compute_hash();
        trace
    }

    pub fn compute_hash(&mut self) {
        use std::collections::hash_map::DefaultHasher;
        use std::hash::{Hash, Hasher};
        let mut hasher = DefaultHasher::new();
        for frame in &self.frames {
            frame.hash(&mut hasher);
        }
        self.hash = hasher.finish();
    }

    pub fn format(&self) -> String {
        let mut s = String::new();
        for frame in &self.frames {
            s.push_str(&frame.format());
            s.push('\n');
        }
        s
    }

    pub fn symbolize(&mut self) {
        // In real compiler-rt: use symbolizer (llvm-symbolizer / addr2line).
        for frame in &mut self.frames {
            if frame.symbol.is_none() {
                frame.symbol = Some(format!(
                    "{}_symbolized+0x{:x}",
                    frame.module, frame.module_offset
                ));
            }
        }
    }
}

impl Default for MTSanStackTrace {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// Vector Clock (Happens-Before Tracking)
// ============================================================================

/// A single entry in a vector clock: (thread_id, clock_value).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
pub struct ClockEntry {
    pub thread_id: u32,
    pub clock: u64,
}

/// A vector clock: partially ordered set of (thread, clock) pairs.
/// Used to represent happens-before relationships between events.
#[derive(Debug, Clone)]
pub struct VectorClock {
    pub entries: Vec<ClockEntry>,
}

impl VectorClock {
    pub fn new() -> Self {
        Self {
            entries: Vec::new(),
        }
    }

    /// Get the clock value for a given thread, or 0 if not present.
    pub fn get(&self, thread_id: u32) -> u64 {
        match self
            .entries
            .binary_search_by_key(&thread_id, |e| e.thread_id)
        {
            Ok(idx) => self.entries[idx].clock,
            Err(_) => 0,
        }
    }

    /// Set the clock value for a given thread (increment only).
    pub fn set(&mut self, thread_id: u32, clock: u64) {
        match self
            .entries
            .binary_search_by_key(&thread_id, |e| e.thread_id)
        {
            Ok(idx) => {
                if clock > self.entries[idx].clock {
                    self.entries[idx].clock = clock;
                }
            }
            Err(idx) => {
                self.entries.insert(idx, ClockEntry { thread_id, clock });
            }
        }
    }

    /// Increment the clock for a given thread.
    pub fn tick(&mut self, thread_id: u32) -> u64 {
        let current = self.get(thread_id);
        let new_val = current + 1;
        self.set(thread_id, new_val);
        new_val
    }

    /// Join (element-wise max) this clock with another clock.
    /// `C = join(C, other)` — adopt all newer clock values from `other`.
    pub fn join(&mut self, other: &VectorClock) {
        for entry in &other.entries {
            self.set(entry.thread_id, entry.clock);
        }
    }

    /// Check if this clock happens-before `other`.
    /// Returns true if this clock is <= other in all dimensions and
    /// strictly less in at least one dimension.
    pub fn happens_before(&self, other: &VectorClock) -> bool {
        let mut strictly_less = false;
        // Check all entries in self
        for entry in &self.entries {
            let other_clock = other.get(entry.thread_id);
            if entry.clock > other_clock {
                return false;
            }
            if entry.clock < other_clock {
                strictly_less = true;
            }
        }
        // Also check entries in other that are not in self
        if !strictly_less {
            for entry in &other.entries {
                let self_clock = self.get(entry.thread_id);
                if self_clock < entry.clock {
                    strictly_less = true;
                    break;
                }
            }
        }
        strictly_less
    }

    /// Check if this clock happens-before or is equal to `other`.
    pub fn happens_before_or_eq(&self, other: &VectorClock) -> bool {
        for entry in &self.entries {
            let other_clock = other.get(entry.thread_id);
            if entry.clock > other_clock {
                return false;
            }
        }
        true
    }

    /// Check if two clocks are concurrent (neither happens-before the other).
    pub fn concurrent(&self, other: &VectorClock) -> bool {
        !self.happens_before(other) && !other.happens_before(self)
    }

    /// Merge (max) with another clock, in place.
    pub fn merge(&mut self, other: &VectorClock) {
        self.join(other);
    }

    /// Number of entries in the clock.
    pub fn len(&self) -> usize {
        self.entries.len()
    }

    pub fn is_empty(&self) -> bool {
        self.entries.is_empty()
    }

    /// Total ordering approximation: compare the maximum clock value.
    pub fn max_clock(&self) -> u64 {
        self.entries.iter().map(|e| e.clock).max().unwrap_or(0)
    }
}

impl Default for VectorClock {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan Shadow Memory
// ============================================================================

/// MemorySanitizer shadow memory — maps application addresses to
/// shadow bytes indicating initialization state.
#[derive(Debug)]
pub struct MSanShadowMemory {
    /// Shadow memory backing: address → shadow byte value.
    /// In practice, a sparse map since shadow occupies distinct VM range.
    pub shadow_map: BTreeMap<u64, u8>,
    /// Origin memory backing: (address / 4) → 32-bit origin ID.
    pub origin_map: BTreeMap<u64, u32>,
    /// Base address of shadow memory region.
    pub shadow_offset: u64,
    /// Scale factor (shadow bytes per app byte).
    pub shadow_scale: usize,
    /// Whether origin tracking is enabled.
    pub track_origins: bool,
    /// Total shadow bytes allocated.
    pub total_shadow_bytes: usize,
}

impl MSanShadowMemory {
    pub fn new(shadow_offset: u64, track_origins: bool) -> Self {
        Self {
            shadow_map: BTreeMap::new(),
            origin_map: BTreeMap::new(),
            shadow_offset,
            shadow_scale: MSAN_SHADOW_SCALE,
            track_origins,
            total_shadow_bytes: 0,
        }
    }

    /// Convert application address to shadow address.
    #[inline]
    pub fn app_to_shadow(&self, app_addr: u64) -> u64 {
        (app_addr.wrapping_sub(self.shadow_offset)) * self.shadow_scale as u64
    }

    /// Convert shadow address back to application address.
    #[inline]
    pub fn shadow_to_app(&self, shadow_addr: u64) -> u64 {
        (shadow_addr / self.shadow_scale as u64).wrapping_add(self.shadow_offset)
    }

    /// Get the shadow byte for an application address.
    pub fn get_shadow(&self, addr: u64) -> u8 {
        let shadow_addr = self.app_to_shadow(addr);
        self.shadow_map
            .get(&shadow_addr)
            .copied()
            .unwrap_or(MSAN_SHADOW_UNINIT)
    }

    /// Set the shadow byte for an application address.
    pub fn set_shadow(&mut self, addr: u64, value: u8) {
        let shadow_addr = self.app_to_shadow(addr);
        if !self.shadow_map.contains_key(&shadow_addr) {
            self.total_shadow_bytes += 1;
        }
        self.shadow_map.insert(shadow_addr, value);
    }

    /// Set shadow for a range of application addresses.
    pub fn set_shadow_range(&mut self, start: u64, size: usize, value: u8) {
        for i in 0..size {
            self.set_shadow(start + i as u64, value);
        }
    }

    /// Clear shadow for a range (mark as initialized).
    pub fn clear_shadow_range(&mut self, start: u64, size: usize) {
        self.set_shadow_range(start, size, MSAN_SHADOW_INIT);
    }

    /// Poison shadow for a range (mark as uninitialized).
    pub fn poison_shadow_range(&mut self, start: u64, size: usize) {
        self.set_shadow_range(start, size, MSAN_SHADOW_UNINIT);
    }

    /// Get the origin for an application address.
    pub fn get_origin(&self, addr: u64) -> u32 {
        if !self.track_origins {
            return MSAN_ORIGIN_CLEAN;
        }
        let origin_key = addr / MSAN_ORIGIN_SCALE as u64;
        self.origin_map
            .get(&origin_key)
            .copied()
            .unwrap_or(MSAN_ORIGIN_CLEAN)
    }

    /// Set the origin for an application address.
    pub fn set_origin(&mut self, addr: u64, origin: u32) {
        if !self.track_origins {
            return;
        }
        let origin_key = addr / MSAN_ORIGIN_SCALE as u64;
        self.origin_map.insert(origin_key, origin);
    }

    /// Set origin for a range of application addresses.
    pub fn set_origin_range(&mut self, start: u64, size: usize, origin: u32) {
        for i in (0..size).step_by(MSAN_ORIGIN_SCALE) {
            self.set_origin(start + i as u64, origin);
        }
    }

    /// Clear origin for a range.
    pub fn clear_origin_range(&mut self, start: u64, size: usize) {
        self.set_origin_range(start, size, MSAN_ORIGIN_CLEAN);
    }

    /// Check if an address range is fully initialized (all shadow = 0).
    pub fn is_initialized_range(&self, start: u64, size: usize) -> bool {
        for i in 0..size {
            if self.get_shadow(start + i as u64) != MSAN_SHADOW_INIT {
                return false;
            }
        }
        true
    }

    /// Find the first uninitialized byte in a range.
    pub fn find_first_uninit(&self, start: u64, size: usize) -> Option<(u64, u8, u32)> {
        for i in 0..size {
            let addr = start + i as u64;
            let shadow = self.get_shadow(addr);
            if shadow != MSAN_SHADOW_INIT {
                let origin = if self.track_origins {
                    self.get_origin(addr)
                } else {
                    MSAN_ORIGIN_CLEAN
                };
                return Some((addr, shadow, origin));
            }
        }
        None
    }
}

impl Default for MSanShadowMemory {
    fn default() -> Self {
        Self::new(MSAN_SHADOW_OFFSET_X86_64, false)
    }
}

// ============================================================================
// MSan Origin Chaining
// ============================================================================

/// An origin chain node, representing where an uninitialized value came from.
/// Origins can be chained: an uninit value propagates through operations,
/// each step in the chain records what operation created the next uninit value.
#[derive(Debug, Clone)]
pub struct OriginChainEntry {
    /// Unique origin ID.
    pub id: u32,
    /// Previous origin in the chain (parent).
    pub prev_id: u32,
    /// Stack trace where this origin was created.
    pub stack_trace: MTSanStackTrace,
    /// Description of the origin (e.g., "heap allocation", "stack variable x").
    pub description: String,
    /// Kind of origin.
    pub kind: OriginKind,
}

/// Kind of origin.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum OriginKind {
    /// Allocated by malloc/calloc/realloc.
    HeapAllocation,
    /// Stack variable.
    StackAllocation,
    /// Global variable.
    GlobalVariable,
    /// Thread-local storage.
    TLSVariable,
    /// Uninitialized parameter passed to function.
    FunctionParameter,
    /// Value produced by a specific instruction.
    Instruction,
    /// Memory deallocated (use-after-free).
    Deallocated,
    /// Memory beyond allocation bounds.
    HeapOverflow,
    /// Custom origin.
    Custom,
}

impl fmt::Display for OriginKind {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            OriginKind::HeapAllocation => write!(f, "heap-allocation"),
            OriginKind::StackAllocation => write!(f, "stack-allocation"),
            OriginKind::GlobalVariable => write!(f, "global-variable"),
            OriginKind::TLSVariable => write!(f, "tls-variable"),
            OriginKind::FunctionParameter => write!(f, "function-parameter"),
            OriginKind::Instruction => write!(f, "instruction"),
            OriginKind::Deallocated => write!(f, "deallocated-memory"),
            OriginKind::HeapOverflow => write!(f, "heap-buffer-overflow"),
            OriginKind::Custom => write!(f, "custom"),
        }
    }
}

/// Registry for origin chains — tracks all origin IDs and their metadata.
#[derive(Debug)]
pub struct OriginRegistry {
    pub entries: HashMap<u32, OriginChainEntry>,
    pub next_id: AtomicU32,
}

impl OriginRegistry {
    pub fn new() -> Self {
        Self {
            entries: HashMap::new(),
            next_id: AtomicU32::new(1),
        }
    }

    /// Allocate a new origin ID and register it.
    pub fn allocate_origin(
        &mut self,
        prev_id: u32,
        description: impl Into<String>,
        kind: OriginKind,
        stack: MTSanStackTrace,
    ) -> u32 {
        let id = self.next_id.fetch_add(1, Ordering::Relaxed);
        if id > MSAN_ORIGIN_MAX {
            // Overflow — wrap around, but preserve chaining.
            self.next_id.store(1, Ordering::Relaxed);
        }
        self.entries.insert(
            id,
            OriginChainEntry {
                id,
                prev_id,
                stack_trace: stack,
                description: description.into(),
                kind,
            },
        );
        id
    }

    /// Retrieve an origin entry.
    pub fn get(&self, id: u32) -> Option<&OriginChainEntry> {
        self.entries.get(&id)
    }

    /// Follow the origin chain, returning ordered entries from oldest to newest.
    pub fn follow_chain(&self, start_id: u32, max_depth: usize) -> Vec<&OriginChainEntry> {
        let mut chain = Vec::new();
        let mut current_id = start_id;
        let mut visited = HashSet::new();

        for _ in 0..max_depth {
            if current_id == MSAN_ORIGIN_CLEAN || !visited.insert(current_id) {
                break;
            }
            if let Some(entry) = self.entries.get(&current_id) {
                let prev = entry.prev_id;
                chain.push(entry);
                current_id = prev;
            } else {
                break;
            }
        }
        chain.reverse();
        chain
    }

    /// Format the origin chain as a human-readable report.
    pub fn format_chain(&self, start_id: u32) -> String {
        let chain = self.follow_chain(start_id, MSAN_MAX_ORIGIN_CHAIN);
        if chain.is_empty() {
            return String::from("  Origin: unknown\n");
        }
        let mut s = String::new();
        for (i, entry) in chain.iter().enumerate() {
            s.push_str(&format!(
                "  Origin {} ({}): {} (id={})\n",
                i + 1,
                entry.kind,
                entry.description,
                entry.id
            ));
            if !entry.stack_trace.frames.is_empty() {
                s.push_str(&format!(
                    "    {}",
                    entry
                        .stack_trace
                        .frames
                        .first()
                        .map(|f| f.format())
                        .unwrap_or_default()
                ));
                s.push('\n');
            }
        }
        s
    }

    pub fn len(&self) -> usize {
        self.entries.len()
    }

    pub fn is_empty(&self) -> bool {
        self.entries.is_empty()
    }
}

impl Default for OriginRegistry {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan Shadow Propagation Engine
// ============================================================================

/// MSan shadow propagation: computes the shadow of an operation from the
/// shadow values of its operands, following LLVM's shadow propagation rules.
#[derive(Debug)]
pub struct MSanShadowPropagator;

impl MSanShadowPropagator {
    /// Compute shadow for `add`/`sub`: union of operand shadows.
    /// `add i32 %a, %b` → shadow(result) = shadow(a) | shadow(b)
    pub fn propagate_add_sub(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `mul`: union unless any operand is zero.
    /// If the concrete value could be zero (shadow is partial), the result
    /// might be clean. But conservatively: union.
    pub fn propagate_mul(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `udiv`/`sdiv`: union of operand shadows.
    /// Division by zero is UB, so we don't handle that here — UBSan does.
    pub fn propagate_div(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `urem`/`srem`: union.
    pub fn propagate_rem(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `and`:
    /// If either input has a 0 bit (concrete), the result bit is 0 regardless
    /// of the other operand's shadow. So shadow = mask of bits where an
    /// uninitialized bit matters.
    pub fn propagate_and(a_shadow: u8, b_shadow: u8) -> u8 {
        // Conservative: any uninitialized bit propagates
        a_shadow | b_shadow
    }

    /// Compute shadow for `or`: union.
    pub fn propagate_or(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `xor`: union.
    pub fn propagate_xor(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for `shl` (shift left).
    pub fn propagate_shl(val_shadow: u8, amt_shadow: u8) -> u8 {
        // If the shift amount is uninitialized, the result is fully uninitialized.
        if amt_shadow != MSAN_SHADOW_INIT {
            return MSAN_SHADOW_UNINIT;
        }
        val_shadow
    }

    /// Compute shadow for `lshr` (logical shift right).
    pub fn propagate_lshr(val_shadow: u8, amt_shadow: u8) -> u8 {
        if amt_shadow != MSAN_SHADOW_INIT {
            return MSAN_SHADOW_UNINIT;
        }
        val_shadow
    }

    /// Compute shadow for `ashr` (arithmetic shift right).
    pub fn propagate_ashr(val_shadow: u8, amt_shadow: u8) -> u8 {
        if amt_shadow != MSAN_SHADOW_INIT {
            return MSAN_SHADOW_UNINIT;
        }
        val_shadow
    }

    /// Compute shadow for `select` (conditional).
    /// If the condition is uninitialized, result is union of both arms.
    /// Otherwise, result is the shadow of the selected arm.
    pub fn propagate_select(cond_shadow: u8, t_shadow: u8, f_shadow: u8) -> u8 {
        if cond_shadow != MSAN_SHADOW_INIT {
            t_shadow | f_shadow
        } else {
            // We don't know which arm — be conservative.
            t_shadow | f_shadow
        }
    }

    /// Compute shadow for `phi` node: union of all incoming shadows.
    pub fn propagate_phi(shadows: &[u8]) -> u8 {
        shadows.iter().fold(MSAN_SHADOW_INIT, |acc, &s| acc | s)
    }

    /// Compute shadow for `trunc`: preserve shadow bits.
    pub fn propagate_trunc(shadow: u8) -> u8 {
        shadow
    }

    /// Compute shadow for `zext`/`sext`: extend shadow (upper bits become
    /// uninitialized if the original had any uninitialized bits).
    pub fn propagate_ext(shadow: u8) -> u8 {
        shadow
    }

    /// Compute shadow for `bitcast`: shadow is unchanged.
    pub fn propagate_bitcast(shadow: u8) -> u8 {
        shadow
    }

    /// Compute shadow for `icmp`/`fcmp`: result is 1 bit; uninit if any
    /// operand has uninitialized bits.
    pub fn propagate_cmp(a_shadow: u8, b_shadow: u8) -> u8 {
        if a_shadow != MSAN_SHADOW_INIT || b_shadow != MSAN_SHADOW_INIT {
            MSAN_SHADOW_UNINIT
        } else {
            MSAN_SHADOW_INIT
        }
    }

    /// Compute shadow for `fadd`/`fsub`/`fmul`/`fdiv`: union.
    pub fn propagate_fbinary(a_shadow: u8, b_shadow: u8) -> u8 {
        a_shadow | b_shadow
    }

    /// Compute shadow for float→int conversion.
    pub fn propagate_fptosi(shadow: u8) -> u8 {
        shadow
    }

    /// Compute shadow for int→float conversion.
    pub fn propagate_sitofp(shadow: u8) -> u8 {
        shadow
    }

    /// Compute shadow for load: read from shadow memory.
    pub fn propagate_load(shadow_mem: &MSanShadowMemory, addr: u64, size: usize) -> Vec<u8> {
        let mut result = Vec::with_capacity(size);
        for i in 0..size {
            result.push(shadow_mem.get_shadow(addr + i as u64));
        }
        result
    }

    /// Compute and write shadow for store: write shadow to shadow memory.
    pub fn propagate_store(shadow_mem: &mut MSanShadowMemory, addr: u64, shadow_bytes: &[u8]) {
        for (i, &s) in shadow_bytes.iter().enumerate() {
            shadow_mem.set_shadow(addr + i as u64, s);
        }
    }

    /// Compute shadow for `call`: arguments shadows propagate to shadow memory
    /// of return value according to ABI.
    pub fn propagate_call_ret(arg_shadows: &[u8]) -> u8 {
        arg_shadows.iter().fold(MSAN_SHADOW_INIT, |acc, &s| acc | s)
    }

    /// Compute shadow for `getelementptr`: the pointer's shadow is the
    /// shadow of the base pointer (indices don't affect pointed-to memory).
    pub fn propagate_gep(base_shadow: u8, _index_shadows: &[u8]) -> u8 {
        base_shadow
    }

    /// Compute shadow for `extractvalue`: extract shadow byte at offset.
    pub fn propagate_extractvalue(agg_shadow: &[u8], offset: usize, size: usize) -> Vec<u8> {
        if offset + size <= agg_shadow.len() {
            agg_shadow[offset..offset + size].to_vec()
        } else {
            vec![MSAN_SHADOW_UNINIT; size]
        }
    }

    /// Compute shadow for `insertvalue`: insert shadow bytes at offset.
    pub fn propagate_insertvalue(agg_shadow: &[u8], offset: usize, val_shadow: &[u8]) -> Vec<u8> {
        let mut result = agg_shadow.to_vec();
        for (i, &s) in val_shadow.iter().enumerate() {
            if offset + i < result.len() {
                result[offset + i] = s;
            }
        }
        result
    }

    /// Compute shadow for memory intrinsics (llvm.memcpy, llvm.memmove):
    /// copy shadow from source to destination.
    pub fn propagate_memcpy(shadow_mem: &mut MSanShadowMemory, dst: u64, src: u64, size: usize) {
        for i in 0..size {
            let s = shadow_mem.get_shadow(src + i as u64);
            shadow_mem.set_shadow(dst + i as u64, s);
        }
    }

    /// Compute shadow for llvm.memset: set shadow for range.
    pub fn propagate_memset(shadow_mem: &mut MSanShadowMemory, dst: u64, size: usize, val: u8) {
        // memset writes known value, so shadow becomes initialized.
        shadow_mem.clear_shadow_range(dst, size);
        let _ = val; // val is the concrete value written, shadow = 0.
    }
}

// ============================================================================
// MSan Interceptors
// ============================================================================

/// MSan interceptor for standard library functions.
/// Each interceptor manipulates shadow memory to match the semantics
/// of the intercepted function.
#[derive(Debug)]
pub struct MSanInterceptors {
    /// Whether to poison memory on free.
    pub poison_in_free: bool,
    /// Stack for tracking origins of intercepted calls.
    pub origin_stack: Vec<(u64, usize)>,
    /// Count of intercepted calls.
    pub call_count: usize,
}

impl MSanInterceptors {
    pub fn new() -> Self {
        Self {
            poison_in_free: true,
            origin_stack: Vec::new(),
            call_count: 0,
        }
    }

    /// Intercept malloc: allocate memory, clear shadow for the returned region.
    pub fn intercept_malloc(
        shadow_mem: &mut MSanShadowMemory,
        registry: &mut OriginRegistry,
        size: usize,
        track_origins: bool,
    ) -> u64 {
        let ptr = unsafe {
            // In real compiler-rt: call the real malloc.
            // Here we simulate with a heap address.
            let layout = std::alloc::Layout::from_size_align(size.max(1), 16).unwrap();
            std::alloc::alloc(layout) as u64
        };
        if ptr != 0 {
            shadow_mem.clear_shadow_range(ptr, size);
            if track_origins {
                let origin = registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("malloc({})", size),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                shadow_mem.set_origin_range(ptr, size, origin);
            }
        }
        ptr
    }

    /// Intercept calloc: allocate zeroed memory, shadow is clean.
    pub fn intercept_calloc(
        shadow_mem: &mut MSanShadowMemory,
        registry: &mut OriginRegistry,
        nmemb: usize,
        size: usize,
        track_origins: bool,
    ) -> u64 {
        let total = nmemb * size;
        let ptr = unsafe {
            let layout = std::alloc::Layout::from_size_align(total.max(1), 16).unwrap();
            std::alloc::alloc_zeroed(layout) as u64
        };
        if ptr != 0 {
            shadow_mem.clear_shadow_range(ptr, total);
            if track_origins {
                let origin = registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("calloc({}, {})", nmemb, size),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                shadow_mem.set_origin_range(ptr, total, origin);
            }
        }
        ptr
    }

    /// Intercept realloc: copy shadow from old to new region.
    pub fn intercept_realloc(
        shadow_mem: &mut MSanShadowMemory,
        registry: &mut OriginRegistry,
        old_ptr: u64,
        new_size: usize,
        old_size: usize,
        track_origins: bool,
    ) -> u64 {
        let new_ptr = unsafe {
            let layout = std::alloc::Layout::from_size_align(new_size.max(1), 16).unwrap();
            std::alloc::alloc(layout) as u64
        };
        if new_ptr != 0 && old_ptr != 0 {
            let copy_size = old_size.min(new_size);
            // Copy shadow from old to new
            for i in 0..copy_size {
                let s = shadow_mem.get_shadow(old_ptr + i as u64);
                shadow_mem.set_shadow(new_ptr + i as u64, s);
                if track_origins && i % MSAN_ORIGIN_SCALE == 0 {
                    let origin = shadow_mem.get_origin(old_ptr + i as u64);
                    shadow_mem.set_origin(new_ptr + i as u64, origin);
                }
            }
            // Clear shadow for extra bytes
            if new_size > copy_size {
                shadow_mem.clear_shadow_range(new_ptr + copy_size as u64, new_size - copy_size);
            }
            // Free old memory
            unsafe {
                let layout = std::alloc::Layout::from_size_align(old_size.max(1), 16).unwrap();
                std::alloc::dealloc(old_ptr as *mut u8, layout);
            }
        }
        new_ptr
    }

    /// Intercept free: poison the freed memory.
    pub fn intercept_free(
        shadow_mem: &mut MSanShadowMemory,
        registry: &mut OriginRegistry,
        ptr: u64,
        size: usize,
        poison: bool,
        track_origins: bool,
    ) {
        if ptr == 0 {
            return;
        }
        if poison {
            shadow_mem.poison_shadow_range(ptr, size);
            if track_origins {
                let origin = registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("freed heap memory at {:#x}", ptr),
                    OriginKind::Deallocated,
                    MTSanStackTrace::capture(4),
                );
                shadow_mem.set_origin_range(ptr, size, origin);
            }
        }
        unsafe {
            let layout = std::alloc::Layout::from_size_align(size.max(1), 16).unwrap();
            std::alloc::dealloc(ptr as *mut u8, layout);
        }
    }

    /// Intercept memcpy: copy shadow from src to dst.
    pub fn intercept_memcpy(shadow_mem: &mut MSanShadowMemory, dst: u64, src: u64, size: usize) {
        MSanShadowPropagator::propagate_memcpy(shadow_mem, dst, src, size);
    }

    /// Intercept memmove: same as memcpy for shadow purposes.
    pub fn intercept_memmove(shadow_mem: &mut MSanShadowMemory, dst: u64, src: u64, size: usize) {
        // For overlapping regions, propagate shadow carefully.
        if dst < src {
            for i in 0..size {
                shadow_mem.set_shadow(dst + i as u64, shadow_mem.get_shadow(src + i as u64));
            }
        } else {
            for i in (0..size).rev() {
                shadow_mem.set_shadow(dst + i as u64, shadow_mem.get_shadow(src + i as u64));
            }
        }
    }

    /// Intercept memset: written bytes become initialized.
    pub fn intercept_memset(shadow_mem: &mut MSanShadowMemory, dst: u64, size: usize) {
        shadow_mem.clear_shadow_range(dst, size);
    }

    /// Intercept strcpy: copy shadow including null terminator.
    pub fn intercept_strcpy(shadow_mem: &mut MSanShadowMemory, dst: u64, src: u64) {
        let mut i = 0u64;
        loop {
            let s = shadow_mem.get_shadow(src + i);
            shadow_mem.set_shadow(dst + i, s);
            i += 1;
            // Stop at null terminator (checked in real interceptor).
            if i > 4096 {
                break; // Safety limit
            }
        }
    }

    /// Intercept strncpy: copy up to n bytes.
    pub fn intercept_strncpy(shadow_mem: &mut MSanShadowMemory, dst: u64, src: u64, n: usize) {
        for i in 0..n {
            let s = shadow_mem.get_shadow(src + i as u64);
            shadow_mem.set_shadow(dst + i as u64, s);
        }
    }

    /// Intercept strlen: check if the string's shadow is initialized.
    pub fn intercept_strlen(shadow_mem: &MSanShadowMemory, src: u64) -> (usize, bool) {
        let mut len = 0usize;
        let mut is_init = true;
        loop {
            let s = shadow_mem.get_shadow(src + len as u64);
            if s != MSAN_SHADOW_INIT {
                is_init = false;
            }
            len += 1;
            if len > 65536 {
                break;
            }
        }
        (len - 1, is_init)
    }

    /// Intercept printf: check that the format string is initialized.
    pub fn intercept_printf(shadow_mem: &MSanShadowMemory, fmt: u64) -> bool {
        // Check that the format string is fully initialized.
        let mut i = 0u64;
        loop {
            let s = shadow_mem.get_shadow(fmt + i);
            if s != MSAN_SHADOW_INIT {
                return false;
            }
            i += 1;
            if i > 4096 {
                break;
            }
        }
        true
    }
}

impl Default for MSanInterceptors {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan Signal Handling
// ============================================================================

/// MSan signal handler support: preserves shadow memory state across
/// signal delivery and restoration.
#[derive(Debug, Clone)]
pub struct MSanSignalContext {
    /// Saved shadow state for registers at signal entry.
    pub saved_reg_shadow: [u8; 16],
    /// Origin tracking for saved registers.
    pub saved_reg_origin: [u32; 16],
    /// Stack shadow: range of stack that was active.
    pub stack_range: (u64, u64),
    /// Signal number.
    pub signum: i32,
}

impl MSanSignalContext {
    pub fn new() -> Self {
        Self {
            saved_reg_shadow: [MSAN_SHADOW_INIT; 16],
            saved_reg_origin: [MSAN_ORIGIN_CLEAN; 16],
            stack_range: (0, 0),
            signum: 0,
        }
    }

    /// Save current shadow state for signal delivery.
    pub fn save(&mut self, shadow_mem: &MSanShadowMemory, signum: i32) {
        self.signum = signum;
        // In production: save shadow of all callee-saved registers.
        for i in 0..16 {
            self.saved_reg_shadow[i] = MSAN_SHADOW_INIT;
            self.saved_reg_origin[i] = MSAN_ORIGIN_CLEAN;
        }
        let _ = shadow_mem;
    }

    /// Restore shadow state after signal handler returns.
    pub fn restore(&self, _shadow_mem: &mut MSanShadowMemory) {
        // In production: restore shadow of all callee-saved registers.
    }
}

impl Default for MSanSignalContext {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan TLS Shadow Tracking
// ============================================================================

/// MSan thread-local storage tracking.
/// Each thread has its own TLS block; we need to track whether TLS
/// variables are initialized.
#[derive(Debug)]
pub struct MSanTLSShadow {
    /// Shadow for TLS variables: (tls_offset → shadow_byte).
    pub tls_shadow: HashMap<u64, u8>,
    /// Origin for TLS variables.
    pub tls_origin: HashMap<u64, u32>,
    /// TLS block size.
    pub tls_size: usize,
    /// Whether TLS tracking is active.
    pub active: bool,
}

impl MSanTLSShadow {
    pub fn new() -> Self {
        Self {
            tls_shadow: HashMap::new(),
            tls_origin: HashMap::new(),
            tls_size: 0,
            active: false,
        }
    }

    pub fn init(&mut self, tls_size: usize) {
        self.tls_size = tls_size;
        self.active = true;
        for offset in 0..tls_size {
            self.tls_shadow.insert(offset as u64, MSAN_SHADOW_UNINIT);
            self.tls_origin.insert(offset as u64, MSAN_ORIGIN_CLEAN);
        }
    }

    pub fn get_tls_shadow(&self, offset: u64) -> u8 {
        self.tls_shadow
            .get(&offset)
            .copied()
            .unwrap_or(MSAN_SHADOW_UNINIT)
    }

    pub fn set_tls_shadow(&mut self, offset: u64, value: u8) {
        self.tls_shadow.insert(offset, value);
    }

    pub fn get_tls_origin(&self, offset: u64) -> u32 {
        self.tls_origin
            .get(&offset)
            .copied()
            .unwrap_or(MSAN_ORIGIN_CLEAN)
    }

    pub fn set_tls_origin(&mut self, offset: u64, origin: u32) {
        self.tls_origin.insert(offset, origin);
    }

    pub fn clear_tls_range(&mut self, start: u64, size: usize) {
        for i in 0..size {
            self.tls_shadow.insert(start + i as u64, MSAN_SHADOW_INIT);
            self.tls_origin.insert(start + i as u64, MSAN_ORIGIN_CLEAN);
        }
    }
}

impl Default for MSanTLSShadow {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// TSan Thread State
// ============================================================================

/// Per-thread state for ThreadSanitizer.
#[derive(Debug, Clone)]
pub struct TSanThreadState {
    /// Thread ID.
    pub thread_id: u32,
    /// Logical clock for this thread.
    pub clock: VectorClock,
    /// Global tick counter (monotonically incremented on each event).
    pub global_tick: u64,
    /// Stack of mutexes currently held by this thread.
    pub held_mutexes: Vec<u64>,
    /// Lock acquisition order history (for deadlock detection).
    pub lock_order: Vec<(u64, u64)>,
    /// Whether the thread has been joined.
    pub is_joined: bool,
    /// Whether the thread is currently in a signal handler.
    pub in_signal_handler: bool,
    /// Signal number being handled (if any).
    pub signal_number: Option<i32>,
    /// Creation stack trace.
    pub creation_stack: MTSanStackTrace,
    /// Thread name (if set).
    pub name: Option<String>,
    /// Whether this thread should be tracked.
    pub is_tracked: bool,
    /// Whether this thread has been joined/detached.
    pub is_detached: bool,
}

impl TSanThreadState {
    pub fn new(thread_id: u32, creation_stack: MTSanStackTrace) -> Self {
        Self {
            thread_id,
            clock: VectorClock::new(),
            global_tick: 0,
            held_mutexes: Vec::new(),
            lock_order: Vec::new(),
            is_joined: false,
            in_signal_handler: false,
            signal_number: None,
            creation_stack,
            name: None,
            is_tracked: true,
            is_detached: false,
        }
    }

    /// Advance the logical clock for this thread.
    pub fn tick(&mut self) -> u64 {
        self.global_tick += 1;
        self.clock.tick(self.thread_id)
    }

    /// Acquire a synchronization edge: join this thread's clock with
    /// the release clock of another thread.
    pub fn acquire(&mut self, release_clock: &VectorClock) {
        self.clock.join(release_clock);
    }

    /// Release this thread's clock for use by other threads.
    pub fn release(&self) -> VectorClock {
        self.clock.clone()
    }
}

// ============================================================================
// TSan Shadow Cell (Per-Memory-Location State)
// ============================================================================

/// A shadow cell for TSan, tracking recent accesses to a memory location.
#[derive(Debug, Clone)]
pub struct TSanShadowCell {
    /// Thread ID of the most recent access.
    pub last_thread: u32,
    /// Clock value at the time of the last access.
    pub last_clock: VectorClock,
    /// Whether the last access was a write.
    pub last_write: bool,
    /// Clock at the time of the last write.
    pub write_clock: VectorClock,
    /// Number of distinct reads since the last write.
    pub read_count: u32,
    /// Access history: ring buffer of previous accesses.
    pub history: VecDeque<TSanAccessRecord>,
    /// Maximum history entries to keep.
    pub history_size: usize,
}

/// A record of a past access for race detection.
#[derive(Debug, Clone)]
pub struct TSanAccessRecord {
    /// Thread that performed the access.
    pub thread_id: u32,
    /// Clock at the time of access.
    pub clock: VectorClock,
    /// Whether this was a write.
    pub is_write: bool,
    /// Access size in bytes.
    pub size: usize,
    /// Whether the access was atomic.
    pub is_atomic: bool,
    /// Memory ordering for atomic accesses.
    pub atomic_ordering: Option<TSanAtomicOrdering>,
    /// Stack trace at the time of access.
    pub stack: MTSanStackTrace,
}

/// Atomic memory ordering levels (matching LLVM/C++ memory order).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
pub enum TSanAtomicOrdering {
    Relaxed,
    Consume,
    Acquire,
    Release,
    AcquireRelease,
    SequentiallyConsistent,
}

impl fmt::Display for TSanAtomicOrdering {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            TSanAtomicOrdering::Relaxed => write!(f, "relaxed"),
            TSanAtomicOrdering::Consume => write!(f, "consume"),
            TSanAtomicOrdering::Acquire => write!(f, "acquire"),
            TSanAtomicOrdering::Release => write!(f, "release"),
            TSanAtomicOrdering::AcquireRelease => write!(f, "acq_rel"),
            TSanAtomicOrdering::SequentiallyConsistent => write!(f, "seq_cst"),
        }
    }
}

impl TSanShadowCell {
    pub fn new(history_size: usize) -> Self {
        Self {
            last_thread: 0,
            last_clock: VectorClock::new(),
            last_write: false,
            write_clock: VectorClock::new(),
            read_count: 0,
            history: VecDeque::with_capacity(history_size),
            history_size,
        }
    }

    /// Record an access and check for races.
    pub fn record_access(
        &mut self,
        thread_id: u32,
        thread_clock: &VectorClock,
        is_write: bool,
        size: usize,
        is_atomic: bool,
        atomic_ordering: Option<TSanAtomicOrdering>,
        stack: MTSanStackTrace,
    ) -> Option<TSanRaceInfo> {
        let record = TSanAccessRecord {
            thread_id,
            clock: thread_clock.clone(),
            is_write,
            size,
            is_atomic,
            atomic_ordering,
            stack,
        };

        let mut race_info = None;

        // Check for races against the last access
        if self.last_thread != 0 && self.last_thread != thread_id {
            if is_write || self.last_write {
                // At least one is a write — potential race
                if !is_atomic
                    && !thread_clock.happens_before(&self.last_clock)
                    && !self.last_clock.happens_before(thread_clock)
                {
                    // No happens-before relationship → RACE!
                    race_info = Some(TSanRaceInfo {
                        addr: 0, // Will be filled by caller
                        size,
                        thread1: self.last_thread,
                        thread2: thread_id,
                        is_write1: self.last_write,
                        is_write2: is_write,
                        clock1: self.last_clock.clone(),
                        clock2: thread_clock.clone(),
                    });
                }
            }
        }

        // Also check against history entries
        if race_info.is_none() {
            for hist_record in &self.history {
                if hist_record.thread_id != thread_id {
                    if is_write || hist_record.is_write {
                        if !is_atomic
                            && !thread_clock.happens_before(&hist_record.clock)
                            && !hist_record.clock.happens_before(thread_clock)
                        {
                            race_info = Some(TSanRaceInfo {
                                addr: 0,
                                size,
                                thread1: hist_record.thread_id,
                                thread2: thread_id,
                                is_write1: hist_record.is_write,
                                is_write2: is_write,
                                clock1: hist_record.clock.clone(),
                                clock2: thread_clock.clone(),
                            });
                            break;
                        }
                    }
                }
            }
        }

        // Update cell state
        self.last_thread = thread_id;
        self.last_clock = thread_clock.clone();
        if is_write {
            self.last_write = true;
            self.write_clock = thread_clock.clone();
            self.read_count = 0;
        } else if !self.last_write {
            self.read_count += 1;
        }

        // Add to history
        if self.history.len() >= self.history_size {
            self.history.pop_front();
        }
        self.history.push_back(record);

        race_info
    }
}

/// Information about a detected race (used for reporting).
#[derive(Debug, Clone)]
pub struct TSanRaceInfo {
    pub addr: u64,
    pub size: usize,
    pub thread1: u32,
    pub thread2: u32,
    pub is_write1: bool,
    pub is_write2: bool,
    pub clock1: VectorClock,
    pub clock2: VectorClock,
}

// ============================================================================
// TSan Mutex Tracking
// ============================================================================

/// Mutex metadata for ThreadSanitizer.
#[derive(Debug, Clone)]
pub struct TSanMutexState {
    /// Unique mutex ID.
    pub id: u64,
    /// Thread that currently owns this mutex.
    pub owner_thread: u32,
    /// Recursion count (for recursive mutexes).
    pub lock_count: u32,
    /// Stack trace of mutex creation.
    pub creation_stack: MTSanStackTrace,
    /// Whether this is a read (shared) lock.
    pub is_read_lock: bool,
    /// Clock value released when this mutex was last unlocked.
    pub release_clock: VectorClock,
    /// Whether this mutex has been destroyed.
    pub is_destroyed: bool,
    /// Lock acquisition history for deadlock detection.
    pub lock_history: Vec<TSanMutexLockRecord>,
}

/// Record of a lock acquisition for deadlock detection.
#[derive(Debug, Clone)]
pub struct TSanMutexLockRecord {
    /// Thread that acquired the lock.
    pub thread_id: u32,
    /// Stack trace of lock acquisition.
    pub stack: MTSanStackTrace,
    /// Clock value at the time of acquisition.
    pub clock: VectorClock,
}

impl TSanMutexState {
    pub fn new(id: u64, creation_stack: MTSanStackTrace) -> Self {
        Self {
            id,
            owner_thread: 0,
            lock_count: 0,
            creation_stack,
            is_read_lock: false,
            release_clock: VectorClock::new(),
            is_destroyed: false,
            lock_history: Vec::new(),
        }
    }
}

// ============================================================================
// TSan Lock Annotation Support
// ============================================================================

/// Lock capability annotation (matching Clang's thread safety annotations).
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum LockCapability {
    /// Mutex (exclusive lock).
    Mutex,
    /// Read-write lock (shared/read lock).
    RwLockShared,
    /// Read-write lock (exclusive/write lock).
    RwLockExclusive,
    /// Generic capability.
    Capability(String),
}

/// Annotation for a lock acquisition.
#[derive(Debug, Clone)]
pub struct LockAnnotation {
    /// The capability being acquired.
    pub capability: LockCapability,
    /// The mutex ID being locked.
    pub mutex_id: u64,
    /// Source location of the annotation.
    pub location: Option<(String, u32, u32)>,
}

impl LockAnnotation {
    pub fn acquire(mutex_id: u64) -> Self {
        Self {
            capability: LockCapability::Mutex,
            mutex_id,
            location: None,
        }
    }

    pub fn release(mutex_id: u64) -> Self {
        Self {
            capability: LockCapability::Mutex,
            mutex_id,
            location: None,
        }
    }

    pub fn try_acquire(mutex_id: u64) -> Self {
        Self {
            capability: LockCapability::Mutex,
            mutex_id,
            location: None,
        }
    }

    pub fn shared_acquire(mutex_id: u64) -> Self {
        Self {
            capability: LockCapability::RwLockShared,
            mutex_id,
            location: None,
        }
    }

    pub fn exclusive_acquire(mutex_id: u64) -> Self {
        Self {
            capability: LockCapability::RwLockExclusive,
            mutex_id,
            location: None,
        }
    }
}

// ============================================================================
// TSan Deadlock Detection
// ============================================================================

/// Deadlock detection engine using wait-for graph analysis.
#[derive(Debug)]
pub struct TSanDeadlockDetector {
    /// Wait-for graph: (waiting_thread → held_by_thread) edges.
    pub wait_for_graph: HashMap<u32, HashSet<u32>>,
    /// Mutex ownership: (mutex_id → owning_thread).
    pub mutex_owners: HashMap<u64, u32>,
    /// Thread lock order history: thread_id → ordered list of mutexes acquired.
    pub lock_orders: HashMap<u32, Vec<u64>>,
}

impl TSanDeadlockDetector {
    pub fn new() -> Self {
        Self {
            wait_for_graph: HashMap::new(),
            mutex_owners: HashMap::new(),
            lock_orders: HashMap::new(),
        }
    }

    /// Notify that a thread is trying to acquire a mutex.
    /// Returns Some(deadlock_cycle) if a deadlock is detected.
    pub fn try_acquire(&mut self, thread_id: u32, mutex_id: u64) -> Option<Vec<u32>> {
        if let Some(&owner) = self.mutex_owners.get(&mutex_id) {
            if owner != thread_id {
                // This thread is waiting for owner.
                self.wait_for_graph
                    .entry(thread_id)
                    .or_insert_with(HashSet::new)
                    .insert(owner);

                // Check for cycles.
                if let Some(cycle) = self.detect_cycle(thread_id) {
                    return Some(cycle);
                }
            }
        }
        None
    }

    /// Notify that a thread successfully acquired a mutex.
    pub fn acquired(&mut self, thread_id: u32, mutex_id: u64) {
        self.mutex_owners.insert(mutex_id, thread_id);
        // Remove waiting edge.
        if let Some(waiters) = self.wait_for_graph.get_mut(&thread_id) {
            waiters.clear();
        }
        // Update lock order.
        self.lock_orders
            .entry(thread_id)
            .or_insert_with(Vec::new)
            .push(mutex_id);
    }

    /// Notify that a thread released a mutex.
    pub fn released(&mut self, thread_id: u32, mutex_id: u64) {
        if self.mutex_owners.get(&mutex_id) == Some(&thread_id) {
            self.mutex_owners.remove(&mutex_id);
        }
    }

    /// Detect if there is a cycle in the wait-for graph starting from `start`.
    fn detect_cycle(&self, start: u32) -> Option<Vec<u32>> {
        let mut visited = HashSet::new();
        let mut stack = Vec::new();
        let mut in_stack = HashSet::new();
        if self.dfs_cycle(start, &mut visited, &mut stack, &mut in_stack) {
            Some(stack)
        } else {
            None
        }
    }

    fn dfs_cycle(
        &self,
        node: u32,
        visited: &mut HashSet<u32>,
        stack: &mut Vec<u32>,
        in_stack: &mut HashSet<u32>,
    ) -> bool {
        visited.insert(node);
        stack.push(node);
        in_stack.insert(node);

        if let Some(neighbors) = self.wait_for_graph.get(&node) {
            for &neighbor in neighbors {
                if !visited.contains(&neighbor) {
                    if self.dfs_cycle(neighbor, visited, stack, in_stack) {
                        return true;
                    }
                } else if in_stack.contains(&neighbor) {
                    // Found a cycle — trim stack to show just the cycle.
                    while stack.first() != Some(&neighbor) {
                        stack.remove(0);
                    }
                    return true;
                }
            }
        }

        stack.pop();
        in_stack.remove(&node);
        false
    }

    /// Check for lock order inversion between two mutexes.
    pub fn check_lock_order(&self, thread_id: u32, new_mutex: u64) -> Option<(u64, u64)> {
        if let Some(order) = self.lock_orders.get(&thread_id) {
            for &held in order.iter().rev() {
                // Check if any other thread acquired these in reverse order.
                for (other_tid, other_order) in &self.lock_orders {
                    if *other_tid == thread_id {
                        continue;
                    }
                    let held_pos = other_order.iter().position(|&m| m == held);
                    let new_pos = other_order.iter().position(|&m| m == new_mutex);
                    if let (Some(hp), Some(np)) = (held_pos, new_pos) {
                        if hp > np {
                            // Inversion detected: this thread acquires held→new_mutex,
                            // other thread acquired new_mutex→held.
                            return Some((held, new_mutex));
                        }
                    }
                }
            }
        }
        None
    }
}

impl Default for TSanDeadlockDetector {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// TSan Signal-Safety Detection
// ============================================================================

/// Known async-signal-unsafe functions (POSIX).
const SIGNAL_UNSAFE_FUNCTIONS: &[&str] = &[
    "printf",
    "fprintf",
    "sprintf",
    "snprintf",
    "malloc",
    "calloc",
    "realloc",
    "free",
    "pthread_mutex_lock",
    "pthread_mutex_unlock",
    "pthread_create",
    "pthread_join",
    "fopen",
    "fclose",
    "fread",
    "fwrite",
    "opendir",
    "readdir",
    "closedir",
    "getpwnam",
    "getpwuid",
    "localtime",
    "gmtime",
    "ctime",
    "asctime",
    "rand",
    "srand",
    "setlocale",
    "getenv",
    "setenv",
    "putenv",
    "system",
    "popen",
    "pclose",
    "dlopen",
    "dlsym",
    "dlclose",
    "exit",
    "abort",
];

/// Signal-unsafe call detector.
#[derive(Debug)]
pub struct TSanSignalSafety {
    /// Set of async-signal-unsafe function names.
    pub unsafe_functions: HashSet<String>,
    /// Whether signal-safety checking is enabled.
    pub enabled: bool,
}

impl TSanSignalSafety {
    pub fn new() -> Self {
        let mut unsafe_functions = HashSet::new();
        for func in SIGNAL_UNSAFE_FUNCTIONS {
            unsafe_functions.insert(func.to_string());
        }
        Self {
            unsafe_functions,
            enabled: true,
        }
    }

    /// Check if a function call is safe in a signal handler context.
    pub fn is_signal_safe(&self, function_name: &str) -> bool {
        !self.unsafe_functions.contains(function_name)
    }

    /// Get the list of known signal-unsafe functions.
    pub fn unsafe_list(&self) -> Vec<&String> {
        self.unsafe_functions.iter().collect()
    }
}

impl Default for TSanSignalSafety {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan Options (MSAN_OPTIONS)
// ============================================================================

/// Parsed MSAN_OPTIONS environment variable.
#[derive(Debug, Clone)]
pub struct MSanOptions {
    /// Poison heap memory on free.
    pub poison_in_free: bool,
    /// Report uninitialized memory reads.
    pub report_umrs: bool,
    /// Wrap signal handlers to preserve shadow.
    pub wrap_signals: bool,
    /// Print statistics on exit.
    pub print_stats: bool,
    /// Track origins of uninitialized values.
    pub track_origins: u32,
    /// Origin tracking level: 0=off, 1=light, 2=full.
    pub origin_level: u32,
    /// Keep going after first error.
    pub keep_going: bool,
    /// Exit code to use when errors are found.
    pub exit_code: i32,
    /// Halt on error (overrides keep_going).
    pub halt_on_error: bool,
    /// Log path for error reports.
    pub log_path: Option<String>,
    /// Verbosity level.
    pub verbosity: u32,
    /// Maximum number of UMR reports.
    pub max_umrs: usize,
    /// Whether to check memory on store.
    pub check_store: bool,
    /// Whether to store clean shadow on allocation.
    pub store_clean_on_allocation: bool,
}

impl Default for MSanOptions {
    fn default() -> Self {
        Self {
            poison_in_free: true,
            report_umrs: true,
            wrap_signals: true,
            print_stats: false,
            track_origins: 0,
            origin_level: 0,
            keep_going: false,
            exit_code: MTSAN_DEFAULT_EXITCODE,
            halt_on_error: false,
            log_path: None,
            verbosity: 0,
            max_umrs: 100,
            check_store: false,
            store_clean_on_allocation: true,
        }
    }
}

impl MSanOptions {
    /// Parse options from the MSAN_OPTIONS environment variable.
    pub fn from_env() -> Self {
        let mut opts = Self::default();
        if let Ok(env_val) = std::env::var("MSAN_OPTIONS") {
            for part in env_val.split(':') {
                let mut kv = part.splitn(2, '=');
                let key = kv.next().unwrap_or("");
                let val = kv.next().unwrap_or("");
                match key {
                    "poison_in_free" => opts.poison_in_free = val != "0",
                    "report_umrs" => opts.report_umrs = val != "0",
                    "wrap_signals" => opts.wrap_signals = val != "0",
                    "print_stats" => opts.print_stats = val != "0",
                    "track_origins" => {
                        if let Ok(n) = val.parse() {
                            opts.track_origins = n;
                            opts.origin_level = n;
                        }
                    }
                    "keep_going" => opts.keep_going = val != "0",
                    "exit_code" => {
                        if let Ok(n) = val.parse() {
                            opts.exit_code = n;
                        }
                    }
                    "halt_on_error" => opts.halt_on_error = val != "0",
                    "log_path" => opts.log_path = Some(val.to_string()),
                    "verbosity" => {
                        if let Ok(n) = val.parse() {
                            opts.verbosity = n;
                        }
                    }
                    _ => {}
                }
            }
        }
        opts
    }

    /// Parse a specific option value from a string.
    pub fn parse_option(&mut self, key: &str, val: &str) {
        match key {
            "poison_in_free" => self.poison_in_free = val != "0",
            "report_umrs" => self.report_umrs = val != "0",
            "wrap_signals" => self.wrap_signals = val != "0",
            "print_stats" => self.print_stats = val != "0",
            "track_origins" => {
                if let Ok(n) = val.parse() {
                    self.track_origins = n;
                    self.origin_level = n;
                }
            }
            "keep_going" => self.keep_going = val != "0",
            "exit_code" => {
                if let Ok(n) = val.parse() {
                    self.exit_code = n;
                }
            }
            "halt_on_error" => self.halt_on_error = val != "0",
            "log_path" => self.log_path = Some(val.to_string()),
            "verbosity" => {
                if let Ok(n) = val.parse() {
                    self.verbosity = n;
                }
            }
            _ => {}
        }
    }
}

// ============================================================================
// TSan Options (TSAN_OPTIONS)
// ============================================================================

/// Parsed TSAN_OPTIONS environment variable.
#[derive(Debug, Clone)]
pub struct TSanOptions {
    /// History size per shadow cell (number of previous accesses to retain).
    pub history_size: usize,
    /// Flush memory every N milliseconds (0 = no periodic flush).
    pub flush_memory_ms: u64,
    /// Force sequentially consistent atomics (slower but stricter).
    pub force_seq_cst_atomics: bool,
    /// Path to suppressions file.
    pub suppressions: Option<String>,
    /// Whether to report thread leaks.
    pub report_thread_leaks: bool,
    /// Whether to detect deadlocks.
    pub detect_deadlocks: bool,
    /// Whether to ignore non-racy read-after-write on same thread.
    pub ignore_non_racy: bool,
    /// Exit code.
    pub exit_code: i32,
    /// Halt on error.
    pub halt_on_error: bool,
    /// Keep going after error.
    pub keep_going: bool,
    /// Log path.
    pub log_path: Option<String>,
    /// Verbosity level.
    pub verbosity: u32,
    /// Atomics sequentially consistent enforcement.
    pub atomic_seq_cst: bool,
    /// Maximum number of threads to track.
    pub max_threads: usize,
    /// Whether to check signal-safety.
    pub check_signal_safety: bool,
}

impl Default for TSanOptions {
    fn default() -> Self {
        Self {
            history_size: TSAN_DEFAULT_HISTORY_SIZE,
            flush_memory_ms: TSAN_DEFAULT_FLUSH_MS,
            force_seq_cst_atomics: false,
            suppressions: None,
            report_thread_leaks: true,
            detect_deadlocks: true,
            ignore_non_racy: true,
            exit_code: MTSAN_DEFAULT_EXITCODE,
            halt_on_error: false,
            keep_going: false,
            log_path: None,
            verbosity: 0,
            atomic_seq_cst: false,
            max_threads: 8192,
            check_signal_safety: true,
        }
    }
}

impl TSanOptions {
    /// Parse options from the TSAN_OPTIONS environment variable.
    pub fn from_env() -> Self {
        let mut opts = Self::default();
        if let Ok(env_val) = std::env::var("TSAN_OPTIONS") {
            for part in env_val.split(':') {
                let mut kv = part.splitn(2, '=');
                let key = kv.next().unwrap_or("");
                let val = kv.next().unwrap_or("");
                opts.parse_option(key, val);
            }
        }
        opts
    }

    /// Parse a specific option value.
    pub fn parse_option(&mut self, key: &str, val: &str) {
        match key {
            "history_size" => {
                if let Ok(n) = val.parse() {
                    self.history_size = n;
                }
            }
            "flush_memory_ms" => {
                if let Ok(n) = val.parse() {
                    self.flush_memory_ms = n;
                }
            }
            "force_seq_cst_atomics" => self.force_seq_cst_atomics = val != "0",
            "suppressions" => self.suppressions = Some(val.to_string()),
            "report_thread_leaks" => self.report_thread_leaks = val != "0",
            "detect_deadlocks" => self.detect_deadlocks = val != "0",
            "halt_on_error" => self.halt_on_error = val != "0",
            "keep_going" => self.keep_going = val != "0",
            "exit_code" => {
                if let Ok(n) = val.parse() {
                    self.exit_code = n;
                }
            }
            "log_path" => self.log_path = Some(val.to_string()),
            "verbosity" => {
                if let Ok(n) = val.parse() {
                    self.verbosity = n;
                }
            }
            _ => {}
        }
    }
}

// ============================================================================
// Combined MTSan Flags
// ============================================================================

/// Combined flags for the MTSan full runtime.
#[derive(Debug, Clone)]
pub struct MTSanFlags {
    /// MemorySanitizer options.
    pub msan_options: MSanOptions,
    /// ThreadSanitizer options.
    pub tsan_options: TSanOptions,
    /// Common log path.
    pub log_path: Option<String>,
    /// Common verbosity level.
    pub verbosity: u32,
    /// Common exit code.
    pub exitcode: i32,
    /// Whether MSan is enabled.
    pub msan_enabled: bool,
    /// Whether TSan is enabled.
    pub tsan_enabled: bool,
    /// Whether origin tracking is enabled.
    pub origins_enabled: bool,
    /// Whether to halt on first error.
    pub halt_on_error: bool,
}

impl MTSanFlags {
    pub fn new() -> Self {
        Self {
            msan_options: MSanOptions::default(),
            tsan_options: TSanOptions::default(),
            log_path: None,
            verbosity: 0,
            exitcode: MTSAN_DEFAULT_EXITCODE,
            msan_enabled: true,
            tsan_enabled: true,
            origins_enabled: false,
            halt_on_error: false,
        }
    }

    /// Parse from both MSAN_OPTIONS and TSAN_OPTIONS.
    pub fn from_env() -> Self {
        let msan_opts = MSanOptions::from_env();
        let tsan_opts = TSanOptions::from_env();
        let log_path = msan_opts
            .log_path
            .clone()
            .or_else(|| tsan_opts.log_path.clone());
        let verbosity = msan_opts.verbosity.max(tsan_opts.verbosity);
        let exitcode = msan_opts.exit_code.min(tsan_opts.exit_code);
        Self {
            msan_options: msan_opts.clone(),
            tsan_options: tsan_opts.clone(),
            log_path,
            verbosity,
            exitcode,
            msan_enabled: true,
            tsan_enabled: true,
            origins_enabled: msan_opts.track_origins > 0,
            halt_on_error: msan_opts.halt_on_error || tsan_opts.halt_on_error,
        }
    }
}

impl Default for MTSanFlags {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// MSan Error Report
// ============================================================================

/// An MSan error report.
#[derive(Debug, Clone)]
pub struct MSanErrorReport {
    /// Error kind.
    pub kind: MSanErrorKind,
    /// Address of the uninitialized memory.
    pub address: u64,
    /// Size of the access.
    pub size: usize,
    /// The origin ID (for origin tracking).
    pub origin: u32,
    /// Stack trace of the error.
    pub stack: MTSanStackTrace,
    /// Thread ID where the error occurred.
    pub thread_id: u32,
    /// Description of the error.
    pub description: String,
    /// Whether the error is fatal.
    pub is_fatal: bool,
}

impl MSanErrorReport {
    pub fn new(
        kind: MSanErrorKind,
        address: u64,
        size: usize,
        origin: u32,
        stack: MTSanStackTrace,
        thread_id: u32,
        description: impl Into<String>,
    ) -> Self {
        Self {
            kind,
            address,
            size,
            origin,
            stack,
            thread_id,
            description: description.into(),
            is_fatal: false,
        }
    }

    /// Format the error report as human-readable text.
    pub fn format(&self, origin_registry: Option<&OriginRegistry>) -> String {
        let mut s = String::new();
        s.push_str("===================================================\n");
        s.push_str(&format!("WARNING: MemorySanitizer: {}\n", self.kind));
        s.push_str(&format!("  Address: 0x{:016x}\n", self.address));
        s.push_str(&format!("  Size: {} bytes\n", self.size));
        s.push_str(&format!("  Thread: {}\n", self.thread_id));
        s.push_str(&format!("  Description: {}\n", self.description));

        if self.origin != MSAN_ORIGIN_CLEAN {
            s.push_str(&format!("  Origin ID: {}\n", self.origin));
            if let Some(registry) = origin_registry {
                s.push_str(&registry.format_chain(self.origin));
            }
        }

        s.push_str("  Stack trace:\n");
        s.push_str(&self.stack.format());
        s.push_str("===================================================\n");
        s
    }
}

// ============================================================================
// TSan Error Report
// ============================================================================

/// A TSan error report.
#[derive(Debug, Clone)]
pub struct TSanErrorReport {
    /// Error kind.
    pub kind: TSanErrorKind,
    /// Thread IDs involved.
    pub threads: Vec<u32>,
    /// Addresses involved.
    pub addresses: Vec<u64>,
    /// Stack traces.
    pub stacks: Vec<MTSanStackTrace>,
    /// Mutex IDs (for mutex-related errors).
    pub mutexes: Vec<u64>,
    /// Description.
    pub description: String,
    /// Whether the error is fatal.
    pub is_fatal: bool,
    /// The suppression signature (hash).
    pub suppression_signature: u64,
}

impl TSanErrorReport {
    pub fn new(kind: TSanErrorKind, description: impl Into<String>) -> Self {
        Self {
            kind,
            threads: Vec::new(),
            addresses: Vec::new(),
            stacks: Vec::new(),
            mutexes: Vec::new(),
            description: description.into(),
            is_fatal: false,
            suppression_signature: 0,
        }
    }

    /// Format the error report as human-readable text.
    pub fn format(&self) -> String {
        let mut s = String::new();
        s.push_str("==================\n");
        s.push_str(&format!(
            "WARNING: ThreadSanitizer: {} ({})\n",
            self.kind, self.description
        ));
        if !self.threads.is_empty() {
            s.push_str(&format!("  Threads involved: {:?}\n", self.threads));
        }
        if !self.addresses.is_empty() {
            for (i, addr) in self.addresses.iter().enumerate() {
                s.push_str(&format!("  Address {}: 0x{:016x}\n", i, addr));
            }
        }
        for (i, stack) in self.stacks.iter().enumerate() {
            s.push_str(&format!("  Stack {}:\n", i));
            s.push_str(&stack.format());
        }
        s.push_str("==================\n");
        s
    }

    /// Create a data race report.
    pub fn data_race(
        addr: u64,
        size: usize,
        thread1: u32,
        thread2: u32,
        is_write1: bool,
        is_write2: bool,
        stack1: MTSanStackTrace,
        stack2: MTSanStackTrace,
    ) -> Self {
        let desc = format!(
            "data race on {} bytes at 0x{:016x} between thread {} ({}) and thread {} ({})",
            size,
            addr,
            thread1,
            if is_write1 { "write" } else { "read" },
            thread2,
            if is_write2 { "write" } else { "read" },
        );
        Self {
            kind: TSanErrorKind::DataRace,
            threads: vec![thread1, thread2],
            addresses: vec![addr],
            stacks: vec![stack1, stack2],
            mutexes: Vec::new(),
            description: desc,
            is_fatal: false,
            suppression_signature: 0,
        }
    }

    /// Create a deadlock report.
    pub fn deadlock(cycle: Vec<u32>, stacks: Vec<MTSanStackTrace>) -> Self {
        Self {
            kind: TSanErrorKind::MutexDeadlock,
            threads: cycle.clone(),
            addresses: Vec::new(),
            stacks,
            mutexes: Vec::new(),
            description: format!("deadlock detected involving threads {:?}", cycle),
            is_fatal: true,
            suppression_signature: 0,
        }
    }

    /// Create a lock order inversion report.
    pub fn lock_order_inversion(
        thread1: u32,
        thread2: u32,
        mutex_a: u64,
        mutex_b: u64,
        stack1: MTSanStackTrace,
        stack2: MTSanStackTrace,
    ) -> Self {
        Self {
            kind: TSanErrorKind::LockOrderInversion,
            threads: vec![thread1, thread2],
            addresses: Vec::new(),
            stacks: vec![stack1, stack2],
            mutexes: vec![mutex_a, mutex_b],
            description: format!(
                "lock order inversion: thread {} acquired mutex {} then {}, \
                 thread {} acquired mutex {} then {}",
                thread1, mutex_a, mutex_b, thread2, mutex_b, mutex_a
            ),
            is_fatal: false,
            suppression_signature: 0,
        }
    }

    /// Create a thread leak report.
    pub fn thread_leak(thread_id: u32, stack: MTSanStackTrace) -> Self {
        Self {
            kind: TSanErrorKind::ThreadLeak,
            threads: vec![thread_id],
            addresses: Vec::new(),
            stacks: vec![stack],
            mutexes: Vec::new(),
            description: format!("thread {} was created but never joined", thread_id),
            is_fatal: false,
            suppression_signature: 0,
        }
    }

    /// Create a signal-unsafe call report.
    pub fn signal_unsafe_call(
        thread_id: u32,
        function: &str,
        signal: i32,
        stack: MTSanStackTrace,
    ) -> Self {
        Self {
            kind: TSanErrorKind::SignalUnsafeCall,
            threads: vec![thread_id],
            addresses: Vec::new(),
            stacks: vec![stack],
            mutexes: Vec::new(),
            description: format!(
                "signal-unsafe function '{}' called from signal {} handler in thread {}",
                function, signal, thread_id
            ),
            is_fatal: false,
            suppression_signature: 0,
        }
    }
}

// ============================================================================
// TSan Suppressions
// ============================================================================

/// A single suppression rule.
#[derive(Debug, Clone)]
pub struct TSanSuppression {
    /// Suppression name.
    pub name: String,
    /// Suppression type (e.g., "race", "deadlock", "thread_leak").
    pub suppression_type: String,
    /// Function name pattern to match in stack trace.
    pub fun_pattern: Option<String>,
    /// Source file pattern to match.
    pub src_pattern: Option<String>,
    /// Module pattern to match.
    pub module_pattern: Option<String>,
}

impl TSanSuppression {
    pub fn matches(&self, report: &TSanErrorReport) -> bool {
        let type_matches = self.suppression_type == "*"
            || self.suppression_type == format!("{:?}", report.kind).to_lowercase();
        if !type_matches {
            return false;
        }
        // Check stack frames
        let mut any_match = false;
        for stack in &report.stacks {
            for frame in &stack.frames {
                let fun_match = self.fun_pattern.as_ref().map_or(true, |pat| {
                    frame.symbol.as_ref().map_or(false, |s| s.contains(pat))
                });
                let src_match = self.src_pattern.as_ref().map_or(true, |pat| {
                    frame.file.as_ref().map_or(false, |f| f.contains(pat))
                });
                let mod_match = self
                    .module_pattern
                    .as_ref()
                    .map_or(true, |pat| frame.module.contains(pat));
                if fun_match && src_match && mod_match {
                    any_match = true;
                    break;
                }
            }
        }
        any_match
    }
}

/// Suppression file parser and matcher.
#[derive(Debug)]
pub struct TSanSuppressions {
    pub entries: Vec<TSanSuppression>,
}

impl TSanSuppressions {
    pub fn new() -> Self {
        Self {
            entries: Vec::new(),
        }
    }

    pub fn load_from_file(path: &str) -> std::io::Result<Self> {
        let content = std::fs::read_to_string(path)?;
        Ok(Self::parse(&content))
    }

    pub fn parse(content: &str) -> Self {
        let mut entries = Vec::new();
        let mut current: Option<TSanSuppression> = None;

        for line in content.lines() {
            let trimmed = line.trim();
            if trimmed.is_empty() || trimmed.starts_with('#') {
                continue;
            }
            // Parse suppression entries in format:
            //   type:name
            //   fun:pattern
            if let Some(colon_pos) = trimmed.find(':') {
                let (key, value) = trimmed.split_at(colon_pos);
                let value = value[1..].trim();
                match key {
                    "race" | "deadlock" | "thread_leak" | "signal" | "mutex" => {
                        if let Some(entry) = current.take() {
                            entries.push(entry);
                        }
                        current = Some(TSanSuppression {
                            name: value.to_string(),
                            suppression_type: key.to_string(),
                            fun_pattern: None,
                            src_pattern: None,
                            module_pattern: None,
                        });
                    }
                    "fun" => {
                        if let Some(ref mut entry) = current {
                            entry.fun_pattern = Some(value.to_string());
                        }
                    }
                    "src" => {
                        if let Some(ref mut entry) = current {
                            entry.src_pattern = Some(value.to_string());
                        }
                    }
                    "module" => {
                        if let Some(ref mut entry) = current {
                            entry.module_pattern = Some(value.to_string());
                        }
                    }
                    _ => {}
                }
            }
        }
        if let Some(entry) = current {
            entries.push(entry);
        }
        Self { entries }
    }

    /// Check if a report is suppressed.
    pub fn is_suppressed(&self, report: &TSanErrorReport) -> bool {
        self.entries.iter().any(|supp| supp.matches(report))
    }

    pub fn len(&self) -> usize {
        self.entries.len()
    }

    pub fn is_empty(&self) -> bool {
        self.entries.is_empty()
    }
}

impl Default for TSanSuppressions {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// X86MTSanFull: Combined MSan + TSan Runtime
// ============================================================================

/// The complete combined MemorySanitizer and ThreadSanitizer runtime for X86.
///
/// ## MSan Component
/// - Shadow memory: 1:1 mapping for uninitialized bit tracking.
/// - Origin tracking: 4-byte origin ID per 4 bytes of application memory.
/// - Shadow propagation for all LLVM IR operations.
/// - Interceptor functions for standard library.
/// - Signal handling support.
/// - TLS shadow tracking.
/// - Origin chaining.
///
/// ## TSan Component
/// - Happens-before tracking via per-thread vector clocks.
/// - Mutex tracking with deadlock detection.
/// - Atomic operation tracking with release/acquire semantics.
/// - Thread creation/join happens-before edges.
/// - Signal synchronization.
/// - Race detection engine.
/// - Lock annotation support.
///
/// ## Flags
/// - MSAN_OPTIONS and TSAN_OPTIONS environment variable parsing.
/// - Common flags: log_path, verbosity, exitcode.
#[derive(Debug)]
pub struct X86MTSanFull {
    // === MSan State ===
    /// MSan shadow memory.
    pub msan_shadow: MSanShadowMemory,
    /// Origin chain registry.
    pub origin_registry: OriginRegistry,
    /// MSan interceptors.
    pub msan_interceptors: MSanInterceptors,
    /// MSan signal context.
    pub msan_signal_ctx: MSanSignalContext,
    /// MSan TLS shadow.
    pub msan_tls: MSanTLSShadow,
    /// MSan shadow propagator.
    pub msan_propagator: MSanShadowPropagator,

    // === TSan State ===
    /// Per-thread state map.
    pub tsan_threads: HashMap<u32, TSanThreadState>,
    /// Shadow cells for memory locations (addr / granularity → cell).
    pub tsan_shadow: HashMap<u64, TSanShadowCell>,
    /// Mutex state map.
    pub tsan_mutexes: HashMap<u64, TSanMutexState>,
    /// Global tick counter (monotonically incremented on each event).
    pub tsan_global_tick: AtomicU64,
    /// Next thread ID allocator.
    pub tsan_next_thread_id: AtomicU32,
    /// Next mutex ID allocator.
    pub tsan_next_mutex_id: AtomicU64,
    /// Deadlock detector.
    pub tsan_deadlock_detector: TSanDeadlockDetector,
    /// Signal safety checker.
    pub tsan_signal_safety: TSanSignalSafety,

    // === Error Reporting ===
    /// Collected MSan error reports.
    pub msan_reports: Vec<MSanErrorReport>,
    /// Collected TSan error reports.
    pub tsan_reports: Vec<TSanErrorReport>,
    /// Suppressions loaded from file.
    pub suppressions: TSanSuppressions,

    // === Flags & Configuration ===
    /// Combined flags.
    pub flags: MTSanFlags,
    /// Whether the runtime has been initialized.
    pub initialized: bool,

    // === Statistics ===
    /// Total number of memory accesses tracked by MSan.
    pub msan_access_count: usize,
    /// Total number of shadow propagation operations.
    pub msan_propagation_count: usize,
    /// Total number of TSan events processed.
    pub tsan_event_count: usize,
    /// Total number of lock operations in TSan.
    pub tsan_lock_ops: usize,
    /// Total number of races detected.
    pub tsan_race_count: usize,

    /// X86 subtarget information (for ABI-specific behavior).
    pub subtarget: Option<X86Subtarget>,
    /// X86 calling convention (for ABI-specific behavior).
    pub calling_convention: Option<X86CallingConvention>,
    /// Register info (for shadow register tracking).
    pub register_info: Option<X86RegisterInfo>,
}

impl X86MTSanFull {
    /// Create a new combined MSan+TSan runtime.
    pub fn new() -> Self {
        let flags = MTSanFlags::from_env();
        let origins_enabled = flags.msan_options.track_origins > 0;
        Self {
            msan_shadow: MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, origins_enabled),
            origin_registry: OriginRegistry::new(),
            msan_interceptors: MSanInterceptors::new(),
            msan_signal_ctx: MSanSignalContext::new(),
            msan_tls: MSanTLSShadow::new(),
            msan_propagator: MSanShadowPropagator,
            tsan_threads: HashMap::new(),
            tsan_shadow: HashMap::new(),
            tsan_mutexes: HashMap::new(),
            tsan_global_tick: AtomicU64::new(0),
            tsan_next_thread_id: AtomicU32::new(1),
            tsan_next_mutex_id: AtomicU64::new(1),
            tsan_deadlock_detector: TSanDeadlockDetector::new(),
            tsan_signal_safety: TSanSignalSafety::new(),
            msan_reports: Vec::new(),
            tsan_reports: Vec::new(),
            suppressions: TSanSuppressions::new(),
            flags,
            initialized: false,
            msan_access_count: 0,
            msan_propagation_count: 0,
            tsan_event_count: 0,
            tsan_lock_ops: 0,
            tsan_race_count: 0,
            subtarget: None,
            calling_convention: None,
            register_info: None,
        }
    }

    /// Initialize the runtime with X86 subtarget information.
    pub fn init_with_subtarget(&mut self, subtarget: &X86Subtarget) {
        self.subtarget = Some(subtarget.clone());
        self.calling_convention = Some(X86CallingConvention::default());
        self.register_info = Some(X86RegisterInfo);
        self.initialized = true;
    }

    /// Initialize the runtime with default values.
    pub fn initialize(&mut self) {
        self.flags = MTSanFlags::from_env();
        let origins_enabled = self.flags.msan_options.track_origins > 0;
        self.msan_shadow.track_origins = origins_enabled;
        self.msan_interceptors.poison_in_free = self.flags.msan_options.poison_in_free;
        self.initialized = true;

        // Load suppressions if configured.
        if let Some(ref path) = self.flags.tsan_options.suppressions {
            if let Ok(supps) = TSanSuppressions::load_from_file(path) {
                self.suppressions = supps;
            }
        }
    }

    // ========================================================================
    // MSan Public API
    // ========================================================================

    /// Check a memory read for uninitialized values.
    /// Returns Some(error_report) if uninitialized memory was read.
    pub fn msan_check_read(
        &mut self,
        addr: u64,
        size: usize,
        thread_id: u32,
    ) -> Option<MSanErrorReport> {
        self.msan_access_count += 1;
        let shadow = (0..size)
            .map(|i| self.msan_shadow.get_shadow(addr + i as u64))
            .collect::<Vec<_>>();

        if shadow.iter().any(|&s| s != MSAN_SHADOW_INIT) {
            let (first_addr, _first_shadow, first_origin) = self
                .msan_shadow
                .find_first_uninit(addr, size)
                .unwrap_or((addr, MSAN_SHADOW_UNINIT, MSAN_ORIGIN_CLEAN));

            let report = MSanErrorReport::new(
                MSanErrorKind::UseOfUninitializedValue,
                first_addr,
                size,
                first_origin,
                MTSanStackTrace::capture(self.flags.msan_options.verbosity as usize + 4),
                thread_id,
                format!(
                    "read of {} byte(s) at 0x{:016x} from uninitialized memory",
                    size, addr
                ),
            );
            self.msan_reports.push(report.clone());
            Some(report)
        } else {
            None
        }
    }

    /// Check a memory write and propagate shadow.
    pub fn msan_check_write(&mut self, addr: u64, shadow_bytes: &[u8], origin: u32) {
        self.msan_access_count += 1;
        MSanShadowPropagator::propagate_store(&mut self.msan_shadow, addr, shadow_bytes);
        if self.msan_shadow.track_origins && origin != MSAN_ORIGIN_CLEAN {
            self.msan_shadow
                .set_origin_range(addr, shadow_bytes.len(), origin);
        }
    }

    /// Check if a conditional branch uses an uninitialized value.
    pub fn msan_check_branch(&mut self, shadow: u8, thread_id: u32) -> Option<MSanErrorReport> {
        if shadow != MSAN_SHADOW_INIT {
            let report = MSanErrorReport::new(
                MSanErrorKind::UninitializedBranch,
                0,
                1,
                MSAN_ORIGIN_CLEAN,
                MTSanStackTrace::capture(4),
                thread_id,
                "branch on uninitialized value",
            );
            self.msan_reports.push(report.clone());
            Some(report)
        } else {
            None
        }
    }

    /// Set shadow for a memory region (e.g., after alloca).
    pub fn msan_set_shadow(&mut self, addr: u64, size: usize, value: u8) {
        self.msan_shadow.set_shadow_range(addr, size, value);
    }

    /// Get shadow for an address.
    pub fn msan_get_shadow(&self, addr: u64) -> u8 {
        self.msan_shadow.get_shadow(addr)
    }

    /// Clear shadow (mark as initialized).
    pub fn msan_clear_shadow(&mut self, addr: u64, size: usize) {
        self.msan_shadow.clear_shadow_range(addr, size);
    }

    /// Set origin for a memory region.
    pub fn msan_set_origin(&mut self, addr: u64, size: usize, origin: u32) {
        self.msan_shadow.set_origin_range(addr, size, origin);
    }

    /// Allocate a new origin ID.
    pub fn msan_allocate_origin(
        &mut self,
        prev_id: u32,
        description: impl Into<String>,
        kind: OriginKind,
    ) -> u32 {
        self.origin_registry.allocate_origin(
            prev_id,
            description,
            kind,
            MTSanStackTrace::capture(4),
        )
    }

    /// Propagate shadow for a binary operation.
    pub fn msan_propagate_binary(&mut self, opcode: &str, a_shadow: u8, b_shadow: u8) -> u8 {
        self.msan_propagation_count += 1;
        match opcode {
            "add" | "sub" | "fadd" | "fsub" => {
                MSanShadowPropagator::propagate_add_sub(a_shadow, b_shadow)
            }
            "mul" | "fmul" => MSanShadowPropagator::propagate_mul(a_shadow, b_shadow),
            "udiv" | "sdiv" | "fdiv" => MSanShadowPropagator::propagate_div(a_shadow, b_shadow),
            "urem" | "srem" | "frem" => MSanShadowPropagator::propagate_rem(a_shadow, b_shadow),
            "and" => MSanShadowPropagator::propagate_and(a_shadow, b_shadow),
            "or" => MSanShadowPropagator::propagate_or(a_shadow, b_shadow),
            "xor" => MSanShadowPropagator::propagate_xor(a_shadow, b_shadow),
            "shl" => MSanShadowPropagator::propagate_shl(a_shadow, b_shadow),
            "lshr" => MSanShadowPropagator::propagate_lshr(a_shadow, b_shadow),
            "ashr" => MSanShadowPropagator::propagate_ashr(a_shadow, b_shadow),
            _ => {
                // Default: union
                a_shadow | b_shadow
            }
        }
    }

    /// Propagate shadow for a comparison operation.
    pub fn msan_propagate_cmp(&mut self, a_shadow: u8, b_shadow: u8) -> u8 {
        self.msan_propagation_count += 1;
        MSanShadowPropagator::propagate_cmp(a_shadow, b_shadow)
    }

    /// Propagate shadow for a select/phi operation.
    pub fn msan_propagate_select(&mut self, cond_shadow: u8, t_shadow: u8, f_shadow: u8) -> u8 {
        self.msan_propagation_count += 1;
        MSanShadowPropagator::propagate_select(cond_shadow, t_shadow, f_shadow)
    }

    /// Intercept a malloc call.
    pub fn msan_intercept_malloc(&mut self, size: usize) -> u64 {
        let track = self.msan_shadow.track_origins;
        MSanInterceptors::intercept_malloc(
            &mut self.msan_shadow,
            &mut self.origin_registry,
            size,
            track,
        )
    }

    /// Intercept a free call.
    pub fn msan_intercept_free(&mut self, ptr: u64, size: usize) {
        let poison = self.flags.msan_options.poison_in_free;
        let track = self.msan_shadow.track_origins;
        MSanInterceptors::intercept_free(
            &mut self.msan_shadow,
            &mut self.origin_registry,
            ptr,
            size,
            poison,
            track,
        )
    }

    /// Intercept a memcpy call.
    pub fn msan_intercept_memcpy(&mut self, dst: u64, src: u64, size: usize) {
        MSanInterceptors::intercept_memcpy(&mut self.msan_shadow, dst, src, size);
    }

    /// Intercept a memmove call.
    pub fn msan_intercept_memmove(&mut self, dst: u64, src: u64, size: usize) {
        MSanInterceptors::intercept_memmove(&mut self.msan_shadow, dst, src, size);
    }

    /// Intercept a memset call.
    pub fn msan_intercept_memset(&mut self, dst: u64, size: usize) {
        MSanInterceptors::intercept_memset(&mut self.msan_shadow, dst, size);
    }

    /// Intercept a strcpy call.
    pub fn msan_intercept_strcpy(&mut self, dst: u64, src: u64) {
        MSanInterceptors::intercept_strcpy(&mut self.msan_shadow, dst, src);
    }

    /// Intercept a strncpy call.
    pub fn msan_intercept_strncpy(&mut self, dst: u64, src: u64, n: usize) {
        MSanInterceptors::intercept_strncpy(&mut self.msan_shadow, dst, src, n);
    }

    /// Signal handler entry: save shadow state.
    pub fn msan_signal_enter(&mut self, signum: i32) {
        self.msan_signal_ctx.save(&self.msan_shadow, signum);
    }

    /// Signal handler exit: restore shadow state.
    pub fn msan_signal_exit(&mut self) {
        self.msan_signal_ctx.restore(&mut self.msan_shadow);
    }

    /// Initialize TLS tracking.
    pub fn msan_tls_init(&mut self, tls_size: usize) {
        self.msan_tls.init(tls_size);
    }

    /// Get TLS shadow for an offset.
    pub fn msan_tls_get_shadow(&self, offset: u64) -> u8 {
        self.msan_tls.get_tls_shadow(offset)
    }

    /// Set TLS shadow for an offset.
    pub fn msan_tls_set_shadow(&mut self, offset: u64, value: u8) {
        self.msan_tls.set_tls_shadow(offset, value);
    }

    // ========================================================================
    // TSan Public API
    // ========================================================================

    /// Create a new thread for TSan tracking.
    pub fn tsan_thread_create(&mut self) -> u32 {
        let thread_id = self.tsan_next_thread_id.fetch_add(1, Ordering::Relaxed);
        let state = TSanThreadState::new(thread_id, MTSanStackTrace::capture(4));
        self.tsan_threads.insert(thread_id, state);
        self.tsan_event_count += 1;
        thread_id
    }

    /// Register a thread join with happens-before.
    pub fn tsan_thread_join(&mut self, joiner_id: u32, joinee_id: u32) {
        // The joining thread acquires the happens-before from the joined thread.
        if let Some(joinee) = self.tsan_threads.get(&joinee_id) {
            let release_clock = joinee.release();
            if let Some(joiner) = self.tsan_threads.get_mut(&joiner_id) {
                joiner.acquire(&release_clock);
            }
        }
        // Mark joined.
        if let Some(joinee) = self.tsan_threads.get_mut(&joinee_id) {
            joinee.is_joined = true;
        }
        self.tsan_event_count += 1;
    }

    /// Record a memory access for race detection.
    pub fn tsan_record_access(
        &mut self,
        thread_id: u32,
        addr: u64,
        size: usize,
        is_write: bool,
        is_atomic: bool,
        atomic_ordering: Option<TSanAtomicOrdering>,
    ) -> Option<TSanRaceInfo> {
        self.tsan_event_count += 1;

        // Get or create the shadow cell.
        let cell_key = addr / TSAN_SHADOW_GRANULARITY as u64;
        let history_size = self.flags.tsan_options.history_size;
        let cell = self
            .tsan_shadow
            .entry(cell_key)
            .or_insert_with(|| TSanShadowCell::new(history_size));

        // Advance the thread's clock.
        let thread_clock = if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
            thread.clock.clone()
        } else {
            return None; // Unknown thread.
        };

        let stack = MTSanStackTrace::capture(4);

        let race_info = cell.record_access(
            thread_id,
            &thread_clock,
            is_write,
            size,
            is_atomic,
            atomic_ordering,
            stack.clone(),
        );

        if let Some(ref race) = race_info {
            // Get stacks for both threads and create a report.
            let stack1 = MTSanStackTrace::capture(4);
            let stack2 = stack;

            let report = TSanErrorReport::data_race(
                addr,
                size,
                race.thread1,
                race.thread2,
                race.is_write1,
                race.is_write2,
                stack1,
                stack2,
            );

            if !self.suppressions.is_suppressed(&report) {
                self.tsan_race_count += 1;
                self.tsan_reports.push(report);
            }
        }

        race_info
    }

    /// Record a plain load.
    pub fn tsan_load(&mut self, thread_id: u32, addr: u64, size: usize) -> Option<TSanRaceInfo> {
        self.tsan_record_access(thread_id, addr, size, false, false, None)
    }

    /// Record a plain store.
    pub fn tsan_store(&mut self, thread_id: u32, addr: u64, size: usize) -> Option<TSanRaceInfo> {
        self.tsan_record_access(thread_id, addr, size, true, false, None)
    }

    /// Record an atomic load.
    pub fn tsan_atomic_load(
        &mut self,
        thread_id: u32,
        addr: u64,
        size: usize,
        ordering: TSanAtomicOrdering,
    ) -> Option<TSanRaceInfo> {
        self.tsan_record_access(thread_id, addr, size, false, true, Some(ordering))
    }

    /// Record an atomic store.
    pub fn tsan_atomic_store(
        &mut self,
        thread_id: u32,
        addr: u64,
        size: usize,
        ordering: TSanAtomicOrdering,
    ) -> Option<TSanRaceInfo> {
        // Release: advance thread clock and publish for other threads.
        if ordering == TSanAtomicOrdering::Release
            || ordering == TSanAtomicOrdering::AcquireRelease
            || ordering == TSanAtomicOrdering::SequentiallyConsistent
        {
            if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                thread.tick();
            }
        }
        self.tsan_record_access(thread_id, addr, size, true, true, Some(ordering))
    }

    /// Record an atomic read-modify-write.
    pub fn tsan_atomic_rmw(
        &mut self,
        thread_id: u32,
        addr: u64,
        size: usize,
        ordering: TSanAtomicOrdering,
    ) -> Option<TSanRaceInfo> {
        // RMW has both acquire and release semantics.
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
        }
        self.tsan_record_access(thread_id, addr, size, true, true, Some(ordering))
    }

    /// Record an atomic fence.
    pub fn tsan_atomic_fence(&mut self, thread_id: u32, ordering: TSanAtomicOrdering) {
        self.tsan_event_count += 1;
        // Fence synchronizes all previous and subsequent accesses.
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            // Sequentially consistent fence: synchronize with all threads.
            if ordering == TSanAtomicOrdering::SequentiallyConsistent {
                thread.tick();
                let clock = thread.clock.clone();
                for (tid, other_thread) in self.tsan_threads.iter_mut() {
                    if *tid != thread_id {
                        other_thread.acquire(&clock);
                        other_thread.tick();
                    }
                }
                // Re-acquire all merged clocks.
                let tids: Vec<u32> = self.tsan_threads.keys().copied().collect();
                for tid in tids {
                    if tid != thread_id {
                        let other_clock = {
                            let other_thread = &self.tsan_threads[&tid];
                            other_thread.release()
                        };
                        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                            thread.acquire(&other_clock);
                        }
                    }
                }
            } else if ordering == TSanAtomicOrdering::Release {
                thread.tick();
            } else if ordering == TSanAtomicOrdering::Acquire {
                thread.tick();
            }
        }
    }

    // ========================================================================
    // TSan Mutex Operations
    // ========================================================================

    /// Create a new mutex for TSan tracking.
    pub fn tsan_mutex_create(&mut self) -> u64 {
        let mutex_id = self.tsan_next_mutex_id.fetch_add(1, Ordering::Relaxed);
        self.tsan_mutexes.insert(
            mutex_id,
            TSanMutexState::new(mutex_id, MTSanStackTrace::capture(4)),
        );
        mutex_id
    }

    /// Lock a mutex (exclusive lock).
    pub fn tsan_mutex_lock(&mut self, thread_id: u32, mutex_id: u64) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;
        self.tsan_event_count += 1;

        let mut error = None;

        // Check for deadlock.
        if self.flags.tsan_options.detect_deadlocks {
            if let Some(ref deadlock_cycle) =
                self.tsan_deadlock_detector.try_acquire(thread_id, mutex_id)
            {
                let cycle = deadlock_cycle.clone();
                let stacks: Vec<_> = cycle.iter().map(|_| MTSanStackTrace::capture(6)).collect();
                let report = TSanErrorReport::deadlock(cycle, stacks);
                self.tsan_reports.push(report.clone());
                error = Some(report);
            }
        }

        // Check for lock order inversion.
        if self.flags.tsan_options.detect_deadlocks {
            if let Some((held, new)) = self
                .tsan_deadlock_detector
                .check_lock_order(thread_id, mutex_id)
            {
                // Find another thread that acquired these in reverse order.
                for (&other_tid, order) in &self.tsan_deadlock_detector.lock_orders {
                    if other_tid != thread_id {
                        let new_pos = order.iter().position(|&m| m == new);
                        let held_pos = order.iter().position(|&m| m == held);
                        if let (Some(np), Some(hp)) = (new_pos, held_pos) {
                            if np < hp {
                                let report = TSanErrorReport::lock_order_inversion(
                                    thread_id,
                                    other_tid,
                                    held,
                                    new,
                                    MTSanStackTrace::capture(4),
                                    MTSanStackTrace::capture(4),
                                );
                                self.tsan_reports.push(report.clone());
                                error = Some(report);
                                break;
                            }
                        }
                    }
                }
            }
        }

        // Update thread state: acquire the mutex's release clock.
        if let Some(mutex) = self.tsan_mutexes.get(&mutex_id) {
            if !mutex.is_destroyed {
                let release_clock = mutex.release_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                    thread.held_mutexes.push(mutex_id);
                }
            }
        }

        // Update mutex state.
        if let Some(mutex) = self.tsan_mutexes.get_mut(&mutex_id) {
            // Check for double-lock.
            if mutex.owner_thread == thread_id && mutex.lock_count > 0 && !mutex.is_read_lock {
                let report = TSanErrorReport::new(
                    TSanErrorKind::DoubleLock,
                    format!("mutex {} double-locked by thread {}", mutex_id, thread_id),
                );
                self.tsan_reports.push(report.clone());
                if error.is_none() {
                    error = Some(report);
                }
            }
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = false;

            mutex.lock_history.push(TSanMutexLockRecord {
                thread_id,
                stack: MTSanStackTrace::capture(4),
                clock: self
                    .tsan_threads
                    .get(&thread_id)
                    .map(|t| t.clock.clone())
                    .unwrap_or_default(),
            });
        }

        // Update deadlock detector.
        self.tsan_deadlock_detector.acquired(thread_id, mutex_id);

        error
    }

    /// Unlock a mutex.
    pub fn tsan_mutex_unlock(&mut self, thread_id: u32, mutex_id: u64) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;
        self.tsan_event_count += 1;

        let mut error = None;

        // Advance the thread's clock (release semantics).
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
            // Remove from held mutexes.
            thread.held_mutexes.retain(|&m| m != mutex_id);
        }

        // Store release clock in the mutex.
        if let Some(thread) = self.tsan_threads.get(&thread_id) {
            if let Some(mutex) = self.tsan_mutexes.get_mut(&mutex_id) {
                // Check for unlock-not-owned.
                if mutex.owner_thread != thread_id {
                    let report = TSanErrorReport::new(
                        TSanErrorKind::UnlockNotOwned,
                        format!(
                            "mutex {} unlocked by thread {}, owned by thread {}",
                            mutex_id, thread_id, mutex.owner_thread
                        ),
                    );
                    self.tsan_reports.push(report.clone());
                    error = Some(report);
                }
                mutex.release_clock = thread.release();
                if mutex.lock_count > 0 {
                    mutex.lock_count -= 1;
                }
                if mutex.lock_count == 0 {
                    mutex.owner_thread = 0;
                }
            }
        }

        // Update deadlock detector.
        self.tsan_deadlock_detector.released(thread_id, mutex_id);

        error
    }

    /// Read-lock a mutex (shared lock).
    pub fn tsan_mutex_read_lock(
        &mut self,
        thread_id: u32,
        mutex_id: u64,
    ) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;

        if let Some(mutex) = self.tsan_mutexes.get(&mutex_id) {
            if !mutex.is_destroyed {
                let release_clock = mutex.release_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                    thread.held_mutexes.push(mutex_id);
                }
            }
        }

        if let Some(mutex) = self.tsan_mutexes.get_mut(&mutex_id) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = true;
        }

        self.tsan_deadlock_detector.acquired(thread_id, mutex_id);
        None
    }

    /// Destroy a mutex.
    pub fn tsan_mutex_destroy(&mut self, mutex_id: u64) -> Option<TSanErrorReport> {
        if let Some(mutex) = self.tsan_mutexes.get(&mutex_id) {
            if mutex.lock_count > 0 {
                let report = TSanErrorReport::new(
                    TSanErrorKind::DestroyLockedMutex,
                    format!("destroying locked mutex {}", mutex_id),
                );
                self.tsan_reports.push(report.clone());
                return Some(report);
            }
        }
        if let Some(mutex) = self.tsan_mutexes.get_mut(&mutex_id) {
            mutex.is_destroyed = true;
        }
        None
    }

    // ========================================================================
    // TSan Condition Variable Operations
    // ========================================================================

    /// Wait on a condition variable (release mutex, wait, reacquire).
    pub fn tsan_cond_wait(&mut self, thread_id: u32, cond_id: u64, mutex_id: u64) {
        self.tsan_event_count += 1;
        // Release the mutex before waiting.
        self.tsan_mutex_unlock(thread_id, mutex_id);
        // (Wait happens here.)
        // Reacquire the mutex after signal.
        self.tsan_mutex_lock(thread_id, mutex_id);
        let _ = cond_id;
    }

    /// Signal a condition variable.
    pub fn tsan_cond_signal(&mut self, thread_id: u32, cond_id: u64) {
        self.tsan_event_count += 1;
        // Advance thread clock (release semantics).
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
        }
        let _ = cond_id;
    }

    /// Broadcast a condition variable.
    pub fn tsan_cond_broadcast(&mut self, thread_id: u32, cond_id: u64) {
        // Same as signal but wakes all waiters.
        self.tsan_cond_signal(thread_id, cond_id);
    }

    // ========================================================================
    // TSan Barrier Operations
    // ========================================================================

    /// Thread arrives at a barrier.
    pub fn tsan_barrier_wait(&mut self, thread_id: u32, barrier_id: u64) {
        self.tsan_event_count += 1;
        // Release semantics before barrier, acquire after.
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
        }
        // In a real implementation, we'd synchronize all threads at the barrier.
        let _ = barrier_id;
    }

    // ========================================================================
    // TSan Semaphore Operations
    // ========================================================================

    /// Wait on a semaphore (acquire semantics).
    pub fn tsan_sem_wait(&mut self, thread_id: u32, sem_id: u64) {
        self.tsan_event_count += 1;
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
        }
        let _ = sem_id;
    }

    /// Post to a semaphore (release semantics).
    pub fn tsan_sem_post(&mut self, thread_id: u32, sem_id: u64) {
        self.tsan_event_count += 1;
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
        }
        let _ = sem_id;
    }

    // ========================================================================
    // TSan Signal Synchronization
    // ========================================================================

    /// Enter a signal handler: happens-before from signal sender.
    pub fn tsan_signal_enter(&mut self, thread_id: u32, signum: i32) -> Option<TSanErrorReport> {
        self.tsan_event_count += 1;

        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.in_signal_handler = true;
            thread.signal_number = Some(signum);
            thread.tick();
        }
        None
    }

    /// Exit a signal handler: happens-before to signal completer.
    pub fn tsan_signal_exit(&mut self, thread_id: u32) {
        self.tsan_event_count += 1;
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.in_signal_handler = false;
            thread.signal_number = None;
            thread.tick();
        }
    }

    /// Check if a function call in a signal handler is safe.
    pub fn tsan_check_signal_safety(
        &mut self,
        thread_id: u32,
        function_name: &str,
    ) -> Option<TSanErrorReport> {
        if !self.flags.tsan_options.check_signal_safety {
            return None;
        }

        if !self.tsan_signal_safety.is_signal_safe(function_name) {
            let signal = self
                .tsan_threads
                .get(&thread_id)
                .and_then(|t| t.signal_number)
                .unwrap_or(0);

            let report = TSanErrorReport::signal_unsafe_call(
                thread_id,
                function_name,
                signal,
                MTSanStackTrace::capture(4),
            );
            self.tsan_reports.push(report.clone());
            Some(report)
        } else {
            None
        }
    }

    // ========================================================================
    // Combined Operations
    // ========================================================================

    /// Perform both MSan and TSan checks for a load.
    pub fn combined_load_check(
        &mut self,
        thread_id: u32,
        addr: u64,
        size: usize,
    ) -> (Option<MSanErrorReport>, Option<TSanRaceInfo>) {
        let msan_result = if self.flags.msan_enabled {
            self.msan_check_read(addr, size, thread_id)
        } else {
            None
        };
        let tsan_result = if self.flags.tsan_enabled {
            self.tsan_load(thread_id, addr, size)
        } else {
            None
        };
        (msan_result, tsan_result)
    }

    /// Perform both MSan and TSan checks for a store.
    pub fn combined_store_check(
        &mut self,
        thread_id: u32,
        addr: u64,
        shadow_bytes: &[u8],
        origin: u32,
    ) -> Option<TSanRaceInfo> {
        if self.flags.msan_enabled {
            self.msan_check_write(addr, shadow_bytes, origin);
        }
        if self.flags.tsan_enabled {
            self.tsan_store(thread_id, addr, shadow_bytes.len())
        } else {
            None
        }
    }

    /// Intercept pthread_create: creates a TSan thread and happens-before edge.
    pub fn combined_pthread_create(
        &mut self,
        creator_thread_id: u32,
    ) -> (u32, Option<TSanErrorReport>) {
        let child_id = self.tsan_thread_create();

        // Happens-before: creator → child.
        if let Some(creator) = self.tsan_threads.get_mut(&creator_thread_id) {
            creator.tick();
            let release_clock = creator.release();
            if let Some(child) = self.tsan_threads.get_mut(&child_id) {
                child.acquire(&release_clock);
            }
        }

        (child_id, None)
    }

    /// Intercept pthread_join: creates a happens-before edge.
    pub fn combined_pthread_join(
        &mut self,
        joiner_id: u32,
        joinee_id: u32,
    ) -> Option<TSanErrorReport> {
        self.tsan_thread_join(joiner_id, joinee_id);
        None
    }

    /// Intercept pthread_mutex_lock.
    pub fn combined_mutex_lock(
        &mut self,
        thread_id: u32,
        mutex_id: u64,
    ) -> Option<TSanErrorReport> {
        // Also check signal safety if in signal handler.
        if let Some(thread) = self.tsan_threads.get(&thread_id) {
            if thread.in_signal_handler {
                return self.tsan_check_signal_safety(thread_id, "pthread_mutex_lock");
            }
        }
        self.tsan_mutex_lock(thread_id, mutex_id)
    }

    /// Intercept pthread_mutex_unlock.
    pub fn combined_mutex_unlock(
        &mut self,
        thread_id: u32,
        mutex_id: u64,
    ) -> Option<TSanErrorReport> {
        self.tsan_mutex_unlock(thread_id, mutex_id)
    }

    /// Intercept pthread_cond_wait.
    pub fn combined_cond_wait(&mut self, thread_id: u32, cond_id: u64, mutex_id: u64) {
        self.tsan_cond_wait(thread_id, cond_id, mutex_id);
    }

    /// Intercept pthread_cond_signal.
    pub fn combined_cond_signal(&mut self, thread_id: u32, cond_id: u64) {
        self.tsan_cond_signal(thread_id, cond_id);
    }

    /// Intercept pthread_barrier_wait.
    pub fn combined_barrier_wait(&mut self, thread_id: u32, barrier_id: u64) {
        self.tsan_barrier_wait(thread_id, barrier_id);
    }

    /// Intercept sem_wait.
    pub fn combined_sem_wait(&mut self, thread_id: u32, sem_id: u64) {
        self.tsan_sem_wait(thread_id, sem_id);
    }

    /// Intercept sem_post.
    pub fn combined_sem_post(&mut self, thread_id: u32, sem_id: u64) {
        self.tsan_sem_post(thread_id, sem_id);
    }

    // ========================================================================
    // Reporting and Statistics
    // ========================================================================

    /// Get all MSan errors.
    pub fn msan_errors(&self) -> &[MSanErrorReport] {
        &self.msan_reports
    }

    /// Get all TSan errors.
    pub fn tsan_errors(&self) -> &[TSanErrorReport] {
        &self.tsan_reports
    }

    /// Get the total number of errors.
    pub fn total_errors(&self) -> usize {
        self.msan_reports.len() + self.tsan_reports.len()
    }

    /// Check if there are any errors.
    pub fn has_errors(&self) -> bool {
        !self.msan_reports.is_empty() || !self.tsan_reports.is_empty()
    }

    /// Print a summary of all findings.
    pub fn print_summary(&self) -> String {
        let mut s = String::new();
        s.push_str("========================================\n");
        s.push_str("X86 MTSan Full Runtime Summary\n");
        s.push_str("========================================\n");

        s.push_str(&format!("MSan enabled: {}\n", self.flags.msan_enabled));
        s.push_str(&format!("TSan enabled: {}\n", self.flags.tsan_enabled));
        s.push_str(&format!(
            "Origin tracking: {}\n",
            self.msan_shadow.track_origins
        ));

        s.push_str("\n--- MSan Statistics ---\n");
        s.push_str(&format!("  Accesses tracked: {}\n", self.msan_access_count));
        s.push_str(&format!(
            "  Propagation ops: {}\n",
            self.msan_propagation_count
        ));
        s.push_str(&format!(
            "  Shadow bytes: {}\n",
            self.msan_shadow.total_shadow_bytes
        ));
        s.push_str(&format!(
            "  Origin entries: {}\n",
            self.origin_registry.len()
        ));
        s.push_str(&format!("  Errors: {}\n", self.msan_reports.len()));

        s.push_str("\n--- TSan Statistics ---\n");
        s.push_str(&format!("  Threads tracked: {}\n", self.tsan_threads.len()));
        s.push_str(&format!("  Events processed: {}\n", self.tsan_event_count));
        s.push_str(&format!("  Lock operations: {}\n", self.tsan_lock_ops));
        s.push_str(&format!("  Mutexes tracked: {}\n", self.tsan_mutexes.len()));
        s.push_str(&format!("  Races detected: {}\n", self.tsan_race_count));
        s.push_str(&format!("  Errors: {}\n", self.tsan_reports.len()));
        s.push_str(&format!(
            "  Suppressions loaded: {}\n",
            self.suppressions.len()
        ));

        if self.has_errors() {
            s.push_str("\n--- Error Reports ---\n");
            for report in &self.msan_reports {
                s.push_str(&report.format(Some(&self.origin_registry)));
            }
            for report in &self.tsan_reports {
                s.push_str(&report.format());
            }
        }

        s.push_str("========================================\n");
        s
    }

    /// Get combined statistics.
    pub fn stats(&self) -> MTSanStats {
        MTSanStats {
            msan_access_count: self.msan_access_count,
            msan_propagation_count: self.msan_propagation_count,
            msan_shadow_bytes: self.msan_shadow.total_shadow_bytes,
            msan_origin_entries: self.origin_registry.len(),
            msan_error_count: self.msan_reports.len(),
            tsan_thread_count: self.tsan_threads.len(),
            tsan_event_count: self.tsan_event_count,
            tsan_lock_ops: self.tsan_lock_ops,
            tsan_mutex_count: self.tsan_mutexes.len(),
            tsan_race_count: self.tsan_race_count,
            tsan_error_count: self.tsan_reports.len(),
            initialized: self.initialized,
        }
    }

    /// Check for thread leaks (threads created but never joined).
    pub fn check_thread_leaks(&self) -> Vec<TSanErrorReport> {
        if !self.flags.tsan_options.report_thread_leaks {
            return Vec::new();
        }
        let mut leaks = Vec::new();
        for (&tid, thread) in &self.tsan_threads {
            if !thread.is_joined && !thread.is_detached && thread.is_tracked && tid != 0 {
                let report = TSanErrorReport::thread_leak(tid, thread.creation_stack.clone());
                leaks.push(report);
            }
        }
        leaks
    }

    /// Finalize the runtime: check for leaks, print stats.
    pub fn finalize(&mut self) {
        // Check for thread leaks.
        let leaks = self.check_thread_leaks();
        for leak in leaks {
            self.tsan_reports.push(leak);
        }

        // Print stats if configured.
        if self.flags.msan_options.print_stats {
            eprintln!("{}", self.print_summary());
        }
    }
}

impl Default for X86MTSanFull {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// Combined Statistics
// ============================================================================

/// Statistics for the combined MTSan runtime.
#[derive(Debug, Clone)]
pub struct MTSanStats {
    pub msan_access_count: usize,
    pub msan_propagation_count: usize,
    pub msan_shadow_bytes: usize,
    pub msan_origin_entries: usize,
    pub msan_error_count: usize,
    pub tsan_thread_count: usize,
    pub tsan_event_count: usize,
    pub tsan_lock_ops: usize,
    pub tsan_mutex_count: usize,
    pub tsan_race_count: usize,
    pub tsan_error_count: usize,
    pub initialized: bool,
}

impl fmt::Display for MTSanStats {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(
            f,
            "MTSanStats {{ msan_access={}, msan_prop={}, msan_errors={}, \
             tsan_events={}, tsan_races={}, tsan_errors={}, initialized={} }}",
            self.msan_access_count,
            self.msan_propagation_count,
            self.msan_error_count,
            self.tsan_event_count,
            self.tsan_race_count,
            self.tsan_error_count,
            self.initialized,
        )
    }
}

// ============================================================================
// Extended MSan Interceptors (Additional libc Functions)
// ============================================================================

impl X86MTSanFull {
    /// Intercept strcat: copy shadow from src to end of dst, including null.
    pub fn msan_intercept_strcat(&mut self, dst: u64, src: u64) {
        let mut dst_end = dst;
        // Find end of dst (shadow propagation).
        loop {
            dst_end += 1;
            if dst_end > dst + 65536 {
                break;
            }
        }
        MSanInterceptors::intercept_strcpy(&mut self.msan_shadow, dst_end, src);
    }

    /// Intercept strncat: copy up to n bytes plus null.
    pub fn msan_intercept_strncat(&mut self, dst: u64, src: u64, n: usize) {
        let mut dst_end = dst;
        loop {
            dst_end += 1;
            if dst_end > dst + 65536 {
                break;
            }
        }
        for i in 0..n {
            let s = self.msan_shadow.get_shadow(src + i as u64);
            self.msan_shadow.set_shadow(dst_end + i as u64, s);
        }
        // Null terminator.
        self.msan_shadow
            .set_shadow(dst_end + n as u64, MSAN_SHADOW_INIT);
    }

    /// Intercept strcmp: check both strings for uninitialized memory.
    pub fn msan_intercept_strcmp(&self, s1: u64, s2: u64) -> (bool, bool) {
        let mut s1_init = true;
        let mut s2_init = true;
        for i in 0..65536u64 {
            if self.msan_shadow.get_shadow(s1 + i) != MSAN_SHADOW_INIT {
                s1_init = false;
            }
            if self.msan_shadow.get_shadow(s2 + i) != MSAN_SHADOW_INIT {
                s2_init = false;
            }
            if i > 65534 {
                break;
            }
        }
        (s1_init, s2_init)
    }

    /// Intercept strncmp: check up to n bytes.
    pub fn msan_intercept_strncmp(&self, s1: u64, s2: u64, n: usize) -> (bool, bool) {
        let mut s1_init = true;
        let mut s2_init = true;
        for i in 0..n {
            if self.msan_shadow.get_shadow(s1 + i as u64) != MSAN_SHADOW_INIT {
                s1_init = false;
            }
            if self.msan_shadow.get_shadow(s2 + i as u64) != MSAN_SHADOW_INIT {
                s2_init = false;
            }
        }
        (s1_init, s2_init)
    }

    /// Intercept memchr: check the search region for initialization.
    pub fn msan_intercept_memchr(&self, ptr: u64, n: usize) -> bool {
        for i in 0..n {
            if self.msan_shadow.get_shadow(ptr + i as u64) != MSAN_SHADOW_INIT {
                return false;
            }
        }
        true
    }

    /// Intercept strchr: check string for initialization.
    pub fn msan_intercept_strchr(&self, s: u64) -> bool {
        for i in 0..65536u64 {
            if self.msan_shadow.get_shadow(s + i) != MSAN_SHADOW_INIT {
                return false;
            }
        }
        true
    }

    /// Intercept strrchr: same as strchr.
    pub fn msan_intercept_strrchr(&self, s: u64) -> bool {
        self.msan_intercept_strchr(s)
    }

    /// Intercept strstr: check both strings.
    pub fn msan_intercept_strstr(&self, haystack: u64, needle: u64) -> (bool, bool) {
        let (h_init, n_init) = self.msan_intercept_strcmp(haystack, needle);
        (h_init, n_init)
    }

    /// Intercept atoi/atol/atoll: check the string.
    pub fn msan_intercept_atoi(&self, s: u64) -> bool {
        self.msan_intercept_strchr(s)
    }

    /// Intercept strtol: check the string and store endptr shadow.
    pub fn msan_intercept_strtol(&mut self, s: u64, endptr: u64) -> bool {
        let s_init = self.msan_intercept_strchr(s);
        // Store clean shadow for *endptr (it's written by strtol).
        if endptr != 0 {
            self.msan_shadow.clear_shadow_range(endptr, 8);
        }
        s_init
    }

    /// Intercept strtod: check the string.
    pub fn msan_intercept_strtod(&mut self, s: u64, endptr: u64) -> bool {
        self.msan_intercept_strtol(s, endptr)
    }

    /// Intercept bcmp/bcopy/bzero legacy functions.
    pub fn msan_intercept_bcmp(&self, s1: u64, s2: u64, n: usize) -> (bool, bool) {
        let mut s1_init = true;
        let mut s2_init = true;
        for i in 0..n {
            if self.msan_shadow.get_shadow(s1 + i as u64) != MSAN_SHADOW_INIT {
                s1_init = false;
            }
            if self.msan_shadow.get_shadow(s2 + i as u64) != MSAN_SHADOW_INIT {
                s2_init = false;
            }
        }
        (s1_init, s2_init)
    }

    pub fn msan_intercept_bcopy(&mut self, src: u64, dst: u64, n: usize) {
        MSanInterceptors::intercept_memcpy(&mut self.msan_shadow, dst, src, n);
    }

    pub fn msan_intercept_bzero(&mut self, dst: u64, n: usize) {
        self.msan_shadow.clear_shadow_range(dst, n);
    }
}

// ============================================================================
// MSan mmap/munmap/brk/sbrk Interceptors
// ============================================================================

/// MSan interceptor for memory mapping operations.
#[derive(Debug)]
pub struct MSanMappingTracker {
    /// Known memory mappings: (start, size, is_initialized, origin).
    pub mappings: Vec<MSanMemoryMapping>,
    /// Total bytes mapped.
    pub total_mapped: usize,
}

#[derive(Debug, Clone)]
pub struct MSanMemoryMapping {
    pub start: u64,
    pub size: usize,
    pub is_initialized: bool,
    pub origin: u32,
    pub prot: u32,
    pub flags: u32,
}

impl MSanMappingTracker {
    pub fn new() -> Self {
        Self {
            mappings: Vec::new(),
            total_mapped: 0,
        }
    }

    pub fn add_mapping(&mut self, start: u64, size: usize, prot: u32, flags: u32) {
        self.mappings.push(MSanMemoryMapping {
            start,
            size,
            is_initialized: false,
            origin: MSAN_ORIGIN_CLEAN,
            prot,
            flags,
        });
        self.total_mapped += size;
    }

    pub fn remove_mapping(&mut self, start: u64, size: usize) {
        self.mappings
            .retain(|m| !(m.start >= start && m.start + m.size as u64 <= start + size as u64));
    }

    pub fn find_mapping(&self, addr: u64) -> Option<&MSanMemoryMapping> {
        self.mappings
            .iter()
            .find(|m| addr >= m.start && addr < m.start + m.size as u64)
    }

    pub fn mark_initialized(&mut self, addr: u64, size: usize) {
        for mapping in &mut self.mappings {
            if addr >= mapping.start && addr < mapping.start + mapping.size as u64 {
                mapping.is_initialized = true;
            }
        }
    }
}

impl Default for MSanMappingTracker {
    fn default() -> Self {
        Self::new()
    }
}

impl X86MTSanFull {
    /// Intercept mmap: track the new mapping and initialize its shadow.
    pub fn msan_intercept_mmap(
        &mut self,
        addr: u64,
        length: usize,
        prot: u32,
        flags: u32,
        fd: i32,
        offset: u64,
    ) -> u64 {
        // In real compiler-rt: call the real mmap.
        let result = addr; // Simplified: return the requested address.
        if result != 0 && result != u64::MAX {
            self.msan_shadow.clear_shadow_range(result, length);
            if self.msan_shadow.track_origins {
                let origin = self.origin_registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!(
                        "mmap(addr={:#x}, len={}, prot={}, flags={}, fd={}, off={})",
                        addr, length, prot, flags, fd, offset
                    ),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                self.msan_shadow.set_origin_range(result, length, origin);
            }
        }
        result
    }

    /// Intercept munmap: poison the unmapped region.
    pub fn msan_intercept_munmap(&mut self, addr: u64, length: usize) {
        self.msan_shadow.poison_shadow_range(addr, length);
        if self.msan_shadow.track_origins {
            self.msan_shadow
                .set_origin_range(addr, length, MSAN_ORIGIN_FREED);
        }
    }

    /// Intercept brk/sbrk: track program break changes.
    pub fn msan_intercept_brk(&mut self, new_brk: u64, old_brk: u64) {
        if new_brk > old_brk {
            let size = (new_brk - old_brk) as usize;
            self.msan_shadow.clear_shadow_range(old_brk, size);
            if self.msan_shadow.track_origins {
                let origin = self.origin_registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("brk({:#x})", new_brk),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                self.msan_shadow.set_origin_range(old_brk, size, origin);
            }
        } else if new_brk < old_brk {
            let size = (old_brk - new_brk) as usize;
            self.msan_shadow.poison_shadow_range(new_brk, size);
        }
    }
}

// ============================================================================
// TSan Read-Write Lock Support (pthread_rwlock_*)
// ============================================================================

/// Read-write lock state for TSan.
#[derive(Debug, Clone)]
pub struct TSanRWLockState {
    /// Unique lock ID.
    pub id: u64,
    /// Threads that hold a read lock.
    pub read_holders: Vec<u32>,
    /// Thread that holds the write lock (if any).
    pub write_holder: Option<u32>,
    /// Release clock from last unlock.
    pub release_clock: VectorClock,
    /// Whether the lock has been destroyed.
    pub is_destroyed: bool,
    /// Creation stack.
    pub creation_stack: MTSanStackTrace,
}

impl TSanRWLockState {
    pub fn new(id: u64, creation_stack: MTSanStackTrace) -> Self {
        Self {
            id,
            read_holders: Vec::new(),
            write_holder: None,
            release_clock: VectorClock::new(),
            is_destroyed: false,
            creation_stack,
        }
    }
}

impl X86MTSanFull {
    /// Create a new read-write lock for TSan tracking.
    pub fn tsan_rwlock_create(&mut self) -> u64 {
        let id = self.tsan_next_mutex_id.fetch_add(1, Ordering::Relaxed);
        // We store rwlock state alongside mutexes (under a separate key space).
        self.tsan_mutexes.insert(
            id | 0x8000_0000_0000_0000, // High bit distinguishes rwlocks.
            TSanMutexState::new(id, MTSanStackTrace::capture(4)),
        );
        id
    }

    /// Read-lock a read-write lock (multiple readers allowed).
    pub fn tsan_rwlock_rdlock(
        &mut self,
        thread_id: u32,
        rwlock_id: u64,
    ) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;
        self.tsan_event_count += 1;

        let key = rwlock_id | 0x8000_0000_0000_0000;
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if !mutex.is_destroyed {
                let release_clock = mutex.release_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                    thread.held_mutexes.push(key);
                }
            }
        }

        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = true;
        }

        // Deadlock check.
        if self.flags.tsan_options.detect_deadlocks {
            if let Some(cycle) = self.tsan_deadlock_detector.try_acquire(thread_id, key) {
                let stacks: Vec<_> = cycle.iter().map(|_| MTSanStackTrace::capture(6)).collect();
                let report = TSanErrorReport::deadlock(cycle, stacks);
                self.tsan_reports.push(report.clone());
                return Some(report);
            }
        }
        self.tsan_deadlock_detector.acquired(thread_id, key);

        None
    }

    /// Write-lock a read-write lock (exclusive access).
    pub fn tsan_rwlock_wrlock(
        &mut self,
        thread_id: u32,
        rwlock_id: u64,
    ) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;
        self.tsan_event_count += 1;

        let key = rwlock_id | 0x8000_0000_0000_0000;
        // Write lock has exclusive semantics: must wait for all readers to finish.
        // We simulate by acquiring the release clock.
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if !mutex.is_destroyed {
                let release_clock = mutex.release_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                    thread.held_mutexes.push(key);
                }
            }
        }

        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = false;
        }

        // Deadlock check.
        if self.flags.tsan_options.detect_deadlocks {
            if let Some(cycle) = self.tsan_deadlock_detector.try_acquire(thread_id, key) {
                let stacks: Vec<_> = cycle.iter().map(|_| MTSanStackTrace::capture(6)).collect();
                let report = TSanErrorReport::deadlock(cycle, stacks);
                self.tsan_reports.push(report.clone());
                return Some(report);
            }
        }
        self.tsan_deadlock_detector.acquired(thread_id, key);

        None
    }

    /// Unlock a read-write lock.
    pub fn tsan_rwlock_unlock(
        &mut self,
        thread_id: u32,
        rwlock_id: u64,
    ) -> Option<TSanErrorReport> {
        self.tsan_lock_ops += 1;
        self.tsan_event_count += 1;

        let key = rwlock_id | 0x8000_0000_0000_0000;
        // Release semantics: advance thread clock.
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
            thread.held_mutexes.retain(|&m| m != key);
        }

        if let Some(thread) = self.tsan_threads.get(&thread_id) {
            if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
                mutex.release_clock = thread.release();
                if mutex.lock_count > 0 {
                    mutex.lock_count -= 1;
                }
                if mutex.lock_count == 0 {
                    mutex.owner_thread = 0;
                }
            }
        }

        self.tsan_deadlock_detector.released(thread_id, key);
        None
    }

    /// Destroy a read-write lock.
    pub fn tsan_rwlock_destroy(&mut self, rwlock_id: u64) -> Option<TSanErrorReport> {
        let key = rwlock_id | 0x8000_0000_0000_0000;
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if mutex.lock_count > 0 {
                let report = TSanErrorReport::new(
                    TSanErrorKind::DestroyLockedMutex,
                    format!("destroying locked rwlock {}", rwlock_id),
                );
                self.tsan_reports.push(report.clone());
                return Some(report);
            }
        }
        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.is_destroyed = true;
        }
        None
    }

    /// Try to read-lock (non-blocking).
    pub fn tsan_rwlock_tryrdlock(&mut self, thread_id: u32, rwlock_id: u64) -> bool {
        // Non-blocking: no deadlock check needed.
        let key = rwlock_id | 0x8000_0000_0000_0000;
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if mutex.is_destroyed {
                return false;
            }
            let release_clock = mutex.release_clock.clone();
            if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                thread.acquire(&release_clock);
                thread.held_mutexes.push(key);
            }
        }
        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = true;
        }
        self.tsan_lock_ops += 1;
        true
    }

    /// Try to write-lock (non-blocking).
    pub fn tsan_rwlock_trywrlock(&mut self, thread_id: u32, rwlock_id: u64) -> bool {
        let key = rwlock_id | 0x8000_0000_0000_0000;
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if mutex.is_destroyed || mutex.lock_count > 0 {
                return false;
            }
            let release_clock = mutex.release_clock.clone();
            if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                thread.acquire(&release_clock);
                thread.held_mutexes.push(key);
            }
        }
        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
            mutex.is_read_lock = false;
        }
        self.tsan_lock_ops += 1;
        true
    }
}

// ============================================================================
// TSan SpinLock Support
// ============================================================================

/// Spinlock state for TSan tracking.
#[derive(Debug, Clone)]
pub struct TSanSpinLockState {
    pub id: u64,
    pub owner_thread: u32,
    pub locked: bool,
    pub release_clock: VectorClock,
}

impl TSanSpinLockState {
    pub fn new(id: u64) -> Self {
        Self {
            id,
            owner_thread: 0,
            locked: false,
            release_clock: VectorClock::new(),
        }
    }
}

impl X86MTSanFull {
    /// Create a spinlock.
    pub fn tsan_spinlock_create(&mut self) -> u64 {
        let id = self.tsan_next_mutex_id.fetch_add(1, Ordering::Relaxed);
        self.tsan_mutexes.insert(
            id | 0x4000_0000_0000_0000, // Distinct key space for spinlocks.
            TSanMutexState::new(id, MTSanStackTrace::capture(4)),
        );
        id
    }

    /// Lock a spinlock.
    pub fn tsan_spinlock_lock(&mut self, thread_id: u32, spinlock_id: u64) {
        self.tsan_lock_ops += 1;
        let key = spinlock_id | 0x4000_0000_0000_0000;
        if let Some(mutex) = self.tsan_mutexes.get(&key) {
            if !mutex.is_destroyed {
                let release_clock = mutex.release_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                    thread.held_mutexes.push(key);
                }
            }
        }
        if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
            mutex.owner_thread = thread_id;
            mutex.lock_count += 1;
        }
    }

    /// Unlock a spinlock.
    pub fn tsan_spinlock_unlock(&mut self, thread_id: u32, spinlock_id: u64) {
        self.tsan_lock_ops += 1;
        let key = spinlock_id | 0x4000_0000_0000_0000;
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
            thread.held_mutexes.retain(|&m| m != key);
        }
        if let Some(thread) = self.tsan_threads.get(&thread_id) {
            if let Some(mutex) = self.tsan_mutexes.get_mut(&key) {
                mutex.release_clock = thread.release();
                if mutex.lock_count > 0 {
                    mutex.lock_count -= 1;
                }
                if mutex.lock_count == 0 {
                    mutex.owner_thread = 0;
                }
            }
        }
    }
}

// ============================================================================
// TSan External Annotation API (__tsan_acquire, __tsan_release, etc.)
// ============================================================================

impl X86MTSanFull {
    /// Generic acquire: thread acquires the release clock from an external source.
    /// Corresponds to __tsan_acquire(void *addr) in the compiler-rt API.
    pub fn tsan_external_acquire(&mut self, thread_id: u32, addr: u64) {
        self.tsan_event_count += 1;
        // Acquire the release clock associated with this address.
        let cell_key = addr / TSAN_SHADOW_GRANULARITY as u64;
        if let Some(cell) = self.tsan_shadow.get(&cell_key) {
            if cell.last_thread != thread_id {
                let release_clock = cell.write_clock.clone();
                if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                    thread.acquire(&release_clock);
                }
            }
        }
    }

    /// Generic release: thread releases its clock for an external consumer.
    /// Corresponds to __tsan_release(void *addr) in the compiler-rt API.
    pub fn tsan_external_release(&mut self, thread_id: u32, addr: u64) {
        self.tsan_event_count += 1;
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.tick();
            let clock = thread.clock.clone();
            let cell_key = addr / TSAN_SHADOW_GRANULARITY as u64;
            let history_size = self.flags.tsan_options.history_size;
            let cell = self
                .tsan_shadow
                .entry(cell_key)
                .or_insert_with(|| TSanShadowCell::new(history_size));
            cell.write_clock = clock;
            cell.last_thread = thread_id;
            cell.last_write = true;
        }
    }

    /// Annotate a happens-before relationship.
    /// Corresponds to AnnotateHappensBefore(addr).
    pub fn tsan_annotate_happens_before(&mut self, addr: u64) {
        // Store the happens-before marker at the address.
        let cell_key = addr / TSAN_SHADOW_GRANULARITY as u64;
        let history_size = self.flags.tsan_options.history_size;
        self.tsan_shadow
            .entry(cell_key)
            .or_insert_with(|| TSanShadowCell::new(history_size));
    }

    /// Annotate a happens-after relationship.
    /// Corresponds to AnnotateHappensAfter(addr).
    pub fn tsan_annotate_happens_after(&mut self, thread_id: u32, addr: u64) {
        let cell_key = addr / TSAN_SHADOW_GRANULARITY as u64;
        if let Some(cell) = self.tsan_shadow.get(&cell_key) {
            let release_clock = cell.write_clock.clone();
            if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
                thread.acquire(&release_clock);
            }
        }
    }

    /// Annotate condition variable signal.
    pub fn tsan_annotate_condvar_signal(&mut self, thread_id: u32, cv: u64) {
        self.tsan_external_release(thread_id, cv);
    }

    /// Annotate condition variable wait.
    pub fn tsan_annotate_condvar_wait(&mut self, thread_id: u32, cv: u64) {
        self.tsan_external_acquire(thread_id, cv);
    }

    /// Annotate RWLock creation.
    pub fn tsan_annotate_rwlock_create(&mut self, lock: u64) {
        self.tsan_annotate_happens_before(lock);
    }

    /// Annotate RWLock acquired.
    pub fn tsan_annotate_rwlock_acquired(&mut self, thread_id: u32, lock: u64, is_write: bool) {
        let _ = is_write;
        self.tsan_external_acquire(thread_id, lock);
    }

    /// Annotate RWLock released.
    pub fn tsan_annotate_rwlock_released(&mut self, thread_id: u32, lock: u64, is_write: bool) {
        let _ = is_write;
        self.tsan_external_release(thread_id, lock);
    }

    /// Annotate that a piece of memory should be ignored by TSan.
    pub fn tsan_annotate_ignore_reads_begin(&self) {
        // In production: set a thread-local flag to ignore reads.
    }

    pub fn tsan_annotate_ignore_reads_end(&self) {
        // Clear the ignore flag.
    }

    pub fn tsan_annotate_ignore_writes_begin(&self) {
        // In production: set a thread-local flag to ignore writes.
    }

    pub fn tsan_annotate_ignore_writes_end(&self) {
        // Clear the ignore flag.
    }

    /// Annotate that a memory region is expected to race (benign race).
    pub fn tsan_annotate_benign_race(&self, addr: u64, size: usize, description: &str) {
        // In production: register a suppression for this address+size.
        let _ = (addr, size, description);
    }
}

// ============================================================================
// TSan Race Deduplication and Throttling
// ============================================================================

/// Race report deduplication: prevents flooding when the same race
/// is detected repeatedly.
#[derive(Debug)]
pub struct TSanRaceDeduplicator {
    /// Set of race hashes already reported.
    pub reported_hashes: HashSet<u64>,
    /// Maximum unique races to report.
    pub max_reports: usize,
    /// Throttling: minimum interval between reports of the same race.
    pub throttle_interval: Duration,
    /// Last report time for each hash.
    pub last_report_times: HashMap<u64, Instant>,
}

impl TSanRaceDeduplicator {
    pub fn new(max_reports: usize) -> Self {
        Self {
            reported_hashes: HashSet::new(),
            max_reports,
            throttle_interval: Duration::from_secs(1),
            last_report_times: HashMap::new(),
        }
    }

    /// Compute a hash for a race (based on address and thread IDs).
    pub fn hash_race(addr: u64, thread1: u32, thread2: u32) -> u64 {
        use std::collections::hash_map::DefaultHasher;
        use std::hash::{Hash, Hasher};
        let mut hasher = DefaultHasher::new();
        addr.hash(&mut hasher);
        let (t1, t2) = if thread1 < thread2 {
            (thread1, thread2)
        } else {
            (thread2, thread1)
        };
        t1.hash(&mut hasher);
        t2.hash(&mut hasher);
        hasher.finish()
    }

    /// Check if a race should be reported (not suppressed and not throttled).
    pub fn should_report(&mut self, addr: u64, thread1: u32, thread2: u32) -> bool {
        if self.reported_hashes.len() >= self.max_reports {
            return false;
        }
        let hash = Self::hash_race(addr, thread1, thread2);
        let now = Instant::now();
        if let Some(&last_time) = self.last_report_times.get(&hash) {
            if now.duration_since(last_time) < self.throttle_interval {
                return false;
            }
        }
        self.reported_hashes.insert(hash);
        self.last_report_times.insert(hash, now);
        true
    }

    pub fn reported_count(&self) -> usize {
        self.reported_hashes.len()
    }
}

impl Default for TSanRaceDeduplicator {
    fn default() -> Self {
        Self::new(1000)
    }
}

impl X86MTSanFull {
    /// Check and deduplicate a race before reporting.
    pub fn tsan_maybe_report_race(
        &mut self,
        dedup: &mut TSanRaceDeduplicator,
        addr: u64,
        thread1: u32,
        thread2: u32,
        size: usize,
        is_write1: bool,
        is_write2: bool,
    ) {
        if dedup.should_report(addr, thread1, thread2) {
            let report = TSanErrorReport::data_race(
                addr,
                size,
                thread1,
                thread2,
                is_write1,
                is_write2,
                MTSanStackTrace::capture(4),
                MTSanStackTrace::capture(4),
            );
            self.tsan_reports.push(report);
        }
    }
}

// ============================================================================
// TSan Event Recording and Trace Replay
// ============================================================================

/// A recorded TSan event for offline analysis.
#[derive(Debug, Clone)]
pub struct TSanTraceEvent {
    pub event_type: TSanTraceEventType,
    pub thread_id: u32,
    pub addr: u64,
    pub size: usize,
    pub is_write: bool,
    pub is_atomic: bool,
    pub ordering: Option<TSanAtomicOrdering>,
    pub timestamp: u64,
    pub stack: MTSanStackTrace,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum TSanTraceEventType {
    Load,
    Store,
    AtomicLoad,
    AtomicStore,
    AtomicRMW,
    AtomicFence,
    MutexLock,
    MutexUnlock,
    ThreadCreate,
    ThreadJoin,
    SignalEnter,
    SignalExit,
}

/// A trace of TSan events for replay-based race detection.
#[derive(Debug)]
pub struct TSanEventTrace {
    pub events: Vec<TSanTraceEvent>,
    pub max_events: usize,
}

impl TSanEventTrace {
    pub fn new(max_events: usize) -> Self {
        Self {
            events: Vec::with_capacity(max_events),
            max_events,
        }
    }

    pub fn record(&mut self, event: TSanTraceEvent) {
        if self.events.len() >= self.max_events {
            self.events.remove(0);
        }
        self.events.push(event);
    }

    pub fn replay_on(&self, runtime: &mut X86MTSanFull) -> Vec<TSanErrorReport> {
        let mut reports = Vec::new();
        for event in &self.events {
            match event.event_type {
                TSanTraceEventType::Load => {
                    if let Some(race) = runtime.tsan_load(event.thread_id, event.addr, event.size) {
                        reports.push(TSanErrorReport::data_race(
                            event.addr,
                            event.size,
                            race.thread1,
                            race.thread2,
                            race.is_write1,
                            race.is_write2,
                            MTSanStackTrace::capture(4),
                            MTSanStackTrace::capture(4),
                        ));
                    }
                }
                TSanTraceEventType::Store => {
                    if let Some(race) = runtime.tsan_store(event.thread_id, event.addr, event.size)
                    {
                        reports.push(TSanErrorReport::data_race(
                            event.addr,
                            event.size,
                            race.thread1,
                            race.thread2,
                            race.is_write1,
                            race.is_write2,
                            MTSanStackTrace::capture(4),
                            MTSanStackTrace::capture(4),
                        ));
                    }
                }
                TSanTraceEventType::AtomicLoad => {
                    let ord = event.ordering.unwrap_or(TSanAtomicOrdering::Relaxed);
                    runtime.tsan_atomic_load(event.thread_id, event.addr, event.size, ord);
                }
                TSanTraceEventType::AtomicStore => {
                    let ord = event.ordering.unwrap_or(TSanAtomicOrdering::Relaxed);
                    runtime.tsan_atomic_store(event.thread_id, event.addr, event.size, ord);
                }
                TSanTraceEventType::MutexLock => {
                    runtime.tsan_mutex_lock(event.thread_id, event.addr);
                }
                TSanTraceEventType::MutexUnlock => {
                    runtime.tsan_mutex_unlock(event.thread_id, event.addr);
                }
                TSanTraceEventType::ThreadCreate => {
                    runtime.tsan_thread_create();
                }
                TSanTraceEventType::ThreadJoin => {
                    // Joiner and joinee from event fields.
                    runtime.tsan_thread_join(event.thread_id, event.addr as u32);
                }
                _ => {}
            }
        }
        reports
    }

    pub fn len(&self) -> usize {
        self.events.len()
    }

    pub fn is_empty(&self) -> bool {
        self.events.is_empty()
    }
}

impl Default for TSanEventTrace {
    fn default() -> Self {
        Self::new(10000)
    }
}

// ============================================================================
// Stack Trace Deduplication and Caching
// ============================================================================

/// Stack trace cache to reduce overhead of repeated trace capture.
#[derive(Debug)]
pub struct StackTraceCache {
    pub cache: HashMap<u64, MTSanStackTrace>,
    pub hits: usize,
    pub misses: usize,
}

impl StackTraceCache {
    pub fn new() -> Self {
        Self {
            cache: HashMap::new(),
            hits: 0,
            misses: 0,
        }
    }

    pub fn get_or_capture(&mut self, hash: u64, depth: usize) -> MTSanStackTrace {
        if let Some(trace) = self.cache.get(&hash) {
            self.hits += 1;
            trace.clone()
        } else {
            self.misses += 1;
            let trace = MTSanStackTrace::capture(depth);
            self.cache.insert(hash, trace.clone());
            trace
        }
    }

    pub fn hit_rate(&self) -> f64 {
        let total = self.hits + self.misses;
        if total == 0 {
            0.0
        } else {
            self.hits as f64 / total as f64
        }
    }
}

impl Default for StackTraceCache {
    fn default() -> Self {
        Self::new()
    }
}

// ============================================================================
// Extended Deadlock Detection Strategies
// ============================================================================

/// Deadlock detection strategy enumeration.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DeadlockStrategy {
    /// Wait-for graph cycle detection (default).
    WaitForGraph,
    /// Lock-timeout heuristic: if a lock is held too long.
    TimeoutHeuristic,
    /// Lock order analysis: static analysis of lock acquisition order.
    LockOrderAnalysis,
    /// Combined: use all strategies.
    Combined,
}

/// Extended deadlock detector with configurable strategies.
#[derive(Debug)]
pub struct ExtendedDeadlockDetector {
    pub base_detector: TSanDeadlockDetector,
    pub strategy: DeadlockStrategy,
    /// Lock hold times: (mutex_id, acquire_time).
    pub lock_hold_times: HashMap<u64, Instant>,
    /// Timeout threshold for the timeout heuristic.
    pub timeout_threshold: Duration,
}

impl ExtendedDeadlockDetector {
    pub fn new(strategy: DeadlockStrategy) -> Self {
        Self {
            base_detector: TSanDeadlockDetector::new(),
            strategy,
            lock_hold_times: HashMap::new(),
            timeout_threshold: Duration::from_secs(60),
        }
    }

    pub fn record_lock_acquired(&mut self, thread_id: u32, mutex_id: u64) {
        self.lock_hold_times.insert(mutex_id, Instant::now());
        self.base_detector.acquired(thread_id, mutex_id);
    }

    pub fn record_lock_released(&mut self, thread_id: u32, mutex_id: u64) {
        self.lock_hold_times.remove(&mutex_id);
        self.base_detector.released(thread_id, mutex_id);
    }

    pub fn check_timeout(&self) -> Vec<u64> {
        let now = Instant::now();
        let mut timed_out = Vec::new();
        for (&mutex_id, &acquire_time) in &self.lock_hold_times {
            if now.duration_since(acquire_time) > self.timeout_threshold {
                timed_out.push(mutex_id);
            }
        }
        timed_out
    }

    pub fn try_acquire(&mut self, thread_id: u32, mutex_id: u64) -> Option<Vec<u32>> {
        match self.strategy {
            DeadlockStrategy::WaitForGraph | DeadlockStrategy::Combined => {
                self.base_detector.try_acquire(thread_id, mutex_id)
            }
            DeadlockStrategy::TimeoutHeuristic => {
                // Simple heuristic: if someone else holds the lock > timeout.
                if self.lock_hold_times.contains_key(&mutex_id) {
                    let now = Instant::now();
                    if let Some(&acquired) = self.lock_hold_times.get(&mutex_id) {
                        if now.duration_since(acquired) > self.timeout_threshold {
                            return Some(vec![thread_id]);
                        }
                    }
                }
                None
            }
            DeadlockStrategy::LockOrderAnalysis => {
                self.base_detector.try_acquire(thread_id, mutex_id)
            }
        }
    }
}

impl Default for ExtendedDeadlockDetector {
    fn default() -> Self {
        Self::new(DeadlockStrategy::WaitForGraph)
    }
}

// ============================================================================
// TSan Performance Throttling
// ============================================================================

/// Performance throttling for TSan to reduce overhead.
#[derive(Debug)]
pub struct TSanThrottle {
    /// Number of events to skip between checks (1 = check every event).
    pub sampling_rate: usize,
    /// Counter since last check.
    pub event_counter: usize,
    /// Whether throttling is active.
    pub enabled: bool,
    /// Total events processed.
    pub total_processed: usize,
    /// Total events skipped due to throttling.
    pub total_skipped: usize,
}

impl TSanThrottle {
    pub fn new(sampling_rate: usize) -> Self {
        Self {
            sampling_rate,
            event_counter: 0,
            enabled: sampling_rate > 1,
            total_processed: 0,
            total_skipped: 0,
        }
    }

    /// Whether the current event should be processed.
    pub fn should_process(&mut self) -> bool {
        if !self.enabled {
            self.total_processed += 1;
            return true;
        }
        self.event_counter += 1;
        if self.event_counter >= self.sampling_rate {
            self.event_counter = 0;
            self.total_processed += 1;
            true
        } else {
            self.total_skipped += 1;
            false
        }
    }

    pub fn skip_rate(&self) -> f64 {
        let total = self.total_processed + self.total_skipped;
        if total == 0 {
            0.0
        } else {
            self.total_skipped as f64 / total as f64
        }
    }
}

impl Default for TSanThrottle {
    fn default() -> Self {
        Self::new(1)
    }
}

// ============================================================================
// File Descriptor Interceptors (MSan)
// ============================================================================

impl X86MTSanFull {
    /// Intercept read(): check buffer shadow after read.
    pub fn msan_intercept_read(&mut self, fd: i32, buf: u64, count: usize) -> isize {
        // After a successful read, the buffer contains initialized data.
        // In real compiler-rt: intercept after the real read call.
        let _ = fd;
        self.msan_shadow.clear_shadow_range(buf, count);
        count as isize
    }

    /// Intercept write(): check buffer for uninitialized data.
    pub fn msan_intercept_write(
        &self,
        fd: i32,
        buf: u64,
        count: usize,
        thread_id: u32,
    ) -> Option<MSanErrorReport> {
        // Writing uninitialized data to a file descriptor is a bug.
        let _ = fd;
        if !self.msan_shadow.is_initialized_range(buf, count) {
            let (first_addr, _, origin) = self
                .msan_shadow
                .find_first_uninit(buf, count)
                .unwrap_or((buf, MSAN_SHADOW_UNINIT, MSAN_ORIGIN_CLEAN));
            Some(MSanErrorReport::new(
                MSanErrorKind::UseOfUninitializedValue,
                first_addr,
                count,
                origin,
                MTSanStackTrace::capture(4),
                thread_id,
                format!(
                    "write of {} byte(s) of uninitialized data to fd {}",
                    count, fd
                ),
            ))
        } else {
            None
        }
    }

    /// Intercept pread(): same as read but with offset.
    pub fn msan_intercept_pread(&mut self, fd: i32, buf: u64, count: usize, offset: u64) -> isize {
        let _ = (fd, offset);
        self.msan_shadow.clear_shadow_range(buf, count);
        count as isize
    }

    /// Intercept recv/recvfrom: receive data from socket.
    pub fn msan_intercept_recv(&mut self, sockfd: i32, buf: u64, len: usize, flags: i32) -> isize {
        let _ = (sockfd, flags);
        self.msan_shadow.clear_shadow_range(buf, len);
        len as isize
    }

    /// Intercept send/sendto: send data over socket.
    pub fn msan_intercept_send(
        &self,
        sockfd: i32,
        buf: u64,
        len: usize,
        flags: i32,
        thread_id: u32,
    ) -> Option<MSanErrorReport> {
        self.msan_intercept_write(sockfd, buf, len, thread_id)
    }

    /// Intercept getcwd: the returned buffer must be initialized.
    pub fn msan_intercept_getcwd(&mut self, buf: u64, size: usize) {
        self.msan_shadow.clear_shadow_range(buf, size);
    }

    /// Intercept gethostname: same.
    pub fn msan_intercept_gethostname(&mut self, name: u64, len: usize) {
        self.msan_shadow.clear_shadow_range(name, len);
    }

    /// Intercept getpeername/getsockname: sockaddr struct initialized.
    pub fn msan_intercept_get_sockname(&mut self, addr: u64, addrlen: usize) {
        self.msan_shadow.clear_shadow_range(addr, addrlen);
        // Also clear the addrlen value itself.
        self.msan_shadow.clear_shadow_range(addr, 4);
    }
}

// ============================================================================
// MSan Vector Shadow Propagation Extensions
// ============================================================================

/// Extended shadow propagator for SIMD/vector operations.
impl MSanShadowPropagator {
    /// Propagate shadow for vector add/sub (element-wise union).
    pub fn propagate_vector_binary(a: &[u8], b: &[u8]) -> Vec<u8> {
        a.iter().zip(b.iter()).map(|(&sa, &sb)| sa | sb).collect()
    }

    /// Propagate shadow for vector shuffle (permute shadow accordingly).
    pub fn propagate_vector_shuffle(shadow: &[u8], mask: &[i32]) -> Vec<u8> {
        mask.iter()
            .map(|&idx| {
                if idx < 0 || idx as usize >= shadow.len() {
                    MSAN_SHADOW_UNINIT
                } else {
                    shadow[idx as usize]
                }
            })
            .collect()
    }

    /// Propagate shadow for extractelement.
    pub fn propagate_extractelement(vec_shadow: &[u8], idx: usize) -> u8 {
        if idx < vec_shadow.len() {
            vec_shadow[idx]
        } else {
            MSAN_SHADOW_UNINIT
        }
    }

    /// Propagate shadow for insertelement.
    pub fn propagate_insertelement(vec_shadow: &[u8], idx: usize, val_shadow: u8) -> Vec<u8> {
        let mut result = vec_shadow.to_vec();
        if idx < result.len() {
            result[idx] = val_shadow;
        }
        result
    }

    /// Propagate shadow for llvm.masked.load.
    pub fn propagate_masked_load(
        shadow_mem: &MSanShadowMemory,
        addr: u64,
        mask: &[bool],
    ) -> Vec<u8> {
        mask.iter()
            .enumerate()
            .map(|(i, &m)| {
                if m {
                    shadow_mem.get_shadow(addr + i as u64)
                } else {
                    MSAN_SHADOW_UNINIT
                }
            })
            .collect()
    }

    /// Propagate shadow for llvm.masked.store.
    pub fn propagate_masked_store(
        shadow_mem: &mut MSanShadowMemory,
        addr: u64,
        shadow_bytes: &[u8],
        mask: &[bool],
    ) {
        for (i, &m) in mask.iter().enumerate() {
            if m && i < shadow_bytes.len() {
                shadow_mem.set_shadow(addr + i as u64, shadow_bytes[i]);
            }
        }
    }

    /// Propagate shadow for llvm.masked.gather.
    pub fn propagate_masked_gather(
        shadow_mem: &MSanShadowMemory,
        ptrs: &[u64],
        mask: &[bool],
        scale: usize,
    ) -> Vec<u8> {
        ptrs.iter()
            .enumerate()
            .map(|(i, &ptr)| {
                if mask[i] {
                    shadow_mem.get_shadow(ptr)
                } else {
                    MSAN_SHADOW_UNINIT
                }
            })
            .collect()
    }

    /// Propagate shadow for llvm.masked.scatter.
    pub fn propagate_masked_scatter(
        shadow_mem: &mut MSanShadowMemory,
        shadow_vals: &[u8],
        ptrs: &[u64],
        mask: &[bool],
    ) {
        for i in 0..ptrs.len() {
            if mask[i] && i < shadow_vals.len() {
                shadow_mem.set_shadow(ptrs[i], shadow_vals[i]);
            }
        }
    }
}

// ============================================================================
// MSan Interceptors for Common POSIX Functions
// ============================================================================

impl X86MTSanFull {
    /// Intercept getenv: the returned string pointer points to initialized data.
    pub fn msan_intercept_getenv(&mut self, result_ptr: u64) {
        if result_ptr != 0 {
            // getenv returns a pointer to the environment, which is initialized.
            // We need to mark the pointed-to string as initialized.
            self.msan_shadow.clear_shadow_range(result_ptr, 4096);
        }
    }

    /// Intercept realpath: output buffer is initialized.
    pub fn msan_intercept_realpath(&mut self, path: u64, resolved_path: u64) {
        let _ = path;
        if resolved_path != 0 {
            self.msan_shadow.clear_shadow_range(resolved_path, 4096);
        }
    }

    /// Intercept readlink: output buffer is initialized.
    pub fn msan_intercept_readlink(&mut self, path: u64, buf: u64, bufsiz: usize, result: isize) {
        let _ = path;
        if result > 0 {
            self.msan_shadow.clear_shadow_range(buf, result as usize);
        }
    }

    /// Intercept stat/fstat/lstat: struct stat is initialized.
    pub fn msan_intercept_stat(&mut self, statbuf: u64, result: i32) {
        if result == 0 && statbuf != 0 {
            self.msan_shadow.clear_shadow_range(statbuf, 144); // sizeof(struct stat) ~ 144.
        }
    }

    /// Intercept gettimeofday: struct timeval is initialized.
    pub fn msan_intercept_gettimeofday(&mut self, tv: u64, tz: u64) {
        if tv != 0 {
            self.msan_shadow.clear_shadow_range(tv, 16); // sizeof(struct timeval).
        }
        if tz != 0 {
            self.msan_shadow.clear_shadow_range(tz, 8);
        }
    }

    /// Intercept clock_gettime: struct timespec is initialized.
    pub fn msan_intercept_clock_gettime(&mut self, tp: u64) {
        if tp != 0 {
            self.msan_shadow.clear_shadow_range(tp, 16); // sizeof(struct timespec).
        }
    }

    /// Intercept pthread_getspecific: the returned value is initialized.
    pub fn msan_intercept_pthread_getspecific(&mut self, key: u32, value_ptr: u64) {
        let _ = key;
        // value_ptr points to thread-local data, which should be initialized.
        if value_ptr != 0 {
            self.msan_shadow.clear_shadow_range(value_ptr, 8);
        }
    }

    /// Intercept dlopen: the returned handle (tracked by MSan).
    pub fn msan_intercept_dlopen(&mut self, filename: u64, flags: i32, handle: u64) {
        let _ = (filename, flags);
        if handle != 0 {
            // dlopen loads shared objects; their globals should be initialized.
        }
    }

    /// Intercept posix_memalign: similar to malloc but with alignment.
    pub fn msan_intercept_posix_memalign(
        &mut self,
        memptr: u64,
        alignment: usize,
        size: usize,
        result: i32,
    ) {
        if result == 0 && memptr != 0 {
            self.msan_shadow.clear_shadow_range(memptr, size);
            if self.msan_shadow.track_origins {
                let origin = self.origin_registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("posix_memalign(align={}, size={})", alignment, size),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                self.msan_shadow.set_origin_range(memptr, size, origin);
            }
        }
    }

    /// Intercept aligned_alloc: C11 aligned allocation.
    pub fn msan_intercept_aligned_alloc(&mut self, alignment: usize, size: usize, ptr: u64) {
        if ptr != 0 {
            self.msan_shadow.clear_shadow_range(ptr, size);
            if self.msan_shadow.track_origins {
                let origin = self.origin_registry.allocate_origin(
                    MSAN_ORIGIN_CLEAN,
                    format!("aligned_alloc(align={}, size={})", alignment, size),
                    OriginKind::HeapAllocation,
                    MTSanStackTrace::capture(4),
                );
                self.msan_shadow.set_origin_range(ptr, size, origin);
            }
        }
    }
}

// ============================================================================
// Combined Utility Functions
// ============================================================================

impl X86MTSanFull {
    /// Check if the runtime should halt (based on flags and error count).
    pub fn should_halt(&self) -> bool {
        if self.flags.halt_on_error && self.has_errors() {
            return true;
        }
        false
    }

    /// Get the exit code based on whether errors were found.
    pub fn exit_code(&self) -> i32 {
        if self.has_errors() {
            self.flags.exitcode
        } else {
            0
        }
    }

    /// Clear all tracking state (for fork()-like scenarios).
    pub fn reset(&mut self) {
        self.msan_shadow = MSanShadowMemory::new(
            self.msan_shadow.shadow_offset,
            self.msan_shadow.track_origins,
        );
        self.origin_registry = OriginRegistry::new();
        self.tsan_threads.clear();
        self.tsan_shadow.clear();
        self.tsan_mutexes.clear();
        self.tsan_deadlock_detector = TSanDeadlockDetector::new();
        self.msan_reports.clear();
        self.tsan_reports.clear();
        self.msan_access_count = 0;
        self.msan_propagation_count = 0;
        self.tsan_event_count = 0;
        self.tsan_lock_ops = 0;
        self.tsan_race_count = 0;
    }

    /// Handle fork(): child process inherits shadow but clears TSan state.
    pub fn handle_fork_child(&mut self) {
        // In child process after fork: keep MSan shadow, reset TSan.
        self.tsan_threads.clear();
        self.tsan_shadow.clear();
        self.tsan_mutexes.clear();
        self.tsan_deadlock_detector = TSanDeadlockDetector::new();
        self.tsan_reports.clear();
        self.tsan_event_count = 0;
        self.tsan_lock_ops = 0;
        self.tsan_race_count = 0;
        // Keep MSan state (shadow memory is inherited).
    }

    /// Handle fork(): parent process is unchanged.
    pub fn handle_fork_parent(&mut self) {
        // Parent is unchanged; nothing to do.
    }

    /// Get the current global tick value.
    pub fn global_tick(&self) -> u64 {
        self.tsan_global_tick.load(Ordering::Relaxed)
    }

    /// Increment the global tick.
    pub fn tick(&self) -> u64 {
        self.tsan_global_tick.fetch_add(1, Ordering::Relaxed)
    }

    /// Register a custom interceptor function name for tracing.
    pub fn register_interceptor(&mut self, name: &str) {
        self.msan_interceptors.origin_stack.push((0, name.len()));
        let _ = name;
    }

    /// Verify that shadow memory is consistent (debug-only).
    pub fn verify_shadow_consistency(&self) -> bool {
        // Check that shadow and origin maps are consistent.
        if self.msan_shadow.track_origins {
            // For every origin entry, there should be shadow coverage.
            for (&origin_key, _) in &self.msan_shadow.origin_map {
                let app_addr = origin_key * MSAN_ORIGIN_SCALE as u64;
                let _ = self.msan_shadow.get_shadow(app_addr);
            }
        }
        true
    }

    /// Dump internal state for debugging.
    pub fn dump_state(&self) -> String {
        let mut s = String::new();
        s.push_str(&format!("=== X86MTSanFull State ===\n"));
        s.push_str(&format!("Initialized: {}\n", self.initialized));
        s.push_str(&format!(
            "MSan shadow bytes: {}\n",
            self.msan_shadow.total_shadow_bytes
        ));
        s.push_str(&format!("MSan access count: {}\n", self.msan_access_count));
        s.push_str(&format!(
            "MSan propagation count: {}\n",
            self.msan_propagation_count
        ));
        s.push_str(&format!("MSan errors: {}\n", self.msan_reports.len()));
        s.push_str(&format!("TSan threads: {}\n", self.tsan_threads.len()));
        s.push_str(&format!("TSan shadow cells: {}\n", self.tsan_shadow.len()));
        s.push_str(&format!("TSan mutexes: {}\n", self.tsan_mutexes.len()));
        s.push_str(&format!("TSan events: {}\n", self.tsan_event_count));
        s.push_str(&format!("TSan lock ops: {}\n", self.tsan_lock_ops));
        s.push_str(&format!("TSan races: {}\n", self.tsan_race_count));
        s.push_str(&format!("TSan errors: {}\n", self.tsan_reports.len()));
        s.push_str(&format!("Origin entries: {}\n", self.origin_registry.len()));
        s
    }

    /// Run the periodic flush (called every flush_memory_ms).
    pub fn periodic_flush(&mut self) {
        // Shrink shadow maps if they've grown too large.
        // In production: release unused shadow memory pages.
        if self.tsan_shadow.len() > 1_000_000 {
            // Prune old shadow cells.
            let keys_to_remove: Vec<u64> = self
                .tsan_shadow
                .iter()
                .filter(|(_, cell)| cell.read_count == 0 && cell.history.is_empty())
                .map(|(k, _)| *k)
                .take(100_000)
                .collect();
            for key in keys_to_remove {
                self.tsan_shadow.remove(&key);
            }
        }
    }

    /// Count the total number of live threads (not joined/detached).
    pub fn live_thread_count(&self) -> usize {
        self.tsan_threads
            .values()
            .filter(|t| !t.is_joined && !t.is_detached)
            .count()
    }

    /// Get a thread's name (if set).
    pub fn thread_name(&self, thread_id: u32) -> Option<&str> {
        self.tsan_threads
            .get(&thread_id)
            .and_then(|t| t.name.as_deref())
    }

    /// Set a thread's name.
    pub fn set_thread_name(&mut self, thread_id: u32, name: impl Into<String>) {
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.name = Some(name.into());
        }
    }

    /// Mark a thread as detached (won't be joined).
    pub fn detach_thread(&mut self, thread_id: u32) {
        if let Some(thread) = self.tsan_threads.get_mut(&thread_id) {
            thread.is_detached = true;
        }
    }

    /// Check if a thread is in a signal handler.
    pub fn is_in_signal_handler(&self, thread_id: u32) -> bool {
        self.tsan_threads
            .get(&thread_id)
            .map(|t| t.in_signal_handler)
            .unwrap_or(false)
    }

    /// Flush all pending reports to the log.
    pub fn flush_reports(&self) {
        if let Some(ref log_path) = self.flags.log_path {
            if let Ok(mut file) = std::fs::OpenOptions::new()
                .create(true)
                .append(true)
                .open(log_path)
            {
                use std::io::Write;
                for report in &self.msan_reports {
                    let _ = writeln!(file, "{}", report.format(Some(&self.origin_registry)));
                }
                for report in &self.tsan_reports {
                    let _ = writeln!(file, "{}", report.format());
                }
            }
        }
    }
}

// ============================================================================
// Test Suite
// ============================================================================

#[cfg(test)]
mod tests {
    use super::*;

    // -----------------------------------------------------------------------
    // MSan Shadow Memory Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_shadow_init_uninit() {
        assert_eq!(MSAN_SHADOW_INIT, 0x00);
        assert_eq!(MSAN_SHADOW_UNINIT, 0xFF);
    }

    #[test]
    fn test_msan_shadow_memory_basic() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        // Initially everything is uninitialized.
        assert_eq!(shadow.get_shadow(0x1000), MSAN_SHADOW_UNINIT);

        // Mark as initialized.
        shadow.set_shadow(0x1000, MSAN_SHADOW_INIT);
        assert_eq!(shadow.get_shadow(0x1000), MSAN_SHADOW_INIT);

        // Neighboring address is still uninitialized.
        assert_eq!(shadow.get_shadow(0x1001), MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_msan_shadow_range() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.clear_shadow_range(0x2000, 100);
        assert!(shadow.is_initialized_range(0x2000, 100));
        assert!(!shadow.is_initialized_range(0x2000, 101));
    }

    #[test]
    fn test_msan_shadow_poison_range() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.clear_shadow_range(0x3000, 50);
        assert!(shadow.is_initialized_range(0x3000, 50));
        shadow.poison_shadow_range(0x3010, 10);
        assert!(!shadow.is_initialized_range(0x3000, 50));
    }

    #[test]
    fn test_msan_origin_tracking() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, true);
        assert_eq!(shadow.get_origin(0x4000), MSAN_ORIGIN_CLEAN);

        shadow.set_origin(0x4000, 42);
        assert_eq!(shadow.get_origin(0x4000), 42);
        // Same origin block (4-byte granularity).
        assert_eq!(shadow.get_origin(0x4003), 42);
    }

    #[test]
    fn test_msan_origin_range() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, true);
        shadow.set_origin_range(0x5000, 32, 99);
        assert_eq!(shadow.get_origin(0x5000), 99);
        assert_eq!(shadow.get_origin(0x5010), 99);
    }

    #[test]
    fn test_msan_origin_disabled() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.set_origin(0x6000, 42);
        assert_eq!(shadow.get_origin(0x6000), MSAN_ORIGIN_CLEAN);
    }

    #[test]
    fn test_msan_find_first_uninit() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.clear_shadow_range(0x7000, 100);
        shadow.set_shadow(0x7032, MSAN_SHADOW_UNINIT);

        let result = shadow.find_first_uninit(0x7000, 100);
        assert!(result.is_some());
        let (addr, val, _) = result.unwrap();
        assert_eq!(addr, 0x7032);
        assert_eq!(val, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_msan_shadow_to_app_roundtrip() {
        let shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        let app_addr = 0x8000u64;
        let sh_addr = shadow.app_to_shadow(app_addr);
        let app_back = shadow.shadow_to_app(sh_addr);
        assert_eq!(app_addr, app_back);
    }

    // -----------------------------------------------------------------------
    // MSan Shadow Propagation Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_propagate_add() {
        let s = MSanShadowPropagator::propagate_add_sub(0x00, 0x00);
        assert_eq!(s, MSAN_SHADOW_INIT);

        let s = MSanShadowPropagator::propagate_add_sub(0xFF, 0x00);
        assert_eq!(s, MSAN_SHADOW_UNINIT);

        let s = MSanShadowPropagator::propagate_add_sub(0x00, 0xFF);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_propagate_mul() {
        let s = MSanShadowPropagator::propagate_mul(0x00, 0x00);
        assert_eq!(s, MSAN_SHADOW_INIT);

        let s = MSanShadowPropagator::propagate_mul(0xFF, 0x00);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_propagate_and() {
        let s = MSanShadowPropagator::propagate_and(0x00, 0x00);
        assert_eq!(s, MSAN_SHADOW_INIT);

        let s = MSanShadowPropagator::propagate_and(0xFF, 0x00);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_propagate_shift() {
        // Shift with uninitialized amount → fully uninitialized.
        let s = MSanShadowPropagator::propagate_shl(0x00, 0xFF);
        assert_eq!(s, MSAN_SHADOW_UNINIT);

        // Shift with clean amount → preserve value shadow.
        let s = MSanShadowPropagator::propagate_shl(0xAB, 0x00);
        assert_eq!(s, 0xAB);
    }

    #[test]
    fn test_propagate_select() {
        // Uninitialized condition → union of both arms.
        let s = MSanShadowPropagator::propagate_select(0xFF, 0x00, 0xFF);
        assert_eq!(s, MSAN_SHADOW_UNINIT);

        // Clean condition → conservative union.
        let s = MSanShadowPropagator::propagate_select(0x00, 0x00, 0x00);
        assert_eq!(s, MSAN_SHADOW_INIT);
    }

    #[test]
    fn test_propagate_phi() {
        let s = MSanShadowPropagator::propagate_phi(&[0x00, 0x00, 0x00]);
        assert_eq!(s, MSAN_SHADOW_INIT);

        let s = MSanShadowPropagator::propagate_phi(&[0x00, 0xFF, 0x00]);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_propagate_cmp() {
        let s = MSanShadowPropagator::propagate_cmp(0x00, 0x00);
        assert_eq!(s, MSAN_SHADOW_INIT);

        let s = MSanShadowPropagator::propagate_cmp(0xFF, 0x00);
        assert_eq!(s, MSAN_SHADOW_UNINIT);

        let s = MSanShadowPropagator::propagate_cmp(0x00, 0xFF);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_propagate_load_store() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.clear_shadow_range(0x9000, 16);

        let loaded = MSanShadowPropagator::propagate_load(&shadow, 0x9000, 8);
        assert_eq!(loaded, vec![MSAN_SHADOW_INIT; 8]);

        MSanShadowPropagator::propagate_store(&mut shadow, 0xA000, &[0xFF; 4]);
        let loaded2 = MSanShadowPropagator::propagate_load(&shadow, 0xA000, 4);
        assert_eq!(loaded2, vec![MSAN_SHADOW_UNINIT; 4]);
    }

    #[test]
    fn test_propagate_memcpy() {
        let mut shadow = MSanShadowMemory::new(MSAN_SHADOW_OFFSET_X86_64, false);
        shadow.clear_shadow_range(0xB000, 16);
        shadow.set_shadow(0xB000, 0xAB);

        MSanShadowPropagator::propagate_memcpy(&mut shadow, 0xC000, 0xB000, 16);
        assert_eq!(shadow.get_shadow(0xC000), 0xAB);
        assert_eq!(shadow.get_shadow(0xC00F), MSAN_SHADOW_INIT);
    }

    #[test]
    fn test_propagate_extractvalue() {
        let agg = vec![0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08];
        let extracted = MSanShadowPropagator::propagate_extractvalue(&agg, 2, 4);
        assert_eq!(extracted, vec![0x03, 0x04, 0x05, 0x06]);
    }

    #[test]
    fn test_propagate_insertvalue() {
        let agg = vec![0x00; 8];
        let val = vec![0xFF; 2];
        let result = MSanShadowPropagator::propagate_insertvalue(&agg, 4, &val);
        assert_eq!(result[4], 0xFF);
        assert_eq!(result[5], 0xFF);
        assert_eq!(result[0], 0x00);
    }

    // -----------------------------------------------------------------------
    // Vector Clock Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_vector_clock_new() {
        let vc = VectorClock::new();
        assert!(vc.is_empty());
        assert_eq!(vc.len(), 0);
        assert_eq!(vc.max_clock(), 0);
    }

    #[test]
    fn test_vector_clock_tick() {
        let mut vc = VectorClock::new();
        let val = vc.tick(1);
        assert_eq!(val, 1);
        assert_eq!(vc.get(1), 1);
    }

    #[test]
    fn test_vector_clock_set_get() {
        let mut vc = VectorClock::new();
        vc.set(1, 42);
        assert_eq!(vc.get(1), 42);
        assert_eq!(vc.get(2), 0);
    }

    #[test]
    fn test_vector_clock_set_monotonic() {
        let mut vc = VectorClock::new();
        vc.set(1, 10);
        vc.set(1, 5); // Should be ignored (monotonic).
        assert_eq!(vc.get(1), 10);
        vc.set(1, 15);
        assert_eq!(vc.get(1), 15);
    }

    #[test]
    fn test_vector_clock_join() {
        let mut vc1 = VectorClock::new();
        vc1.set(1, 10);
        vc1.set(2, 5);

        let mut vc2 = VectorClock::new();
        vc2.set(1, 5);
        vc2.set(2, 15);
        vc2.set(3, 20);

        vc1.join(&vc2);
        assert_eq!(vc1.get(1), 10); // max(10, 5) = 10
        assert_eq!(vc1.get(2), 15); // max(5, 15) = 15
        assert_eq!(vc1.get(3), 20); // new entry from vc2
    }

    #[test]
    fn test_vector_clock_happens_before() {
        let mut vc1 = VectorClock::new();
        vc1.set(1, 5);
        vc1.set(2, 10);

        let mut vc2 = VectorClock::new();
        vc2.set(1, 10);
        vc2.set(2, 10);

        // vc1[1]=5 < vc2[1]=10, vc1[2] == vc2[2]
        assert!(vc1.happens_before(&vc2));
        assert!(!vc2.happens_before(&vc1));
    }

    #[test]
    fn test_vector_clock_concurrent() {
        let mut vc1 = VectorClock::new();
        vc1.set(1, 10);
        vc1.set(2, 5);

        let mut vc2 = VectorClock::new();
        vc2.set(1, 5);
        vc2.set(2, 10);

        assert!(vc1.concurrent(&vc2));
        assert!(!vc1.happens_before(&vc2));
        assert!(!vc2.happens_before(&vc1));
    }

    #[test]
    fn test_vector_clock_happens_before_or_eq() {
        let mut vc1 = VectorClock::new();
        vc1.set(1, 10);
        vc1.set(2, 10);

        let vc2 = vc1.clone();
        assert!(vc1.happens_before_or_eq(&vc2));
        assert!(vc2.happens_before_or_eq(&vc1));
    }

    #[test]
    fn test_vector_clock_max_clock() {
        let mut vc = VectorClock::new();
        vc.set(1, 3);
        vc.set(2, 7);
        vc.set(3, 2);
        assert_eq!(vc.max_clock(), 7);
    }

    // -----------------------------------------------------------------------
    // TSan Thread State Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_thread_state_new() {
        let state = TSanThreadState::new(42, MTSanStackTrace::capture(2));
        assert_eq!(state.thread_id, 42);
        assert!(!state.is_joined);
        assert!(!state.in_signal_handler);
        assert!(state.is_tracked);
    }

    #[test]
    fn test_tsan_thread_state_tick() {
        let mut state = TSanThreadState::new(1, MTSanStackTrace::new());
        let val = state.tick();
        assert_eq!(val, 1);
        let val2 = state.tick();
        assert_eq!(val2, 2);
        assert_eq!(state.global_tick, 2);
    }

    #[test]
    fn test_tsan_thread_state_acquire() {
        let mut state = TSanThreadState::new(1, MTSanStackTrace::new());
        state.tick();

        let mut release_clock = VectorClock::new();
        release_clock.set(2, 10);
        release_clock.set(3, 20);

        state.acquire(&release_clock);
        assert_eq!(state.clock.get(2), 10);
        assert_eq!(state.clock.get(3), 20);
        // Original clock for thread 1 is preserved.
        assert_eq!(state.clock.get(1), 1);
    }

    // -----------------------------------------------------------------------
    // TSan Shadow Cell Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_shadow_cell_new() {
        let cell = TSanShadowCell::new(4);
        assert_eq!(cell.last_thread, 0);
        assert_eq!(cell.read_count, 0);
        assert_eq!(cell.history.len(), 0);
    }

    #[test]
    fn test_tsan_shadow_cell_record_access_no_race() {
        let mut cell = TSanShadowCell::new(4);
        let clock1 = {
            let mut vc = VectorClock::new();
            vc.set(1, 1);
            vc
        };
        let result = cell.record_access(1, &clock1, true, 8, false, None, MTSanStackTrace::new());
        assert!(result.is_none());
        assert_eq!(cell.last_thread, 1);
        assert!(cell.last_write);
    }

    #[test]
    fn test_tsan_shadow_cell_record_access_same_thread() {
        let mut cell = TSanShadowCell::new(4);
        let clock1 = {
            let mut vc = VectorClock::new();
            vc.set(1, 1);
            vc
        };
        let clock2 = {
            let mut vc = VectorClock::new();
            vc.set(1, 2);
            vc
        };
        cell.record_access(1, &clock1, true, 8, false, None, MTSanStackTrace::new());
        let result = cell.record_access(1, &clock2, true, 8, false, None, MTSanStackTrace::new());
        // Same thread — no race.
        assert!(result.is_none());
    }

    #[test]
    fn test_tsan_shadow_cell_record_access_race() {
        let mut cell = TSanShadowCell::new(4);
        // Thread 1 writes.
        let clock1 = {
            let mut vc = VectorClock::new();
            vc.set(1, 1);
            vc
        };
        cell.record_access(1, &clock1, true, 8, false, None, MTSanStackTrace::new());

        // Thread 2 writes concurrently.
        let clock2 = {
            let mut vc = VectorClock::new();
            vc.set(2, 1);
            vc
        };
        let result = cell.record_access(2, &clock2, true, 8, false, None, MTSanStackTrace::new());
        // Concurrent writes → race!
        assert!(result.is_some());
        let race = result.unwrap();
        assert_eq!(race.thread1, 1);
        assert_eq!(race.thread2, 2);
    }

    #[test]
    fn test_tsan_shadow_cell_record_access_happens_before_no_race() {
        let mut cell = TSanShadowCell::new(4);
        // Thread 1 writes.
        let clock1 = {
            let mut vc = VectorClock::new();
            vc.set(1, 1);
            vc
        };
        cell.record_access(1, &clock1, true, 8, false, None, MTSanStackTrace::new());

        // Thread 2 reads, but has a clock that happens-after thread 1.
        let mut clock2 = VectorClock::new();
        clock2.set(1, 2); // thread 1 is at 2, which is > 1
        clock2.set(2, 1);
        let result = cell.record_access(2, &clock2, false, 8, false, None, MTSanStackTrace::new());
        // clock2 happens-after clock1 → no race.
        assert!(result.is_none());
    }

    // -----------------------------------------------------------------------
    // TSan Mutex Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_mutex_state_new() {
        let mutex = TSanMutexState::new(100, MTSanStackTrace::new());
        assert_eq!(mutex.id, 100);
        assert_eq!(mutex.owner_thread, 0);
        assert_eq!(mutex.lock_count, 0);
        assert!(!mutex.is_destroyed);
    }

    #[test]
    fn test_tsan_deadlock_detector_simple() {
        let mut detector = TSanDeadlockDetector::new();
        // Thread 1 holds mutex A.
        detector.acquired(1, 10);
        // Thread 2 holds mutex B.
        detector.acquired(2, 20);

        // Thread 1 tries to acquire B (held by 2).
        let result = detector.try_acquire(1, 20);
        assert!(result.is_none()); // No cycle yet.

        // Thread 2 tries to acquire A (held by 1) → cycle!
        let result = detector.try_acquire(2, 10);
        assert!(result.is_some());
    }

    #[test]
    fn test_tsan_deadlock_detector_no_cycle() {
        let mut detector = TSanDeadlockDetector::new();
        detector.acquired(1, 10);
        detector.acquired(2, 20);
        // Thread 1 waits for B.
        detector.try_acquire(1, 20);
        // But thread 2 releases B first.
        detector.released(2, 20);
        detector.acquired(1, 20);
        // No cycle.
        assert!(detector.detect_cycle(1).is_none());
    }

    // -----------------------------------------------------------------------
    // TSan Signal Safety Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_signal_safety_unsafe() {
        let safety = TSanSignalSafety::new();
        assert!(!safety.is_signal_safe("printf"));
        assert!(!safety.is_signal_safe("malloc"));
        assert!(!safety.is_signal_safe("pthread_mutex_lock"));
    }

    #[test]
    fn test_signal_safety_safe() {
        let safety = TSanSignalSafety::new();
        // Some functions are safe (not in the unsafe list).
        assert!(safety.is_signal_safe("write"));
        assert!(safety.is_signal_safe("read"));
        assert!(safety.is_signal_safe("_exit"));
    }

    // -----------------------------------------------------------------------
    // Origin Registry Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_origin_registry_allocate() {
        let mut registry = OriginRegistry::new();
        let id = registry.allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "test allocation",
            OriginKind::HeapAllocation,
            MTSanStackTrace::capture(2),
        );
        assert!(id > 0);
        assert!(id <= MSAN_ORIGIN_MAX);
        assert!(registry.get(id).is_some());
    }

    #[test]
    fn test_origin_registry_chain() {
        let mut registry = OriginRegistry::new();
        let id1 = registry.allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "initial",
            OriginKind::HeapAllocation,
            MTSanStackTrace::new(),
        );
        let id2 = registry.allocate_origin(
            id1,
            "derived",
            OriginKind::Instruction,
            MTSanStackTrace::new(),
        );
        let id3 = registry.allocate_origin(
            id2,
            "final",
            OriginKind::Instruction,
            MTSanStackTrace::new(),
        );

        let chain = registry.follow_chain(id3, 16);
        assert_eq!(chain.len(), 3);
        assert_eq!(chain[0].description, "initial");
        assert_eq!(chain[1].description, "derived");
        assert_eq!(chain[2].description, "final");
    }

    #[test]
    fn test_origin_registry_format_chain() {
        let mut registry = OriginRegistry::new();
        let id = registry.allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "test",
            OriginKind::StackAllocation,
            MTSanStackTrace::new(),
        );
        let formatted = registry.format_chain(id);
        assert!(formatted.contains("test"));
        assert!(formatted.contains("stack-allocation"));
    }

    // -----------------------------------------------------------------------
    // MSan Options Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_options_default() {
        let opts = MSanOptions::default();
        assert!(opts.poison_in_free);
        assert!(opts.report_umrs);
        assert!(!opts.print_stats);
        assert_eq!(opts.track_origins, 0);
    }

    #[test]
    fn test_msan_options_parse() {
        let mut opts = MSanOptions::default();
        opts.parse_option("poison_in_free", "0");
        assert!(!opts.poison_in_free);
        opts.parse_option("track_origins", "2");
        assert_eq!(opts.track_origins, 2);
        opts.parse_option("verbosity", "3");
        assert_eq!(opts.verbosity, 3);
    }

    // -----------------------------------------------------------------------
    // TSan Options Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_options_default() {
        let opts = TSanOptions::default();
        assert_eq!(opts.history_size, TSAN_DEFAULT_HISTORY_SIZE);
        assert_eq!(opts.flush_memory_ms, TSAN_DEFAULT_FLUSH_MS);
        assert!(!opts.force_seq_cst_atomics);
        assert!(opts.report_thread_leaks);
        assert!(opts.detect_deadlocks);
    }

    #[test]
    fn test_tsan_options_parse() {
        let mut opts = TSanOptions::default();
        opts.parse_option("history_size", "4");
        assert_eq!(opts.history_size, 4);
        opts.parse_option("force_seq_cst_atomics", "1");
        assert!(opts.force_seq_cst_atomics);
        opts.parse_option("report_thread_leaks", "0");
        assert!(!opts.report_thread_leaks);
    }

    // -----------------------------------------------------------------------
    // MTSan Flags Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_mtsan_flags_default() {
        let flags = MTSanFlags::default();
        assert!(flags.msan_enabled);
        assert!(flags.tsan_enabled);
        assert!(!flags.origins_enabled);
    }

    // -----------------------------------------------------------------------
    // X86MTSanFull Integration Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_mtsan_full_new() {
        let runtime = X86MTSanFull::new();
        assert!(!runtime.initialized);
        assert!(runtime.msan_reports.is_empty());
        assert!(runtime.tsan_reports.is_empty());
    }

    #[test]
    fn test_mtsan_full_initialize() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        assert!(runtime.initialized);
    }

    #[test]
    fn test_mtsan_full_msan_check_read_init() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x10000, 16);

        let result = runtime.msan_check_read(0x10000, 8, 1);
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_msan_check_read_uninit() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        // Shadow is uninitialized by default.

        let result = runtime.msan_check_read(0x20000, 4, 1);
        assert!(result.is_some());
        let report = result.unwrap();
        assert_eq!(report.kind, MSanErrorKind::UseOfUninitializedValue);
    }

    #[test]
    fn test_mtsan_full_msan_set_get_shadow() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x30000, 4, 0xAB);
        assert_eq!(runtime.msan_get_shadow(0x30000), 0xAB);
        assert_eq!(runtime.msan_get_shadow(0x30001), 0xAB);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_binary() {
        let mut runtime = X86MTSanFull::new();
        let result = runtime.msan_propagate_binary("add", 0xFF, 0x00);
        assert_eq!(result, MSAN_SHADOW_UNINIT);

        let result = runtime.msan_propagate_binary("mul", 0x00, 0x00);
        assert_eq!(result, MSAN_SHADOW_INIT);
    }

    #[test]
    fn test_mtsan_full_msan_origin() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_shadow.track_origins = true;

        let origin = runtime.msan_allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "test_var",
            OriginKind::StackAllocation,
        );
        assert!(origin > 0);
        runtime.msan_set_origin(0x40000, 8, origin);
        assert_eq!(runtime.msan_shadow.get_origin(0x40000), origin);
    }

    #[test]
    fn test_mtsan_full_tsan_thread_create() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        let tid = runtime.tsan_thread_create();
        assert!(tid > 0);
        assert!(runtime.tsan_threads.contains_key(&tid));
    }

    #[test]
    fn test_mtsan_full_tsan_load_store_no_race() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        // Single thread access — no race.
        let result = runtime.tsan_load(tid, 0x50000, 4);
        assert!(result.is_none());

        let result = runtime.tsan_store(tid, 0x50000, 4);
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_tsan_race_detection() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Thread 1 writes.
        runtime.tsan_store(tid1, 0x60000, 8);

        // Thread 2 writes concurrently (no happens-before).
        let result = runtime.tsan_store(tid2, 0x60000, 8);

        // Should detect a race.
        assert!(result.is_some());
        assert!(runtime.tsan_race_count > 0);
        assert!(!runtime.tsan_reports.is_empty());
    }

    #[test]
    fn test_mtsan_full_tsan_happens_before_no_race() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Thread 1 writes, then thread 1 joins into thread 2.
        runtime.tsan_store(tid1, 0x70000, 4);
        runtime.tsan_thread_join(tid2, tid1);

        // Thread 2 reads — happens-after thread 1's write.
        let result = runtime.tsan_load(tid2, 0x70000, 4);
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_tsan_mutex_lock_unlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let mutex_id = runtime.tsan_mutex_create();

        // Thread 1 locks, writes, unlocks.
        runtime.tsan_mutex_lock(tid1, mutex_id);
        runtime.tsan_store(tid1, 0x80000, 4);
        runtime.tsan_mutex_unlock(tid1, mutex_id);

        // Thread 2 locks (happens-after unlock), reads.
        runtime.tsan_mutex_lock(tid2, mutex_id);
        let result = runtime.tsan_load(tid2, 0x80000, 4);
        runtime.tsan_mutex_unlock(tid2, mutex_id);

        // Should NOT be a race: mutex provides happens-before.
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_tsan_deadlock_detection() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let mutex_a = runtime.tsan_mutex_create();
        let mutex_b = runtime.tsan_mutex_create();

        // Thread 1: lock A then B.
        runtime.tsan_mutex_lock(tid1, mutex_a);
        runtime.tsan_mutex_lock(tid1, mutex_b);

        // Thread 2: lock B then A → deadlock.
        runtime.tsan_mutex_lock(tid2, mutex_b);
        let result = runtime.tsan_mutex_lock(tid2, mutex_a);

        // Deadlock detected.
        assert!(result.is_some());
    }

    #[test]
    fn test_mtsan_full_tsan_atomic_load_store() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Thread 1: atomic store with release.
        let r1 = runtime.tsan_atomic_store(tid1, 0x90000, 4, TSanAtomicOrdering::Release);
        assert!(r1.is_none()); // First access, no race.

        // Thread 2: atomic load with acquire — synchronized.
        let r2 = runtime.tsan_atomic_load(tid2, 0x90000, 4, TSanAtomicOrdering::Acquire);
        // Should not be a race because release→acquire synchronizes.
        assert!(r2.is_none());
    }

    #[test]
    fn test_mtsan_full_combined_load() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0xA0000, 16);

        let tid = runtime.tsan_thread_create();
        let (msan_err, tsan_race) = runtime.combined_load_check(tid, 0xA0000, 8);

        assert!(msan_err.is_none()); // Shadow is clean.
        assert!(tsan_race.is_none()); // First access, no race.
    }

    #[test]
    fn test_mtsan_full_combined_store() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let result = runtime.combined_store_check(tid, 0xB0000, &[0x00; 8], MSAN_ORIGIN_CLEAN);
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_pthread_create_join() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let parent_tid = runtime.tsan_thread_create();
        let (child_tid, _) = runtime.combined_pthread_create(parent_tid);

        assert!(child_tid > 0);
        assert!(child_tid != parent_tid);
        assert!(runtime.tsan_threads.contains_key(&child_tid));

        let result = runtime.combined_pthread_join(parent_tid, child_tid);
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_cond_wait_signal() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let mutex_id = runtime.tsan_mutex_create();
        let cond_id: u64 = 1;

        runtime.tsan_mutex_lock(tid1, mutex_id);
        runtime.combined_cond_wait(tid1, cond_id, mutex_id);
        // After wait: mutex is reacquired.
        runtime.tsan_mutex_unlock(tid1, mutex_id);

        runtime.combined_cond_signal(tid2, cond_id);
    }

    #[test]
    fn test_mtsan_full_barrier() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        runtime.combined_barrier_wait(tid1, 1);
        runtime.combined_barrier_wait(tid2, 1);
    }

    #[test]
    fn test_mtsan_full_semaphore() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        runtime.combined_sem_wait(tid1, 1);
        runtime.combined_sem_post(tid2, 1);
    }

    #[test]
    fn test_mtsan_full_signal_safety() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        runtime.tsan_signal_enter(tid, 2); // SIGINT

        let result = runtime.tsan_check_signal_safety(tid, "printf");
        assert!(result.is_some());
        assert_eq!(result.unwrap().kind, TSanErrorKind::SignalUnsafeCall);

        runtime.tsan_signal_exit(tid);
    }

    #[test]
    fn test_mtsan_full_stats() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        runtime.tsan_store(tid, 0xC0000, 4);
        runtime.msan_set_shadow(0xC0000, 4, MSAN_SHADOW_INIT);
        runtime.msan_check_read(0xC0000, 4, tid);

        let stats = runtime.stats();
        assert!(stats.initialized);
        assert!(stats.msan_access_count > 0);
        assert!(stats.tsan_event_count > 0);
    }

    #[test]
    fn test_mtsan_full_print_summary() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        let summary = runtime.print_summary();
        assert!(summary.contains("X86 MTSan Full Runtime Summary"));
        assert!(summary.contains("MSan enabled"));
        assert!(summary.contains("TSan enabled"));
    }

    #[test]
    fn test_mtsan_full_has_errors_initial() {
        let runtime = X86MTSanFull::new();
        assert!(!runtime.has_errors());
    }

    #[test]
    fn test_mtsan_full_thread_leak_detection() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        // Create a thread but never join it.
        let tid = runtime.tsan_thread_create();
        // Access some memory with it.
        runtime.tsan_store(tid, 0xD0000, 4);

        let leaks = runtime.check_thread_leaks();
        assert!(!leaks.is_empty());
    }

    #[test]
    fn test_mtsan_full_finalize() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.flags.msan_options.print_stats = false;
        runtime.finalize();
        // Thread leak checks run during finalize.
        // No panic.
    }

    #[test]
    fn test_mtsan_full_msan_interceptors_memcpy() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0xE0000, 16, MSAN_SHADOW_INIT);
        runtime.msan_set_shadow(0xE0000, 4, 0xFF); // First 4 bytes uninit.

        runtime.msan_intercept_memcpy(0xE0100, 0xE0000, 16);
        assert_eq!(runtime.msan_get_shadow(0xE0100), 0xFF);
        assert_eq!(runtime.msan_get_shadow(0xE0104), MSAN_SHADOW_INIT);
    }

    #[test]
    fn test_mtsan_full_msan_interceptors_memmove() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0xF0000, 16, MSAN_SHADOW_INIT);
        runtime.msan_set_shadow(0xF0000, 2, 0xAB);

        // memmove within the same region
        runtime.msan_intercept_memmove(0xF0002, 0xF0000, 8);
        assert_eq!(runtime.msan_get_shadow(0xF0002), 0xAB);
    }

    #[test]
    fn test_mtsan_full_msan_interceptors_memset() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x110000, 32, MSAN_SHADOW_UNINIT);
        runtime.msan_intercept_memset(0x110000, 32);
        // memset should clear the shadow.
        for i in 0..32 {
            assert_eq!(runtime.msan_get_shadow(0x110000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_mtsan_full_atomic_fence_seq_cst() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        runtime.tsan_store(tid1, 0x120000, 4);
        runtime.tsan_atomic_fence(tid1, TSanAtomicOrdering::SequentiallyConsistent);

        // After seq_cst fence, thread 2 should see the write.
        runtime.tsan_atomic_fence(tid2, TSanAtomicOrdering::SequentiallyConsistent);
        let result = runtime.tsan_load(tid2, 0x120000, 4);
        // With a proper implementation, this should not be a race.
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_lock_order_inversion() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let mutex_a = runtime.tsan_mutex_create();
        let mutex_b = runtime.tsan_mutex_create();

        // Thread 1: A → B
        runtime.tsan_mutex_lock(tid1, mutex_a);
        runtime.tsan_mutex_lock(tid1, mutex_b);
        runtime.tsan_mutex_unlock(tid1, mutex_b);
        runtime.tsan_mutex_unlock(tid1, mutex_a);

        // Thread 2: B → A (inversion)
        runtime.tsan_mutex_lock(tid2, mutex_b);
        let result = runtime.tsan_mutex_lock(tid2, mutex_a);

        // Should detect lock order inversion (or deadlock).
        assert!(
            result.is_some()
                || runtime
                    .tsan_reports
                    .iter()
                    .any(|r| r.kind == TSanErrorKind::LockOrderInversion)
        );
    }

    #[test]
    fn test_mtsan_full_atomic_rmw() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Thread 1: atomic RMW (release)
        let r1 = runtime.tsan_atomic_rmw(tid1, 0x130000, 4, TSanAtomicOrdering::AcquireRelease);
        assert!(r1.is_none()); // First access.

        // Thread 2: atomic RMW (acquire) — should synchronize.
        let r2 = runtime.tsan_atomic_rmw(tid2, 0x130000, 4, TSanAtomicOrdering::Acquire);
        assert!(r2.is_none()); // Synchronized via atomic.
    }

    #[test]
    fn test_mtsan_full_destroy_locked_mutex() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let mutex_id = runtime.tsan_mutex_create();

        runtime.tsan_mutex_lock(tid, mutex_id);
        let result = runtime.tsan_mutex_destroy(mutex_id);
        assert!(result.is_some());
        assert_eq!(result.unwrap().kind, TSanErrorKind::DestroyLockedMutex);
    }

    #[test]
    fn test_mtsan_full_unlock_not_owned() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let mutex_id = runtime.tsan_mutex_create();

        runtime.tsan_mutex_lock(tid1, mutex_id);
        // Thread 2 tries to unlock mutex owned by thread 1.
        let result = runtime.tsan_mutex_unlock(tid2, mutex_id);
        assert!(result.is_some());
        assert_eq!(result.unwrap().kind, TSanErrorKind::UnlockNotOwned);

        runtime.tsan_mutex_unlock(tid1, mutex_id);
    }

    #[test]
    fn test_mtsan_full_msan_branch_check() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let result = runtime.msan_check_branch(MSAN_SHADOW_INIT, 1);
        assert!(result.is_none());

        let result = runtime.msan_check_branch(MSAN_SHADOW_UNINIT, 1);
        assert!(result.is_some());
        assert_eq!(result.unwrap().kind, MSanErrorKind::UninitializedBranch);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_cmp() {
        let mut runtime = X86MTSanFull::new();
        let result = runtime.msan_propagate_cmp(0x00, 0x00);
        assert_eq!(result, MSAN_SHADOW_INIT);

        let result = runtime.msan_propagate_cmp(0xFF, 0x00);
        assert_eq!(result, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_select() {
        let mut runtime = X86MTSanFull::new();
        let result = runtime.msan_propagate_select(0x00, 0x00, 0x00);
        assert_eq!(result, MSAN_SHADOW_INIT);

        let result = runtime.msan_propagate_select(0xFF, 0xAA, 0xBB);
        assert_eq!(result, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_mtsan_full_suppressions() {
        let supp_content = r#"
# Comment line
race:test_race_suppression
fun:test_func
src:test_file.c

deadlock:test_deadlock
fun:deadlock_func
"#;
        let supps = TSanSuppressions::parse(supp_content);
        assert_eq!(supps.len(), 2);
    }

    #[test]
    fn test_mtsan_full_suppression_matching() {
        let supp_content = "race:my_race\nfun:known_racy\n";
        let supps = TSanSuppressions::parse(supp_content);

        let mut report = TSanErrorReport::data_race(
            0x100,
            4,
            1,
            2,
            true,
            true,
            MTSanStackTrace::new(),
            MTSanStackTrace::new(),
        );
        report.stacks[0]
            .frames
            .push(MTSanStackFrame::with_symbol("known_racy"));
        assert!(supps.is_suppressed(&report));
    }

    #[test]
    fn test_mtsan_full_tsan_error_report_formatting() {
        let report = TSanErrorReport::data_race(
            0x200,
            8,
            1,
            2,
            true,
            false,
            MTSanStackTrace::capture(3),
            MTSanStackTrace::capture(3),
        );
        let formatted = report.format();
        assert!(formatted.contains("ThreadSanitizer"));
        assert!(formatted.contains("data-race"));
        assert!(formatted.contains("0x200"));
    }

    #[test]
    fn test_mtsan_full_msan_error_report_formatting() {
        let report = MSanErrorReport::new(
            MSanErrorKind::UseOfUninitializedValue,
            0x300,
            4,
            MSAN_ORIGIN_CLEAN,
            MTSanStackTrace::capture(2),
            1,
            "test error",
        );
        let formatted = report.format(None);
        assert!(formatted.contains("MemorySanitizer"));
        assert!(formatted.contains("use-of-uninitialized-value"));
    }

    #[test]
    fn test_mtsan_full_stack_trace() {
        let mut trace = MTSanStackTrace::capture(5);
        assert_eq!(trace.frames.len(), 5);

        let formatted = trace.format();
        assert!(!formatted.is_empty());

        trace.symbolize();
        for frame in &trace.frames {
            assert!(frame.symbol.is_some());
        }
    }

    #[test]
    fn test_mtsan_full_stack_frame_format() {
        let frame = MTSanStackFrame {
            module: "mymodule".into(),
            module_offset: 0x100,
            symbol: Some("my_func".into()),
            file: Some("myfile.c".into()),
            line: Some(42),
            column: Some(10),
        };
        let formatted = frame.format();
        assert!(formatted.contains("my_func"));
        assert!(formatted.contains("myfile.c"));
        assert!(formatted.contains("42"));
    }

    #[test]
    fn test_mtsan_full_tls_shadow() {
        let mut tls = MSanTLSShadow::new();
        assert!(!tls.active);

        tls.init(1024);
        assert!(tls.active);
        assert_eq!(tls.tls_size, 1024);

        tls.clear_tls_range(0, 64);
        assert_eq!(tls.get_tls_shadow(0), MSAN_SHADOW_INIT);
        assert_eq!(tls.get_tls_shadow(65), MSAN_SHADOW_UNINIT);

        tls.set_tls_shadow(128, 0xAB);
        tls.set_tls_origin(128, 42);
        assert_eq!(tls.get_tls_shadow(128), 0xAB);
        assert_eq!(tls.get_tls_origin(128), 42);
    }

    #[test]
    fn test_mtsan_full_atomic_ordering_display() {
        assert_eq!(format!("{}", TSanAtomicOrdering::Relaxed), "relaxed");
        assert_eq!(format!("{}", TSanAtomicOrdering::Acquire), "acquire");
        assert_eq!(format!("{}", TSanAtomicOrdering::Release), "release");
        assert_eq!(format!("{}", TSanAtomicOrdering::AcquireRelease), "acq_rel");
        assert_eq!(
            format!("{}", TSanAtomicOrdering::SequentiallyConsistent),
            "seq_cst"
        );
    }

    #[test]
    fn test_mtsan_full_origin_kind_display() {
        assert_eq!(format!("{}", OriginKind::HeapAllocation), "heap-allocation");
        assert_eq!(format!("{}", OriginKind::Deallocated), "deallocated-memory");
    }

    #[test]
    fn test_mtsan_full_msan_propagate_ext() {
        let s = MSanShadowPropagator::propagate_ext(0xAB);
        assert_eq!(s, 0xAB);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_bitcast() {
        let s = MSanShadowPropagator::propagate_bitcast(0xCD);
        assert_eq!(s, 0xCD);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_gep() {
        let s = MSanShadowPropagator::propagate_gep(0xEF, &[0x00, 0x00]);
        assert_eq!(s, 0xEF);
    }

    #[test]
    fn test_mtsan_full_msan_propagate_fbinary() {
        let s = MSanShadowPropagator::propagate_fbinary(0x00, 0xFF);
        assert_eq!(s, MSAN_SHADOW_UNINIT);
    }

    #[test]
    fn test_mtsan_full_mtsan_stats_display() {
        let stats = MTSanStats {
            msan_access_count: 10,
            msan_propagation_count: 5,
            msan_shadow_bytes: 100,
            msan_origin_entries: 3,
            msan_error_count: 1,
            tsan_thread_count: 2,
            tsan_event_count: 20,
            tsan_lock_ops: 4,
            tsan_mutex_count: 1,
            tsan_race_count: 0,
            tsan_error_count: 0,
            initialized: true,
        };
        let display = format!("{}", stats);
        assert!(display.contains("10"));
        assert!(display.contains("true"));
    }

    #[test]
    fn test_mtsan_full_tsan_shadow_cell_history() {
        let mut cell = TSanShadowCell::new(2);

        for i in 1..6 {
            let mut clock = VectorClock::new();
            clock.set(i, i as u64);
            cell.record_access(i, &clock, true, 4, false, None, MTSanStackTrace::new());
        }

        // History should only keep 2 entries.
        assert!(cell.history.len() <= 2);
    }

    #[test]
    fn test_mtsan_full_lock_annotation() {
        let ann = LockAnnotation::acquire(42);
        assert_eq!(ann.capability, LockCapability::Mutex);
        assert_eq!(ann.mutex_id, 42);

        let ann = LockAnnotation::shared_acquire(100);
        assert_eq!(ann.capability, LockCapability::RwLockShared);
    }

    #[test]
    fn test_mtsan_full_init_with_subtarget() {
        let mut runtime = X86MTSanFull::new();
        let subtarget = X86Subtarget::default();
        runtime.init_with_subtarget(&subtarget);
        assert!(runtime.initialized);
        assert!(runtime.subtarget.is_some());
        assert!(runtime.calling_convention.is_some());
        assert!(runtime.register_info.is_some());
    }

    #[test]
    fn test_mtsan_full_deadlock_detector_self_cycle() {
        let mut detector = TSanDeadlockDetector::new();
        detector.acquired(1, 10);
        // Thread 1 tries to acquire mutex it already holds.
        let result = detector.try_acquire(1, 10);
        // Already owns it (re-entrant check is separate).
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_origin_constants() {
        assert_eq!(MSAN_ORIGIN_CLEAN, 0);
        assert_eq!(MSAN_ORIGIN_FREED, 0xFFFF_FFFE);
        assert_eq!(MSAN_ORIGIN_STACK_UAR, 0xFFFF_FFFD);
        assert_eq!(MSAN_ORIGIN_HEAP, 0xFFFF_FFFC);
        assert_eq!(MSAN_ORIGIN_MAX, 0x7FFF_FFFF);
    }

    #[test]
    fn test_mtsan_full_shadow_constants() {
        assert_eq!(MSAN_SHADOW_SCALE, 1);
        assert_eq!(MSAN_ORIGIN_SCALE, 4);
        assert_eq!(TSAN_SHADOW_GRANULARITY, 8);
        assert_eq!(TSAN_DEFAULT_HISTORY_SIZE, 2);
        assert_eq!(MTSAN_MAX_STACK_DEPTH, 64);
    }

    // -----------------------------------------------------------------------
    // Extended MSan Interceptor Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_intercept_strcmp() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x200000, 256);

        let (s1_init, s2_init) = runtime.msan_intercept_strcmp(0x200000, 0x200010);
        assert!(s1_init);
        assert!(s2_init);

        runtime.msan_set_shadow(0x200000, 4, MSAN_SHADOW_UNINIT);
        let (s1_init, s2_init) = runtime.msan_intercept_strcmp(0x200000, 0x200010);
        assert!(!s1_init);
    }

    #[test]
    fn test_msan_intercept_strncmp() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x210000, 256);

        let (s1_init, s2_init) = runtime.msan_intercept_strncmp(0x210000, 0x210010, 16);
        assert!(s1_init);
        assert!(s2_init);

        runtime.msan_set_shadow(0x210010, 4, MSAN_SHADOW_UNINIT);
        let (s1_init, s2_init) = runtime.msan_intercept_strncmp(0x210000, 0x210010, 16);
        assert!(s1_init);
        assert!(!s2_init);
    }

    #[test]
    fn test_msan_intercept_memchr() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x220000, 256);

        assert!(runtime.msan_intercept_memchr(0x220000, 128));

        runtime.msan_set_shadow(0x220020, 1, MSAN_SHADOW_UNINIT);
        assert!(!runtime.msan_intercept_memchr(0x220000, 128));
    }

    #[test]
    fn test_msan_intercept_strchr() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x230000, 256);
        assert!(runtime.msan_intercept_strchr(0x230000));
    }

    #[test]
    fn test_msan_intercept_bcopy() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x240000, 32, 0xAB);

        runtime.msan_intercept_bcopy(0x240000, 0x240100, 32);
        assert_eq!(runtime.msan_get_shadow(0x240100), 0xAB);
    }

    #[test]
    fn test_msan_intercept_bzero() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x250000, 32, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_bzero(0x250000, 32);
        for i in 0..32 {
            assert_eq!(runtime.msan_get_shadow(0x250000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_strtol() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x260000, 256);

        assert!(runtime.msan_intercept_strtol(0x260000, 0x260100));
        // endptr should be initialized.
        assert_eq!(runtime.msan_get_shadow(0x260100), MSAN_SHADOW_INIT);
    }

    #[test]
    fn test_msan_intercept_read() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x270000, 64, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_read(0, 0x270000, 64);
        // After a successful read, the buffer is initialized.
        for i in 0..64 {
            assert_eq!(runtime.msan_get_shadow(0x270000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_write() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x280000, 64);

        // Writing initialized data: no error.
        let result = runtime.msan_intercept_write(1, 0x280000, 64, 1);
        assert!(result.is_none());

        // Writing uninitialized data: error.
        runtime.msan_set_shadow(0x280000, 4, MSAN_SHADOW_UNINIT);
        let result = runtime.msan_intercept_write(1, 0x280000, 64, 1);
        assert!(result.is_some());
    }

    #[test]
    fn test_msan_intercept_stat() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x290000, 200, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_stat(0x290000, 0);
        for i in 0..144 {
            assert_eq!(runtime.msan_get_shadow(0x290000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_gettimeofday() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x300000, 32, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_gettimeofday(0x300000, 0x300020);
        for i in 0..16 {
            assert_eq!(runtime.msan_get_shadow(0x300000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_posix_memalign() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        runtime.msan_intercept_posix_memalign(0x310000, 64, 128, 0);
        for i in 0..128 {
            assert_eq!(runtime.msan_get_shadow(0x310000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_getcwd() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x320000, 256, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_getcwd(0x320000, 256);
        for i in 0..256 {
            assert_eq!(runtime.msan_get_shadow(0x320000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_gethostname() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x330000, 256, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_gethostname(0x330000, 256);
        for i in 0..256 {
            assert_eq!(runtime.msan_get_shadow(0x330000 + i), MSAN_SHADOW_INIT);
        }
    }

    // -----------------------------------------------------------------------
    // MSan mmap/munmap Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_intercept_mmap() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let result = runtime.msan_intercept_mmap(0x340000, 4096, 3, 0x22, -1, 0);
        assert_eq!(result, 0x340000);
        // New mapping should have initialized shadow.
        for i in 0..4096 {
            assert_eq!(runtime.msan_get_shadow(0x340000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_munmap() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_clear_shadow(0x350000, 4096);

        runtime.msan_intercept_munmap(0x350000, 4096);
        for i in 0..4096 {
            assert_eq!(runtime.msan_get_shadow(0x350000 + i), MSAN_SHADOW_UNINIT);
        }
    }

    #[test]
    fn test_msan_intercept_brk() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        // brk: increase program break.
        runtime.msan_intercept_brk(0x360100, 0x360000);
        for i in 0..256 {
            assert_eq!(runtime.msan_get_shadow(0x360000 + i), MSAN_SHADOW_INIT);
        }

        // brk: decrease program break → poison.
        runtime.msan_intercept_brk(0x360000, 0x360100);
        for i in 0..256 {
            assert_eq!(runtime.msan_get_shadow(0x360000 + i), MSAN_SHADOW_UNINIT);
        }
    }

    // -----------------------------------------------------------------------
    // TSan RWLock Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_rwlock_create_lock_unlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let rwlock = runtime.tsan_rwlock_create();

        let result = runtime.tsan_rwlock_rdlock(tid, rwlock);
        assert!(result.is_none());

        let result = runtime.tsan_rwlock_unlock(tid, rwlock);
        assert!(result.is_none());
    }

    #[test]
    fn test_tsan_rwlock_wrlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let rwlock = runtime.tsan_rwlock_create();

        let result = runtime.tsan_rwlock_wrlock(tid, rwlock);
        assert!(result.is_none());

        let result = runtime.tsan_rwlock_unlock(tid, rwlock);
        assert!(result.is_none());
    }

    #[test]
    fn test_tsan_rwlock_destroy_locked() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let rwlock = runtime.tsan_rwlock_create();

        runtime.tsan_rwlock_wrlock(tid, rwlock);
        let result = runtime.tsan_rwlock_destroy(rwlock);
        assert!(result.is_some());

        runtime.tsan_rwlock_unlock(tid, rwlock);
        let result = runtime.tsan_rwlock_destroy(rwlock);
        assert!(result.is_none());
    }

    #[test]
    fn test_tsan_rwlock_tryrdlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let rwlock = runtime.tsan_rwlock_create();

        assert!(runtime.tsan_rwlock_tryrdlock(tid, rwlock));
        runtime.tsan_rwlock_unlock(tid, rwlock);
    }

    #[test]
    fn test_tsan_rwlock_trywrlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let rwlock = runtime.tsan_rwlock_create();

        assert!(runtime.tsan_rwlock_trywrlock(tid, rwlock));
        runtime.tsan_rwlock_unlock(tid, rwlock);
    }

    // -----------------------------------------------------------------------
    // TSan SpinLock Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_spinlock_create_lock_unlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        let spinlock = runtime.tsan_spinlock_create();

        runtime.tsan_spinlock_lock(tid, spinlock);

        // Write under spinlock protection.
        runtime.tsan_store(tid, 0x370000, 4);

        runtime.tsan_spinlock_unlock(tid, spinlock);
    }

    #[test]
    fn test_tsan_spinlock_happens_before() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();
        let spinlock = runtime.tsan_spinlock_create();

        // Thread 1: lock → write → unlock.
        runtime.tsan_spinlock_lock(tid1, spinlock);
        runtime.tsan_store(tid1, 0x380000, 4);
        runtime.tsan_spinlock_unlock(tid1, spinlock);

        // Thread 2: lock → read (happens-after thread 1's write).
        runtime.tsan_spinlock_lock(tid2, spinlock);
        let result = runtime.tsan_load(tid2, 0x380000, 4);
        runtime.tsan_spinlock_unlock(tid2, spinlock);

        assert!(result.is_none());
    }

    // -----------------------------------------------------------------------
    // TSan External Annotation Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_external_acquire_release() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Thread 1 writes and releases at address.
        runtime.tsan_store(tid1, 0x390000, 4);
        runtime.tsan_external_release(tid1, 0x390000);

        // Thread 2 acquires and reads.
        runtime.tsan_external_acquire(tid2, 0x390000);
        let result = runtime.tsan_load(tid2, 0x390000, 4);

        assert!(result.is_none());
    }

    #[test]
    fn test_tsan_annotate_happens_before_after() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();

        runtime.tsan_annotate_happens_before(0x400000);
        runtime.tsan_annotate_happens_after(tid, 0x400000);
    }

    #[test]
    fn test_tsan_annotate_condvar() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        runtime.tsan_annotate_condvar_signal(tid1, 0x410000);
        runtime.tsan_annotate_condvar_wait(tid2, 0x410000);
    }

    #[test]
    fn test_tsan_annotate_benign_race() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        // Benign race annotations should not panic.
        runtime.tsan_annotate_benign_race(0x420000, 4, "known benign race");
    }

    // -----------------------------------------------------------------------
    // TSan Race Deduplication Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_race_deduplicator_new() {
        let dedup = TSanRaceDeduplicator::new(100);
        assert_eq!(dedup.reported_count(), 0);
    }

    #[test]
    fn test_race_deduplicator_hash() {
        let h1 = TSanRaceDeduplicator::hash_race(0x1000, 1, 2);
        let h2 = TSanRaceDeduplicator::hash_race(0x1000, 2, 1);
        assert_eq!(h1, h2); // Order doesn't matter.

        let h3 = TSanRaceDeduplicator::hash_race(0x2000, 1, 2);
        assert_ne!(h1, h3); // Different addresses.
    }

    #[test]
    fn test_race_deduplicator_first_report() {
        let mut dedup = TSanRaceDeduplicator::new(100);
        assert!(dedup.should_report(0x1000, 1, 2));
        assert_eq!(dedup.reported_count(), 1);
    }

    #[test]
    fn test_race_deduplicator_duplicate() {
        let mut dedup = TSanRaceDeduplicator::new(100);
        // Set throttle to 0 for testing.
        dedup.throttle_interval = Duration::from_secs(10);

        assert!(dedup.should_report(0x1000, 1, 2));
        // Same race, throttled.
        assert!(!dedup.should_report(0x1000, 1, 2));
    }

    // -----------------------------------------------------------------------
    // TSan Event Trace Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_event_trace_record() {
        let mut trace = TSanEventTrace::new(100);
        let event = TSanTraceEvent {
            event_type: TSanTraceEventType::Load,
            thread_id: 1,
            addr: 0x430000,
            size: 4,
            is_write: false,
            is_atomic: false,
            ordering: None,
            timestamp: 1,
            stack: MTSanStackTrace::capture(2),
        };
        trace.record(event);
        assert_eq!(trace.len(), 1);
    }

    #[test]
    fn test_tsan_event_trace_max_events() {
        let mut trace = TSanEventTrace::new(3);
        for i in 0..5 {
            trace.record(TSanTraceEvent {
                event_type: TSanTraceEventType::Load,
                thread_id: 1,
                addr: 0x440000 + i * 8,
                size: 4,
                is_write: false,
                is_atomic: false,
                ordering: None,
                timestamp: i,
                stack: MTSanStackTrace::new(),
            });
        }
        assert_eq!(trace.len(), 3);
    }

    #[test]
    fn test_tsan_event_trace_replay() {
        let mut trace = TSanEventTrace::new(100);
        trace.record(TSanTraceEvent {
            event_type: TSanTraceEventType::ThreadCreate,
            thread_id: 0,
            addr: 0,
            size: 0,
            is_write: false,
            is_atomic: false,
            ordering: None,
            timestamp: 0,
            stack: MTSanStackTrace::new(),
        });
        trace.record(TSanTraceEvent {
            event_type: TSanTraceEventType::Store,
            thread_id: 1,
            addr: 0x450000,
            size: 4,
            is_write: true,
            is_atomic: false,
            ordering: None,
            timestamp: 1,
            stack: MTSanStackTrace::new(),
        });

        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        let reports = trace.replay_on(&mut runtime);
        // Single thread — no races expected.
        assert!(reports.is_empty());
    }

    // -----------------------------------------------------------------------
    // Stack Trace Cache Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_stack_trace_cache_new() {
        let cache = StackTraceCache::new();
        assert_eq!(cache.hits, 0);
        assert_eq!(cache.misses, 0);
        assert_eq!(cache.hit_rate(), 0.0);
    }

    #[test]
    fn test_stack_trace_cache_get() {
        let mut cache = StackTraceCache::new();
        let trace1 = cache.get_or_capture(42, 3);
        assert_eq!(cache.misses, 1);

        let trace2 = cache.get_or_capture(42, 3);
        assert_eq!(cache.hits, 1);
    }

    #[test]
    fn test_stack_trace_cache_hit_rate() {
        let mut cache = StackTraceCache::new();
        cache.get_or_capture(1, 3);
        cache.get_or_capture(2, 3);
        cache.get_or_capture(1, 3);

        assert!(cache.hit_rate() > 0.0);
        assert_eq!(cache.hits, 1);
        assert_eq!(cache.misses, 2);
    }

    // -----------------------------------------------------------------------
    // Vector Shadow Propagation Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_propagate_vector_binary() {
        let a = vec![0x00, 0xFF, 0x00, 0xFF];
        let b = vec![0x00, 0x00, 0xFF, 0xFF];
        let result = MSanShadowPropagator::propagate_vector_binary(&a, &b);
        assert_eq!(result, vec![0x00, 0xFF, 0xFF, 0xFF]);
    }

    #[test]
    fn test_propagate_vector_shuffle() {
        let shadow = vec![0x01, 0x02, 0x03, 0x04];
        let mask = vec![3, 1, 2, 0];
        let result = MSanShadowPropagator::propagate_vector_shuffle(&shadow, &mask);
        assert_eq!(result, vec![0x04, 0x02, 0x03, 0x01]);
    }

    #[test]
    fn test_propagate_vector_shuffle_undef() {
        let shadow = vec![0x01, 0x02];
        let mask = vec![0, -1, 1, -1];
        let result = MSanShadowPropagator::propagate_vector_shuffle(&shadow, &mask);
        assert_eq!(result, vec![0x01, 0xFF, 0x02, 0xFF]);
    }

    #[test]
    fn test_propagate_extractelement() {
        let vec_shadow = vec![0x01, 0x02, 0x03, 0x04];
        assert_eq!(
            MSanShadowPropagator::propagate_extractelement(&vec_shadow, 0),
            0x01
        );
        assert_eq!(
            MSanShadowPropagator::propagate_extractelement(&vec_shadow, 3),
            0x04
        );
        assert_eq!(
            MSanShadowPropagator::propagate_extractelement(&vec_shadow, 99),
            MSAN_SHADOW_UNINIT
        );
    }

    #[test]
    fn test_propagate_insertelement() {
        let vec_shadow = vec![0x00; 4];
        let result = MSanShadowPropagator::propagate_insertelement(&vec_shadow, 2, 0xFF);
        assert_eq!(result, vec![0x00, 0x00, 0xFF, 0x00]);
    }

    #[test]
    fn test_propagate_masked_load() {
        let mut shadow = MSanShadowMemory::default();
        shadow.clear_shadow_range(0x460000, 4);
        shadow.set_shadow(0x460001, 0xFF);

        let mask = vec![true, true, true, true];
        let result = MSanShadowPropagator::propagate_masked_load(&shadow, 0x460000, &mask);
        assert_eq!(result[0], MSAN_SHADOW_INIT);
        assert_eq!(result[1], MSAN_SHADOW_UNINIT);
    }

    // -----------------------------------------------------------------------
    // Extended Deadlock Detector Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_extended_deadlock_detector_new() {
        let detector = ExtendedDeadlockDetector::new(DeadlockStrategy::WaitForGraph);
        assert_eq!(detector.strategy, DeadlockStrategy::WaitForGraph);
    }

    #[test]
    fn test_extended_deadlock_detector_timeout() {
        let mut detector = ExtendedDeadlockDetector::new(DeadlockStrategy::TimeoutHeuristic);
        detector.timeout_threshold = Duration::from_millis(1);

        detector.record_lock_acquired(1, 10);
        // Immediately check — no timeout yet.
        assert!(detector.check_timeout().is_empty());

        // After timeout...
        std::thread::sleep(Duration::from_millis(5));
        let timed_out = detector.check_timeout();
        assert!(!timed_out.is_empty());
        assert_eq!(timed_out[0], 10);
    }

    #[test]
    fn test_extended_deadlock_detector_combined() {
        let mut detector = ExtendedDeadlockDetector::new(DeadlockStrategy::Combined);
        detector.record_lock_acquired(1, 10);
        detector.record_lock_acquired(2, 20);

        detector.try_acquire(1, 20);
        let result = detector.try_acquire(2, 10);
        assert!(result.is_some());
    }

    // -----------------------------------------------------------------------
    // TSan Throttle Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_throttle_disabled() {
        let mut throttle = TSanThrottle::new(1);
        assert!(!throttle.enabled);
        assert!(throttle.should_process());
        assert_eq!(throttle.total_processed, 1);
        assert_eq!(throttle.total_skipped, 0);
    }

    #[test]
    fn test_tsan_throttle_sampling() {
        let mut throttle = TSanThrottle::new(4);
        assert!(throttle.enabled);

        // Only every 4th event is processed.
        let mut processed = 0;
        for _ in 0..12 {
            if throttle.should_process() {
                processed += 1;
            }
        }
        assert_eq!(processed, 3);
        assert_eq!(throttle.total_processed, 3);
        assert_eq!(throttle.total_skipped, 9);
    }

    #[test]
    fn test_tsan_throttle_skip_rate() {
        let mut throttle = TSanThrottle::new(10);
        for _ in 0..100 {
            throttle.should_process();
        }
        assert!(throttle.skip_rate() > 0.5);
    }

    // -----------------------------------------------------------------------
    // Combined Utility Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_mtsan_full_should_halt() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.flags.halt_on_error = false;
        assert!(!runtime.should_halt());

        runtime.flags.halt_on_error = true;
        assert!(!runtime.should_halt()); // No errors yet.

        // Trigger an error.
        runtime.msan_check_read(0x470000, 4, 1);
        assert!(runtime.should_halt());
    }

    #[test]
    fn test_mtsan_full_exit_code() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        assert_eq!(runtime.exit_code(), 0);

        runtime.msan_check_read(0x480000, 4, 1);
        assert_eq!(runtime.exit_code(), MTSAN_DEFAULT_EXITCODE);
    }

    #[test]
    fn test_mtsan_full_reset() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        runtime.tsan_store(tid, 0x490000, 4);
        runtime.msan_set_shadow(0x490000, 4, 0xFF);

        assert!(!runtime.tsan_threads.is_empty());

        runtime.reset();

        assert!(runtime.tsan_threads.is_empty());
        assert!(runtime.tsan_shadow.is_empty());
        assert_eq!(runtime.msan_access_count, 0);
        assert_eq!(runtime.tsan_event_count, 0);
    }

    #[test]
    fn test_mtsan_full_fork_child() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        runtime.msan_set_shadow(0x500000, 4, 0xAB);
        let tid = runtime.tsan_thread_create();

        runtime.handle_fork_child();

        // MSan shadow should be preserved.
        assert_eq!(runtime.msan_get_shadow(0x500000), 0xAB);

        // TSan state should be reset.
        assert!(runtime.tsan_threads.is_empty());
        assert!(runtime.tsan_shadow.is_empty());
    }

    #[test]
    fn test_mtsan_full_global_tick() {
        let runtime = X86MTSanFull::new();
        assert_eq!(runtime.global_tick(), 0);
        runtime.tick();
        assert_eq!(runtime.global_tick(), 1);
    }

    #[test]
    fn test_mtsan_full_dump_state() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        let state = runtime.dump_state();
        assert!(state.contains("X86MTSanFull"));
        assert!(state.contains("Initialized:"));
    }

    #[test]
    fn test_mtsan_full_live_thread_count() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        assert_eq!(runtime.live_thread_count(), 2);

        runtime.tsan_thread_join(tid1, tid2);
        assert_eq!(runtime.live_thread_count(), 1);

        runtime.detach_thread(tid1);
        assert_eq!(runtime.live_thread_count(), 0);
    }

    #[test]
    fn test_mtsan_full_thread_name() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        assert!(runtime.thread_name(tid).is_none());

        runtime.set_thread_name(tid, "worker-1");
        assert_eq!(runtime.thread_name(tid), Some("worker-1"));
    }

    #[test]
    fn test_mtsan_full_is_in_signal_handler() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();
        assert!(!runtime.is_in_signal_handler(tid));

        runtime.tsan_signal_enter(tid, 2);
        assert!(runtime.is_in_signal_handler(tid));

        runtime.tsan_signal_exit(tid);
        assert!(!runtime.is_in_signal_handler(tid));
    }

    #[test]
    fn test_mtsan_full_verify_shadow_consistency() {
        let runtime = X86MTSanFull::new();
        assert!(runtime.verify_shadow_consistency());
    }

    #[test]
    fn test_mtsan_full_periodic_flush() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        // Add many shadow cells.
        for i in 0..100 {
            let tid = runtime.tsan_thread_create();
            runtime.tsan_store(tid, 0x500000 + i * 8, 1);
        }

        runtime.periodic_flush();
        // No panic.
    }

    // -----------------------------------------------------------------------
    // MSan Interceptor Edge Case Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_intercept_realpath() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x510000, 4096, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_realpath(0x510000, 0x511000);
        for i in 0..4096 {
            assert_eq!(runtime.msan_get_shadow(0x511000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_readlink() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x520000, 256, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_readlink(0x520000, 0x520100, 256, 32);
        for i in 0..32 {
            assert_eq!(runtime.msan_get_shadow(0x520100 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_clock_gettime() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x530000, 32, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_clock_gettime(0x530000);
        for i in 0..16 {
            assert_eq!(runtime.msan_get_shadow(0x530000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_pthread_getspecific() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x540000, 8, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_pthread_getspecific(0, 0x540000);
        for i in 0..8 {
            assert_eq!(runtime.msan_get_shadow(0x540000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_aligned_alloc() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        runtime.msan_intercept_aligned_alloc(64, 256, 0x550000);
        for i in 0..256 {
            assert_eq!(runtime.msan_get_shadow(0x550000 + i), MSAN_SHADOW_INIT);
        }
    }

    #[test]
    fn test_msan_intercept_getenv() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_set_shadow(0x560000, 4096, MSAN_SHADOW_UNINIT);

        runtime.msan_intercept_getenv(0x560000);
        for i in 0..4096 {
            assert_eq!(runtime.msan_get_shadow(0x560000 + i), MSAN_SHADOW_INIT);
        }
    }

    // -----------------------------------------------------------------------
    // MSan Mapping Tracker Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_mapping_tracker_add_find() {
        let mut tracker = MSanMappingTracker::new();
        tracker.add_mapping(0x570000, 4096, 3, 0x22);

        let mapping = tracker.find_mapping(0x570000);
        assert!(mapping.is_some());
        assert_eq!(mapping.unwrap().size, 4096);

        let mapping = tracker.find_mapping(0x571000);
        assert!(mapping.is_some());

        let mapping = tracker.find_mapping(0x580000);
        assert!(mapping.is_none());
    }

    #[test]
    fn test_msan_mapping_tracker_remove() {
        let mut tracker = MSanMappingTracker::new();
        tracker.add_mapping(0x590000, 4096, 3, 0x22);
        tracker.add_mapping(0x591000, 4096, 3, 0x22);

        tracker.remove_mapping(0x590000, 4096);
        assert!(tracker.find_mapping(0x590000).is_none());
        assert!(tracker.find_mapping(0x591000).is_some());
    }

    #[test]
    fn test_msan_mapping_tracker_mark_initialized() {
        let mut tracker = MSanMappingTracker::new();
        tracker.add_mapping(0x600000, 4096, 3, 0x22);

        tracker.mark_initialized(0x600000, 256);
        let mapping = tracker.find_mapping(0x600000).unwrap();
        assert!(mapping.is_initialized);
    }

    // -----------------------------------------------------------------------
    // TSan Annotation Edge Case Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_annotate_ignore_reads() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        runtime.tsan_annotate_ignore_reads_begin();
        runtime.tsan_annotate_ignore_reads_end();
    }

    #[test]
    fn test_tsan_annotate_ignore_writes() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        runtime.tsan_annotate_ignore_writes_begin();
        runtime.tsan_annotate_ignore_writes_end();
    }

    #[test]
    fn test_tsan_annotate_rwlock() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();

        runtime.tsan_annotate_rwlock_create(0x610000);
        runtime.tsan_annotate_rwlock_acquired(tid, 0x610000, true);
        runtime.tsan_annotate_rwlock_released(tid, 0x610000, true);
    }

    // -----------------------------------------------------------------------
    // Overall Runtime Integration Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_mtsan_full_complex_scenario() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();
        runtime.msan_shadow.track_origins = true;

        // Simulate a complex multi-threaded scenario.
        let main_tid = runtime.tsan_thread_create();
        let worker_tid = runtime.tsan_thread_create();

        // Main thread allocates and initializes memory.
        let mem = 0x620000u64;
        let size = 64usize;
        runtime.msan_clear_shadow(mem, size);

        // Set an origin for the memory.
        let origin = runtime.msan_allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "main stack allocation",
            OriginKind::StackAllocation,
        );
        runtime.msan_set_origin(mem, size, origin);

        // Worker creates a mutex and protects a write.
        let mutex = runtime.tsan_mutex_create();

        // Main: lock → write → unlock.
        runtime.tsan_mutex_lock(main_tid, mutex);
        runtime.combined_store_check(main_tid, mem, &[MSAN_SHADOW_INIT; 8], origin);
        runtime.tsan_mutex_unlock(main_tid, mutex);

        // Worker: lock → read (happens-after main's write).
        runtime.tsan_mutex_lock(worker_tid, mutex);
        let (msan_err, tsan_race) = runtime.combined_load_check(worker_tid, mem, 8);
        runtime.tsan_mutex_unlock(worker_tid, mutex);

        // MSan: memory is initialized → no error.
        assert!(msan_err.is_none());
        // TSan: happens-before via mutex → no race.
        assert!(tsan_race.is_none());

        // Join worker.
        runtime.combined_pthread_join(main_tid, worker_tid);

        // Finalize.
        runtime.finalize();
    }

    #[test]
    fn test_mtsan_full_race_without_sync() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        // Both threads access same memory without synchronization.
        runtime.tsan_store(tid1, 0x630000, 4);
        let race = runtime.tsan_store(tid2, 0x630000, 4);
        assert!(race.is_some());
        assert!(!runtime.tsan_reports.is_empty());
    }

    #[test]
    fn test_mtsan_full_uninit_across_function_boundary() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        // Simulate a function receiving an uninitialized argument.
        let origin = runtime.msan_allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "uninit param x",
            OriginKind::FunctionParameter,
        );

        let param_addr: u64 = 0x640000;
        runtime.msan_set_shadow(param_addr, 4, MSAN_SHADOW_UNINIT);
        runtime.msan_set_origin(param_addr, 4, origin);

        let result = runtime.msan_check_read(param_addr, 4, 1);
        assert!(result.is_some());
        let report = result.unwrap();
        assert_eq!(report.origin, origin);
    }

    #[test]
    fn test_mtsan_full_mixed_atomics_and_mutexes() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid1 = runtime.tsan_thread_create();
        let tid2 = runtime.tsan_thread_create();

        let mutex = runtime.tsan_mutex_create();

        // Thread 1: atomic release store.
        runtime.tsan_atomic_store(tid1, 0x650000, 4, TSanAtomicOrdering::Release);

        // Thread 2: mutex lock (acquires mutex clock, not the atomic release).
        runtime.tsan_mutex_lock(tid2, mutex);
        let result = runtime.tsan_atomic_load(tid2, 0x650000, 4, TSanAtomicOrdering::Acquire);
        runtime.tsan_mutex_unlock(tid2, mutex);

        // The mutex does not synchronize with the atomic → race possible.
        // (The acquire load sees the release — this actually synchronizes.)
        assert!(result.is_none());
    }

    #[test]
    fn test_mtsan_full_many_threads() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let mut threads = Vec::new();
        for _ in 0..50 {
            let tid = runtime.tsan_thread_create();
            threads.push(tid);
        }

        assert_eq!(threads.len(), 50);
        assert_eq!(runtime.tsan_threads.len(), 50);

        // All threads access shared memory.
        for &tid in &threads {
            runtime.tsan_store(tid, 0x660000, 4);
        }

        // Races should be detected.
        assert!(runtime.tsan_race_count > 0);
    }

    #[test]
    fn test_mtsan_full_signal_handler_race_protection() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let tid = runtime.tsan_thread_create();

        // Normal access.
        runtime.tsan_store(tid, 0x670000, 4);

        // Enter signal handler.
        runtime.tsan_signal_enter(tid, 2);

        // Access in signal handler.
        let result = runtime.tsan_store(tid, 0x670000, 4);
        // Same thread — no race.
        assert!(result.is_none());

        runtime.tsan_signal_exit(tid);
    }

    // -----------------------------------------------------------------------
    // Error Report Formatting Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_tsan_error_report_deadlock_format() {
        let cycle = vec![1, 2, 3];
        let stacks: Vec<_> = cycle.iter().map(|_| MTSanStackTrace::capture(3)).collect();
        let report = TSanErrorReport::deadlock(cycle, stacks);
        let formatted = report.format();
        assert!(formatted.contains("deadlock"));
        assert!(formatted.contains("1"));
    }

    #[test]
    fn test_tsan_error_report_thread_leak_format() {
        let report = TSanErrorReport::thread_leak(42, MTSanStackTrace::capture(2));
        let formatted = report.format();
        assert!(formatted.contains("thread-leak"));
        assert!(formatted.contains("42"));
    }

    #[test]
    fn test_tsan_error_report_signal_unsafe_format() {
        let report =
            TSanErrorReport::signal_unsafe_call(1, "malloc", 2, MTSanStackTrace::capture(2));
        let formatted = report.format();
        assert!(formatted.contains("signal-unsafe-call"));
        assert!(formatted.contains("malloc"));
    }

    #[test]
    fn test_msan_error_report_with_origin() {
        let mut runtime = X86MTSanFull::new();
        runtime.initialize();

        let origin = runtime.msan_allocate_origin(
            MSAN_ORIGIN_CLEAN,
            "test origin",
            OriginKind::HeapAllocation,
        );

        let report = MSanErrorReport::new(
            MSanErrorKind::UseOfUninitializedValue,
            0x680000,
            4,
            origin,
            MTSanStackTrace::capture(2),
            1,
            "test",
        );
        let formatted = report.format(Some(&runtime.origin_registry));
        assert!(formatted.contains("test origin"));
        assert!(formatted.contains("heap-allocation"));
    }

    // -----------------------------------------------------------------------
    // Suppression File Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_suppression_parse_multiple_entries() {
        let content = r#"
race:suppress_race_1
fun:racy_func_1

race:suppress_race_2
src:file2.c
module:mymodule

thread_leak:leak_suppression
fun:leaky_func
"#;
        let supps = TSanSuppressions::parse(content);
        assert_eq!(supps.len(), 3);
    }

    #[test]
    fn test_suppression_match_type_wildcard() {
        let content = "*:match_all\nfun:any_func\n";
        let supps = TSanSuppressions::parse(content);

        let report = TSanErrorReport::data_race(
            0x100,
            4,
            1,
            2,
            true,
            true,
            MTSanStackTrace::new(),
            MTSanStackTrace::new(),
        );
        // No matching func, should not suppress.
        assert!(!supps.is_suppressed(&report));
    }

    // -----------------------------------------------------------------------
    // Error Kind Display Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_msan_error_kind_display_all() {
        let kinds = [
            MSanErrorKind::UseOfUninitializedValue,
            MSanErrorKind::UninitializedBranch,
            MSanErrorKind::UninitializedCondition,
            MSanErrorKind::UninitializedSyscallArg,
            MSanErrorKind::UninitializedFree,
            MSanErrorKind::MemoryLeak,
            MSanErrorKind::DoubleFreeUninitialized,
        ];
        for kind in &kinds {
            let s = format!("{}", kind);
            assert!(!s.is_empty());
        }
    }

    #[test]
    fn test_tsan_error_kind_display_all() {
        let kinds = [
            TSanErrorKind::DataRace,
            TSanErrorKind::MutexDeadlock,
            TSanErrorKind::LockOrderInversion,
            TSanErrorKind::ThreadLeak,
            TSanErrorKind::SignalUnsafeCall,
            TSanErrorKind::UseAfterFreeRace,
            TSanErrorKind::DoubleLock,
            TSanErrorKind::UnlockNotOwned,
            TSanErrorKind::DestroyLockedMutex,
        ];
        for kind in &kinds {
            let s = format!("{}", kind);
            assert!(!s.is_empty());
        }
    }

    // -----------------------------------------------------------------------
    // Default Implementation Tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_default_implementations() {
        let _shadow = MSanShadowMemory::default();
        let _registry = OriginRegistry::default();
        let _interceptors = MSanInterceptors::default();
        let _tls = MSanTLSShadow::default();
        let _signal_ctx = MSanSignalContext::default();
        let _deadlock = TSanDeadlockDetector::default();
        let _safety = TSanSignalSafety::default();
        let _suppressions = TSanSuppressions::default();
        let _options_msan = MSanOptions::default();
        let _options_tsan = TSanOptions::default();
        let _flags = MTSanFlags::default();
        let _runtime = X86MTSanFull::default();
        let _trace_cache = StackTraceCache::default();
        let _dedup = TSanRaceDeduplicator::default();
        let _throttle = TSanThrottle::default();
        let _event_trace = TSanEventTrace::default();
        let _ext_deadlock = ExtendedDeadlockDetector::default();
        let _mapping_tracker = MSanMappingTracker::default();
    }

    #[test]
    fn test_vector_clock_default() {
        let vc = VectorClock::default();
        assert!(vc.is_empty());
    }

    #[test]
    fn test_mtsan_flags_from_env() {
        // Save and restore environment.
        let saved = std::env::var("MSAN_OPTIONS").ok();
        std::env::set_var("MSAN_OPTIONS", "poison_in_free=0:track_origins=2");
        let flags = MTSanFlags::from_env();
        assert!(!flags.msan_options.poison_in_free);
        assert_eq!(flags.msan_options.track_origins, 2);
        assert!(flags.origins_enabled);

        // Restore.
        if let Some(val) = saved {
            std::env::set_var("MSAN_OPTIONS", val);
        } else {
            std::env::remove_var("MSAN_OPTIONS");
        }
    }
}