Fix TSAN tests failing in Docker containers due to setarch

ARM64 CI builds fail with "setarch: failed to set personality to (null):
Operation not permitted" because Docker containers lack CAP_SYS_ADMIN
capability required for setarch to modify process personality flags.

Root cause: CI scripts were calling setarch -R externally before make,
but the Makefile also wraps test execution with setarch via BIN_WRAPPER,
causing double-wrapping and permission failures in containers.

Solution:
1. Remove redundant setarch calls from CI scripts (both x64 and ARM64)
2. Add graceful fallback in Makefile's BIN_WRAPPER:
   sh -c 'setarch $(uname -m) -R "$@" 2>/dev/null || "$@"' --

This allows TSAN tests to run successfully in:
- Native Linux (setarch works normally)
- Docker containers (falls back without setarch)
- macOS (already skips setarch, no change)

TSAN still works correctly in containers because:
- We use MAP_FIXED for 4GB allocation at fixed addresses
- Container ASLR is limited compared to host systems
- TSAN shadow memory layout remains valid

Fixes:
- host-arm64: "setarch failed" exit code 1
- host-x64: Redundant setarch removed for consistency

Author: jserv

.github/workflows/main.yml

@@ -258,9 +258,10 @@ jobs:
             set -o pipefail
 
             # TSAN requires ASLR disabled to prevent allocations in shadow memory
+            # Note: setarch handled by Makefile's BIN_WRAPPER
             # Interpreter with FULL4G: Basic race detection across emulation core
             echo "=== TSAN Test 1/3: Interpreter + FULL4G ==="
-            make distclean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 check $PARALLEL 2>&1 | tee tsan-interpreter.log
+            make distclean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 check $PARALLEL 2>&1 | tee tsan-interpreter.log
             if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-interpreter.log; then
               echo "ERROR: Data race detected in interpreter mode!"
               grep -A 10 "ThreadSanitizer:" tsan-interpreter.log
@@ -270,7 +271,7 @@ jobs:
 
             # JIT tier-1: Race detection in template-based JIT compilation
             echo "=== TSAN Test 2/3: JIT Tier-1 ==="
-            make ENABLE_JIT=1 clean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 check $PARALLEL 2>&1 | tee tsan-jit.log
+            make ENABLE_JIT=1 clean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 check $PARALLEL 2>&1 | tee tsan-jit.log
             if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-jit.log; then
               echo "ERROR: Data race detected in JIT tier-1 mode!"
               grep -A 10 "ThreadSanitizer:" tsan-jit.log
@@ -280,7 +281,7 @@ jobs:
 
             # JIT tier-2 (T2C): Race detection across LLVM compilation thread
             echo "=== TSAN Test 3/3: JIT Tier-2 (T2C) ==="
-            make ENABLE_JIT=1 clean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 ENABLE_T2C=1 check $PARALLEL 2>&1 | tee tsan-t2c.log
+            make ENABLE_JIT=1 clean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 ENABLE_T2C=1 check $PARALLEL 2>&1 | tee tsan-t2c.log
             if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-t2c.log; then
               echo "ERROR: Data race detected in JIT tier-2 (T2C) mode!"
               grep -A 10 "ThreadSanitizer:" tsan-t2c.log
@@ -447,25 +448,26 @@ jobs:
           make distclean && make ENABLE_EXT_F=0 ENABLE_JIT=1 check $PARALLEL
           make distclean && make ENABLE_EXT_C=0 ENABLE_JIT=1 check $PARALLEL
           # TSAN on ARM64: Fixed memory layout (0x150000000000 for main, 0x151000000000 for JIT)
+          # Note: setarch handled by Makefile's BIN_WRAPPER (falls back gracefully in containers)
           set -o pipefail
           echo "=== TSAN Test 1/3: Interpreter + FULL4G (ARM64) ==="
-          make distclean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 check $PARALLEL 2>&1 | tee tsan-interpreter.log
+          make distclean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 check $PARALLEL 2>&1 | tee tsan-interpreter.log
           if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-interpreter.log; then
             echo "ERROR: Data race detected in interpreter mode!"
             grep -A 10 "ThreadSanitizer:" tsan-interpreter.log
             exit 1
           fi
           echo "✓ No races detected in interpreter mode"
           echo "=== TSAN Test 2/3: JIT Tier-1 (ARM64) ==="
-          make ENABLE_JIT=1 clean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 check $PARALLEL 2>&1 | tee tsan-jit.log
+          make ENABLE_JIT=1 clean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 check $PARALLEL 2>&1 | tee tsan-jit.log
           if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-jit.log; then
             echo "ERROR: Data race detected in JIT tier-1 mode!"
             grep -A 10 "ThreadSanitizer:" tsan-jit.log
             exit 1
           fi
           echo "✓ No races detected in JIT tier-1 mode"
           echo "=== TSAN Test 3/3: JIT Tier-2 (T2C) (ARM64) ==="
-          make ENABLE_JIT=1 clean && setarch -R make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 ENABLE_T2C=1 check $PARALLEL 2>&1 | tee tsan-t2c.log
+          make ENABLE_JIT=1 clean && make ENABLE_TSAN=1 ENABLE_FULL4G=1 ENABLE_JIT=1 ENABLE_T2C=1 check $PARALLEL 2>&1 | tee tsan-t2c.log
           if grep -q "ThreadSanitizer: data race\|ThreadSanitizer: race on\|WARNING: ThreadSanitizer:" tsan-t2c.log; then
             echo "ERROR: Data race detected in JIT tier-2 (T2C) mode!"
             grep -A 10 "ThreadSanitizer:" tsan-t2c.log

Makefile

@@ -107,8 +107,10 @@ override ENABLE_LTO := 0       # LTO interferes with TSAN instrumentation
 CFLAGS += -DTSAN_ENABLED       # Signal code to use TSAN-compatible allocations
 # Disable ASLR for TSAN tests to prevent allocations in TSAN shadow memory
 # Note: setarch is Linux-only; macOS requires different approach (SIP disable)
+# In containers (GitHub Actions), setarch may fail due to missing capabilities.
+# We use a wrapper script that falls back gracefully if setarch is unavailable.
 ifeq ($(UNAME_S),Linux)
-BIN_WRAPPER = setarch $(shell uname -m) -R
+BIN_WRAPPER = sh -c 'setarch $(shell uname -m) -R "$$@" 2>/dev/null || "$$@"' --
 else
 BIN_WRAPPER =
 endif