From c60ccf6858f007f09780c69a0d789a3500419ed7 Mon Sep 17 00:00:00 2001
From: kronecker <2026692687@qq.com>
Date: Sun, 18 Oct 2026 17:18:55 +0800
Subject: [PATCH] perf(sandbox): limit javac to the first JIT tier

Keep the short-lived compiler VM on the first JIT tier while preserving student runtime options and every resource budget. The closed profile validator rejects removed or overridden compiler tier options.

Validation: make contracts; make check. Actual isolated VM reacceptance remains pending.
---
 judge/crates/sandbox/src/profiles.rs          |  2 ++
 .../crates/sandbox/tests/managed_profiles.rs  | 26 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/judge/crates/sandbox/src/profiles.rs b/judge/crates/sandbox/src/profiles.rs
index ed0f32c..e09c4cb 100644
--- a/judge/crates/sandbox/src/profiles.rs
+++ b/judge/crates/sandbox/src/profiles.rs
@@ -73,6 +73,8 @@ pub fn argv(profile: P, limits: &ResourceLimits) -> Result<Vec<String>, &'static
         P::JavaCompile => {
             let mut args = vec!["/usr/lib/jvm/bin/javac".into()];
             args.extend(jvm_options(limits)?.into_iter().map(|a| format!("-J{a}")));
+            // javac is short-lived; avoid C2 work in the compiler's own JVM.
+            args.push("-J-XX:TieredStopAtLevel=1".into());
             args.extend(
                 [
                     "-proc:none",
diff --git a/judge/crates/sandbox/tests/managed_profiles.rs b/judge/crates/sandbox/tests/managed_profiles.rs
index 461fbc4..9e3952e 100644
--- a/judge/crates/sandbox/tests/managed_profiles.rs
+++ b/judge/crates/sandbox/tests/managed_profiles.rs
@@ -357,6 +357,32 @@ fn startup_heap_and_budget_parameters_cannot_be_supplied_by_request() {
     assert!(small.validate(&SpecPolicy::default()).is_err());
 }
 
+#[test]
+fn javac_jit_tier_is_fixed_without_changing_student_runtime() {
+    let original = request(ExecutionProfile::JavaCompile);
+    let index = original
+        .argv
+        .iter()
+        .position(|arg| arg == "-J-XX:TieredStopAtLevel=1")
+        .unwrap();
+    assert!(original.clone().validate(&SpecPolicy::default()).is_ok());
+    for replacement in [
+        "-J-XX:TieredStopAtLevel=0",
+        "-J-XX:TieredStopAtLevel=4",
+        "-J-XX:-TieredCompilation",
+    ] {
+        let mut changed = original.clone();
+        changed.argv[index] = replacement.into();
+        assert!(changed.validate(&SpecPolicy::default()).is_err());
+    }
+    let mut missing = original;
+    missing.argv.remove(index);
+    assert!(missing.validate(&SpecPolicy::default()).is_err());
+    let run = request(ExecutionProfile::JavaRun);
+    assert!(!run.argv.iter().any(|arg| arg.contains("TieredStopAtLevel")));
+    assert!(run.validate(&SpecPolicy::default()).is_ok());
+}
+
 #[test]
 fn root_image_kind_never_promotes_legacy_authority() {
     let legacy: RuntimeConfig = serde_json::from_str(include_str!(