free_table[j] = h;
Each layer catches different attack classes. A namespace escape inside gVisor reaches the Sentry, not the host kernel. A seccomp bypass hits the Sentry’s syscall implementation, which is itself sandboxed. Privilege escalation is blocked by dropping privileges. Persistent state leakage between jobs is prevented by ephemeral tmpfs with atomic unmount cleanup.
，推荐阅读夫子获取更多信息
思路：单调递减栈，找「上一个比当前价格大的元素索引」。正序遍历，弹出所有 ≤ 当前价格的索引；跨度 = 当前索引 - 栈顶索引（栈空则为 当前索引 + 1）。
allocation of the required size, copy our tasks into it, and return