1117180 - Messing with weakmap can result on negative value for heap-unclassified

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Guilherme Lima]

I was testing bug 657264, and went to check about:memory after some hangs.
Tested some more and discovered that if you run that test with a high number for N (2e19 or more), and then check about:memory, you will get it negative. You have to minimize memory usage first, and then measure it.

Comment 1

[Nicholas Nethercote [inactive]]

Can you give clear steps to reproduce? I was unable to reproduce this using the code from bug 657264 comment 0.

Comment 2

[Guilherme Lima]

I'm not being able to reproduce as well now. But will keep trying. It was fairly easy when I filled. Now I'm only getting the hangs.

Comment 3

[Guilherme Lima]

Got it:
My STR:
1 - open http://www.play-hookey.com/htmltest/
2 - paste the code:
<script>
var t0 = new Date;
var wm = new WeakMap();
var key = {}, value = {};
var N = Math.pow(2, 12);
while(N--){
  wm.set(key, value);
  key = value;
  value = {};
}
alert(new Date - t0);
</script>
3 - click "Show Page" 20x
4 - go to about:memory, click on "Minimize memory usage" and then "Measure"

Result:
WARNING: the following values are negative or unreasonably large.

    explicit/(16 tiny)
    explicit/(16 tiny)/heap-unclassified 

This indicates a defect in one or more memory reporters. The invalid values are highlighted. 

──-13.00 MB (-6.06%) -- (16 tiny) [?!]
└──-18.75 MB (-8.74%) ── heap-unclassified [?!]

Comment 4

[Andrew McCreight [:mccr8]]

This is probably a bug in a JS weak map memory reporter, so I'm going to move it over to the JS engine component.

Comment 5

[Guilherme Lima]

Ah, important thing I just found out: it only happens with the addon NoScript enabled.