1471589 - Check that we do not insert overlapping memory regions in diagnostic builds.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Nicolas B. Pierron [:nbp]]

(reasoning in Bug 1263794 comment 34)

LifoAlloc is registering memory regions in the Memory Protection mechanism, we want to double check that we do not insert multiple memory regions with the same addresses.

Memory regions are being registered by the BumpChunk constructor and remove by the BumpChunks destructor.  BumpChunk lifetime is handle only with UniquePtr classes.

Therefore, if this assertion happens in the wild, it would imply that we have live allocations with overlapping memory ranges.

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Ensure that range do not overlap in diagnostic builds.

Comment 2

[Ted Campbell [:tcampbell]]

Comment on attachment 8988156 [details] [diff] [review]
Ensure that range do not overlap in diagnostic builds.

Review of attachment 8988156 [details] [diff] [review]:
-----------------------------------------------------------------

Good idea

Comment 3

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/77d45de84983

Comment 4

[Nicolas B. Pierron [:nbp]]

We should see this assertion with the following crash-stat search:

https://crash-stats.mozilla.com/search/?moz_crash_reason=~cmp&date=%3E%3D2018-06-20T15%3A03%3A55.000Z&date=%3C2018-09-30T15%3A03%3A00.000Z&page=1&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/77d45de84983

Comment 6

[Nicolas B. Pierron [:nbp]]

Since the last 16 days, this assertion triggered only twice on Nightlies (Mac & Windows).  Unfortunately, it is unexpected to produce any more crashes since the memory protection (Bug 1437600) is going away.  The last crash [1], on Windows, reports that we had already allocated a 12k BumpChunk, and that we are trying to register a new allocation aligned at the same address with a size of 4k.

So jemalloc does provide twice the same pointer, but we have no way to know if these is a wrong-ptr free or double free.
However, the frequency of this issue is not enough to explain what is observed in LifoAlloc issues.

[1] https://crash-stats.mozilla.com/report/index/f1f1378e-a069-4596-907e-1b9ee01807202