TenuredChunk::decommitFreeArenasWithoutUnlocking doesn't clear the free committed arenas list
Categories
(Core :: JavaScript: GC, defect, P1)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox87 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
Details
Attachments
(1 file)
TenuredChunkInfo contains a bunch of information about the chunk, including counts of free and free committed arenas and a list of free committed arenas (arenas can be in three states: allocated, free committed and free decommitted).
I noticed when reviewing the patch in bug 1660006 comment 17 that TenuredChunk::decommitFreeArenasWithoutUnlocking doesn't update the list of free committed arenas. I'm not sure how bad this is because in general we check the counts to see if there are free committed arenas before pulling one off the list, but this could well be hiding bugs.
This method is only called rarely (in response to OOM) and hardly shows up in our testing.
|
Assignee | |
Comment 1•3 years ago
|
||
This adds methods to verify the chunk metadata very GC in debug builds (held relocated arenas mess things up because they're mprotected so it's checked after we free those).
The code in question was hard to exercise and I had to update reportLargeAllocationFailure to take a byte count so we could avoid calling the shell's large allocation failure callback, which causes the shell to exit (see JSRuntime::onOutOfMemoryCanGC).
It's debateable whether it's worth handling OOM from MarkPagesUnusedSoft. If we assume pages have been been successfully marked unused regardless of failure I think the worst that happens is that we don't reuse them immediately... I ended up handling this anyway though, and rebuilding the list rather than clearing it entirely in decommitFreeArenasWithoutUnlocking.
|
||
Updated•3 years ago
|
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/92d91d4eb2cd Update list of free committed arenas in TenuredChunk::decommitFreeArenasWithoutUnlocking r=sfink
|
||
Comment 3•3 years ago
|
||
Backed out changeset 92d91d4eb2cd (Bug 1692221) for causing sm failures in bug-1692221.js
Backout link: https://hg.mozilla.org/integration/autoland/rev/98a0d23d6c73d8c71fc970c6311c656e5d7e8f90
Failure log: https://treeherder.mozilla.org/logviewer?job_id=330006274&repo=autoland&lineNumber=9458
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/6214d7dd8d9b Update list of free committed arenas in TenuredChunk::decommitFreeArenasWithoutUnlocking r=sfink
|
||
Comment 5•3 years ago
|
||
| bugherder | ||
|
|
Assignee | |
Updated•3 years ago
|
Description
•