TenuredChunk::decommitFreeArenasWithoutUnlocking doesn't clear the free committed arenas list
Categories
(Core :: JavaScript: GC, defect, P1)
Tracking
()
Tracking | Status | |
---|---|---|
firefox87 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
Details
Attachments
(1 file)
TenuredChunkInfo contains a bunch of information about the chunk, including counts of free and free committed arenas and a list of free committed arenas (arenas can be in three states: allocated, free committed and free decommitted).
I noticed when reviewing the patch in bug 1660006 comment 17 that TenuredChunk::decommitFreeArenasWithoutUnlocking doesn't update the list of free committed arenas. I'm not sure how bad this is because in general we check the counts to see if there are free committed arenas before pulling one off the list, but this could well be hiding bugs.
This method is only called rarely (in response to OOM) and hardly shows up in our testing.
Assignee | ||
Comment 1•4 years ago
|
||
This adds methods to verify the chunk metadata very GC in debug builds (held relocated arenas mess things up because they're mprotected so it's checked after we free those).
The code in question was hard to exercise and I had to update reportLargeAllocationFailure to take a byte count so we could avoid calling the shell's large allocation failure callback, which causes the shell to exit (see JSRuntime::onOutOfMemoryCanGC).
It's debateable whether it's worth handling OOM from MarkPagesUnusedSoft. If we assume pages have been been successfully marked unused regardless of failure I think the worst that happens is that we don't reuse them immediately... I ended up handling this anyway though, and rebuilding the list rather than clearing it entirely in decommitFreeArenasWithoutUnlocking.
Updated•4 years ago
|
Comment 3•4 years ago
|
||
Backed out changeset 92d91d4eb2cd (Bug 1692221) for causing sm failures in bug-1692221.js
Backout link: https://hg.mozilla.org/integration/autoland/rev/98a0d23d6c73d8c71fc970c6311c656e5d7e8f90
Failure log: https://treeherder.mozilla.org/logviewer?job_id=330006274&repo=autoland&lineNumber=9458
Comment 5•4 years ago
|
||
bugherder |
Assignee | ||
Updated•4 years ago
|
Description
•