1739761 - Investigate the large amount of heap fragmentation in the hunspell RLBox sandbox

Status: RESOLVED FIXED

(Core :: Security: RLBox, defect, P3)

Description

[Shravan Narayan]

When investigating Bug 1737841 which looked at the large memory consumption of the hunspell spellchecking code when checking the "bg" locale, we see that when hunspell is run in a rlbox sandbox there is a large amount of fragmentation

For example bg requires about 23.26mb in the sandbox to perform spellchecking.

When allocating a 16mb sandbox, spellchecking uses 11.67mb out of 16mb used and then crashes with OOM
When allocating a 32mb sandbox, spellchecking uses 22.53mb out of 32mb used and then crashes with OOM
When allocating a 64mb sandbox, spellchecking uses 23.26mb out of 64mb used and succeeds

This seems to be a rather high level of fragmentation

Comment 1

[Bobby Holley (:bholley)]

Attachment: Bug 1739761 - arena-allocate strings in hunspell.

This reduces the number of wasm pages allocated from 64 to 47 on en_us
builds, corresponding to about 1 MB of reduced memory usage.

Comment 2

[Bobby Holley (:bholley)]

Attachment: Bug 1739761 - Scale down the hunspell sandbox size calculation to account for reduced fragmentation.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/74f7e61f745f
arena-allocate strings in hunspell. r=glandium
https://hg.mozilla.org/integration/autoland/rev/97263298aa24
Scale down the hunspell sandbox size calculation to account for reduced fragmentation. r=shravanrn

Comment 4

[Natalia Csoregi [:nataliaCs]]

Backed out for causing failures on test_hunspell.js

• backout: https://hg.mozilla.org/integration/autoland/rev/42ef5c33902ad11cfef2f2e1595b92bf9dada48d

• push: https://treeherder.mozilla.org/jobs?repo=autoland&selectedTaskRun=fAR11rP9SnacIkYO4IXZbw.0&revision=97263298aa24abc15459e0eb9b2441ee2ee176c5&group_state=expanded

• failure log: https://treeherder.mozilla.org/logviewer?job_id=359916112&repo=autoland&lineNumber=2306

03:04:52 WARNING - TEST-UNEXPECTED-FAIL | extensions/spellcheck/hunspell/tests/unit/test_hunspell.js | xpcshell return code: -11
03:04:53 INFO - PID 3328 | Assertion failed: outstanding_arena_allocations == 0 (/builds/worker/checkouts/gecko/extensions/spellcheck/hunspell/src/hashmgr.cxx: ~HashMgr: 164)
03:04:53 INFO - PID 3328 | Hit MOZ_CRASH(wasm2c crash: wasm2c: WASM_RT_TRAP_UNREACHABLE) at /builds/worker/checkouts/gecko/config/external/rlbox_wasm2c_sandbox/rlbox_wasm2c_thread_locals.cpp:30
03:04:55 WARNING - PROCESS-CRASH | extensions/spellcheck/hunspell/tests/unit/test_hunspell.js | application crashed [@ moz_wasm2c_trap_handler]

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b658492a6895
arena-allocate strings in hunspell. r=glandium
https://hg.mozilla.org/integration/autoland/rev/8aed6a301f1e
Scale down the hunspell sandbox size calculation to account for reduced fragmentation. r=shravanrn

Comment 6

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/b658492a6895
https://hg.mozilla.org/mozilla-central/rev/8aed6a301f1e