1784164 - only use js_free for memory allocated in the js::MallocArena

Status: ASSIGNED

(Core :: JavaScript Engine, defect, P3)

Description

[Steve Fink [:sfink] [:s:]]

As the comment says:

static inline void js_free(void* p) {
  // TODO: This should call |moz_arena_free(js::MallocArena, p)| but we
  // currently can't enforce that all memory freed here was allocated by
  // js_malloc().
  free(p);
}

An example of an allocation that would not be in this arena is ArrayBuffer data, which gets allocated into its own js::ArrayBufferContentsArena. Or at least, sometimes it does.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1784164 - update comment on current state

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a1a954a12f34
update comment on current state r=jonco

Comment 3

[Sandor Molnar]

https://hg.mozilla.org/mozilla-central/rev/a1a954a12f34

Comment 4

[Paul Bone [:pbone]]

Other than an assertion there's currently no reason to free memory in its own arena.

https://searchfox.org/mozilla-central/source/memory/build/mozjemalloc.cpp#3634

jemalloc will always find the correct arena based on the memory's location and then use that, the only time aArena is used is for the above assertion. But if we ever switch to a more pedantic allocator this could be relevant.