Last Comment Bug 323529 - non-minimum-sized GC arena pools have wrong alignment modulus
: non-minimum-sized GC arena pools have wrong alignment modulus
: js1.6, verified1.8.0.2, verified1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: P1 normal (vote)
: mozilla1.9alpha1
Assigned To: Brendan Eich [:brendan]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: js1.6rc1
  Show dependency treegraph
Reported: 2006-01-15 08:28 PST by Brendan Eich [:brendan]
Modified: 2006-11-10 12:22 PST (History)
4 users (show)
brendan: blocking1.8.1+
brendan: blocking1.8.0.2+
bob: in‑testsuite-
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

minimal fix (1.10 KB, patch)
2006-01-15 08:41 PST, Brendan Eich [:brendan]
no flags Details | Diff | Splinter Review
minimal fix, v2 (1.25 KB, patch)
2006-01-15 09:57 PST, Brendan Eich [:brendan]
igor: review+
brendan: approval‑branch‑1.8.1+
brendan: approval1.8.0.2+
Details | Diff | Splinter Review

Description Brendan Eich [:brendan] 2006-01-15 08:28:36 PST
See bug 294499 -- thanks to Igor for noticing.  Patch in a trice.

Comment 1 Brendan Eich [:brendan] 2006-01-15 08:41:06 PST
Created attachment 208562 [details] [diff] [review]
minimal fix

Want to get this into the 1.8x branches in due course, and into the JS1.6 RC1 minibranch.

Comment 2 Igor Bukanov 2006-01-15 08:56:22 PST
Comment on attachment 208562 [details] [diff] [review]
minimal fix

Why using sizeof(JSGCThing) and not 1 given that GC code aligns things itself?
Comment 3 Igor Bukanov 2006-01-15 09:10:02 PST
(In reply to comment #1)
> Created an attachment (id=208562) [edit]
> minimal fix
> Want to get this into the 1.8x branches in due course, and into the JS1.6 RC1
> minibranch.

This bug has a consequence that prevented mixing of arenas for things of different sizes. For example, if an arena was allocated for things with size 5*sizeof(JSGCThing) and later freed, it would only be re-used for things of size 5..8 and not for sizeof(JSGCThings) (objects, strings or doubles).

So fixing this bug can theoretically expose GC-related bugs that currently not visible as, for example, xml things do not mix with strings.
Comment 4 Brendan Eich [:brendan] 2006-01-15 09:57:07 PST
Created attachment 208568 [details] [diff] [review]
minimal fix, v2

Good point, the arena alignment machinery is unused here.

Yes, we'll get more recycling via arena_freelist than before, because it does exact fit and sizes are no longer different among freelist pools.  I'm not sure how afraid to be of this.  It seems worth trying out for a JS1.6 RC1.  I wouldn't put it in, but it might fit in

Comment 5 Bob Clary [:bc:] 2006-01-15 13:43:44 PST
patch me baby! Regressions are my reason to live!
Comment 6 Brendan Eich [:brendan] 2006-01-15 13:56:37 PST
Comment on attachment 208568 [details] [diff] [review]
minimal fix, v2

This is going into the trunk now, so it can be picked up before Igor's major trunk-only GC changes land.

Comment 7 Brendan Eich [:brendan] 2006-01-15 13:58:00 PST
Fixed in the trunk:

$ cvs ci -m"Remove bogus arena-pool alignment parameters (323529, r=igor)." jsgc.c
Checking in jsgc.c;
/cvsroot/mozilla/js/src/jsgc.c,v  <--  jsgc.c
new revision: 3.112; previous revision: 3.111

Comment 8 Brendan Eich [:brendan] 2006-01-31 12:47:04 PST
Comment on attachment 208568 [details] [diff] [review]
minimal fix, v2

Who is going to check all these branch-1.8.1+'d patches in?

Comment 9 Brendan Eich [:brendan] 2006-02-22 12:42:02 PST
Fixed on branches.

Comment 10 Dave Liebreich [:davel] 2006-03-01 13:53:24 PST
Please provide a testcase and testing guidance so that we can verify this bug in the Firefox candidate builds.
Comment 11 Brendan Eich [:brendan] 2006-03-01 13:57:31 PST
This isn't testable in any practical way.  The bug was found by inspection, it wasted real but small amounts of memory, but the noise and other signals in our dynamic footprint dwarf those amounts.

Verified by code inspection.

Comment 12 Dave Liebreich [:davel] 2006-03-01 14:02:00 PST
marking [nvn-dl], which removes this bug from the "to be verified by QA" list
for Firefox
Comment 13 Bob Clary [:bc:] 2006-03-01 14:09:09 PST
2006-02-22 15:40 mozilla/js/src/jsgc.c MOZILLA_1_8_0_BRANCH
2006-02-22 15:39 mozilla/js/src/jsgc.c     MOZILLA_1_8_BRANCH

Note You need to log in before you can comment on or make changes to this bug.