Closed Bug 323529 Opened 18 years ago Closed 18 years ago

non-minimum-sized GC arena pools have wrong alignment modulus


(Core :: JavaScript Engine, defect, P1)






(Reporter: brendan, Assigned: brendan)



(Keywords: js1.6, verified1.8.0.2, verified1.8.1, Whiteboard: [nvn-dl])


(1 file, 1 obsolete file)

See bug 294499 -- thanks to Igor for noticing.  Patch in a trice.

Priority: -- → P1
Attached patch minimal fix (obsolete) — Splinter Review
Want to get this into the 1.8x branches in due course, and into the JS1.6 RC1 minibranch.

Attachment #208562 - Flags: review?(igor.bukanov)
Flags: blocking1.8.1+
Flags: blocking1.8.0.2+
Comment on attachment 208562 [details] [diff] [review]
minimal fix

Why using sizeof(JSGCThing) and not 1 given that GC code aligns things itself?
(In reply to comment #1)
> Created an attachment (id=208562) [edit]
> minimal fix
> Want to get this into the 1.8x branches in due course, and into the JS1.6 RC1
> minibranch.

This bug has a consequence that prevented mixing of arenas for things of different sizes. For example, if an arena was allocated for things with size 5*sizeof(JSGCThing) and later freed, it would only be re-used for things of size 5..8 and not for sizeof(JSGCThings) (objects, strings or doubles).

So fixing this bug can theoretically expose GC-related bugs that currently not visible as, for example, xml things do not mix with strings.
Attached patch minimal fix, v2Splinter Review
Good point, the arena alignment machinery is unused here.

Yes, we'll get more recycling via arena_freelist than before, because it does exact fit and sizes are no longer different among freelist pools.  I'm not sure how afraid to be of this.  It seems worth trying out for a JS1.6 RC1.  I wouldn't put it in, but it might fit in

Attachment #208562 - Attachment is obsolete: true
Attachment #208568 - Flags: review?(igor.bukanov)
Attachment #208562 - Flags: review?(igor.bukanov)
Attachment #208568 - Flags: review?(igor.bukanov) → review+
patch me baby! Regressions are my reason to live!
Comment on attachment 208568 [details] [diff] [review]
minimal fix, v2

This is going into the trunk now, so it can be picked up before Igor's major trunk-only GC changes land.

Attachment #208568 - Flags: approval1.8.1?
Attachment #208568 - Flags: approval1.8.0.2?
Fixed in the trunk:

$ cvs ci -m"Remove bogus arena-pool alignment parameters (323529, r=igor)." jsgc.c
Checking in jsgc.c;
/cvsroot/mozilla/js/src/jsgc.c,v  <--  jsgc.c
new revision: 3.112; previous revision: 3.111

Closed: 18 years ago
Resolution: --- → FIXED
Attachment #208568 - Flags: approval1.8.1? → branch-1.8.1?(brendan)
Comment on attachment 208568 [details] [diff] [review]
minimal fix, v2

Who is going to check all these branch-1.8.1+'d patches in?

Attachment #208568 - Flags: branch-1.8.1?(brendan)
Attachment #208568 - Flags: branch-1.8.1+
Attachment #208568 - Flags: approval1.8.0.2?
Attachment #208568 - Flags: approval1.8.0.2+
Flags: testcase-
Fixed on branches.

Please provide a testcase and testing guidance so that we can verify this bug in the Firefox candidate builds.
Whiteboard: [tcn-dl]
This isn't testable in any practical way.  The bug was found by inspection, it wasted real but small amounts of memory, but the noise and other signals in our dynamic footprint dwarf those amounts.

Verified by code inspection.

marking [nvn-dl], which removes this bug from the "to be verified by QA" list
for Firefox
Whiteboard: [tcn-dl] → [nvn-dl]
2006-02-22 15:40 mozilla/js/src/jsgc.c MOZILLA_1_8_0_BRANCH
2006-02-22 15:39 mozilla/js/src/jsgc.c     MOZILLA_1_8_BRANCH
Keywords: fixed1.8.1
You need to log in before you can comment on or make changes to this bug.