413565 - free list construction ignores free things

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

The free list construction code in js_GC adds to the free list only things that were just freed. It skips the already free cells. This is a consequence of my patch for bug 333236.

Comment 1

[Igor Bukanov]

Attachment: v1

Comment 2

[Igor Bukanov]

Comment on attachment 298570 [details] [diff] [review]
v1

I must be smoking something when wrote that code.

Comment 3

[Igor Bukanov]

Attachment: diff -b of v1

Comment 4

[Brendan Eich [:brendan]]

I must have been inhaling while reviewing, then...

/be

Comment 5

[Igor Bukanov]

This bug should be partly responsible for the regression in Sun Spider benchmarks.. According to the bug 408144 comment 5 and 6, there here is an extra regression that happens around 2007-09-19, the day when I landed the patch.

Comment 6

[Igor Bukanov]

I checked in the patch from comment 1 to the trunk: 

http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&branch=HEAD&cvsroot=%252Fcvsroot&date=explicit&mindate=1201093262&maxdate=1201093534&who=igor%25mir2.org

Comment 7

[Igor Bukanov]

About regression test for this:

in principle it should be possible to has a test case for this. Since the result of this bug is waste of unused GC cells in the allocated arenas, it should be possible to create a code that without the bug fixed would require to allocate, say, 4GB of memory, when in reality it needs just 8 MB.