478576 - infinite loop in jemalloc:chunk_recycle_reserve

Status: RESOLVED FIXED

(Core :: Memory Allocator, defect, P1)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I'm in a weird spin in jemalloc, in the loop that starts at line 2521 (while reserve_cur < reserve_min).  chunk_alloc_mmap is returning NULL, and we go into the little do/while loop and call reserve_notify... but there's nothing to receive those notifications.  reserve_cur is 0x00100000, reserve_min is 0x00200000, so the outer loop expression always evaluates to true and we just spin here forever.  Does the outer loop need a similar check to the inner one, to break out if there was nothing to notify that could replenish the reserve?

mozcrt19.dll!chunk_recycle_reserve(unsigned int size=0x0f300000, int zero=0x7813938a)  Line 2535	C
mozcrt19.dll!chunk_alloc(unsigned int size=0x00000000, int zero=0x781394ea, int pagefile=0x781394ea)  Line 2576 + 0x6 bytes	C
mozcrt19.dll!arena_run_alloc(arena_s * arena=0x00000000, arena_bin_s * bin=0x00000000, unsigned int size=0x00080000, int large=0x00000001, int zero=0x00000000)  Line 3334	C
mozcrt19.dll!arena_malloc_large(arena_s * arena=0x00000000, unsigned int size=0x00000000, int zero=0x00000000)  Line 3928 + 0xf bytes	C
mozcrt19.dll!malloc(unsigned int size=0x00080000)  Line 5992 + 0x39 bytes	C
mozcrt19.dll!operator new(unsigned int size=0x00080000)  Line 54 + 0xd bytes	C++
xul.dll!nsDeque::GrowCapacity()  Line 182 + 0x18 bytes	C++

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Hit this again; same spot.  WinXP task manager said about 1.75gb was used, previous time it was around 1.5gb.

Comment 2

[Jason Evans]

Attachment: Fix infinite loop due to depleted memory reserve [Checkin: Comment 6 & 7]

It looks to me like Vlad is totally right about the cause of the infinite loop.  The attached (completely untested) patch is the cleanest fix I can think of.

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

Stuart said he'd take a look at the review, and we thank him for it!

Comment 4

[Stuart Parmenter]

Comment on attachment 362767 [details] [diff] [review]
Fix infinite loop due to depleted memory reserve
[Checkin: Comment 6 & 7]

this looks correct, but given how hard this is to hit, going to be hard to test.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Is there anything else to do here, or could someone land the patch and mark
this fixed?

Comment 6

[Serge Gautherie (:sgautherie)]

Comment on attachment 362767 [details] [diff] [review]
Fix infinite loop due to depleted memory reserve
[Checkin: Comment 6 & 7]


http://hg.mozilla.org/mozilla-central/rev/4e454c6a79ce

Comment 7

[Serge Gautherie (:sgautherie)]

Comment on attachment 362767 [details] [diff] [review]
Fix infinite loop due to depleted memory reserve
[Checkin: Comment 6 & 7]


http://hg.mozilla.org/releases/mozilla-1.9.1/rev/0fcd0d3d84e3