596804 - hang/memory allocation in methodjit in 20100915 nightly

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I'm seeing frequent multi-second hangs in today's nightly, and attaching the debugger gives me this call stack where we're allocating ~80MB, while trying to grow to a new capacity of 0x52dffdb0 which is rather large.

003daec0 52c89414 xul!JSContext::malloc(unsigned int bytes = 0x5000000)+0x2f
003daecc 52de2374 xul!js::VectorImpl<js::mjit::Compiler::InternalCallSite,64,js::ContextAllocPolicy,0>::growTo(class js::Vector<js::mjit::Compiler::InternalCallSite,64,js::ContextAllocPolicy> * v = 0x0373a000, unsigned int newcap = 0x52dffdb0)+0x14
003db0ec 52dffdb0 xul!js::mjit::Compiler::generateMethod(void)+0x1114
003db104 52c88e69 xul!js::mjit::Compiler::Compile(void)+0xa0
003dd4cc 530587ab xul!js::mjit::TryCompile(struct JSContext * cx = 0x10d88f40, struct JSScript * script = 0x4fd00000, struct JSFunction * fun = 0x00000000, struct JSObject * scopeChain = 0x370f2b88)+0x39
003dd4f8 52d98181 xul!js::mjit::CanMethodJIT+0x2a6a2b
003dd550 52c8e957 xul!js::Execute(struct JSContext * cx = 0x10d88d80, struct JSObject * chain = 0x00002000, struct JSScript * script = 0x00006e08, struct JSStackFrame * down = 0x5395b5c8, unsigned int flags = 0x111edc00, class js::Value * result = 0x00000000)+0x391
003dd580 52e2e33f xul!JS_EvaluateUCScriptForPrincipals(struct JSContext * cx = 0x10d88f40, struct JSObject * obj = 0x370f2b88, struct JSPrincipals * principals = 0x0a749974, wchar_t * chars = 0x4e200008 "tinderbox_data = ...", unsigned int length = 0x4c1289, char * filename = 0x1e424a08 "http://tinderbox.mozilla.org/Firefox/json.js", unsigned int lineno = 1, unsigned int64 * rval = 0x00000000)+0x57
003dd600 52e3d413 xul!nsJSContext::EvaluateString(class nsAString_internal * aScript = 0x29d84a10, void * aScopeObject = 0x370f2b88, class nsIPrincipal * aPrincipal = 0x0a749970, char * aURL = 0x1e424a08 "http://tinderbox.mozilla.org/Firefox/json.js", unsigned int aLineNo = 1, unsigned int aVersion = 0, class nsAString_internal * aRetValue = 0x00000000, int * aIsUndefined = 0x003dd634)+0x195
003dd6bc 52e6ea40 xul!nsScriptLoader::EvaluateScript(class nsScriptLoadRequest * aRequest = 0x00000008, class nsString * aScript = 0x29d84a10)+0x17c
003dd77c 530a2dc5 xul!nsScriptLoader::ProcessRequest(class nsScriptLoadRequest * aRequest = 0x10d88f40)+0xb2
003dd7a0 5341bb48 xul!nsScriptLoader::ProcessPendingRequests+0x454c9a
003dd7b4 52e75b42 xul!nsScriptLoader::OnStreamComplete(class nsIStreamLoader * aLoader = 0x43e7b340, class nsISupports * aContext = 0x29d84a00, unsigned int aStatus = 0, unsigned int aStringLen = 0x4c1289, unsigned char * aString = 0x4ac00000 "tinderbox_data = ...")+0x6a
003dd7e0 52efdda8 xul!nsStreamLoader::OnStopRequest(class nsIRequest * request = 0x2178a27c, class nsISupports * ctxt = 0x29d84a00, unsigned int aStatus = 0)+0x47
003dd7f4 52e49dd8 xul!nsHTTPCompressConv::OnStopRequest(class nsIRequest * request = 0x191777c0, class nsISupports * aContext = 0x2178a27c, unsigned int aStatus = 0x29d84a00)+0x19
003dd818 52e3ea52 xul!nsStreamListenerTee::OnStopRequest(class nsIRequest * request = 0x2178a27c, class nsISupports * context = 0x29d84a00, unsigned int status = 0)+0x48
003dd83c 52e3e8fc xul!nsHttpChannel::OnStopRequest(class nsIRequest * request = 0x00000000, class nsISupports * ctxt = 0x00000000, unsigned int status = 0)+0x11e
003dd85c 52c7efe3 xul!nsInputStreamPump::OnStateStop(void)+0x3d
003dd870 52c83b67 xul!nsInputStreamPump::OnInputStreamReady(class nsIAsyncInputStream * stream = 0x00407b83)+0x4d
003dd880 52d2c18b xul!nsInputStreamReadyEvent::Run(void)+0x1d
003dd8a8 52cf351a xul!nsThread::ProcessNextEvent(int mayWait = <Memory access error>, int * result = <Memory access error>)+0x15b
003dd8e4 52ee67e5 xul!mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate * aDelegate = 0x537e831c)+0x6a
003dd8f0 52ee67ce xul!MessageLoop::RunInternal(void)+0x11
003dd928 52ee6776 xul!MessageLoop::RunHandler(void)+0x1d
003dd960 52bdb000 xul!MessageLoop::Run(void)+0x1f
003dd96c 52effc93 xul!nsBaseAppShell::Run(void)+0x2c
003df8c0 52effc3d xul!nsAppShell::Run(void)+0x42
003df8cc 52e8e20a xul!nsAppStartup::Run(void)+0x1e
003dfb3c 010c134c xul!XRE_main(int argc = 0n1, char ** argv = 0x0062c0a8, struct nsXREAppData * aAppData = 0x00617440)+0xca0
003dfb8c 010c16f2 firefox!wmain(int argc = 0n1, wchar_t ** argv = 0x0061a160)+0x34c
003dfbcc 75233677 firefox!__tmainCRTStartup(void)+0x152
003dfbd8 77689d72 kernel32!BaseThreadInitThunk+0xe
003dfc18 77689d45 ntdll!__RtlUserThreadStart+0x70
003dfc30 00000000 ntdll!_RtlUserThreadStart+0x1b

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Note that all the "hang" time is in growTo() -- stepping out of that took about 10s, but the process continued normally afterwards.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

Well, this could be a reason. Debug-mode recompilation needs to keep a struct of info around for basically every bytecode. But if we're not in debug mode that's completely unnecessary. This saves about 300KB of memory running v8 and 200KB on SunSpider. Not a lot, but you could see how this adds up, especially on huge scripts.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/01477e17bd69

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/01477e17bd69