738080 - OOM on 8th reload of MAMS

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Alon Zakai (:azakai)]

Me And My Shadow (MAMS) is a nice GPL 2D game. Here is part of it compiled to JS:

http://syntensity.com/static/mams_oom.tar.bz2

It is far from working, loading it will after several seconds write to the web console that Mix_PlayMusic is not defined. But, if you reload the page 8 times, seeing the same error each of the first 7, on the 8th time it starts to allocate memory without restraint, eventually eating up almost all the system's RAM at which point the error console shows "out of memory". Note that during the first 7 a significant amount of memory is also used, but it isn't that memory slowly accumulates. On the 8th reload, a qualitative change occurs and much more allocation is done, much more quickly (a memory monitor graph tool is useful to see that).

Amazingly, it happens exactly on the 8th reload every time (!)

Here is what about:memory has to say at the OOM point:

2,387.44 MB (100.0%) -- explicit
├──2,108.79 MB (88.33%) -- js
│  ├──1,943.75 MB (81.42%) -- compartment(file:///home/alon/Dev/meandmyshadow/mams.html)
│  │  ├──1,903.02 MB (79.71%) -- shapes-extra
│  │  │  ├──1,902.93 MB (79.71%) ── tree-tables
│  │  │  └──────0.09 MB (00.00%) ++ (3 tiny)
│  │  └─────40.73 MB (01.71%) ++ (6 tiny)
│  ├────115.85 MB (04.85%) ++ (18 tiny)
│  └─────49.19 MB (02.06%) ++ compartment(file:///home/alon/Documents/mams_oom/mams.html)
├────138.24 MB (05.79%) ── heap-unclassified

That's a lot of shapes...

Note: Closing the tab frees the memory, there isn't a leak here.

Comment 1

[Luke Wagner [:luke]]

Brian: Perhaps one of these own-shape-generating pathological cases?

Comment 2

[Alon Zakai (:azakai)]

(Hmm, it looks like the data/ folder I included is not necessary for this testcase. All you really need is just the single HTML file.)

Comment 3

[Brian Hackett [Laid off!]]

These are tree tables, so not related to dictionary objects/shapes.  Interestingly, the number of times we will do a linear search of an object's shape for a property before generating one of these tables (LINEAR_SEARCHES_MAX) is 7.  It would be good to see what the shapes look like which tables are being generated for.

Comment 4

[Alon Zakai (:azakai)]

Interesting, that number looks like it exactly explains the behavior here ;) I'm curious though, the page is being reloaded here - so we get new objects each time, so how can the counter reach 8?

Comment 5

[Nicholas Nethercote [inactive]]

Brian, can you take a look?

Comment 6

[Alon Zakai (:azakai)]

I am seeing the same problem in another emscripten-compiled project (cube2). So it isn't something super-specific to MAMS apparently.

Comment 7

[Nicholas Nethercote [inactive]]

Compartment per global might fix this for free -- we'd get a new compartment every time the page is reloaded, so all the shape counters would be reset...

Comment 8

[Alon Zakai (:azakai)]

CPG landed, and this does appear to be fixed so I guess that resolved the problem. CPG is awesome.