775382 - "analysis-temporary" memory measurement goes negative on platforms that don't support malloc_usable_size (e.g. BSD)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicholas Nethercote [inactive]]

I was chatting on IRC with a user who was seeing ridiculous "analysis-temporary" numbers in about:memory, e.g.:

  4,095.85 MB (14.22%) -- analysis-temporary

  4,092.95 MB -- js-main-runtime-analysis-temporary

It was a 32-bit build, so this is almost certainly integer overflow caused by the measurements going slightly negative.  This is plausible because the measurement of "analysis-temporary" involves some subtractions.

Unfortunately, the user's script is private.

Comment 1

[Nicholas Nethercote [inactive]]

Oh, I know why this happened.  The "analysis-temporary" computation is roughly this:

  malloc_usable_size(some_stuff) - computed_size_of(other_stuff)

This user was on BSD which doesn't have malloc_usable_size so the LHS would have ended up as zero.

So it's an obscure case, but still isn't a nice behaviour.

Comment 2

[Jan Beich]

Is it now about "analysis-pool" (after bug 789398)? Besides, malloc_usable_size() shouldn't be an issue for FreeBSD since bug 778056 and bug 788955 (--enable-jemalloc + MOZ_JEMALLOC3).

Comment 3

[Nicholas Nethercote [inactive]]

(In reply to Jan Beich from comment #2)
> Is it now about "analysis-pool" (after bug 789398)?

Yes.

> Besides, malloc_usable_size() shouldn't be an issue for FreeBSD since
> bug 778056 and bug 788955 (--enable-jemalloc + MOZ_JEMALLOC3).

And the subtraction mentioned in comment 1 was removed in bug 789398.  So this shouldn't happen any more.