923317 - Add a GC zeal mode specifically targeting generational GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: add_zeal_7-v0.diff

This implements a zeal mode for "do a minor collection every N nursery allocations". Additionally, it tweaks the way we allocate a bit to make us more likely to crash (rather than exhibit wrong behavior) from GC problems in this mode. It does this by using the full 16MiB nursery and not resetting the allocation pointer after each GC. This should leave dead objects as swept and not reused over a much larger window.

This mode can be triggered by setting zeal mode 7. Additionally, the frequency parameter is valid for this mode and it works exactly like it works in zeal mode 2. I'm re-using 7, however I don't think we checked in any bugs that used this mode when it was available before, so this should be fine.

Note:
It would be even better for this mode to never re-use the nursery and just drop and allocate a new nursery at sweep time. This was easy to get working in the interpreter, but the assumptions the jits make made this significantly harder to get working there. We can probably add this feature later if we think it is worth the trouble.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 813367 [details] [diff] [review]
add_zeal_7-v0.diff

Review of attachment 813367 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsgcinlines.h
@@ +407,5 @@
>  
>  #ifdef JS_GC_ZEAL
> +        if (rt->needZealousGC() && allowGC) {
> +            if (rt->gcZeal() == js::gc::ZealGenerationalGCValue)
> +                MinorGC(rt, JS::gcreason::DEBUG_GC);

Can you put this logic inside RunDebugGC instead?

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5aebbece1058

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/5aebbece1058

Comment 4

[Christian Holler (:decoder)]

Fwiw, this fixes a lot of issues for me in fuzzing GGC. I'm hitting the same bugs I've been seeing before, but now they reduce to something that I can work with to file. Especially gczeal(7,1) seems to help in some dodgy cases. One bug for example had the gczeal(7) in it, and stopped reproducing when I made paths relative instead of absolute (loaded with "load()"). Changed it to gczeal(7,1) made it reproduce again and reduce nicely.