Bug 65585 – JSC GC may not be able to reuse partially-free blocks after a full collection

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Filip Pizlo]

The JSC GC has a quirk in the management of free blocks, where when a free block is removed from a size class, all blocks prior to that one may also be removed from the size class's list of to-sweep blocks.  The lazy sweep will then overlook these blocks and allocate fresh blocks instead of reusing free space in partially-free blocks.  This pathology will persist only until the next non-full collection, so it only has two effects:

1) The next collection may come sooner than otherwise, if there is a lot of free space in partially-free blocks.

2) The allocator has fewer opportunities to "fill in" fragmentation.  Oddly, this might be good for performance.  But on the downside, it may lead to more fragmentation in the long run.

Notably, other than the risk of fragmentation, this bug does not degrade memory usage - it only has the potential pathology of decreasing the time-to-next-collection after a full collection.

[Filip Pizlo]

Created attachment 102719 [details]
the patch

Tests still running, will set flags to ? when they're done.

[Filip Pizlo]

Comment on attachment 102719 [details]
the patch

All tests pass.  No performance regression on either my Mac Pro or my iMac.  It's ready for review.

[WebKit Review Bot]

Comment on attachment 102719 [details]
the patch

Clearing flags on attachment: 102719

Committed r92251: <http://trac.webkit.org/changeset/92251>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.