The JSC GC has a quirk in the management of free blocks, where when a free block is removed from a size class, all blocks prior to that one may also be removed from the size class's list of to-sweep blocks. The lazy sweep will then overlook these blocks and allocate fresh blocks instead of reusing free space in partially-free blocks. This pathology will persist only until the next non-full collection, so it only has two effects: 1) The next collection may come sooner than otherwise, if there is a lot of free space in partially-free blocks. 2) The allocator has fewer opportunities to "fill in" fragmentation. Oddly, this might be good for performance. But on the downside, it may lead to more fragmentation in the long run. Notably, other than the risk of fragmentation, this bug does not degrade memory usage - it only has the potential pathology of decreasing the time-to-next-collection after a full collection.
Created attachment 102719 [details] the patch Tests still running, will set flags to ? when they're done.
Comment on attachment 102719 [details] the patch All tests pass. No performance regression on either my Mac Pro or my iMac. It's ready for review.
Comment on attachment 102719 [details] the patch Clearing flags on attachment: 102719 Committed r92251: <http://trac.webkit.org/changeset/92251>
All reviewed patches have been landed. Closing bug.