Skip to content

[libpas] large_utility_aligned_allocator unconditionally calls give_back on allocation failure#64521

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/libpas-large-free-heap-helpers-give-back-guard
May 9, 2026
Merged

[libpas] large_utility_aligned_allocator unconditionally calls give_back on allocation failure#64521
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/libpas-large-free-heap-helpers-give-back-guard

Conversation

@sosukesuzuki
Copy link
Copy Markdown
Contributor

@sosukesuzuki sosukesuzuki commented May 8, 2026

eccbe3f

[libpas] `large_utility_aligned_allocator` unconditionally calls give_back on allocation failure
https://bugs.webkit.org/show_bug.cgi?id=314368

Reviewed by Yusuke Suzuki.

large_utility_aligned_allocator's setup path only calls
pas_physical_page_sharing_pool_take_later when
pas_large_utility_free_heap_talks_to_large_sharing_pool is set, but the
failure path called pas_physical_page_sharing_pool_give_back
unconditionally. With the flag off, every failed allocation drifts
pas_physical_page_sharing_pool_balance upward by aligned_size, hiding
reclaimable pages from the scavenger.

Add the missing guard and a regression test that drives the failure path
with an always-failing memory source and checks the balance stays at zero
in both flag states.

* Source/bmalloc/libpas/src/libpas/pas_large_free_heap_helpers.c:
(large_utility_aligned_allocator):
* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:
(std::failingMemorySource):
(std::testGiveBackGuardOnAllocationFailure):
(addLargeFreeHeapTests):

Canonical link: https://commits.webkit.org/312942@main

e952e5a

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64 ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@sosukesuzuki sosukesuzuki self-assigned this May 8, 2026
@sosukesuzuki sosukesuzuki added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label May 8, 2026
@sosukesuzuki sosukesuzuki marked this pull request as ready for review May 9, 2026 01:15
@sosukesuzuki sosukesuzuki requested a review from a team as a code owner May 9, 2026 01:15
Copy link
Copy Markdown
Member

@Constellation Constellation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me
While pas_large_utility_free_heap_talks_to_large_sharing_pool is always true on the actual production environment, anyway, this is nice to fix!

@sosukesuzuki sosukesuzuki added the merge-queue Applied to send a pull request to merge-queue label May 9, 2026
…_back on allocation failure

https://bugs.webkit.org/show_bug.cgi?id=314368

Reviewed by Yusuke Suzuki.

large_utility_aligned_allocator's setup path only calls
pas_physical_page_sharing_pool_take_later when
pas_large_utility_free_heap_talks_to_large_sharing_pool is set, but the
failure path called pas_physical_page_sharing_pool_give_back
unconditionally. With the flag off, every failed allocation drifts
pas_physical_page_sharing_pool_balance upward by aligned_size, hiding
reclaimable pages from the scavenger.

Add the missing guard and a regression test that drives the failure path
with an always-failing memory source and checks the balance stays at zero
in both flag states.

* Source/bmalloc/libpas/src/libpas/pas_large_free_heap_helpers.c:
(large_utility_aligned_allocator):
* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:
(std::failingMemorySource):
(std::testGiveBackGuardOnAllocationFailure):
(addLargeFreeHeapTests):

Canonical link: https://commits.webkit.org/312942@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/libpas-large-free-heap-helpers-give-back-guard branch from e952e5a to eccbe3f Compare May 9, 2026 06:50
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 312942@main (eccbe3f): https://commits.webkit.org/312942@main

Reviewed commits have been landed. Closing PR #64521 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit eccbe3f into WebKit:main May 9, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants