Source/JavaScriptCore:
authorfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 Jul 2016 20:31:20 +0000 (20:31 +0000)
committerfpizlo@apple.com <fpizlo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 18 Jul 2016 20:31:20 +0000 (20:31 +0000)
commit022bf0f6aa2b9404e4a22b269a0a6b31243a916c
tree8decbbd7e27f3259fa9d8bdecc1cf82da64d6519
parent6df8981918ed79868b24ca1dd54ad45d6c1215be
Source/JavaScriptCore:
Repeatedly creating and destroying workers that enqueue DFG plans can outpace the DFG worklist, which then causes VM shutdown to stall, which then causes memory growth
https://bugs.webkit.org/show_bug.cgi?id=159754

Reviewed by Geoffrey Garen.

If you create and destroy workers at a high rate and those workers enqueue some DFG plans
that are still not compiled at the time that the worker is closed, then the closed workers
end up stalling in VM::~VM waiting for the DFG worklist thread to finish those plans. Since
we don't actually cancel the plans, it's easy to create a situation where the workers
outpace the DFG worklist, especially if you create many workers at a time and each one
finishes just after enqueueing those plans.

The solution is to allow VM::~VM to remove plans from the DFG worklist that are related to
that VM but aren't currently being worked on. That turns out to be an easy change.

I have a test that repros this, but it's quite long-running. I call it workers/bomb.html. We
may want to exclude it from test runs because of how long it takes.

* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::removeNonCompilingPlansForVM):
(JSC::DFG::Worklist::queueLength):
(JSC::DFG::Worklist::runThread):
* dfg/DFGWorklist.h:
* runtime/VM.cpp:
(JSC::VM::~VM):

LayoutTests:
Repeatedly creating and destroying workers that enqueue DFG plans can outpace the DFG worklist, which then causes VM shutdown to stall, which then causes a memory growth
https://bugs.webkit.org/show_bug.cgi?id=159754

Reviewed by Geoffrey Garen.

Adds two tests that create a lot of workers that do sophisticated things. These are
long-running tests so we may want to skip them. It's OK if we end up only running them
manually occasionally.

* workers: Added.
* workers/bomb.html: Added.
* workers/bomb-expected.txt: Added.
* workers/bomb-with-v8.html: Added.
* workers/tests: Added.
* workers/tests/3d-cube.js: Added.
* workers/tests/3d-morph.js: Added.
* workers/tests/3d-raytrace.js: Added.
* workers/tests/access-binary-trees.js: Added.
* workers/tests/access-fannkuch.js: Added.
* workers/tests/access-nbody.js: Added.
* workers/tests/access-nsieve.js: Added.
* workers/tests/bitops-3bit-bits-in-byte.js: Added.
* workers/tests/bitops-bits-in-byte.js: Added.
* workers/tests/bitops-bitwise-and.js: Added.
* workers/tests/bitops-nsieve-bits.js: Added.
* workers/tests/controlflow-recursive.js: Added.
* workers/tests/crypto-aes.js: Added.
* workers/tests/crypto-md5.js: Added.
* workers/tests/crypto-sha1.js: Added.
* workers/tests/date-format-tofte.js: Added.
* workers/tests/date-format-xparb.js: Added.
* workers/tests/math-cordic.js: Added.
* workers/tests/math-partial-sums.js: Added.
* workers/tests/math-spectral-norm.js: Added.
* workers/tests/regexp-dna.js: Added.
* workers/tests/string-base64.js: Added.
* workers/tests/string-fasta.js: Added.
* workers/tests/string-tagcloud.js: Added.
* workers/tests/string-unpack-code.js: Added.
* workers/tests/string-validate-input.js: Added.
* workers/tests/v8-crypto.js: Added.
* workers/tests/v8-deltablue.js: Added.
* workers/tests/v8-earley-boyer.js: Added.
* workers/tests/v8-raytrace.js: Added.
* workers/tests/v8-regexp.js: Added.
* workers/tests/v8-richards.js: Added.
* workers/tests/v8-splay.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203370 268f45cc-cd09-0410-ab3c-d52691b4dbfc
44 files changed:
LayoutTests/ChangeLog
LayoutTests/TestExpectations
LayoutTests/workers/bomb-expected.txt [new file with mode: 0644]
LayoutTests/workers/bomb-with-v8.html [new file with mode: 0644]
LayoutTests/workers/bomb.html [new file with mode: 0644]
LayoutTests/workers/tests/3d-cube.js [new file with mode: 0644]
LayoutTests/workers/tests/3d-morph.js [new file with mode: 0644]
LayoutTests/workers/tests/3d-raytrace.js [new file with mode: 0644]
LayoutTests/workers/tests/access-binary-trees.js [new file with mode: 0644]
LayoutTests/workers/tests/access-fannkuch.js [new file with mode: 0644]
LayoutTests/workers/tests/access-nbody.js [new file with mode: 0644]
LayoutTests/workers/tests/access-nsieve.js [new file with mode: 0644]
LayoutTests/workers/tests/bitops-3bit-bits-in-byte.js [new file with mode: 0644]
LayoutTests/workers/tests/bitops-bits-in-byte.js [new file with mode: 0644]
LayoutTests/workers/tests/bitops-bitwise-and.js [new file with mode: 0644]
LayoutTests/workers/tests/bitops-nsieve-bits.js [new file with mode: 0644]
LayoutTests/workers/tests/controlflow-recursive.js [new file with mode: 0644]
LayoutTests/workers/tests/crypto-aes.js [new file with mode: 0644]
LayoutTests/workers/tests/crypto-md5.js [new file with mode: 0644]
LayoutTests/workers/tests/crypto-sha1.js [new file with mode: 0644]
LayoutTests/workers/tests/date-format-tofte.js [new file with mode: 0644]
LayoutTests/workers/tests/date-format-xparb.js [new file with mode: 0644]
LayoutTests/workers/tests/math-cordic.js [new file with mode: 0644]
LayoutTests/workers/tests/math-partial-sums.js [new file with mode: 0644]
LayoutTests/workers/tests/math-spectral-norm.js [new file with mode: 0644]
LayoutTests/workers/tests/regexp-dna.js [new file with mode: 0644]
LayoutTests/workers/tests/string-base64.js [new file with mode: 0644]
LayoutTests/workers/tests/string-fasta.js [new file with mode: 0644]
LayoutTests/workers/tests/string-tagcloud.js [new file with mode: 0644]
LayoutTests/workers/tests/string-unpack-code.js [new file with mode: 0644]
LayoutTests/workers/tests/string-validate-input.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-crypto.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-deltablue.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-earley-boyer.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-raytrace.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-regexp.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-richards.js [new file with mode: 0644]
LayoutTests/workers/tests/v8-splay.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGPlan.cpp
Source/JavaScriptCore/dfg/DFGPlan.h
Source/JavaScriptCore/dfg/DFGWorklist.cpp
Source/JavaScriptCore/dfg/DFGWorklist.h
Source/JavaScriptCore/runtime/VM.cpp