bmalloc: eager scavenge leaves behind a bogus allocator

https://bugs.webkit.org/show_bug.cgi?id=136743

Reviewed by Sam Weinig.

Be sure to clear the allocator after logging it in the eager scavenge
case, so that we don't later try to allocate out of the lines that we
have thrown away.

We didn't need to do this previously because scavenge would only happen
at thread exit time, after which no further allocation from the per-thread
cache would take place.

* bmalloc/Allocator.cpp:
(bmalloc::Allocator::scavenge):
* bmalloc/MediumAllocator.h:
(bmalloc::MediumAllocator::clear):
* bmalloc/SmallAllocator.h:
(bmalloc::SmallAllocator::clear):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@173524 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/bmalloc/ChangeLog b/Source/bmalloc/ChangeLog
index e71eb86..226b086 100644 (file)
--- a/Source/bmalloc/ChangeLog
+++ b/Source/bmalloc/ChangeLog
@@ -1,3 +1,25 @@
+2014-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        bmalloc: eager scavenge leaves behind a bogus allocator
+        https://bugs.webkit.org/show_bug.cgi?id=136743
+
+        Reviewed by Sam Weinig.
+
+        Be sure to clear the allocator after logging it in the eager scavenge
+        case, so that we don't later try to allocate out of the lines that we
+        have thrown away.
+
+        We didn't need to do this previously because scavenge would only happen
+        at thread exit time, after which no further allocation from the per-thread
+        cache would take place.
+
+        * bmalloc/Allocator.cpp:
+        (bmalloc::Allocator::scavenge):
+        * bmalloc/MediumAllocator.h:
+        (bmalloc::MediumAllocator::clear):
+        * bmalloc/SmallAllocator.h:
+        (bmalloc::SmallAllocator::clear):
+
 2014-09-05  Geoffrey Garen  <ggaren@apple.com>
 
         bmalloc should honor the FastMalloc statistics API

diff --git a/Source/bmalloc/bmalloc/Allocator.cpp b/Source/bmalloc/bmalloc/Allocator.cpp
index eab2b6a..6d44fa1 100644 (file)
--- a/Source/bmalloc/bmalloc/Allocator.cpp
+++ b/Source/bmalloc/bmalloc/Allocator.cpp
@@ -56,11 +56,14 @@ Allocator::~Allocator()
     
 void Allocator::scavenge()
 {
-    for (auto& allocator : m_smallAllocators)
+    for (auto& allocator : m_smallAllocators) {
         log(allocator);
+        allocator.clear();
+    }
     processSmallAllocatorLog();
 
     log(m_mediumAllocator);
+    m_mediumAllocator.clear();
     processMediumAllocatorLog();
 }
 

diff --git a/Source/bmalloc/bmalloc/MediumAllocator.h b/Source/bmalloc/bmalloc/MediumAllocator.h
index a4bf938..0f6828b 100644 (file)
--- a/Source/bmalloc/bmalloc/MediumAllocator.h
+++ b/Source/bmalloc/bmalloc/MediumAllocator.h
@@ -45,7 +45,9 @@ public:
     bool allocate(size_t, void*&);
 
     unsigned char derefCount();
+
     void refill(MediumLine*);
+    void clear();
 
 private:
     char* m_end;
@@ -101,6 +103,13 @@ inline void MediumAllocator::refill(MediumLine* line)
     m_objectCount = 0;
 }
 
+inline void MediumAllocator::clear()
+{
+    m_end = nullptr;
+    m_remaining = 0;
+    m_objectCount = 0;
+}
+
 } // namespace bmalloc
 
 #endif // MediumAllocator_h

diff --git a/Source/bmalloc/bmalloc/SmallAllocator.h b/Source/bmalloc/bmalloc/SmallAllocator.h
index 842bf05..677f5de 100644 (file)
--- a/Source/bmalloc/bmalloc/SmallAllocator.h
+++ b/Source/bmalloc/bmalloc/SmallAllocator.h
@@ -47,7 +47,9 @@ public:
 
     unsigned short objectCount();
     unsigned char derefCount();
+
     void refill(SmallLine*);
+    void clear();
 
 private:
     char* m_ptr;
@@ -107,6 +109,12 @@ inline void SmallAllocator::refill(SmallLine* line)
     m_remaining = m_maxObjectCount;
 }
 
+inline void SmallAllocator::clear()
+{
+    m_ptr = nullptr;
+    m_remaining = 0;
+}
+
 } // namespace bmalloc
 
 #endif // SmallAllocator_h