Update the tcmalloc chromium branch to r144 (gperftools 2.0), and merge chromium-specific changes.

third_party/tcmalloc/chromium/src/thread_cache.h

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 70 matching lines @@
 
   // Total byte size in cache
   size_t Size() const { return size_; }
 
   // Allocate an object of the given size and class. The size given
   // must be the same as the size of the class in the size map.
   void* Allocate(size_t size, size_t cl);
   void Deallocate(void* ptr, size_t size_class);
 
   void Scavenge();
-  void Print(TCMalloc_Printer* out) const;
 
   int GetSamplePeriod();
 
   // Record allocation of "k" bytes.  Return true iff allocation
   // should be sampled
   bool SampleAllocation(size_t k);
 
   // Record additional bytes allocated.
   void AddToByteAllocatedTotal(size_t k) { total_bytes_allocated_ += k; }
 
@@ skipping 16 matching lines @@
   // Return the number of thread heaps in use.
   static inline int HeapsInUse();
 
   // Writes to total_bytes the total number of bytes used by all thread heaps.
   // class_count must be an array of size kNumClasses.  Writes the number of
   // items on the corresponding freelist.  class_count may be NULL.
   // The storage of both parameters must be zero intialized.
   // REQUIRES: Static::pageheap_lock is held.
   static void GetThreadStats(uint64_t* total_bytes, uint64_t* class_count);
 
-  // Write debugging statistics to 'out'.
-  // REQUIRES: Static::pageheap_lock is held.
-  static void PrintThreads(TCMalloc_Printer* out);
-
   // Sets the total thread cache size to new_size, recomputing the
   // individual thread cache sizes as necessary.
   // REQUIRES: Static::pageheap lock is held.
   static void set_overall_thread_cache_size(size_t new_size);
   static size_t overall_thread_cache_size() {
     return overall_thread_cache_size_;
   }
 
  private:
   class FreeList {
@@ skipping 65 matching lines @@
       length_++;
     }
 
     void* Pop() {
       ASSERT(list_ != NULL);
       length_--;
       if (length_ < lowater_) lowater_ = length_;
       return FL_Pop(&list_);
     }
 
+    void* Next() {
+      return SLL_Next(&list_);

[jar (doing other things), 2012/02/28 22:15:49]

Probably add FL_Next() instead of SLL_next.

[Dai Mikurube (NOT FULLTIME), 2012/02/28 23:05:43]

Done.

+    }
+
     void PushRange(int N, void *start, void *end) {
       FL_PushRange(&list_, start, end);
       length_ += N;
     }
 
     void PopRange(int N, void **start, void **end) {
       FL_PopRange(&list_, N, start, end);
       ASSERT(length_ >= N);
       length_ -= N;
       if (length_ < lowater_) lowater_ = length_;
@@ skipping 132 matching lines @@
     return FetchFromCentralCache(cl, size);
   }
   size_ -= size;
   return list->Pop();
 }
 
 inline void ThreadCache::Deallocate(void* ptr, size_t cl) {
   FreeList* list = &list_[cl];
   size_ += Static::sizemap()->ByteSizeForClass(cl);
   ssize_t size_headroom = max_size_ - size_ - 1;
+
+  // This catches back-to-back frees of allocs in the same size
+  // class. A more comprehensive (and expensive) test would be to walk
+  // the entire freelist. But this might be enough to find some bugs.
+  ASSERT(ptr != list->Next());

[jar (doing other things), 2012/03/01 01:35:05]

Since you're having trouble with this assert... I looked closer... and it looks
to be correct to use FL_Next() in the  implementation of Next().

The list that we got is a FreeList found in line 365.  That list should be
completely well formed.  (i.e., there is no chance this is just a partially
formed list mis-firing an assertion).

The assertion in the implementation of FL_Next() (which we forward Next() into)
first checks (without asserting) if there is a next item, and if so, then it
traps if the follower does not point back to the current item via a prev link. 
That should definitely be valid in the heap (where we found the free list) at
all times.  It should be a nice clean invariant.

[Dai Mikurube (NOT FULLTIME), 2012/03/01 01:54:05]

Thanks, Jim.

I agree.  It looks that the list SHOULD be well formed at all times (at least at
the ASSERT).  But, I observed a case that :

FL_Previous_No_Check(FL_Next_No_Check(t)) != t
(i.e. FL_Previous_No_Check(FL_Next_No_Check(t)) == NULL
   && FL_Next_No_Check(t) != NULL)

at FL_Next() while I was diving with gdb into the code ONLY with the ASSERT
(http://codereview.chromium.org/9528002/).

If my observation is correct, it may be a real corruption... I'm looking at this
deeper.


On 2012/03/01 01:35:05, jar wrote:

+
   list->Push(ptr);
   ssize_t list_headroom =
       static_cast<ssize_t>(list->max_length()) - list->length();
 
   // There are two relatively uncommon things that require further work.
   // In the common case we're done, and in that case we need a single branch
   // because of the bitwise-or trick that follows.
   if ((list_headroom | size_headroom) < 0) {
     if (list_headroom < 0) {
       ListTooLong(list, cl);
@@ skipping 27 matching lines @@
 // because we may be in the thread destruction code and may have
 // already cleaned up the cache for this thread.
 inline ThreadCache* ThreadCache::GetCacheIfPresent() {
   if (!tsd_inited_) return NULL;
   return GetThreadHeap();
 }
 
 }  // namespace tcmalloc
 
 #endif  // TCMALLOC_THREAD_CACHE_H_