Fix PartitionAlloc randomization on 32-bit systems

Fix PartitionAlloc randomization on 32-bit systems

Make PartitionAlloc reduce churn on Windows system
allocations, and use less aggressive randomization on
32-bit systems in general.

Updated version of:
https://codereview.chromium.org/1383153002/

BUG=538479, 394591
Committed: https://crrev.com/bae4e6fc3d968bd444f793e4fc821ba1078070be
Cr-Commit-Position: refs/heads/master@{#353881}

[jschuh, 2015-10-09 04:28:56]

Patchset #2 (id:20001) has been deleted

[jschuh, 2015-10-09 04:35:36]

Patchset #2 (id:40001) has been deleted

[jschuh, 2015-10-09 05:30:34]

The CQ bit was checked by jschuh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-09 05:30:54]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1401483002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1401483002/60001

[commit-bot: I haz the power, 2015-10-09 05:45:52]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-09 05:45:52]

Dry run: Try jobs failed on following builders:
  android_arm64_dbg_recipe on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/android_arm64_d...)

[jschuh, 2015-10-09 06:46:27]

Patchset #3 (id:80001) has been deleted

[jschuh, 2015-10-09 08:28:23]

The CQ bit was checked by jschuh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-09 08:28:27]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1401483002/120001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1401483002/120001

[commit-bot: I haz the power, 2015-10-09 08:59:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-09 08:59:01]

Dry run: Try jobs failed on following builders:
  android_clang_dbg_recipe on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_d...)

[jschuh, 2015-10-10 05:16:48]

Patchset #5 (id:140001) has been deleted

[jschuh, 2015-10-10 05:16:59]

Patchset #5 (id:160001) has been deleted

[jschuh, 2015-10-10 05:17:10]

Patchset #5 (id:180001) has been deleted

[jschuh, 2015-10-10 05:17:25]

Patchset #5 (id:200001) has been deleted

[jschuh, 2015-10-11 17:36:02]

Patchset #6 (id:240001) has been deleted

[jschuh, 2015-10-11 17:36:15]

Patchset #6 (id:260001) has been deleted

[jschuh, 2015-10-11 17:38:18]

Patchset #4 (id:120001) has been deleted

[jschuh, 2015-10-11 18:48:48]

Patchset #6 (id:300001) has been deleted

[jschuh, 2015-10-11 23:27:47]

The CQ bit was checked by jschuh@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-11 23:27:53]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1401483002/340001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1401483002/340001

[jschuh, 2015-10-11 23:29:05]

jschuh@chromium.org changed reviewers:
+ glider@chromium.org

[jschuh, 2015-10-11 23:29:05]

glider@ - Mind taking a look? TSan seems fine at this point, but there are a
whole lot of ASan errors in there.

[commit-bot: I haz the power, 2015-10-12 00:39:45]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-12 00:39:46]

Dry run: Try jobs failed on following builders:
  linux_chromium_asan_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[jschuh, 2015-10-12 23:43:09]

jschuh@chromium.org changed reviewers:
+ haraken@chromium.org

[jschuh, 2015-10-12 23:43:09]

glider@ - ping

haraken@ - This is an updated version of my earlier patch that bounced. It
includes your proposed changes from the last round, and fixes some additional
quirks for Windows.

[haraken, 2015-10-12 23:51:03]

LGTM

[Alexander Potapenko, 2015-10-13 16:02:42]

https://codereview.chromium.org/1401483002/diff/370001/third_party/WebKit/Sou...
File third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp (right):

https://codereview.chromium.org/1401483002/diff/370001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:89: #if
defined(MEMORY_TOOL_REPLACES_ALLOCATOR)
You also need "if !defined(MEMORY_TOOL_REPLACES_ALLOCATOR)" around the anonymous
namespace above.

[jschuh, 2015-10-13 17:44:13]

https://codereview.chromium.org/1401483002/diff/370001/third_party/WebKit/Sou...
File third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp (right):

https://codereview.chromium.org/1401483002/diff/370001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:89: #if
defined(MEMORY_TOOL_REPLACES_ALLOCATOR)
On 2015/10/13 16:02:42, Alexander Potapenko wrote:
> You also need "if !defined(MEMORY_TOOL_REPLACES_ALLOCATOR)" around the
anonymous
> namespace above.

I dropped this approach and just added a custom range as we discussed over chat.

[Alexander Potapenko, 2015-10-13 18:00:46]

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
File third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp (right):

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:103: // This range
is copied from the TSan source, but works for all tools.
Should be fine. The acceptable ranges for ASan on x86_64 are [0x000000000000,
0x00007fff7fff] + [0x10007fff8000, 0x7fffffffffff] \ [0x600000000000,
0x640000000000]
(see
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/asan_mapping.h...)
, for MSan:
[0x5500000000, 0x5600000000] + [0x7000000000, 0x8000000000]
(see
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/msan/msan.h?revisio...)

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:111: // ARM64 on
Linux has 39-bit user space.
Note that we do have ASan (but not TSan or MSan) on 32-bit x86, ARM and ARM64.
Looks like your ranges overlap with the shadow or shadow gap ranges here:
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/asan_mapping.h...

[jschuh, 2015-10-13 18:35:57]

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
File third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp (right):

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:103: // This range
is copied from the TSan source, but works for all tools.
On 2015/10/13 18:00:46, Alexander Potapenko wrote:
> Should be fine. The acceptable ranges for ASan on x86_64 are [0x000000000000,
> 0x00007fff7fff] + [0x10007fff8000, 0x7fffffffffff] \ [0x600000000000,
> 0x640000000000]
> (see
>
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/asan_mapping.h...)
> , for MSan:
> [0x5500000000, 0x5600000000] + [0x7000000000, 0x8000000000]
> (see
>
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/msan/msan.h?revisio...)

Okay, sounds like this has enough room to play in.

https://codereview.chromium.org/1401483002/diff/390001/third_party/WebKit/Sou...
third_party/WebKit/Source/wtf/AddressSpaceRandomization.cpp:111: // ARM64 on
Linux has 39-bit user space.
On 2015/10/13 18:00:46, Alexander Potapenko wrote:
> Note that we do have ASan (but not TSan or MSan) on 32-bit x86, ARM and ARM64.
> Looks like your ranges overlap with the shadow or shadow gap ranges here:
>
http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/asan/asan_mapping.h...

For this one I'm just going to rely on the retry logic eventually landing in the
right spot. In practice it might be a bit slower, but I doubt enough to matter.

[jschuh, 2015-10-13 18:43:17]

The CQ bit was checked by jschuh@chromium.org

[jschuh, 2015-10-13 18:43:17]

The patchset sent to the CQ was uploaded after l-g-t-m from haraken@chromium.org
Link to the patchset: https://codereview.chromium.org/1401483002/#ps390001
(title: "carve out tsan's range in getRandomPageBase")

[commit-bot: I haz the power, 2015-10-13 18:46:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1401483002/390001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1401483002/390001

[commit-bot: I haz the power, 2015-10-13 21:17:07]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-13 21:17:08]

Try jobs failed on following builders:
  win_chromium_rel_ng on tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[jschuh, 2015-10-13 21:18:48]

The CQ bit was checked by jschuh@chromium.org

[commit-bot: I haz the power, 2015-10-13 21:22:13]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1401483002/390001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1401483002/390001

[commit-bot: I haz the power, 2015-10-13 22:44:09]

Committed patchset #10 (id:390001)

[commit-bot: I haz the power, 2015-10-13 22:44:40]

Patchset 10 (id:??) landed as
https://crrev.com/bae4e6fc3d968bd444f793e4fc821ba1078070be
Cr-Commit-Position: refs/heads/master@{#353881}

[Alexander Potapenko, 2015-10-14 13:48:34]

LGTM