OLD | NEW |
| (Empty) |
1 // Copyright 2015 the V8 project authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "test/cctest/cctest.h" | |
6 #include "test/cctest/heap/heap-tester.h" | |
7 #include "test/cctest/heap/utils-inl.h" | |
8 | |
9 namespace v8 { | |
10 namespace internal { | |
11 | |
12 static std::vector<Handle<FixedArray>> FillUpFirstOldSpacePage(Heap* heap) { | |
13 // This functions assumes that old space top is still on the first page | |
14 heap->old_space()->EmptyAllocationInfo(); | |
15 int free_on_first_page = static_cast<int>(heap->old_space()->Available()); | |
16 return CreatePadding(heap, free_on_first_page, TENURED); | |
17 } | |
18 | |
19 | |
20 static void CheckInvariantsOfAbortedPage(Page* page) { | |
21 // Check invariants: | |
22 // 1) Markbits are cleared | |
23 // 2) The page is not marked as evacuation candidate anymore | |
24 // 3) The page is not marked as aborted compaction anymore. | |
25 CHECK(page->markbits()->IsClean()); | |
26 CHECK(!page->IsEvacuationCandidate()); | |
27 CHECK(!page->IsFlagSet(Page::COMPACTION_WAS_ABORTED)); | |
28 } | |
29 | |
30 | |
31 HEAP_TEST(CompactionFullAbortedPage) { | |
32 // Test the scenario where we reach OOM during compaction and the whole page | |
33 // is aborted. | |
34 | |
35 FLAG_manual_evacuation_candidates_selection = true; | |
36 CcTest::InitializeVM(); | |
37 Isolate* isolate = CcTest::i_isolate(); | |
38 Heap* heap = isolate->heap(); | |
39 // Disable concurrent sweeping to ensure memory is in an expected state, i.e., | |
40 // we can reach the state of a half aborted page. We cannot just set | |
41 // {FLAG_concurrent_sweeping} because the flag is cached in heap, which is | |
42 // initialized earlier. | |
43 heap->concurrent_sweeping_enabled_ = false; | |
44 { | |
45 HandleScope scope1(isolate); | |
46 // Fill up the first page since it cannot be evacuated. | |
47 auto first_page_handles = FillUpFirstOldSpacePage(heap); | |
48 | |
49 { | |
50 HandleScope scope2(isolate); | |
51 heap->old_space()->EmptyAllocationInfo(); | |
52 auto second_page_handles = | |
53 CreatePadding(heap, Page::kAllocatableMemory, TENURED); | |
54 Page* to_be_aborted_page = | |
55 Page::FromAddress(second_page_handles.front()->address()); | |
56 to_be_aborted_page->SetFlag( | |
57 MemoryChunk::FORCE_EVACUATION_CANDIDATE_FOR_TESTING); | |
58 heap->set_force_oom(true); | |
59 heap->CollectAllGarbage(); | |
60 | |
61 // Check that all handles still point to the same page, i.e., compaction | |
62 // has been aborted on the page. | |
63 for (Handle<FixedArray> object : second_page_handles) { | |
64 CHECK_EQ(to_be_aborted_page, Page::FromAddress(object->address())); | |
65 } | |
66 CheckInvariantsOfAbortedPage(to_be_aborted_page); | |
67 } | |
68 } | |
69 } | |
70 | |
71 | |
72 HEAP_TEST(CompactionPartiallyAbortedPage) { | |
73 // Test the scenario where we reach OOM during compaction and parts of the | |
74 // page have already been migrated to a new one. | |
75 | |
76 FLAG_manual_evacuation_candidates_selection = true; | |
77 | |
78 const int object_size = 128 * KB; | |
79 | |
80 CcTest::InitializeVM(); | |
81 Isolate* isolate = CcTest::i_isolate(); | |
82 Heap* heap = isolate->heap(); | |
83 // Disable concurrent sweeping to ensure memory is in an expected state, i.e., | |
84 // we can reach the state of a half aborted page. We cannot just set | |
85 // {FLAG_concurrent_sweeping} because the flag is cached in heap, which is | |
86 // initialized earlier. | |
87 heap->concurrent_sweeping_enabled_ = false; | |
88 { | |
89 HandleScope scope1(isolate); | |
90 // Fill up the first page since it cannot be evacuated. | |
91 auto first_page_handles = FillUpFirstOldSpacePage(heap); | |
92 | |
93 { | |
94 HandleScope scope2(isolate); | |
95 // Fill the second page with objects of size {object_size} (last one is | |
96 // properly adjusted). | |
97 heap->old_space()->EmptyAllocationInfo(); | |
98 auto second_page_handles = | |
99 CreatePadding(heap, Page::kAllocatableMemory, TENURED, object_size); | |
100 // Mark the second page for evacuation. | |
101 Page* to_be_aborted_page = | |
102 Page::FromAddress(second_page_handles.front()->address()); | |
103 to_be_aborted_page->SetFlag( | |
104 MemoryChunk::FORCE_EVACUATION_CANDIDATE_FOR_TESTING); | |
105 | |
106 { | |
107 // Add a third page that is filled with {num_objects} objects of size | |
108 // {object_size}. | |
109 HandleScope scope3(isolate); | |
110 heap->old_space()->EmptyAllocationInfo(); | |
111 const int num_objects = 3; | |
112 std::vector<Handle<FixedArray>> third_page_handles = CreatePadding( | |
113 heap, object_size * num_objects, TENURED, object_size); | |
114 Page* third_page = | |
115 Page::FromAddress(third_page_handles.front()->address()); | |
116 heap->set_force_oom(true); | |
117 heap->CollectAllGarbage(); | |
118 | |
119 bool migration_aborted = false; | |
120 for (Handle<FixedArray> object : second_page_handles) { | |
121 // Once compaction has been aborted, all following objects still have | |
122 // to be on the initial page. | |
123 CHECK(!migration_aborted || | |
124 (Page::FromAddress(object->address()) == to_be_aborted_page)); | |
125 if (Page::FromAddress(object->address()) == to_be_aborted_page) { | |
126 // This object has not been migrated. | |
127 migration_aborted = true; | |
128 } else { | |
129 CHECK_EQ(Page::FromAddress(object->address()), third_page); | |
130 } | |
131 } | |
132 // Check that we actually created a scenario with a partially aborted | |
133 // page. | |
134 CHECK(migration_aborted); | |
135 CheckInvariantsOfAbortedPage(to_be_aborted_page); | |
136 } | |
137 } | |
138 } | |
139 } | |
140 | |
141 | |
142 HEAP_TEST(CompactionPartiallyAbortedPageIntraAbortedPointers) { | |
143 // Test the scenario where we reach OOM during compaction and parts of the | |
144 // page have already been migrated to a new one. Objects on the aborted page | |
145 // are linked together. This test makes sure that intra-aborted page pointers | |
146 // get properly updated. | |
147 | |
148 FLAG_manual_evacuation_candidates_selection = true; | |
149 | |
150 const int object_size = 128 * KB; | |
151 | |
152 CcTest::InitializeVM(); | |
153 Isolate* isolate = CcTest::i_isolate(); | |
154 Heap* heap = isolate->heap(); | |
155 // Disable concurrent sweeping to ensure memory is in an expected state, i.e., | |
156 // we can reach the state of a half aborted page. We cannot just set | |
157 // {FLAG_concurrent_sweeping} because the flag is cached in heap, which is | |
158 // initialized earlier. | |
159 heap->concurrent_sweeping_enabled_ = false; | |
160 { | |
161 HandleScope scope1(isolate); | |
162 // Fill up the first page since it cannot be evacuated. | |
163 auto first_page_handles = FillUpFirstOldSpacePage(heap); | |
164 | |
165 Page* to_be_aborted_page = nullptr; | |
166 { | |
167 HandleScope temporary_scope(isolate); | |
168 // Fill the second page with objects of size {object_size} (last one is | |
169 // properly adjusted). | |
170 heap->old_space()->EmptyAllocationInfo(); | |
171 const int free_on_second_page = Page::kAllocatableMemory; | |
172 std::vector<Handle<FixedArray>> second_page_handles = | |
173 CreatePadding(heap, free_on_second_page, TENURED, object_size); | |
174 // Mark the second page for evacuation. | |
175 to_be_aborted_page = | |
176 Page::FromAddress(second_page_handles.front()->address()); | |
177 to_be_aborted_page->SetFlag( | |
178 MemoryChunk::FORCE_EVACUATION_CANDIDATE_FOR_TESTING); | |
179 | |
180 for (size_t i = second_page_handles.size() - 1; i > 0; i--) { | |
181 second_page_handles[i]->set(0, *second_page_handles[i - 1]); | |
182 } | |
183 first_page_handles.front()->set(0, *second_page_handles.back()); | |
184 } | |
185 | |
186 { | |
187 // Add a third page that is filled with {num_objects} objects of size | |
188 // {object_size}. | |
189 HandleScope scope3(isolate); | |
190 heap->old_space()->EmptyAllocationInfo(); | |
191 const int num_objects = 2; | |
192 int used_memory = object_size * num_objects; | |
193 std::vector<Handle<FixedArray>> third_page_handles = | |
194 CreatePadding(heap, used_memory, TENURED, object_size); | |
195 Page* third_page = | |
196 Page::FromAddress(third_page_handles.front()->address()); | |
197 heap->set_force_oom(true); | |
198 heap->CollectAllGarbage(); | |
199 | |
200 // The following check makes sure that we compacted "some" objects, while | |
201 // leaving others in place. | |
202 bool in_place = true; | |
203 Handle<FixedArray> current = first_page_handles.front(); | |
204 while (current->get(0) != heap->undefined_value()) { | |
205 current = Handle<FixedArray>(FixedArray::cast(current->get(0))); | |
206 CHECK(current->IsFixedArray()); | |
207 if (Page::FromAddress(current->address()) != to_be_aborted_page) { | |
208 in_place = false; | |
209 } | |
210 bool on_aborted_page = | |
211 Page::FromAddress(current->address()) == to_be_aborted_page; | |
212 bool on_third_page = | |
213 Page::FromAddress(current->address()) == third_page; | |
214 CHECK((in_place && on_aborted_page) || (!in_place && on_third_page)); | |
215 } | |
216 // Check that we at least migrated one object, as otherwise the test would | |
217 // not trigger. | |
218 CHECK(!in_place); | |
219 | |
220 CheckInvariantsOfAbortedPage(to_be_aborted_page); | |
221 } | |
222 } | |
223 } | |
224 | |
225 | |
226 HEAP_TEST(CompactionPartiallyAbortedPageWithStoreBufferEntries) { | |
227 // Test the scenario where we reach OOM during compaction and parts of the | |
228 // page have already been migrated to a new one. Objects on the aborted page | |
229 // are linked together and the very first object on the aborted page points | |
230 // into new space. The test verifies that the store buffer entries are | |
231 // properly cleared and rebuilt after aborting a page. Failing to do so can | |
232 // result in other objects being allocated in the free space where their | |
233 // payload looks like a valid new space pointer. | |
234 | |
235 FLAG_manual_evacuation_candidates_selection = true; | |
236 | |
237 const int object_size = 128 * KB; | |
238 | |
239 CcTest::InitializeVM(); | |
240 Isolate* isolate = CcTest::i_isolate(); | |
241 Heap* heap = isolate->heap(); | |
242 // Disable concurrent sweeping to ensure memory is in an expected state, i.e., | |
243 // we can reach the state of a half aborted page. We cannot just set | |
244 // {FLAG_concurrent_sweeping} because the flag is cached in heap, which is | |
245 // initialized earlier. | |
246 heap->concurrent_sweeping_enabled_ = false; | |
247 { | |
248 HandleScope scope1(isolate); | |
249 // Fill up the first page since it cannot be evacuated. | |
250 auto first_page_handles = FillUpFirstOldSpacePage(heap); | |
251 | |
252 Page* to_be_aborted_page = nullptr; | |
253 { | |
254 HandleScope temporary_scope(isolate); | |
255 // Fill the second page with objects of size {object_size} (last one is | |
256 // properly adjusted). | |
257 heap->old_space()->EmptyAllocationInfo(); | |
258 auto second_page_handles = | |
259 CreatePadding(heap, Page::kAllocatableMemory, TENURED, object_size); | |
260 // Mark the second page for evacuation. | |
261 to_be_aborted_page = | |
262 Page::FromAddress(second_page_handles.front()->address()); | |
263 to_be_aborted_page->SetFlag( | |
264 MemoryChunk::FORCE_EVACUATION_CANDIDATE_FOR_TESTING); | |
265 | |
266 for (size_t i = second_page_handles.size() - 1; i > 0; i--) { | |
267 second_page_handles[i]->set(0, *second_page_handles[i - 1]); | |
268 } | |
269 first_page_handles.front()->set(0, *second_page_handles.back()); | |
270 Handle<FixedArray> new_space_array = | |
271 isolate->factory()->NewFixedArray(1, NOT_TENURED); | |
272 CHECK(heap->InNewSpace(*new_space_array)); | |
273 second_page_handles.front()->set(1, *new_space_array); | |
274 } | |
275 | |
276 { | |
277 // Add a third page that is filled with {num_objects} objects of size | |
278 // {object_size}. | |
279 HandleScope scope3(isolate); | |
280 heap->old_space()->EmptyAllocationInfo(); | |
281 const int num_objects = 2; | |
282 int used_memory = object_size * num_objects; | |
283 std::vector<Handle<FixedArray>> third_page_handles = | |
284 CreatePadding(heap, used_memory, TENURED, object_size); | |
285 Page* third_page = | |
286 Page::FromAddress(third_page_handles.front()->address()); | |
287 heap->set_force_oom(true); | |
288 heap->CollectAllGarbage(); | |
289 | |
290 // The following check makes sure that we compacted "some" objects, while | |
291 // leaving others in place. | |
292 bool in_place = true; | |
293 Handle<FixedArray> current = first_page_handles.front(); | |
294 while (current->get(0) != heap->undefined_value()) { | |
295 current = Handle<FixedArray>(FixedArray::cast(current->get(0))); | |
296 CHECK(!heap->InNewSpace(*current)); | |
297 CHECK(current->IsFixedArray()); | |
298 if (Page::FromAddress(current->address()) != to_be_aborted_page) { | |
299 in_place = false; | |
300 } | |
301 bool on_aborted_page = | |
302 Page::FromAddress(current->address()) == to_be_aborted_page; | |
303 bool on_third_page = | |
304 Page::FromAddress(current->address()) == third_page; | |
305 CHECK((in_place && on_aborted_page) || (!in_place && on_third_page)); | |
306 } | |
307 // Check that we at least migrated one object, as otherwise the test would | |
308 // not trigger. | |
309 CHECK(!in_place); | |
310 | |
311 CheckInvariantsOfAbortedPage(to_be_aborted_page); | |
312 | |
313 // Allocate a new object in new space. | |
314 Handle<FixedArray> holder = | |
315 isolate->factory()->NewFixedArray(10, NOT_TENURED); | |
316 // Create a broken address that looks like a tagged pointer to a new space | |
317 // object. | |
318 Address broken_address = holder->address() + 2 * kPointerSize + 1; | |
319 // Convert it to a vector to create a string from it. | |
320 Vector<const uint8_t> string_to_broken_addresss( | |
321 reinterpret_cast<const uint8_t*>(&broken_address), 8); | |
322 | |
323 Handle<String> string; | |
324 do { | |
325 // We know that the interesting slot will be on the aborted page and | |
326 // hence we allocate until we get our string on the aborted page. | |
327 // We used slot 1 in the fixed size array which corresponds to the | |
328 // the first word in the string. Since the first object definitely | |
329 // migrated we can just allocate until we hit the aborted page. | |
330 string = isolate->factory() | |
331 ->NewStringFromOneByte(string_to_broken_addresss, TENURED) | |
332 .ToHandleChecked(); | |
333 } while (Page::FromAddress(string->address()) != to_be_aborted_page); | |
334 | |
335 // If store buffer entries are not properly filtered/reset for aborted | |
336 // pages we have now a broken address at an object slot in old space and | |
337 // the following scavenge will crash. | |
338 heap->CollectGarbage(NEW_SPACE); | |
339 } | |
340 } | |
341 } | |
342 | |
343 } // namespace internal | |
344 } // namespace v8 | |
OLD | NEW |