PartitionAlloc: Leave bucket in valid state when allocation fails

Source/wtf/PartitionAllocTest.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 14 matching lines @@
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "wtf/PartitionAlloc.h"
 
 #include "wtf/BitwiseOperations.h"
+#include "wtf/CPU.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include <gtest/gtest.h>
 #include <stdlib.h>
 #include <string.h>
 
 #if OS(POSIX)
 #include <sys/mman.h>
+#include <sys/resource.h>
+#include <sys/time.h>
 
 #ifndef MAP_ANONYMOUS
 #define MAP_ANONYMOUS MAP_ANON
 #endif
 #endif // OS(POSIX)
 
 #if !defined(MEMORY_TOOL_REPLACES_ALLOCATOR)
 
 namespace {
 
@@ skipping 25 matching lines @@
     // bitrotted because no test calls it.
     partitionDumpStats(*allocator.root());
 #endif
 
     // We expect no leaks in the general case. We have a test for leak
     // detection.
     EXPECT_TRUE(allocator.shutdown());
     EXPECT_TRUE(genericAllocator.shutdown());
 }
 
+static bool SetAddressSpaceLimit()
+{
+#if !CPU(64BIT)
+    // 32 bits => address space is limited already.
+    return true;
+#elif OS(POSIX)
+    const size_t kAddressSpaceLimit = static_cast<size_t>(4096) * 1024 * 1024;
+    struct rlimit limit;
+    if (getrlimit(RLIMIT_AS, &limit) != 0)
+        return false;
+    if (limit.rlim_cur == RLIM_INFINITY || limit.rlim_cur > kAddressSpaceLimit) {
+        limit.rlim_cur = kAddressSpaceLimit;
+        if (setrlimit(RLIMIT_AS, &limit) != 0)
+            return false;
+    }
+    return true;
+#else
+    return false;
+#endif
+}
+
+static bool ClearAddressSpaceLimit()
+{
+#if !CPU(64BIT)
+    return true;
+#elif OS(POSIX)
+    struct rlimit limit;
+    if (getrlimit(RLIMIT_AS, &limit) != 0)
+        return false;
+    limit.rlim_cur = limit.rlim_max;
+    if (setrlimit(RLIMIT_AS, &limit) != 0)
+        return false;
+    return true;
+#else
+    return false;
+#endif
+}
+
 static WTF::PartitionPage* GetFullPage(size_t size)
 {
     size_t realSize = size + kExtraAllocSize;
     size_t bucketIdx = realSize >> WTF::kBucketShift;
     WTF::PartitionBucket* bucket = &allocator.root()->buckets()[bucketIdx];
     size_t numSlots = (bucket->numSystemPagesPerSlotSpan * WTF::kSystemPageSize) / realSize;
     void* first = 0;
     void* last = 0;
     size_t i;
     for (i = 0; i < numSlots; ++i) {
@@ skipping 992 matching lines @@
     ptr = partitionAllocGeneric(genericAllocator.root(), size);
     EXPECT_TRUE(ptr);
     partitionFreeGeneric(genericAllocator.root(), ptr);
 
     EXPECT_TRUE(bucket->activePagesHead);
     EXPECT_TRUE(bucket->freePagesHead);
 
     TestShutdown();
 }
 
+#if !CPU(64BIT) || OS(POSIX)
+
+// Tests that if an allocation fails in "return null" mode, repeating it doesn't
+// crash, and still returns null. The test tries to allocate 6 GB of memory in
+// 512 kB blocks. On 64-bit POSIX systems, the address space is limited to 4 GB
+// using setrlimit() first.
+TEST(PartitionAllocTest, RepeatedReturnNull)
+{
+    TestSetup();
+
+    EXPECT_TRUE(SetAddressSpaceLimit());
+
+    void* ptrs[8192];

[Chris Evans, 2014/11/07 03:33:23]

Nit: shouldn't this be 6144 ?

[Jens Widell, 2014/11/07 14:17:31]

Done.

[Jens Widell, 2014/11/07 14:29:51]

Actually, since this is now calculated as 6GB / 512kB, it's rather 12288.

6144 amounts to allocating 3 GB of actual memory, which is less than the 4 GB
address space limit we set (on 64-bit systems). But since we can only fit 3 x
512 kB into a super page, we ended up needing to map 4 GB of address space,
which, since we inevitably also have some other memory mapped, was still too
much.

And on 32-bit systems even mapping 3 GB of address would likely have failed, of
course.

Anyhow, the test checks that it doesn't succeed in allocating all it tries to
allocate, so all this was mostly academic.

+    int i;
+
+    for (i = 0; i < 6144; ++i) {

[Chris Evans, 2014/11/07 03:33:23]

Nit: Can we make 6144 calculated to make it clearer? Maybe have 512KB be a
constant and then
size_t numAllocs = (6 * 1024 * 1024 * 1024) / theConstant512KB

[Jens Widell, 2014/11/07 14:17:31]

Done. Made constants out all of "6 GB", "512 kB" and "6144".

+        ptrs[i] = partitionAllocGenericFlags(genericAllocator.root(), WTF::PartitionAllocReturnNull, 512*1024);

[Chris Evans, 2014/11/07 03:33:23]

Nit: for style consistency, add spaces? "512 * 1024"

[Jens Widell, 2014/11/07 14:17:31]

That's weird... I never write code like that normally, and complain when other
people do. Sorry.

+        if (!ptrs[i]) {
+            ptrs[i] = partitionAllocGenericFlags(genericAllocator.root(), WTF::PartitionAllocReturnNull, 512*1024);

[Chris Evans, 2014/11/07 03:33:23]

Same nit.

[Jens Widell, 2014/11/07 14:17:31]

Done.

+            EXPECT_FALSE(ptrs[i]);
+            break;
+        }
+    }
+
+    // We shouldn't succeed in allocating all 6 GB of memory. If we do, then
+    // we're not actually testing anything here.
+    EXPECT_LT(i, 6144);
+
+    for (--i; i >= 0; --i) {
+        partitionFreeGeneric(genericAllocator.root(), ptrs[i]);
+        ptrs[i] = partitionAllocGenericFlags(genericAllocator.root(), WTF::PartitionAllocReturnNull, 512*1024);

[Chris Evans, 2014/11/07 03:33:23]

Nit: Why do we alloc again here? Thoroughness of testing? Maybe add comment?

And maybe a non-nit: should we EXPECT() that the allocation succeeded? If it
fails, we won't notice because partitionFreeGeneric(NULL) is ok.

[Jens Widell, 2014/11/07 14:17:31]

Thoroughness. Since I fiddled with the free() code path, it seemed meaningful to
check that allocated memory could be freed, and that freed memory could be
allocated again.
Yes, that seems like a good idea. I see no reason why any of these allocations
could reasonably fail.

+        partitionFreeGeneric(genericAllocator.root(), ptrs[i]);
+    }
+
+    EXPECT_TRUE(ClearAddressSpaceLimit());
+
+    TestShutdown();
+}
+
+#endif // !CPU(64BIT) || OS(POSIX)
+
 #if !OS(ANDROID)
 
 // Make sure that malloc(-1) dies.
 // In the past, we had an integer overflow that would alias malloc(-1) to
 // malloc(0), which is not good.
 TEST(PartitionAllocDeathTest, LargeAllocs)
 {
     TestSetup();
     // Largest alloc.
     EXPECT_DEATH(partitionAllocGeneric(genericAllocator.root(), static_cast<size_t>(-1)), "");
@@ skipping 79 matching lines @@
     EXPECT_EQ(32u, WTF::countLeadingZerosSizet(0u));
     EXPECT_EQ(31u, WTF::countLeadingZerosSizet(1u));
     EXPECT_EQ(1u, WTF::countLeadingZerosSizet(1u << 30));
     EXPECT_EQ(0u, WTF::countLeadingZerosSizet(1u << 31));
 #endif
 }
 
 } // namespace
 
 #endif // !defined(MEMORY_TOOL_REPLACES_ALLOCATOR)