Reserve code range block for evacuation.

Reserve code range block for evacuation.

If we run out of code range, then GC wouldn't be able to compact code space,
because it wouldn't be able to allocate a new page. This can cause code space
fragmentation and OOM crashes.

BUG=chromium:430118
LOG=Y

Committed: https://chromium.googlesource.com/v8/v8/+/4fbbd29403f86699c1734685ee7c6a61ff74ac82

[ulan, 2014-11-19 16:37:52]

ulan@chromium.org changed reviewers:
+ hpayer@chromium.org

[ulan, 2014-11-19 16:37:52]

By setting code range size to 32MB, I can easily trigger OOM crash in gmail
because of code fragmentation. With this patch applied gmail doesn't crash.

I've been thinking about adding test, but that's a bit tricky since we need to
simulate code space fragmentation. Not sure how to do that.

[Erik Corry, 2014-11-19 17:02:47]

erik.corry@gmail.com changed reviewers:
+ erik.corry@gmail.com

[Erik Corry, 2014-11-19 17:02:48]

You should be able to simulate code space fragmentation with regexps.

var re_source = "."; // Avoid atom regexp engine.
for (var i = 0; i < 1000000; i++) {
   re_source += "x";
   var re = new RegExp(re_source);
   "xxx".match(re);
}

[Hannes Payer (out of office), 2014-11-20 08:00:37]

Awesome catch! LGTM, just nits.

A regression test would be amazing, can you try Erik's idea? I guess you would
have to make some of the code objects survive.

https://codereview.chromium.org/742733002/diff/20001/src/heap/heap.cc
File src/heap/heap.cc (right):

https://codereview.chromium.org/742733002/diff/20001/src/heap/heap.cc#newcode...
src/heap/heap.cc:5265: isolate_->code_range()->ReserveEmergencyBlock();
Can we do that after setting up code_range?

https://codereview.chromium.org/742733002/diff/20001/src/heap/spaces.h
File src/heap/spaces.h (right):

https://codereview.chromium.org/742733002/diff/20001/src/heap/spaces.h#newcod...
src/heap/spaces.h:939: FreeBlock emergency_block_;
Please add a comment that describes the concept of the emergency block.

[ulan, 2014-11-20 13:49:30]

Thanks, Erik and Hannes!

I tried RegExp and eval for generating code and ended up using eval, since it is
easier to control caching/flushing for it. The test is in patch set #3: it uses
a new flag --code-range-size, otherwise it would take long time to fill up
512MB. The test uncovered a bogus (I think) assert in verify evacuation:

#
# Fatal error in ../src/heap/mark-compact.cc, line 162
# CHECK(!MarkCompactCollector::IsOnEvacuationCandidate(object)) failed
#

==== C stack trace ===============================

 1: V8_Fatal
 2: v8::internal::VerifyEvacuationVisitor::VisitPointers(v8::internal::Object**,
v8::internal::Object**)
 3: v8::internal::ObjectVisitor::VisitPointer(v8::internal::Object**)
 4: v8::internal::ObjectVisitor::VisitCodeTarget(v8::internal::RelocInfo*)
 5: v8::internal::RelocInfo::Visit(v8::internal::Isolate*,
v8::internal::ObjectVisitor*)
 6: v8::internal::Code::CodeIterateBody(v8::internal::ObjectVisitor*)
 7: v8::internal::HeapObject::IterateBody(v8::internal::InstanceType, int,
v8::internal::ObjectVisitor*)
 8: v8::internal::HeapObject::Iterate(v8::internal::ObjectVisitor*)
 9: ??
10: ??
11: ??
12: v8::internal::MarkCompactCollector::EnsureSweepingCompleted()
13: v8::internal::PagedSpace::WaitForSweeperThreadsAndRetryAllocation(int)
14: v8::internal::PagedSpace::SlowAllocateRaw(int)
15: v8::internal::PagedSpace::AllocateRaw(int)
16:
v8::internal::MarkCompactCollector::EvacuateLiveObjectsFromPage(v8::internal::Page*)
17: v8::internal::MarkCompactCollector::EvacuatePages()
18: v8::internal::MarkCompactCollector::EvacuateNewSpaceAndCandidates()
19: v8::internal::MarkCompactCollector::SweepSpaces()
20: v8::internal::MarkCompactCollector::CollectGarbage()
21: v8::internal::Heap::MarkCompact()

I am going to land this without the test since I want to get coverage as soon as
possible and merge back to M39. I'll land the test after fixing the assert.

https://codereview.chromium.org/742733002/diff/20001/src/heap/heap.cc
File src/heap/heap.cc (right):

https://codereview.chromium.org/742733002/diff/20001/src/heap/heap.cc#newcode...
src/heap/heap.cc:5265: isolate_->code_range()->ReserveEmergencyBlock();
On 2014/11/20 08:00:37, Hannes Payer wrote:
> Can we do that after setting up code_range?

Done.

https://codereview.chromium.org/742733002/diff/20001/src/heap/spaces.h
File src/heap/spaces.h (right):

https://codereview.chromium.org/742733002/diff/20001/src/heap/spaces.h#newcod...
src/heap/spaces.h:939: FreeBlock emergency_block_;
On 2014/11/20 08:00:37, Hannes Payer wrote:
> Please add a comment that describes the concept of the emergency block.

Done.

[ulan, 2014-11-20 14:06:24]

The CQ bit was checked by ulan@chromium.org

[commit-bot: I haz the power, 2014-11-20 14:07:05]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/742733002/80001

[commit-bot: I haz the power, 2014-11-20 14:52:36]

Committed patchset #5 (id:80001)