Bug 453432 - Checking for MaybeGC conditions when allocating GC things.

r=igor,mrbkap a191=blocker

dom/src/base/nsJSEnvironment.cpp

@@ -850,24 +850,8 @@ PrintWinCodebase(nsGlobalWindow *win)
 }
 #endif
 
-// The accumulated operation weight before we call MaybeGC
+// The accumulated operation weight for DOM callback.
-const PRUint32 MAYBE_GC_OPERATION_WEIGHT = 5000 * JS_OPERATION_WEIGHT_BASE;
+const PRUint32 DOM_CALLBACK_OPERATION_WEIGHT = 5000 * JS_OPERATION_WEIGHT_BASE;
-
-static void
-MaybeGC(JSContext *cx)
-{
-  size_t bytes = cx->runtime->gcBytes;
-  size_t lastBytes = cx->runtime->gcLastBytes;
-
-  if ((bytes > 8192 && bytes / 16 > lastBytes)
-#ifdef DEBUG
-      || cx->runtime->gcZeal > 0
-#endif
-      ) {
-    ++sGCCount;
-    JS_GC(cx);
-  }
-}
 
 static already_AddRefed<nsIPrompt>
 GetPromptFromContext(nsJSContext* ctx)
@@ -900,17 +884,8 @@ nsJSContext::DOMOperationCallback(JSContext *cx)
     return JS_TRUE;
   }
 
-  // XXX Save the operation callback time so we can restore it after the GC,
-  // because GCing can cause JS to run on our context, causing our
-  // ScriptEvaluated to be called, and clearing our operation callback time.
-  // See bug 302333.
   PRTime callbackTime = ctx->mOperationCallbackTime;
 
-  MaybeGC(cx);
-
-  // Now restore the callback time and count, in case they got reset.
-  ctx->mOperationCallbackTime = callbackTime;
-
   // Check to see if we are running OOM
   nsCOMPtr<nsIMemory> mem;
   NS_GetMemoryManager(getter_AddRefs(mem));
@@ -1238,7 +1213,7 @@ nsJSContext::nsJSContext(JSRuntime *aRuntime) : mGCOnDestruction(PR_TRUE)
                                          this);
 
     ::JS_SetOperationCallback(mContext, DOMOperationCallback,
-                              MAYBE_GC_OPERATION_WEIGHT);
+                              DOM_CALLBACK_OPERATION_WEIGHT);
 
     static JSLocaleCallbacks localeCallbacks =
       {
@@ -1251,7 +1226,6 @@ nsJSContext::nsJSContext(JSRuntime *aRuntime) : mGCOnDestruction(PR_TRUE)
     ::JS_SetLocaleCallbacks(mContext, &localeCallbacks);
   }
   mIsInitialized = PR_FALSE;
-  mNumEvaluations = 0;
   mTerminations = nsnull;
   mScriptsEnabled = PR_TRUE;
   mOperationCallbackTime = LL_ZERO;
@@ -3294,22 +3268,8 @@ nsJSContext::ScriptEvaluated(PRBool aTerminated)
     delete start;
   }
 
-  mNumEvaluations++;
-
-#ifdef JS_GC_ZEAL
-  if (mContext->runtime->gcZeal >= 2) {
-    MaybeGC(mContext);
-  } else
-#endif
-  if (mNumEvaluations > 20) {
-    mNumEvaluations = 0;
-    MaybeGC(mContext);
-  }
-
-  if (aTerminated) {
   mOperationCallbackTime = LL_ZERO;
 }
-}
 
 nsresult
 nsJSContext::SetTerminationFunction(nsScriptTerminationFunc aFunc,
@@ -3392,19 +3352,29 @@ nsJSContext::CC()
 #endif
   sPreviousCCTime = PR_Now();
   sDelayedCCollectCount = 0;
-  sGCCount = 0;
+  sGCCount = JS_GetGCParameter(nsJSRuntime::sRuntime, JSGC_NUMBER);
   sCCSuspectChanges = 0;
   // nsCycleCollector_collect() will run a ::JS_GC() indirectly, so
   // we do not explicitly call ::JS_GC() here.
   sCollectedObjectsCounts = nsCycleCollector_collect();
   sCCSuspectedCount = nsCycleCollector_suspectedCount();
 #ifdef DEBUG_smaug
-  printf("Collected %u objects, %u suspected objects, took %lldms\n",
+  printf("Collected %u objects, %u suspected objects\n",
-         sCollectedObjectsCounts, sCCSuspectedCount,
+         sCollectedObjectsCounts, sCCSuspectedCount);
-         (PR_Now() - sPreviousCCTime) / PR_USEC_PER_MSEC);
 #endif
 }
 
+static inline uint32
+GetGCRunsCount()
+{
+    /*
+     * The result value may overflow if sGCCount is close to the uint32
+     * maximum. It may cause additional invocations of the CC, which may
+     * reduce performance but cannot breach security.
+     */
+    return JS_GetGCParameter(nsJSRuntime::sRuntime, JSGC_NUMBER) - sGCCount;
+}
+
 //static
 PRBool
 nsJSContext::MaybeCC(PRBool aHigherProbability)
@@ -3413,7 +3383,7 @@ nsJSContext::MaybeCC(PRBool aHigherProbability)
 
   // Don't check suspected count if CC will be called anyway.
   if (sCCSuspectChanges <= NS_MIN_SUSPECT_CHANGES ||
-      sGCCount <= NS_MAX_GC_COUNT) {
+      GetGCRunsCount() <= NS_MAX_GC_COUNT) {
 #ifdef DEBUG_smaug
     PRTime now = PR_Now();
 #endif
@@ -3431,7 +3401,8 @@ nsJSContext::MaybeCC(PRBool aHigherProbability)
   }
 #ifdef DEBUG_smaug
   printf("sCCSuspectChanges %u, sGCCount %u\n",
-         sCCSuspectChanges, sGCCount);
+         sCCSuspectChanges,
+         GetGCRunsCount());
 #endif
 
   // Increase the probability also if the previous call to cycle collector
@@ -3444,7 +3415,7 @@ nsJSContext::MaybeCC(PRBool aHigherProbability)
   if (!sGCTimer &&
       (sDelayedCCollectCount > NS_MAX_DELAYED_CCOLLECT) &&
       ((sCCSuspectChanges > NS_MIN_SUSPECT_CHANGES &&
-        sGCCount > NS_MAX_GC_COUNT) ||
+        GetGCRunsCount() > NS_MAX_GC_COUNT) ||
        (sCCSuspectChanges > NS_MAX_SUSPECT_CHANGES))) {
     if ((PR_Now() - sPreviousCCTime) >=
         PRTime(NS_MIN_CC_INTERVAL * PR_USEC_PER_MSEC)) {

dom/src/base/nsJSEnvironment.h

@@ -220,7 +220,6 @@ private:
   void Unlink();
 
   JSContext *mContext;
-  PRUint32 mNumEvaluations;
 
 protected:
   struct TerminationFuncHolder;

js/src/js.cpp

@@ -186,14 +186,8 @@ my_BranchCallback(JSContext *cx, JSScript *script)
         return JS_FALSE;
     }
 #ifdef JS_THREADSAFE
-    if ((gBranchCount & 0xff) == 1) {
+    if ((gBranchCount & 0xff) == 1)
-#endif
-        if ((gBranchCount & 0x3fff) == 1)
-            JS_MaybeGC(cx);
-#ifdef JS_THREADSAFE
-        else
         JS_YieldRequest(cx);
-    }
 #endif
     return JS_TRUE;
 }
@@ -866,24 +860,49 @@ GCParameter(JSContext *cx, uintN argc, jsval *vp)
         param = JSGC_MAX_BYTES;
     } else if (strcmp(paramName, "maxMallocBytes") == 0) {
         param = JSGC_MAX_MALLOC_BYTES;
+    } else if (strcmp(paramName, "gcStackpoolLifespan") == 0) {
+        param = JSGC_STACKPOOL_LIFESPAN;
+    } else if (strcmp(paramName, "gcBytes") == 0) {
+        param = JSGC_BYTES;
+    } else if (strcmp(paramName, "gcNumber") == 0) {
+        param = JSGC_NUMBER;
+    } else if (strcmp(paramName, "gcTriggerFactor") == 0) {
+        param = JSGC_TRIGGER_FACTOR;
     } else {
         JS_ReportError(cx,
-                       "the first argument argument must be either maxBytes "
+                       "the first argument argument must be maxBytes, "
-                       "or maxMallocBytes");
+                       "maxMallocBytes, gcStackpoolLifespan, gcBytes, "
+                       "gcNumber or gcTriggerFactor");
         return JS_FALSE;
     }
 
-    if (!JS_ValueToECMAUint32(cx, argc < 2 ? JSVAL_VOID : vp[3], &value))
+    if (argc == 1) {
+        value = JS_GetGCParameter(cx->runtime, param);
+        return JS_NewNumberValue(cx, value, &vp[0]);
+    }
+
+    if (param == JSGC_NUMBER ||
+        param == JSGC_BYTES) {
+        JS_ReportError(cx, "Attempt to change read-only parameter %s",
+                       paramName);
         return JS_FALSE;
-    if (value == 0) {
+    }
+
+    if (!JS_ValueToECMAUint32(cx, vp[3], &value)) {
         JS_ReportError(cx,
-                       "the second argument must be convertable to uint32 with "
+                       "the second argument must be convertable to uint32 "
-                       "non-zero value");
+                       "with non-zero value");
+        return JS_FALSE;
+    }
+    if (param == JSGC_TRIGGER_FACTOR && value < 100) {
+        JS_ReportError(cx,
+                       "the gcTriggerFactor value must be >= 100");
         return JS_FALSE;
     }
     JS_SetGCParameter(cx->runtime, param, value);
     *vp = JSVAL_VOID;
     return JS_TRUE;
+
 }
 
 #ifdef JS_GC_ZEAL

js/src/jsapi.cpp

@@ -2593,6 +2593,31 @@ JS_SetGCParameter(JSRuntime *rt, JSGCParamKey key, uint32 value)
       case JSGC_STACKPOOL_LIFESPAN:
         rt->gcEmptyArenaPoolLifespan = value;
         break;
+      default:
+        JS_ASSERT(key == JSGC_TRIGGER_FACTOR);
+        JS_ASSERT(value >= 100);
+        rt->gcTriggerFactor = value;
+        return;
+    }
+}
+
+JS_PUBLIC_API(uint32)
+JS_GetGCParameter(JSRuntime *rt, JSGCParamKey key)
+{
+    switch (key) {
+      case JSGC_MAX_BYTES:
+        return rt->gcMaxBytes;
+      case JSGC_MAX_MALLOC_BYTES:
+        return rt->gcMaxMallocBytes;
+      case JSGC_STACKPOOL_LIFESPAN:
+        return rt->gcEmptyArenaPoolLifespan;
+      case JSGC_TRIGGER_FACTOR:
+        return rt->gcTriggerFactor;
+      case JSGC_BYTES:
+        return rt->gcBytes;
+      default:
+        JS_ASSERT(key == JSGC_NUMBER);
+        return rt->gcNumber;
     }
 }
 

js/src/jsapi.h

@@ -1134,12 +1134,31 @@ typedef enum JSGCParamKey {
     JSGC_MAX_MALLOC_BYTES   = 1,
 
     /* Hoard stackPools for this long, in ms, default is 30 seconds. */
-    JSGC_STACKPOOL_LIFESPAN = 2
+    JSGC_STACKPOOL_LIFESPAN = 2,
+
+    /*
+     * The factor that defines when the GC is invoked. The factor is a
+     * percent of the memory allocated by the GC after the last run of
+     * the GC. When the current memory allocated by the GC is more than
+     * this percent then the GC is invoked. The factor cannot be less
+     * than 100 since the current memory allocated by the GC cannot be less
+     * than the memory allocated after the last run of the GC.
+     */
+    JSGC_TRIGGER_FACTOR = 3,
+
+    /* Amount of bytes allocated by the GC. */
+    JSGC_BYTES = 4,
+
+    /* Number of times when GC was invoked. */
+    JSGC_NUMBER = 5
 } JSGCParamKey;
 
 extern JS_PUBLIC_API(void)
 JS_SetGCParameter(JSRuntime *rt, JSGCParamKey key, uint32 value);
 
+extern JS_PUBLIC_API(uint32)
+JS_GetGCParameter(JSRuntime *rt, JSGCParamKey key);
+
 /*
  * Add a finalizer for external strings created by JS_NewExternalString (see
  * below) using a type-code returned from this function, and that understands

js/src/jscntxt.h

@@ -253,6 +253,7 @@ struct JSRuntime {
     uint32              gcLevel;
     uint32              gcNumber;
     JSTracer            *gcMarkingTracer;
+    uint32              gcTriggerFactor;
 
     /*
      * NB: do not pack another flag here by claiming gcPadding unless the new

js/src/jsgc.cpp

@@ -1253,6 +1253,18 @@ js_InitGC(JSRuntime *rt, uint32 maxbytes)
     rt->gcMaxBytes = rt->gcMaxMallocBytes = maxbytes;
     rt->gcEmptyArenaPoolLifespan = 30000;
 
+    /*
+     * By default the trigger factor gets maximum possible value. This
+     * means that GC will not be triggered by growth of GC memory (gcBytes).
+     */
+    rt->gcTriggerFactor = (uint32) -1;
+
+    /*
+     * The assigned value prevents GC from running when GC memory is too low
+     * (during JS engine start).
+     */
+    rt->gcLastBytes = 8192;
+
     METER(memset(&rt->gcStats, 0, sizeof rt->gcStats));
     return JS_TRUE;
 }
@@ -1757,6 +1769,17 @@ EnsureLocalFreeList(JSContext *cx)
 
 #endif
 
+static JS_INLINE JSBool
+IsGCThresholdReached(JSRuntime *rt)
+{
+    /*
+     * Since the initial value of the gcLastBytes parameter is not equal to
+     * zero (see the js_InitGC function) the return value is false when
+     * the gcBytes value is close to zero at the JS engine start.
+     */
+    return rt->gcBytes / rt->gcTriggerFactor >= rt->gcLastBytes / 100;
+}
+
 void *
 js_NewGCThing(JSContext *cx, uintN flags, size_t nbytes)
 {
@@ -1823,7 +1846,8 @@ js_NewGCThing(JSContext *cx, uintN flags, size_t nbytes)
         return NULL;
     }
 
-    doGC = (rt->gcMallocBytes >= rt->gcMaxMallocBytes && rt->gcPoke);
+    doGC = (rt->gcMallocBytes >= rt->gcMaxMallocBytes && rt->gcPoke) ||
+           IsGCThresholdReached(rt);
 #ifdef JS_GC_ZEAL
     doGC = doGC || rt->gcZeal >= 2 || (rt->gcZeal >= 1 && rt->gcPoke);
 #endif
@@ -2033,9 +2057,10 @@ RefillDoubleFreeList(JSContext *cx)
         return NULL;
     }
 
-    if (rt->gcMallocBytes >= rt->gcMaxMallocBytes && rt->gcPoke
+    if ((rt->gcMallocBytes >= rt->gcMaxMallocBytes && rt->gcPoke) ||
+        IsGCThresholdReached(rt)
 #ifdef JS_GC_ZEAL
-        && (rt->gcZeal >= 2 || (rt->gcZeal >= 1 && rt->gcPoke))
+        || (rt->gcZeal >= 2 || (rt->gcZeal >= 1 && rt->gcPoke))
 #endif
         ) {
         goto do_gc;
@@ -2207,7 +2232,8 @@ js_AddAsGCBytes(JSContext *cx, size_t sz)
 
     rt = cx->runtime;
     if (rt->gcBytes >= rt->gcMaxBytes ||
-        sz > (size_t) (rt->gcMaxBytes - rt->gcBytes)
+        sz > (size_t) (rt->gcMaxBytes - rt->gcBytes) ||
+        IsGCThresholdReached(rt)
 #ifdef JS_GC_ZEAL
         || rt->gcZeal >= 2 || (rt->gcZeal >= 1 && rt->gcPoke)
 #endif

js/src/xpconnect/src/xpcjsruntime.cpp

@@ -1084,6 +1084,9 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
         JS_SetContextCallback(mJSRuntime, ContextCallback);
         JS_SetGCCallbackRT(mJSRuntime, GCCallback);
         JS_SetExtraGCRoots(mJSRuntime, TraceJS, this);
+
+        // GC will be called when gcBytes is 1600% of gcLastBytes.
+        JS_SetGCParameter(mJSRuntime, JSGC_TRIGGER_FACTOR, 1600);
     }
 
     if(!JS_DHashTableInit(&mJSHolders, JS_DHashGetStubOps(), nsnull,