Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a9c5f5b57b1740de140d8528c98ee8186e024dd8
https://github.com/WebKit/WebKit/commit/a9c5f5b57b1740de140d8528c98ee8186e024dd8
Author: Dan Hecht <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
M Source/bmalloc/libpas/src/test/IsoHeapChaosTests.cpp
Log Message:
-----------
[libpas] Check zeroed and large allocations in IsoHeapChaosTests
https://bugs.webkit.org/show_bug.cgi?id=319861
rdar://182760919
Reviewed by Marcus Plutowski and Yusuke Suzuki.
testAllocationChaos stamped every object immediately and kept sizes under 1 MB,
so
it never verified that a zeroed allocation came back zero and never reached the
large-heap VA-zeroing path. Extend it to cover both, and to catch a double
handout
onto a large object:
- Route about one in four common-primitive allocations through the zeroed API
and
verify the buffer reads back zero before stamping it, catching a reused region
handed back non-zero. Wired for the iso and bmalloc scopes.
- Inject a rare fraction of those allocations into [1 MB, 16 MB] (threshold from
PAS_VA_BASED_ZERO_MEMORY_SHIFT) to exercise the VA zeroing path concurrently.
Large objects are sampled -- a leading-word stamp and a whole-page zero scan
over
a bounded, seed-rotated, shuffled set of pages, faulted out of order -- since
touching every byte over millions of actions is infeasible; smaller objects
keep
the full-buffer path.
- Add a frequent-scavenging variant of the bmalloc scope so decommit races
alloc/free and large regions are re-zeroed on reuse, and yield before a random
subset of a large region's page faults so they can first-fault on different
cores.
- Track live large [base, size) ranges and CHECK that no allocation overlaps
one.
The stamp catches overlap onto small objects (stamped in full) but not large
ones
(only sampled); tracking just large ranges keeps this check free.
* Source/bmalloc/libpas/src/test/IsoHeapChaosTests.cpp:
(std::seededShuffle):
(std::sampledPageOffsets):
(std::forEachStampRange):
(std::forEachZeroCheckRange):
(std::testAllocationChaos):
(std::addIsoTests):
(std::addAllTests):
Canonical link: https://commits.webkit.org/317624@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
