New issue
Advanced search Search tips

Issue 912764 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocked on:
issue v8:8689

Blocking:
issue 909723



Sign in to add a comment

Large WASM memory causes OOM on page reload

Project Member Reported by kainino@chromium.org, Dec 6

Issue description

Chrome Version: 70.0.3538.110 or 72.0.3626.7 (64-bit)
OS: Any (tried this repro on Linux)

What steps will reproduce the problem?
(1) Download repro case, run it in Chrome.
(2) Reload.

What is the expected result?
Page reloads.

What happens instead?
Renderer process crashes (OOM).
crash/5ac193068158b737

The attached program is trivial. However, it is built with -s TOTAL_MEMORY=2047MB.

This also happens reliably with more complex applications (UE4) when allocating significantly less total memory (512MB). This is probably because of other memory resources (images, audio, buffers, WebGL resources in particular) being allocated as well.

It kind of seems like the page's memory is not cleaned up before the reloaded page's WASM memory tries to allocate.
 
wasm-large-memory-reload-oom.zip
86.9 KB Download
Owner: herhut@chromium.org
Status: Assigned (was: Untriaged)
This is likely a dup of issue 909723, but the included test case might make it easier to debug.
Cc: herhut@chromium.org
Owner: clemensh@chromium.org
When looking at this bug, I noticed that there are a couple of global handles that hold on to state long enough to make page refreshed go out of memory. Some are devtools related but one instance where the wasm implementation is at fault is the handle to the imports of a module.

The imports object also contains a reference to the webassembly memory object (the default in generated emscripten code). Hence, keeping the module_import alive will also keep the memory alive. It now seems that on a page refresh, the handle in AsyncInstantiateCompileResultResolver is alive long enough that it blocks the allocation of the new memory and the page goes OOM.

Assigning to Clemens, as he is currently refactoring that area.
Blocking: 909723
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 11

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/148039e6a10f63739b12832235d5075ea72d23f0

commit 148039e6a10f63739b12832235d5075ea72d23f0
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Dec 11 18:06:23 2018

[wasm] Reset callbacks after last event

Callbacks can keep embedder objects alive, hence clear them after
delivering the final event.

R=ahaas@chromium.org

Bug: chromium:912764
Change-Id: I9ac739bbce32cb1026991610e0720210717c333e
Reviewed-on: https://chromium-review.googlesource.com/c/1371565
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58168}
[modify] https://crrev.com/148039e6a10f63739b12832235d5075ea72d23f0/src/wasm/compilation-environment.h
[modify] https://crrev.com/148039e6a10f63739b12832235d5075ea72d23f0/src/wasm/module-compiler.cc

Cc: -herhut@chromium.org clemensh@chromium.org
Owner: herhut@chromium.org
#5 fixes some retaining paths via callbacks. We still run OOM though.
Back to Stephan to look at the other paths.
Cc: herhut@chromium.org
Owner: clemensh@chromium.org
I just saw that we still keep the CompilationResultResolver alive as long as the AsyncCompileJob lives. We should fix that.
Taking the bug back for now :)

Comment 8 by clemensh@chromium.org, Jan 16 (6 days ago)

Blockedon: v8:8689

Sign in to add a comment