ITStudio_OUC/OxideJS
Archived
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Vm 增加 Drop 收尾释放全部 session 堆数据消除逐实例泄漏

Browse Source 
test262 每测试新建 Vm 直接 drop，此前对象堆数据/串/BigInt/cell 全部
泄漏。新增 teardown 收尾函数（epoch+session 对象堆数据、串、BigInt、
cell 统一释放）供 full_reset 与 Drop 共用。连带补齐 promote 分支的
ArrayBuffer 字节缓冲深拷贝（与 sweep 对齐，消除共享所有权 double-free），
并修正依赖旧泄漏行为跨 Vm 解析字符串的 error 测试。
This commit is contained in:
彭俊皓
2026-08-15 19:13:51 +08:00
parent d97d39e8ad
commit 12d1a85e44
6 changed files with 64 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/oxide_vm/src/session_arena.rs
+4 -1
View File
@@ -6,7 +6,7 @@ use oxide_types::value::JsValue;
use rustc_hash::FxBuildHasher;
use crate::vm::Vm;
use oxide_builtins::{data_view, map, set, typed_array};
use oxide_builtins::{array_buffer, data_view, map, set, typed_array};
impl Vm {
pub(crate) fn is_session_escape_root_ptr(&self, target_ptr: *mut JsObject) -> bool {
@@ -65,6 +65,9 @@ impl Vm {
data_view::clone_data_view_native_with_rewrite(src_ref, dst_ref, |value| {
self.promote_value_if_epoch_object(value, forwarding)
});
} else if src_ref.is_array_buffer_obj() {
// 字节缓冲深拷贝到新对象：源 Vec 随 epoch 释放，互不共享。
array_buffer::clone_array_buffer_native(src_ref, dst_ref);
} else if src_ref.is_generator_obj() {
// 生成器状态盒深拷贝到新对象：源盒随 epoch 释放，互不共享。
crate::generator::clone_generator_native_with_rewrite(src_ref, dst_ref, |value| {
crates/oxide_vm/src/session_gc.rs
+1 -4
View File
@@ -578,10 +578,7 @@ impl SessionGc {
live.clear();
Self::record_object_string_edges(&mut live, obj);
for s_ptr in live.drain() {
assert!(
self.live_strings.contains(&s_ptr),
"存活对象持有未登记的 session 字符串边"
);
assert!(self.live_strings.contains(&s_ptr), "存活对象持有未登记的 session 字符串边");
}
}
}
crates/oxide_vm/src/vm.rs
+8
View File
@@ -451,6 +451,14 @@ pub struct Vm {
pub(crate) cell_stack: Vec<Vec<*mut Cell>>,
}
impl Drop for Vm {
fn drop(&mut self) {
// 直接 drop（test262 每测试新建即弃）不经 reset/full_reset 路径：
// 统一收尾释放全部 session 堆数据，防逐测试累积泄漏。
self.teardown_session_heap_data();
}
}
impl Vm {
const SYNC_NATIVE_ARG_BASE: usize = 0;
const SYNC_NATIVE_ARG_LIMIT: usize = 253;
crates/oxide_vm/src/vm_support.rs
+26 -25
View File
@@ -299,32 +299,34 @@ impl Vm {
self.bytecode = Arc::default();
self.immutables_cache.clear();
self.active_immutables = std::ptr::slice_from_raw_parts(std::ptr::null(), 0);
self.free_epoch_object_heap_data();
self.teardown_session_heap_data();
self.epoch.reset();
self.gc_state.epoch_object_ptrs.clear();
// 先释放 session 对象堆数据（属性向量 + 各原生盒），再重置 arena：
// 原生盒在 GC 搬移/晋升时已深拷贝为单所有权，此处恰好释放一次。
let mut freed = 0u64;
for ptr in self.gc_state.session_object_ptrs.drain(..) {
freed += crate::session_gc::SessionGc::drop_object_heap_data(ptr, true);
}
if freed > 0 {
self.gc_state.session_gc.total_bytes_freed =
self.gc_state.session_gc.total_bytes_freed.saturating_add(freed);
self.gc_state.session_gc.last_collection_bytes_freed = freed;
}
self.gc_state.session_epoch.reset();
self.gc_state.session_bytes_allocated = 0;
self.gc_state.string_gc_watermark = self.kernel_core.config().session_gc_threshold;
self.gc_state.session_gc = crate::session_gc::SessionGc::new();
self.free_session_string_heap_data();
self.free_session_bigint_heap_data();
self.gc_state.free_cells();
self.symbols.reset();
self.root_reg_limit = 0;
self.active_reg_limit = 0;
}
/// 释放全部 session 堆数据：epoch 对象堆数据 + session 对象堆数据 + session 串 +
/// BigInt box + upvalue cell box。
///
/// 供 `full_reset` 与 `Drop` 共用——对象本体（bumpalo arena / epoch bump）由调用方
/// 重置，本函数只释放手工管理的 Box 指针（属性向量、各原生盒、串、BigInt、cell）。
/// 原生盒在 GC 搬移/晋升时已深拷贝为单所有权，此处恰好释放一次。
pub(crate) fn teardown_session_heap_data(&mut self) {
self.free_epoch_object_heap_data();
for ptr in self.gc_state.session_object_ptrs.drain(..) {
crate::session_gc::SessionGc::drop_object_heap_data(ptr, true);
}
self.free_session_string_heap_data();
self.free_session_bigint_heap_data();
self.gc_state.free_cells();
}
fn free_epoch_object_heap_data(&mut self) {
let mut freed = 0u64;
for ptr in self.gc_state.epoch_object_ptrs.drain(..) {
@@ -682,11 +684,14 @@ mod tests {
match vm.resume_generator(gen, crate::generator::GeneratorResumeMode::Next(JsValue::undefined())) {
Ok(crate::generator::GeneratorStep::Suspended { value }) => value,
Ok(crate::generator::GeneratorStep::Completed { value }) => value,
Ok(other) => panic!("unexpected step: {:?}", match other {
crate::generator::GeneratorStep::Thrown { value } => format!("Thrown({value})"),
crate::generator::GeneratorStep::SuspendedRaw { value } => format!("SuspendedRaw({value})"),
_ => String::new(),
}),
Ok(other) => panic!(
"unexpected step: {:?}",
match other {
crate::generator::GeneratorStep::Thrown { value } => format!("Thrown({value})"),
crate::generator::GeneratorStep::SuspendedRaw { value } => format!("SuspendedRaw({value})"),
_ => String::new(),
}
),
Err(e) => panic!("resume failed: {e}"),
}
}
@@ -694,10 +699,7 @@ mod tests {
#[test]
fn generator_survives_object_sweep_and_resumes() {
let mut vm = vm_with_low_threshold();
let _ = run_source(
&mut vm,
"function* g(){ yield 1; yield 2; } globalThis.it = g(); globalThis.it.next(); 0",
);
let _ = run_source(&mut vm, "function* g(){ yield 1; yield 2; } globalThis.it = g(); globalThis.it.next(); 0");
// 直接触发完整收集（保留执行上下文）：存活生成器克隆进新 arena，
// 状态盒深拷贝为新 Box（reset 会清空模块表使恢复不可行，走收集入口等价验证）。
@@ -1069,4 +1071,3 @@ mod tests {
assert_eq!(vm.lookup_str(te).as_deref(), Some("TypeError"));
}
}