Integrate DiscardableMemory using MADV_FREE with renderer

Generalize usage of discardable memory in the renderer process to use
higher-level discardable memory primitives (DiscardableMemoryAllocator
and DiscardableMemory).

Implement a factory method to create a discardable memory allocator
implementation in renderer context depending on platform support.

Note that usage of MADV_FREE DiscardableMemory is gated by a feature
flag. Discardable memory should behave exactly as before this
change if the feature flag is not enabled.

Binary-Size: Unused ForTest method not being removed by linker
Bug: 1014513
Change-Id: I94afd2347a6ecbe254cd2d1a3ad667a6624293ac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1850758
Commit-Queue: Gordon Guan <gordonguan@google.com>
Reviewed-by: Peng Huang <penghuang@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Benoit L <lizeb@chromium.org>
Reviewed-by: Egor Pasko <pasko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713010}

base/memory/discardable_memory_allocator.h

@@ -42,6 +42,10 @@ class BASE_EXPORT DiscardableMemoryAllocator {
   // been discarded.
   virtual size_t GetBytesAllocated() const = 0;
 
+  // Release any memory used in the implementation of discardable memory that is
+  // not immediately being used.
+  virtual void ReleaseFreeMemory() = 0;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(DiscardableMemoryAllocator);
 };

base/memory/madv_free_discardable_memory_allocator_posix.h

@@ -32,6 +32,11 @@ class BASE_EXPORT MadvFreeDiscardableMemoryAllocatorPosix
 
   size_t GetBytesAllocated() const override;
 
+  void ReleaseFreeMemory() override {
+    // Do nothing, since MADV_FREE discardable memory does not keep any memory
+    // overhead that can be released.
+  }
+
  private:
   std::atomic<size_t> bytes_allocated_{0};
 

base/test/test_discardable_memory_allocator.h

@@ -25,6 +25,10 @@ class TestDiscardableMemoryAllocator : public DiscardableMemoryAllocator {
 
   size_t GetBytesAllocated() const override;
 
+  void ReleaseFreeMemory() override {
+    // Do nothing since it is backed by heap memory.
+  }
+
  private:
   DISALLOW_COPY_AND_ASSIGN(TestDiscardableMemoryAllocator);
 };

components/discardable_memory/client/client_discardable_shared_memory_manager.h

@@ -46,7 +46,7 @@ class DISCARDABLE_MEMORY_EXPORT ClientDiscardableSharedMemoryManager
                     base::trace_event::ProcessMemoryDump* pmd) override;
 
   // Release memory and associated resources that have been purged.
-  void ReleaseFreeMemory();
+  void ReleaseFreeMemory() override;
 
   bool LockSpan(DiscardableSharedMemoryHeap::Span* span);
   void UnlockSpan(DiscardableSharedMemoryHeap::Span* span);

components/discardable_memory/service/discardable_shared_memory_manager.h

@@ -95,6 +95,10 @@ class DISCARDABLE_MEMORY_EXPORT DiscardableSharedMemoryManager
   // Returns bytes of allocated discardable memory.
   size_t GetBytesAllocated() const override;
 
+  void ReleaseFreeMemory() override {
+    // Do nothing since we already subscribe to memory pressure notifications.
+  }
+
  private:
   class MemorySegment : public base::RefCountedThreadSafe<MemorySegment> {
    public:

content/renderer/BUILD.gn

@@ -66,6 +66,8 @@ target(link_target_type, "renderer") {
     "context_menu_params_builder.h",
     "crash_helpers.cc",
     "crash_helpers.h",
+    "discardable_memory_utils.cc",
+    "discardable_memory_utils.h",
     "dom_automation_controller.cc",
     "dom_automation_controller.h",
     "drop_data_builder.cc",
@@ -438,6 +440,7 @@ target(link_target_type, "renderer") {
 
     deps += [
       "//third_party/android_ndk:cpu_features",
+      "//third_party/ashmem",
       "//third_party/libphonenumber",
     ]
   } else {

content/renderer/discardable_memory_utils.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <utility>
+
+#include "base/command_line.h"
+#include "content/child/child_process.h"
+#include "content/child/child_thread_impl.h"
+#include "content/public/common/content_switches.h"
+#include "content/renderer/discardable_memory_utils.h"
+
+#if defined(OS_POSIX)
+#include <sys/mman.h>
+#include <sys/utsname.h>
+
+#include "base/memory/madv_free_discardable_memory_allocator_posix.h"
+#include "base/memory/madv_free_discardable_memory_posix.h"
+#endif
+
+#if defined(OS_ANDROID)
+#include <third_party/ashmem/ashmem.h>
+#endif
+
+namespace content {
+
+static const base::Feature kMadvFreeDiscardableMemoryFeature{
+    "MadvFreeDiscardableMemory", base::FEATURE_DISABLED_BY_DEFAULT};
+
+namespace {
+DiscardableMemoryBacking GetPlatformDiscardableMemoryBacking() {
+#if defined(OS_ANDROID)
+  if (ashmem_device_is_supported())
+    return DiscardableMemoryBacking::kSharedMemory;
+#endif
+
+  bool madv_free_supported = false;
+#if defined(OS_POSIX)
+  madv_free_supported =
+      base::GetMadvFreeSupport() == base::MadvFreeSupport::kSupported;
+#endif
+
+  if (base::FeatureList::IsEnabled(kMadvFreeDiscardableMemoryFeature) &&
+      madv_free_supported) {
+    return DiscardableMemoryBacking::kMadvFree;
+  }
+  return DiscardableMemoryBacking::kSharedMemory;
+}
+}  // namespace
+
+DiscardableMemoryBacking GetDiscardableMemoryBacking() {
+  static DiscardableMemoryBacking backing =
+      GetPlatformDiscardableMemoryBacking();
+  return backing;
+}
+
+std::unique_ptr<base::DiscardableMemoryAllocator>
+CreateDiscardableMemoryAllocator() {
+  if (GetDiscardableMemoryBacking() == DiscardableMemoryBacking::kMadvFree) {
+#if defined(OS_POSIX)
+    DVLOG(1) << "Using MADV_FREE for discardable memory";
+    return std::make_unique<base::MadvFreeDiscardableMemoryAllocatorPosix>();
+#endif
+  }
+  DVLOG(1) << "Using shared memory for discardable memory";
+
+  mojo::PendingRemote<discardable_memory::mojom::DiscardableSharedMemoryManager>
+      manager_remote;
+  ChildThread::Get()->BindHostReceiver(
+      manager_remote.InitWithNewPipeAndPassReceiver());
+  return std::make_unique<
+      discardable_memory::ClientDiscardableSharedMemoryManager>(
+      std::move(manager_remote), ChildProcess::current()->io_task_runner());
+}
+
+}  // namespace content

content/renderer/discardable_memory_utils.h

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_DISCARDABLE_MEMORY_UTILS_H_
+#define CONTENT_RENDERER_DISCARDABLE_MEMORY_UTILS_H_
+
+#include <stddef.h>
+
+#include <memory>
+
+#include "base/feature_list.h"
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/memory/discardable_memory.h"
+#include "base/memory/discardable_memory_allocator.h"
+#include "base/memory/madv_free_discardable_memory_posix.h"
+#include "base/memory/ref_counted.h"
+#include "base/synchronization/lock.h"
+#include "build/build_config.h"
+#include "components/discardable_memory/client/client_discardable_shared_memory_manager.h"
+#include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/thread_safe_interface_ptr.h"
+
+namespace content {
+enum class DiscardableMemoryBacking { kSharedMemory, kMadvFree };
+
+CONTENT_EXPORT DiscardableMemoryBacking GetDiscardableMemoryBacking();
+
+CONTENT_EXPORT std::unique_ptr<base::DiscardableMemoryAllocator>
+CreateDiscardableMemoryAllocator();
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_DISCARDABLE_MEMORY_UTILS_H_

content/renderer/render_thread_impl.cc

@@ -940,20 +940,13 @@ void RenderThreadImpl::Init() {
 #endif
   categorized_worker_pool_->Start(num_raster_threads);
 
-  mojo::PendingRemote<discardable_memory::mojom::DiscardableSharedMemoryManager>
-      manager_remote;
-  ChildThread::Get()->BindHostReceiver(
-      manager_remote.InitWithNewPipeAndPassReceiver());
-
-  discardable_shared_memory_manager_ = std::make_unique<
-      discardable_memory::ClientDiscardableSharedMemoryManager>(
-      std::move(manager_remote), GetIOTaskRunner());
+  discardable_memory_allocator_ = CreateDiscardableMemoryAllocator();
 
   // TODO(boliu): In single process, browser main loop should set up the
   // discardable memory manager, and should skip this if kSingleProcess.
   // See crbug.com/503724.
   base::DiscardableMemoryAllocator::SetInstance(
-      discardable_shared_memory_manager_.get());
+      discardable_memory_allocator_.get());
 
 #if defined(OS_LINUX)
   if (base::FeatureList::IsEnabled(
@@ -1692,8 +1685,7 @@ bool RenderThreadImpl::GetRendererMemoryMetrics(
   size_t malloc_usage = metric->GetMallocUsage();
   memory_metrics->malloc_mb = malloc_usage / 1024 / 1024;
 
-  size_t discardable_usage =
-      discardable_shared_memory_manager_->GetBytesAllocated();
+  size_t discardable_usage = discardable_memory_allocator_->GetBytesAllocated();
   memory_metrics->discardable_kb = discardable_usage / 1024;
 
   size_t v8_usage = 0;
@@ -2368,7 +2360,7 @@ void RenderThreadImpl::OnRendererForegrounded() {
 
 void RenderThreadImpl::ReleaseFreeMemory() {
   base::allocator::ReleaseFreeMemory();
-  discardable_shared_memory_manager_->ReleaseFreeMemory();
+  discardable_memory_allocator_->ReleaseFreeMemory();
 
   // Do not call into blink if it is not initialized.
   if (blink_platform_impl_) {

content/renderer/render_thread_impl.h

@@ -17,6 +17,7 @@
 
 #include "base/cancelable_callback.h"
 #include "base/macros.h"
+#include "base/memory/discardable_memory_allocator.h"
 #include "base/memory/memory_pressure_listener.h"
 #include "base/memory/ref_counted.h"
 #include "base/metrics/user_metrics_action.h"
@@ -37,6 +38,7 @@
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/url_loader_throttle_provider.h"
 #include "content/renderer/compositor/compositor_dependencies.h"
+#include "content/renderer/discardable_memory_utils.h"
 #include "content/renderer/media/audio/audio_input_ipc_factory.h"
 #include "content/renderer/media/audio/audio_output_ipc_factory.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
@@ -78,10 +80,6 @@ namespace cc {
 class TaskGraphRunner;
 }
 
-namespace discardable_memory {
-class ClientDiscardableSharedMemoryManager;
-}
-
 namespace gpu {
 class GpuChannelHost;
 }
@@ -257,9 +255,9 @@ class CONTENT_EXPORT RenderThreadImpl
   bool web_test_mode() const { return web_test_mode_; }
   void enable_web_test_mode() { web_test_mode_ = true; }
 
-  discardable_memory::ClientDiscardableSharedMemoryManager*
-  GetDiscardableSharedMemoryManagerForTest() {
-    return discardable_shared_memory_manager_.get();
+  base::DiscardableMemoryAllocator* GetDiscardableMemoryAllocatorForTest()
+      const {
+    return discardable_memory_allocator_.get();
   }
 
   RendererBlinkPlatformImpl* blink_platform_impl() const {
@@ -538,8 +536,8 @@ class CONTENT_EXPORT RenderThreadImpl
   void OnRendererInterfaceReceiver(
       mojo::PendingAssociatedReceiver<mojom::Renderer> receiver);
 
-  std::unique_ptr<discardable_memory::ClientDiscardableSharedMemoryManager>
-      discardable_shared_memory_manager_;
+  std::unique_ptr<base::DiscardableMemoryAllocator>
+      discardable_memory_allocator_;
 
   // These objects live solely on the render thread.
   std::unique_ptr<blink::scheduler::WebThreadScheduler> main_thread_scheduler_;

content/renderer/render_thread_impl_discardable_memory_browsertest.cc

@@ -14,6 +14,9 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/memory/discardable_memory.h"
+#include "base/memory/discardable_memory_allocator.h"
+#include "base/memory/madv_free_discardable_memory_allocator_posix.h"
+#include "base/memory/madv_free_discardable_memory_posix.h"
 #include "base/memory/memory_pressure_listener.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
@@ -23,6 +26,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
+#include "content/renderer/discardable_memory_utils.h"
 #include "content/shell/browser/shell.h"
 #include "gpu/ipc/common/gpu_memory_buffer_impl.h"
 #include "ui/gfx/buffer_format_util.h"
@@ -34,7 +38,7 @@ namespace {
 class RenderThreadImplDiscardableMemoryBrowserTest : public ContentBrowserTest {
  public:
   RenderThreadImplDiscardableMemoryBrowserTest()
-      : child_discardable_shared_memory_manager_(nullptr) {}
+      : discardable_memory_allocator_(nullptr) {}
 
   // Overridden from BrowserTestBase:
   void SetUpCommandLine(base::CommandLine* command_line) override {
@@ -48,19 +52,17 @@ class RenderThreadImplDiscardableMemoryBrowserTest : public ContentBrowserTest {
         base::Unretained(this)));
   }
 
-  discardable_memory::ClientDiscardableSharedMemoryManager*
-  child_discardable_shared_memory_manager() {
-    return child_discardable_shared_memory_manager_;
+  base::DiscardableMemoryAllocator* discardable_memory_allocator() {
+    return discardable_memory_allocator_;
   }
 
  private:
   void SetUpOnRenderThread() {
-    child_discardable_shared_memory_manager_ =
-        RenderThreadImpl::current()->GetDiscardableSharedMemoryManagerForTest();
+    discardable_memory_allocator_ =
+        RenderThreadImpl::current()->GetDiscardableMemoryAllocatorForTest();
   }
 
-  discardable_memory::ClientDiscardableSharedMemoryManager*
-      child_discardable_shared_memory_manager_;
+  base::DiscardableMemoryAllocator* discardable_memory_allocator_;
 };
 
 IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
@@ -68,8 +70,7 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
   const size_t kSize = 1024 * 1024;  // 1MiB.
 
   std::unique_ptr<base::DiscardableMemory> memory =
-      child_discardable_shared_memory_manager()
-          ->AllocateLockedDiscardableMemory(kSize);
+      discardable_memory_allocator()->AllocateLockedDiscardableMemory(kSize);
 
   ASSERT_TRUE(memory);
   void* addr = memory->data();
@@ -77,13 +78,17 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
 
   memory->Unlock();
 
-  // Purge all unlocked memory.
-  discardable_memory::DiscardableSharedMemoryManager::Get()->SetMemoryLimit(0);
+  // Simulate memory being discarded as if under memory pressure.
+  memory->DiscardForTesting();
 
   // Should fail as memory should have been purged.
   EXPECT_FALSE(memory->Lock());
 }
 
+// Ensure that address space mapped by allocating discardable memory is unmapped
+// after discarding under memory pressure, by creating and discarding a large
+// amount of discardable memory.
+//
 // Disable the test for the Android asan build.
 // See http://crbug.com/667837 for detail.
 #if !(defined(OS_ANDROID) && defined(ADDRESS_SANITIZER))
@@ -92,11 +97,21 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
   const size_t kLargeSize = 4 * 1024 * 1024;   // 4MiB.
   const size_t kNumberOfInstances = 1024 + 1;  // >4GiB total.
 
+  DiscardableMemoryBacking impl = GetDiscardableMemoryBacking();
+
+  // TODO(gordonguan): When MADV_FREE DiscardableMemory is discarded, the
+  // backing memory is freed, but remains mapped in memory. It is only
+  // unmapped when the object is destroyed, or on the next Lock() after
+  // discard. Therefore, an abundance of discarded but mapped discardable
+  // memory instances may cause an out-of-memory condition.
+  if (impl != DiscardableMemoryBacking::kSharedMemory)
+    return;
+
   std::vector<std::unique_ptr<base::DiscardableMemory>> instances;
   for (size_t i = 0; i < kNumberOfInstances; ++i) {
     std::unique_ptr<base::DiscardableMemory> memory =
-        child_discardable_shared_memory_manager()
-            ->AllocateLockedDiscardableMemory(kLargeSize);
+        discardable_memory_allocator()->AllocateLockedDiscardableMemory(
+            kLargeSize);
     ASSERT_TRUE(memory);
     void* addr = memory->data();
     ASSERT_NE(nullptr, addr);
@@ -110,18 +125,26 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
                        ReleaseFreeDiscardableMemory) {
   const size_t kSize = 1024 * 1024;  // 1MiB.
 
+  DiscardableMemoryBacking impl = GetDiscardableMemoryBacking();
+
   std::unique_ptr<base::DiscardableMemory> memory =
-      child_discardable_shared_memory_manager()
-          ->AllocateLockedDiscardableMemory(kSize);
+      discardable_memory_allocator()->AllocateLockedDiscardableMemory(kSize);
 
   EXPECT_TRUE(memory);
+  EXPECT_GE(discardable_memory_allocator()->GetBytesAllocated(), kSize);
   memory.reset();
 
+  EXPECT_EQ(discardable_memory_allocator()->GetBytesAllocated(), 0U);
+  if (impl != DiscardableMemoryBacking::kSharedMemory)
+    return;
+
   EXPECT_GE(discardable_memory::DiscardableSharedMemoryManager::Get()
                 ->GetBytesAllocated(),
             kSize);
 
-  child_discardable_shared_memory_manager()->ReleaseFreeMemory();
+  static_cast<discardable_memory::ClientDiscardableSharedMemoryManager*>(
+      discardable_memory_allocator())
+      ->ReleaseFreeMemory();
 
   // Busy wait for host memory usage to be reduced.
   base::TimeTicks end =
@@ -141,15 +164,12 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
   const size_t kSize = 1024 * 1024;  // 1MiB.
 
   std::unique_ptr<base::DiscardableMemory> memory =
-      child_discardable_shared_memory_manager()
-          ->AllocateLockedDiscardableMemory(kSize);
+      discardable_memory_allocator()->AllocateLockedDiscardableMemory(kSize);
 
   EXPECT_TRUE(memory);
   memory.reset();
 
-  EXPECT_GE(discardable_memory::DiscardableSharedMemoryManager::Get()
-                ->GetBytesAllocated(),
-            kSize);
+  EXPECT_GE(discardable_memory_allocator()->GetBytesAllocated(), kSize);
 
   // Call RenderThreadImpl::ReleaseFreeMemory through a fake memory pressure
   // notification.
@@ -158,8 +178,7 @@ IN_PROC_BROWSER_TEST_F(RenderThreadImplDiscardableMemoryBrowserTest,
   base::RunLoop().RunUntilIdle();
   RunAllTasksUntilIdle();
 
-  EXPECT_EQ(0U, discardable_memory::DiscardableSharedMemoryManager::Get()
-                    ->GetBytesAllocated());
+  EXPECT_EQ(0U, discardable_memory_allocator()->GetBytesAllocated());
 }
 
 }  // namespace