In Bug 1472062 we're seeing OOMs during evicting the nursery. We might be able to avoid this if we: + We stop collecting the nursery when this happens. + We _do_ handle updating the pointers for the evicted objects, but this also now includes pointers _in_ the nursery to evicted objects. + We probably cannot recover memory from the nursery yet. AFAIK there are still live objects on every chunk. + We _do_ trace through the rest of the nursery, but now without eviction, we do this to mark objects in the tenured heap. + We proceeded to collect the tenured heap. It must be non-incremental and must not do compaction. + ONce that completes, and sweeping recovers some memory. We can proceed with evicting the nursery. and potentially compact the tenured heap after that (since memory usage is dire, we should do this soon, but doesn't have to happen in this collection). This is porbably not worthwhile (by developer time) but we could come back to it if that changes.

Signature report for OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> Showing results from 7 days ago Windows 7 394 66.2% Windows 10 146 24.5% Windows 8.1 47 7.9% Windows 8 8 1.3% Firefox 62.0b16 384 64.5% 252 Firefox 60.1.0esr 43 7.2% 34 Firefox 60.0.2 38 6.4% 27 Firefox 62.0b15 28 4.7% 22 Firefox 60.0.1 19 3.2% 12 Firefox 60.0.2esr 15 2.5% 14 Firefox 58.0.2 12 2.0% 11 Firefox 60.0esr 7 1.2% 8 Architecture x86 595 100.0% Signature report for OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::gc::AllocateCellInGC Showing results from 7 days ago Windows 10 28 48.3% Windows 7 26 44.8% Windows 8.1 3 5.2% Windows 8 1 1.7% Firefox 63.0a1 58 100.0% 44 Architecture amd64 31 53.4% x86 27 46.6%

Top Crashers for Firefox 60.0.2 31 0.35% 0.01% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> 10 10 0 0 9 0 2017-10-18 Top Crashers for Firefox 63.0a1 44 0.31% -0.11% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::gc::AllocateCellInGC 11 11 0 0 10 0 2018-07-07 Top Crashers for Firefox 60.0.1 45 0.28% 0.1% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> 4 4 0 0 4 0 2017-10-18 Top Crashers for Firefox 62.0b15 70 0.2% -0.01% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> 3 3 0 0 3 0 2017-10-18 Top Crashers for Firefox 62.0b16 75 0.17% 0.16% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> 12 12 0 0 12 0 2017-10-18 Top Crashers for Firefox 60.1.0esr 109 0.14% -0.05% OOM | large | js::AutoEnterOOMUnsafeRegion::crash | js::AutoEnterOOMUnsafeRegion::crash | js::TenuringTracer::allocTenured<T> 5 5 0 0 5 0 2017-10-18 7 days ago.

Can we leave bug 1472062 as the bug for tracking OOM during nursery eviction? This bug is tracking an idea for a possible mitigation.

(In reply to Paul Bone [:pbone] from comment #0) Paul, how would this handle parts of the GC that expect minor GC to have completed first?

(In reply to Jon Coppeard (:jonco) from comment #4) > (In reply to Paul Bone [:pbone] from comment #0) > Paul, how would this handle parts of the GC that expect minor GC to have > completed first? I think right now the only really hard requirement is for compacting. Otherwise provided we mark tenured objects as we trace tne nursery (without moving the nursery objects) it'll be fine, also it's a non-incremental collection. When the collection is completed we can then evict the nursery and re-do a compacting collection. ..may need cooperation from the DOM/CC to ensure we can free as much stuff as possible (like the memory pressure event).