PA: Support multiple ThreadCache instances per thread. [chromium/src : main]

0 views
Skip to first unread message

Ayumi Ono (Gerrit)

unread,
Dec 7, 2025, 9:04:00 PM (12 days ago) Dec 7
to Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org

Ayumi Ono added 3 comments

Patchset-level comments
File-level comment, Patchset 9 (Latest):
Ayumi Ono . resolved

PTAL.
Implemented Multiple ThreadCache support; remaining work includes additional testing and addressing 3 TODO comments about optimization, which will be addressed in subsequent CLs.

File base/allocator/partition_allocator/src/partition_alloc/extended_api.cc
Line 20, Patchset 7:// ThreadCaches at a differenct, preferably dedicated index and swap only when
Ayumi Ono . unresolved

I'll fix the typo later

File third_party/blink/renderer/platform/wtf/allocator/partitions.cc
Line 126, Patchset 7: options.thread_cache_index = 1;
Ayumi Ono . unresolved

This is for test purposes.
I'll revert this change after reviews.

Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 9
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Comment-Date: Mon, 08 Dec 2025 02:03:35 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Ayumi Ono (Gerrit)

unread,
Dec 7, 2025, 9:04:55 PM (12 days ago) Dec 7
to Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Mikihito Matsuura and Stephen Nusko

Ayumi Ono added 1 comment

Patchset-level comments
Open in Gerrit

Related details

Attention is currently required from:
  • Mikihito Matsuura
  • Stephen Nusko
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 9
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Stephen Nusko <nus...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Comment-Date: Mon, 08 Dec 2025 02:04:20 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Stephen Nusko (Gerrit)

unread,
Dec 8, 2025, 12:42:51 AM (12 days ago) Dec 8
to Ayumi Ono, Mikihito Matsuura, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Stephen Nusko added 6 comments

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc.cc
Line 113, Patchset 9 (Parent): PA_CHECK(opts.thread_cache == PartitionOptions::kDisabled)
Stephen Nusko . unresolved

Should there be a check to see if we've registered to MANY thread caches?

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 6387, Patchset 9 (Latest): ThreadCache::SwapForTesting(nullptr, another_thread_cache_index);
root1->settings.with_thread_cache = false;
Stephen Nusko . unresolved

Is this to properly clean up the test for destruction?

I think we should consider trying to move this into something automated.

For example root1 has `CreateCustomTestRoot` that returns a unique_ptr, we could either

1) make the PartitionRoot destructor handle it
2) Add a custom deletor to the unique_ptr that nulls out the thread cache when it goes out of scope.

File base/allocator/partition_allocator/src/partition_alloc/partition_root.h
Line 1833, Patchset 9 (Latest): // TODO(ayumiohno): Once `ThreadCache::largest_active_bucket_index_` becomes a
Stephen Nusko . unresolved

Can you file a bug (crbug/####) and put all the details there?

You can use component chromium > Blink > MemoryAllocator > Partition

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 250, Patchset 9 (Latest): static ThreadCache* Get(size_t index) {
Stephen Nusko . resolved

Should we provide a templated version of this?

`ThreadCache::Get<0>()` or is the schedulerloop the only user of explicit index anymore and long term doesn't make sense?

I guess looking through that only SchedulerLoopQuarantine and the extended_api for tests knows that it was <0>. Therefore probably not worth adding.

Line 81, Patchset 9 (Latest): PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
Line 133, Patchset 9 (Latest): tcache->AccumulateStats(stats);
Stephen Nusko . unresolved

Should this be updated to have some sort of index to track stats per thread cache?

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
  • Mikihito Matsuura
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 9
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Mon, 08 Dec 2025 05:42:18 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

chromeperf@appspot.gserviceaccount.com (Gerrit)

unread,
Dec 8, 2025, 2:22:09 AM (12 days ago) Dec 8
to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Message from chrom...@appspot.gserviceaccount.com

📍 Job mac-m1_mini_2020-perf/speedometer3 complete.

See results at: https://pinpoint-dot-chromeperf.appspot.com/job/13006667310000

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
  • Mikihito Matsuura
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 10
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Mon, 08 Dec 2025 07:21:58 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

chromeperf@appspot.gserviceaccount.com (Gerrit)

unread,
Dec 8, 2025, 3:45:04 AM (12 days ago) Dec 8
to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Message from chrom...@appspot.gserviceaccount.com

📍 Job mac-m1_mini_2020-perf/speedometer3 complete.

See results at: https://pinpoint-dot-chromeperf.appspot.com/job/17582db7310000

Gerrit-Comment-Date: Mon, 08 Dec 2025 08:44:52 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Mikihito Matsuura (Gerrit)

unread,
Dec 8, 2025, 5:47:12 AM (12 days ago) Dec 8
to Ayumi Ono, chrom...@appspot.gserviceaccount.com, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono

Mikihito Matsuura added 8 comments

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 6368, Patchset 9: const size_t another_thread_cache_index = 1;
Mikihito Matsuura . unresolved

nit: `constexpr`?

File base/allocator/partition_allocator/src/partition_alloc/partition_root.h
Line 302, Patchset 9: size_t thread_cache_index = 0;
Mikihito Matsuura . unresolved

ditto

Line 216, Patchset 9: size_t thread_cache_index = 0;
Mikihito Matsuura . unresolved

Put this near `thread_cache`?

File base/allocator/partition_allocator/src/partition_alloc/scheduler_loop_quarantine_support.cc
Line 13, Patchset 9: ThreadCache* tcache = ThreadCache::Get(0);
Mikihito Matsuura . unresolved

Can you explicitly create a constant for this, or create a function like `GetForQurantine`?

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

Mikihito Matsuura

But do we want bounds checking every time? This is fast path.

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
Line 487, Patchset 10 (Latest): tcaches = reinterpret_cast<ThreadCache*>(operator new(array_size));
Mikihito Matsuura . unresolved

Is this calling the `ThreadCache::operator new`? Or the global one?

Line 574, Patchset 10 (Latest): operator delete(tcaches);
Mikihito Matsuura . unresolved

ditto

Line 587, Patchset 10 (Latest): internal::g_thread_caches[internal::kThreadCacheTombstoneIndex]) =
Mikihito Matsuura . unresolved

Can you explain why setting this on `internal::kThreadCacheTombstoneIndex` is sufficient to mitigate the issue commented above?

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 10
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Mon, 08 Dec 2025 10:46:40 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Stephen Nusko <nus...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

Ayumi Ono (Gerrit)

unread,
Dec 8, 2025, 7:39:22 PM (11 days ago) Dec 8
to chrom...@appspot.gserviceaccount.com, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Mikihito Matsuura and Stephen Nusko

Ayumi Ono added 12 comments

Patchset-level comments
File-level comment, Patchset 11 (Latest):
Ayumi Ono . resolved

Not completely but addressed comments.

File base/allocator/partition_allocator/src/partition_alloc/extended_api.cc
Line 20, Patchset 7:// ThreadCaches at a differenct, preferably dedicated index and swap only when
Ayumi Ono . resolved

I'll fix the typo later

Ayumi Ono

Done

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc.cc
Line 113, Patchset 9 (Parent): PA_CHECK(opts.thread_cache == PartitionOptions::kDisabled)
Stephen Nusko . unresolved

Should there be a check to see if we've registered to MANY thread caches?

Ayumi Ono
I've added this check. This should be removed once multiple thread cache is in use.
```
PA_CHECK(opts.thread_cache_index == 0)
<< "Cannot use a non-default thread cache index.";
```
File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 6368, Patchset 9: const size_t another_thread_cache_index = 1;
Mikihito Matsuura . resolved

nit: `constexpr`?

Ayumi Ono

Done

Line 6387, Patchset 9: ThreadCache::SwapForTesting(nullptr, another_thread_cache_index);
root1->settings.with_thread_cache = false;
Stephen Nusko . unresolved

Is this to properly clean up the test for destruction?

I think we should consider trying to move this into something automated.

For example root1 has `CreateCustomTestRoot` that returns a unique_ptr, we could either

1) make the PartitionRoot destructor handle it
2) Add a custom deletor to the unique_ptr that nulls out the thread cache when it goes out of scope.

Ayumi Ono

Created `CreateCustomTestRootWithThreadCache`, which returns the unique_ptr with destructor that nulls out the thread cache.

File base/allocator/partition_allocator/src/partition_alloc/partition_root.h
Line 302, Patchset 9: size_t thread_cache_index = 0;
Mikihito Matsuura . resolved

ditto

Ayumi Ono

Done

Line 216, Patchset 9: size_t thread_cache_index = 0;
Mikihito Matsuura . resolved

Put this near `thread_cache`?

Ayumi Ono

Done

File base/allocator/partition_allocator/src/partition_alloc/scheduler_loop_quarantine_support.cc
Line 13, Patchset 9: ThreadCache* tcache = ThreadCache::Get(0);
Mikihito Matsuura . resolved

Can you explicitly create a constant for this, or create a function like `GetForQurantine`?

Ayumi Ono

Created `internal::kThreadCacheQuarantineIndex` in thread_cache.h

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

Mikihito Matsuura

But do we want bounds checking every time? This is fast path.

Ayumi Ono

By accessing the array with [] (not .at()), can we remove PA_UNSAFE_TODO while avoiding bounds checks?

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
Line 133, Patchset 9: tcache->AccumulateStats(stats);
Stephen Nusko . unresolved

Should this be updated to have some sort of index to track stats per thread cache?

Ayumi Ono

Thank you, I added index to the `DumpStats` arguments, and made it accumulate stats of the thread caches of the same root.

Line 487, Patchset 10: tcaches = reinterpret_cast<ThreadCache*>(operator new(array_size));
Mikihito Matsuura . unresolved

Is this calling the `ThreadCache::operator new`? Or the global one?

Ayumi Ono

It's calling the class-specific one. Should I create Alloc/Free functions and use them instead?

Line 587, Patchset 10: internal::g_thread_caches[internal::kThreadCacheTombstoneIndex]) =
Mikihito Matsuura . unresolved

Can you explain why setting this on `internal::kThreadCacheTombstoneIndex` is sufficient to mitigate the issue commented above?

Ayumi Ono

`PartitionRoot::MaybeInitThreadCache`, `ForceInitThreadCache`, and `EnableThreadCacheIfSupported` are the only place where `ThreadCache::Create` is called.

In `MaybeInitThreadCache` and `ForceInitThreadCache`, (which are called when newly allocating thread cache), `ThreadCache::IsTombstone()` check is always performed, and `IsTombstone` only sees the `internal::kThreadCacheTombstoneIndex`, so it's sufficient.

Regarding `EnableThreadCacheIfSupported`, I guess it's not called during thread/process teardown (and that's why `IsTombstone` does not exist), so I think it's okay.

Open in Gerrit

Related details

Attention is currently required from:
  • Mikihito Matsuura
  • Stephen Nusko
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 11
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Stephen Nusko <nus...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Comment-Date: Tue, 09 Dec 2025 00:38:47 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Stephen Nusko <nus...@chromium.org>
Comment-In-Reply-To: Mikihito Matsuura <mi...@google.com>
Comment-In-Reply-To: Ayumi Ono <ayum...@google.com>
satisfied_requirement
unsatisfied_requirement
open
diffy

chromeperf@appspot.gserviceaccount.com (Gerrit)

unread,
Dec 8, 2025, 10:00:44 PM (11 days ago) Dec 8
to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono, Mikihito Matsuura and Stephen Nusko

Message from chrom...@appspot.gserviceaccount.com

📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

See results at: https://pinpoint-dot-chromeperf.appspot.com/job/124999c0b10000

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
  • Mikihito Matsuura
  • Stephen Nusko
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Tue, 09 Dec 2025 03:00:31 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Stephen Nusko (Gerrit)

unread,
Dec 9, 2025, 12:50:12 AM (11 days ago) Dec 9
to Ayumi Ono, chrom...@appspot.gserviceaccount.com, Mikihito Matsuura, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Stephen Nusko added 6 comments

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc.cc
Line 113, Patchset 9 (Parent): PA_CHECK(opts.thread_cache == PartitionOptions::kDisabled)
Stephen Nusko . unresolved

Should there be a check to see if we've registered to MANY thread caches?

Ayumi Ono
I've added this check. This should be removed once multiple thread cache is in use.
```
PA_CHECK(opts.thread_cache_index == 0)
<< "Cannot use a non-default thread cache index.";
```
Stephen Nusko

Sorry what I meant is something like

`PA_CHECK(opts.thread_cache_index < internal::kMaxThreadCacheIndex);`

Obviously == 0 is fine for now as well

Though I also see you check it in partition_root so perhaps fine.

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 419, Patchset 11 (Latest): ThreadCache::SwapForTesting(nullptr, root->settings.thread_cache_index);
Stephen Nusko . unresolved

Can you add a comment about why this exists so it doesn't confuse future readers?

Line 6387, Patchset 9: ThreadCache::SwapForTesting(nullptr, another_thread_cache_index);
root1->settings.with_thread_cache = false;
Stephen Nusko . resolved

Is this to properly clean up the test for destruction?

I think we should consider trying to move this into something automated.

For example root1 has `CreateCustomTestRoot` that returns a unique_ptr, we could either

1) make the PartitionRoot destructor handle it
2) Add a custom deletor to the unique_ptr that nulls out the thread cache when it goes out of scope.

Ayumi Ono

Created `CreateCustomTestRootWithThreadCache`, which returns the unique_ptr with destructor that nulls out the thread cache.

Stephen Nusko

Thanks looks a lot cleaner!

Line 6402, Patchset 11 (Latest): root0->Free(ptr0);
root1->Free(ptr1);
Stephen Nusko . unresolved

Should we check that

1) the thread cache are different pointers
2) that they have the correct pointer in their free lists? I.E. root0's thread cache's freelist should have ptr0 and root1 should have ptr1?

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

Mikihito Matsuura

But do we want bounds checking every time? This is fast path.

Ayumi Ono

By accessing the array with [] (not .at()), can we remove PA_UNSAFE_TODO while avoiding bounds checks?

Stephen Nusko

In Chrome [] triggers bounds checking due to Chromium compiling with [libc++ hardening](https://libcxx.llvm.org/Hardening.html).

I suspect given this is a constexpr sized array, that most if not all of the bounds checks would be optimized away.

If we see bounds checks show up in our performance then of course we can opt-out (that is what PA_UNSAFE_TODO/PA_UNSAFE_BUFFERS macros are for), however in this case I suspect when accessing at `kThreadCacheQuarantineIndex` we'll have no bounds check, and for most of the roots especially if we assign it in a way that is clearly valid the checks will be optimized out, because the value never changes.

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
Line 133, Patchset 9: tcache->AccumulateStats(stats);
Stephen Nusko . resolved

Should this be updated to have some sort of index to track stats per thread cache?

Ayumi Ono

Thank you, I added index to the `DumpStats` arguments, and made it accumulate stats of the thread caches of the same root.

Stephen Nusko

Acknowledged

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
  • Mikihito Matsuura
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 11
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Tue, 09 Dec 2025 05:49:46 +0000
satisfied_requirement
unsatisfied_requirement
open
diffy

Stephen Nusko (Gerrit)

unread,
Dec 9, 2025, 12:51:44 AM (11 days ago) Dec 9
to Ayumi Ono, chrom...@appspot.gserviceaccount.com, Mikihito Matsuura, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Stephen Nusko added 1 comment

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

Mikihito Matsuura

But do we want bounds checking every time? This is fast path.

Ayumi Ono

By accessing the array with [] (not .at()), can we remove PA_UNSAFE_TODO while avoiding bounds checks?

Stephen Nusko

In Chrome [] triggers bounds checking due to Chromium compiling with [libc++ hardening](https://libcxx.llvm.org/Hardening.html).

I suspect given this is a constexpr sized array, that most if not all of the bounds checks would be optimized away.

If we see bounds checks show up in our performance then of course we can opt-out (that is what PA_UNSAFE_TODO/PA_UNSAFE_BUFFERS macros are for), however in this case I suspect when accessing at `kThreadCacheQuarantineIndex` we'll have no bounds check, and for most of the roots especially if we assign it in a way that is clearly valid the checks will be optimized out, because the value never changes.

Stephen Nusko

Oh and of course not mandating it, I defer to @mikt if there is a legit reason to suspect this is going to cause a large issue then of course keep it as a ThreadCache* but if benchmarks don't move we could just move it to std::array, we use std::array in plenty of locations already.

Gerrit-Comment-Date: Tue, 09 Dec 2025 05:51:14 +0000
satisfied_requirement
unsatisfied_requirement
open
diffy

chromeperf@appspot.gserviceaccount.com (Gerrit)

unread,
Dec 9, 2025, 2:26:00 AM (11 days ago) Dec 9
to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Message from chrom...@appspot.gserviceaccount.com

📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

See results at: https://pinpoint-dot-chromeperf.appspot.com/job/1737a4bb310000

Gerrit-Comment-Date: Tue, 09 Dec 2025 07:25:48 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Ayumi Ono (Gerrit)

unread,
Dec 9, 2025, 7:24:27 PM (10 days ago) Dec 9
to chrom...@appspot.gserviceaccount.com, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Mikihito Matsuura and Stephen Nusko

Ayumi Ono added 5 comments

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc.cc
Line 113, Patchset 9 (Parent): PA_CHECK(opts.thread_cache == PartitionOptions::kDisabled)
Stephen Nusko . unresolved

Should there be a check to see if we've registered to MANY thread caches?

Ayumi Ono
I've added this check. This should be removed once multiple thread cache is in use.
```
PA_CHECK(opts.thread_cache_index == 0)
<< "Cannot use a non-default thread cache index.";
```
Stephen Nusko

Sorry what I meant is something like

`PA_CHECK(opts.thread_cache_index < internal::kMaxThreadCacheIndex);`

Obviously == 0 is fine for now as well

Though I also see you check it in partition_root so perhaps fine.

Ayumi Ono

I see, I'll allow multiple thread cache from now, and I've fixed the checks to the following:
If the default partition uses thread cache and thus index 0 will be initialized in `EnableThreadCacheIfSupported`, I prohibit `opts.thread_cache_index == 0 && opts.thread_cache == PartitionOptions::kEnabled`.

Anyway, `thread_cache_index` should be less than `kMaxThreadCacheIndex`.
```
#if PA_BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
PA_CHECK(opts.thread_cache_index != 0 ||
opts.thread_cache == PartitionOptions::kDisabled)
<< "Cannot use a thread cache at default index when PartitionAlloc is "
"malloc().";
#endif
PA_CHECK(opts.thread_cache_index < internal::kMaxThreadCacheIndex)
<< "Thread cache index must be less than kMaxThreadCacheIndex";
```
File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 419, Patchset 11: ThreadCache::SwapForTesting(nullptr, root->settings.thread_cache_index);
Stephen Nusko . resolved

Can you add a comment about why this exists so it doesn't confuse future readers?

Ayumi Ono

Done

Line 6402, Patchset 11: root0->Free(ptr0);
root1->Free(ptr1);
Stephen Nusko . unresolved

Should we check that

1) the thread cache are different pointers
2) that they have the correct pointer in their free lists? I.E. root0's thread cache's freelist should have ptr0 and root1 should have ptr1?

Ayumi Ono

Thank you, they looks good to ensure the behavior of PartitionRoot and ThreadCache.

However, in `PartitionAllocTest`, `root0 = allocator.root()` does not have thread cache, and instead default partition (of the process running the test) has the thread cache, so I found it's dangerous to use `ThreadCache::Get(0)` for this test.

So I created two roots (with index 1 and 2), and use them to do the test you suggest.

File base/allocator/partition_allocator/src/partition_alloc/partition_root.h
Line 1833, Patchset 9: // TODO(ayumiohno): Once `ThreadCache::largest_active_bucket_index_` becomes a
Stephen Nusko . unresolved

Can you file a bug (crbug/####) and put all the details there?

You can use component chromium > Blink > MemoryAllocator > Partition

Ayumi Ono

I filed a feature request bug to track the multiple thread cache project, and put the number within TODO, (because this todo will be handled soon)
https://g-issues.chromium.org/issues/467243745

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 280, Patchset 12 (Latest): static bool IsValid(ThreadCache* tcache) {
Ayumi Ono . unresolved

I found that we don't need `tcache->root_` check if `THREAD_CACHE_FAST_TLS` and tcache pointer is taken from `g_thread_caches[index]`, so I fixed these parts.

(It's possible to change `ThreadCache* g_thread_caches[kMaxThreadCacheIndex]` to `ThreadCache*` that only has the same pointer as `PartitionTls`, but I think the current strategy is better in that we can eliminate such checks.)

Open in Gerrit

Related details

Attention is currently required from:
  • Mikihito Matsuura
  • Stephen Nusko
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 12
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Stephen Nusko <nus...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Comment-Date: Wed, 10 Dec 2025 00:23:55 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Stephen Nusko <nus...@chromium.org>
Comment-In-Reply-To: Ayumi Ono <ayum...@google.com>
satisfied_requirement
unsatisfied_requirement
open
diffy

Stephen Nusko (Gerrit)

unread,
Dec 10, 2025, 12:59:09 AM (10 days ago) Dec 10
to Ayumi Ono, chrom...@appspot.gserviceaccount.com, Mikihito Matsuura, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono and Mikihito Matsuura

Stephen Nusko added 3 comments

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc.cc
Line 113, Patchset 9 (Parent): PA_CHECK(opts.thread_cache == PartitionOptions::kDisabled)
Stephen Nusko . resolved

Should there be a check to see if we've registered to MANY thread caches?

Ayumi Ono
I've added this check. This should be removed once multiple thread cache is in use.
```
PA_CHECK(opts.thread_cache_index == 0)
<< "Cannot use a non-default thread cache index.";
```
Stephen Nusko

Sorry what I meant is something like

`PA_CHECK(opts.thread_cache_index < internal::kMaxThreadCacheIndex);`

Obviously == 0 is fine for now as well

Though I also see you check it in partition_root so perhaps fine.

Ayumi Ono

I see, I'll allow multiple thread cache from now, and I've fixed the checks to the following:
If the default partition uses thread cache and thus index 0 will be initialized in `EnableThreadCacheIfSupported`, I prohibit `opts.thread_cache_index == 0 && opts.thread_cache == PartitionOptions::kEnabled`.

Anyway, `thread_cache_index` should be less than `kMaxThreadCacheIndex`.
```
#if PA_BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
PA_CHECK(opts.thread_cache_index != 0 ||
opts.thread_cache == PartitionOptions::kDisabled)
<< "Cannot use a thread cache at default index when PartitionAlloc is "
"malloc().";
#endif
PA_CHECK(opts.thread_cache_index < internal::kMaxThreadCacheIndex)
<< "Thread cache index must be less than kMaxThreadCacheIndex";
```
Stephen Nusko

Acknowledged

File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
Line 6412, Patchset 13 (Latest): internal::SlotStart::Unchecked(ptr1).Untag(), bucket_index, pos1));
Stephen Nusko . unresolved
nit: 
```
EXPECT_EQ(pos1, 0u);
EXPECT_TRUE(tcache2->IsInFreelist(
internal::SlotStart::Unchecked(ptr2).Untag(), bucket_index, pos2));
EXPECT_EQ(pos2, 0u);
```
File base/allocator/partition_allocator/src/partition_alloc/partition_root.h
Line 1833, Patchset 9: // TODO(ayumiohno): Once `ThreadCache::largest_active_bucket_index_` becomes a
Stephen Nusko . resolved

Can you file a bug (crbug/####) and put all the details there?

You can use component chromium > Blink > MemoryAllocator > Partition

Ayumi Ono

I filed a feature request bug to track the multiple thread cache project, and put the number within TODO, (because this todo will be handled soon)
https://g-issues.chromium.org/issues/467243745

Stephen Nusko

Acknowledged

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
  • Mikihito Matsuura
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
Gerrit-Change-Number: 7206958
Gerrit-PatchSet: 13
Gerrit-Owner: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
Gerrit-CC: Kentaro Hara <har...@chromium.org>
Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
Gerrit-Attention: Ayumi Ono <ayum...@google.com>
Gerrit-Comment-Date: Wed, 10 Dec 2025 05:58:39 +0000
satisfied_requirement
unsatisfied_requirement
open
diffy

Mikihito Matsuura (Gerrit)

unread,
Dec 10, 2025, 3:24:06 AM (10 days ago) Dec 10
to Ayumi Ono, chrom...@appspot.gserviceaccount.com, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
Attention needed from Ayumi Ono

Mikihito Matsuura voted and added 4 comments

Votes added by Mikihito Matsuura

Code-Review+1

4 comments

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
[kMaxThreadCacheIndex];
Stephen Nusko . unresolved

can this be an `thread_local std::array<ThreadCache>`?

Then you don't need as many PA_UNSAFE_TODO

Mikihito Matsuura

But do we want bounds checking every time? This is fast path.

Ayumi Ono

By accessing the array with [] (not .at()), can we remove PA_UNSAFE_TODO while avoiding bounds checks?

Stephen Nusko

In Chrome [] triggers bounds checking due to Chromium compiling with [libc++ hardening](https://libcxx.llvm.org/Hardening.html).

I suspect given this is a constexpr sized array, that most if not all of the bounds checks would be optimized away.

If we see bounds checks show up in our performance then of course we can opt-out (that is what PA_UNSAFE_TODO/PA_UNSAFE_BUFFERS macros are for), however in this case I suspect when accessing at `kThreadCacheQuarantineIndex` we'll have no bounds check, and for most of the roots especially if we assign it in a way that is clearly valid the checks will be optimized out, because the value never changes.

Stephen Nusko

Oh and of course not mandating it, I defer to @mikt if there is a legit reason to suspect this is going to cause a large issue then of course keep it as a ThreadCache* but if benchmarks don't move we could just move it to std::array, we use std::array in plenty of locations already.

Mikihito Matsuura

I don't have strong preference. Maybe the ongoing movement to rewrite raw pointers to `std::array` will rewrite this anyway.

My suggestion is leave this as-is, and let them rewrite to delegate perf impact measurement.

File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
Line 487, Patchset 10: tcaches = reinterpret_cast<ThreadCache*>(operator new(array_size));
Mikihito Matsuura . resolved

Is this calling the `ThreadCache::operator new`? Or the global one?

Ayumi Ono

It's calling the class-specific one. Should I create Alloc/Free functions and use them instead?

Mikihito Matsuura

No, it should be fine. Thanks ;)

Line 574, Patchset 10: operator delete(tcaches);
Mikihito Matsuura . resolved

ditto

Mikihito Matsuura

Done

Line 587, Patchset 10: internal::g_thread_caches[internal::kThreadCacheTombstoneIndex]) =
Mikihito Matsuura . unresolved

Can you explain why setting this on `internal::kThreadCacheTombstoneIndex` is sufficient to mitigate the issue commented above?

Ayumi Ono

`PartitionRoot::MaybeInitThreadCache`, `ForceInitThreadCache`, and `EnableThreadCacheIfSupported` are the only place where `ThreadCache::Create` is called.

In `MaybeInitThreadCache` and `ForceInitThreadCache`, (which are called when newly allocating thread cache), `ThreadCache::IsTombstone()` check is always performed, and `IsTombstone` only sees the `internal::kThreadCacheTombstoneIndex`, so it's sufficient.

Regarding `EnableThreadCacheIfSupported`, I guess it's not called during thread/process teardown (and that's why `IsTombstone` does not exist), so I think it's okay.

Mikihito Matsuura

(Sorry I meant to explain in the comments)

Open in Gerrit

Related details

Attention is currently required from:
  • Ayumi Ono
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
    Gerrit-Change-Number: 7206958
    Gerrit-PatchSet: 13
    Gerrit-Owner: Ayumi Ono <ayum...@google.com>
    Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
    Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
    Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
    Gerrit-CC: Kentaro Hara <har...@chromium.org>
    Gerrit-Attention: Ayumi Ono <ayum...@google.com>
    Gerrit-Comment-Date: Wed, 10 Dec 2025 08:23:32 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    Comment-In-Reply-To: Stephen Nusko <nus...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Ayumi Ono (Gerrit)

    unread,
    Dec 10, 2025, 7:04:45 PM (9 days ago) Dec 10
    to Mikihito Matsuura, chrom...@appspot.gserviceaccount.com, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
    Attention needed from Mikihito Matsuura and Stephen Nusko

    Ayumi Ono added 6 comments

    File base/allocator/partition_allocator/src/partition_alloc/partition_alloc_unittest.cc
    Line 6402, Patchset 11: root0->Free(ptr0);
    root1->Free(ptr1);
    Stephen Nusko . resolved

    Should we check that

    1) the thread cache are different pointers
    2) that they have the correct pointer in their free lists? I.E. root0's thread cache's freelist should have ptr0 and root1 should have ptr1?

    Ayumi Ono

    Thank you, they looks good to ensure the behavior of PartitionRoot and ThreadCache.

    However, in `PartitionAllocTest`, `root0 = allocator.root()` does not have thread cache, and instead default partition (of the process running the test) has the thread cache, so I found it's dangerous to use `ThreadCache::Get(0)` for this test.

    So I created two roots (with index 1 and 2), and use them to do the test you suggest.

    Ayumi Ono

    Done

    Line 6412, Patchset 13: internal::SlotStart::Unchecked(ptr1).Untag(), bucket_index, pos1));
    Stephen Nusko . resolved
    nit: 
    ```
    EXPECT_EQ(pos1, 0u);
    EXPECT_TRUE(tcache2->IsInFreelist(
    internal::SlotStart::Unchecked(ptr2).Untag(), bucket_index, pos2));
    EXPECT_EQ(pos2, 0u);
    ```
    Ayumi Ono

    Done, thank you

    File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
    Line 280, Patchset 12: static bool IsValid(ThreadCache* tcache) {
    Ayumi Ono . resolved

    I found that we don't need `tcache->root_` check if `THREAD_CACHE_FAST_TLS` and tcache pointer is taken from `g_thread_caches[index]`, so I fixed these parts.

    (It's possible to change `ThreadCache* g_thread_caches[kMaxThreadCacheIndex]` to `ThreadCache*` that only has the same pointer as `PartitionTls`, but I think the current strategy is better in that we can eliminate such checks.)

    Ayumi Ono

    Done

    Line 81, Patchset 9: PARTITION_ALLOC) thread_local ThreadCache* g_thread_caches
    [kMaxThreadCacheIndex];
    Stephen Nusko . resolved

    can this be an `thread_local std::array<ThreadCache>`?

    Then you don't need as many PA_UNSAFE_TODO

    Mikihito Matsuura

    But do we want bounds checking every time? This is fast path.

    Ayumi Ono

    By accessing the array with [] (not .at()), can we remove PA_UNSAFE_TODO while avoiding bounds checks?

    Stephen Nusko

    In Chrome [] triggers bounds checking due to Chromium compiling with [libc++ hardening](https://libcxx.llvm.org/Hardening.html).

    I suspect given this is a constexpr sized array, that most if not all of the bounds checks would be optimized away.

    If we see bounds checks show up in our performance then of course we can opt-out (that is what PA_UNSAFE_TODO/PA_UNSAFE_BUFFERS macros are for), however in this case I suspect when accessing at `kThreadCacheQuarantineIndex` we'll have no bounds check, and for most of the roots especially if we assign it in a way that is clearly valid the checks will be optimized out, because the value never changes.

    Stephen Nusko

    Oh and of course not mandating it, I defer to @mikt if there is a legit reason to suspect this is going to cause a large issue then of course keep it as a ThreadCache* but if benchmarks don't move we could just move it to std::array, we use std::array in plenty of locations already.

    Mikihito Matsuura

    I don't have strong preference. Maybe the ongoing movement to rewrite raw pointers to `std::array` will rewrite this anyway.

    My suggestion is leave this as-is, and let them rewrite to delegate perf impact measurement.

    Ayumi Ono

    Looks good, I'll leave PA_UNSAFE_TODO for now.

    File base/allocator/partition_allocator/src/partition_alloc/thread_cache.cc
    Line 587, Patchset 10: internal::g_thread_caches[internal::kThreadCacheTombstoneIndex]) =
    Mikihito Matsuura . resolved

    Can you explain why setting this on `internal::kThreadCacheTombstoneIndex` is sufficient to mitigate the issue commented above?

    Ayumi Ono

    `PartitionRoot::MaybeInitThreadCache`, `ForceInitThreadCache`, and `EnableThreadCacheIfSupported` are the only place where `ThreadCache::Create` is called.

    In `MaybeInitThreadCache` and `ForceInitThreadCache`, (which are called when newly allocating thread cache), `ThreadCache::IsTombstone()` check is always performed, and `IsTombstone` only sees the `internal::kThreadCacheTombstoneIndex`, so it's sufficient.

    Regarding `EnableThreadCacheIfSupported`, I guess it's not called during thread/process teardown (and that's why `IsTombstone` does not exist), so I think it's okay.

    Mikihito Matsuura

    (Sorry I meant to explain in the comments)

    Ayumi Ono

    Oh, I've added brief comments in code.

    File third_party/blink/renderer/platform/wtf/allocator/partitions.cc
    Line 126, Patchset 7: options.thread_cache_index = 1;
    Ayumi Ono . resolved

    This is for test purposes.
    I'll revert this change after reviews.

    Ayumi Ono

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Mikihito Matsuura
    • Stephen Nusko
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
      Gerrit-Change-Number: 7206958
      Gerrit-PatchSet: 14
      Gerrit-Owner: Ayumi Ono <ayum...@google.com>
      Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
      Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
      Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
      Gerrit-CC: Kentaro Hara <har...@chromium.org>
      Gerrit-Attention: Stephen Nusko <nus...@chromium.org>
      Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
      Gerrit-Comment-Date: Thu, 11 Dec 2025 00:04:11 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Stephen Nusko (Gerrit)

      unread,
      Dec 11, 2025, 1:26:53 AM (9 days ago) Dec 11
      to Ayumi Ono, Mikihito Matsuura, chrom...@appspot.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
      Attention needed from Mikihito Matsuura

      Stephen Nusko voted Code-Review+1

      Code-Review+1
      Open in Gerrit

      Related details

      Attention is currently required from:
      • Mikihito Matsuura
      Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement is not satisfiedCode-Owners
        • requirement is not satisfiedCode-Review
        • requirement satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
        Gerrit-Change-Number: 7206958
        Gerrit-PatchSet: 14
        Gerrit-Owner: Ayumi Ono <ayum...@google.com>
        Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
        Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
        Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
        Gerrit-CC: Kentaro Hara <har...@chromium.org>
        Gerrit-Attention: Mikihito Matsuura <mi...@google.com>
        Gerrit-Comment-Date: Thu, 11 Dec 2025 06:26:31 +0000
        Gerrit-HasComments: No
        Gerrit-Has-Labels: Yes
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy

        Mikihito Matsuura (Gerrit)

        unread,
        Dec 11, 2025, 3:01:04 AM (9 days ago) Dec 11
        to Ayumi Ono, Stephen Nusko, chrom...@appspot.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
        Attention needed from Ayumi Ono

        Mikihito Matsuura voted Code-Review+1

        Code-Review+1
        Open in Gerrit

        Related details

        Attention is currently required from:
        • Ayumi Ono
        Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement is not satisfiedCode-Owners
          • requirement satisfiedCode-Review
          • requirement satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
          Gerrit-Change-Number: 7206958
          Gerrit-PatchSet: 14
          Gerrit-Owner: Ayumi Ono <ayum...@google.com>
          Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
          Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
          Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
          Gerrit-CC: Kentaro Hara <har...@chromium.org>
          Gerrit-Attention: Ayumi Ono <ayum...@google.com>
          Gerrit-Comment-Date: Thu, 11 Dec 2025 08:00:29 +0000
          Gerrit-HasComments: No
          Gerrit-Has-Labels: Yes
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Mikihito Matsuura (Gerrit)

          unread,
          Dec 17, 2025, 1:28:45 AM (3 days ago) Dec 17
          to Ayumi Ono, Stephen Nusko, chrom...@appspot.gserviceaccount.com, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
          Attention needed from Ayumi Ono and Stephen Nusko

          Mikihito Matsuura voted and added 1 comment

          Votes added by Mikihito Matsuura

          Code-Review+1

          1 comment

          File base/allocator/partition_allocator/src/partition_alloc/thread_cache.h
          Line 275, Patchset 15 (Latest): static bool IsValidPtr(ThreadCache* tcache) {
          // Do not MTE-untag, as it'd mess up the sentinel value.
          return reinterpret_cast<uintptr_t>(tcache) & kTombstoneMask;
          }

          static bool IsValid(ThreadCache* tcache) {
          #if PA_CONFIG(THREAD_CACHE_FAST_TLS)
          // `g_thread_caches[index]` has valid pointers only if the ThreadCache
          // object is initialized.
          return IsValidPtr(tcache);
          #else
          // Even if the array of ThreadCache is allocated, the ThreadCache object
          // may not be initialized, and thus check `root_` to know if initialized.
          return tcache && tcache->root_;
          #endif
          }
          Mikihito Matsuura . unresolved

          nit: comment difference and use cases between `IsValidPtr` and `IsValid`.

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Ayumi Ono
          • Stephen Nusko
          Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement is not satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
            Gerrit-Change-Number: 7206958
            Gerrit-PatchSet: 15
            Gerrit-Owner: Ayumi Ono <ayum...@google.com>
            Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
            Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
            Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
            Gerrit-CC: Kentaro Hara <har...@chromium.org>
            Gerrit-Attention: Stephen Nusko <nus...@chromium.org>
            Gerrit-Attention: Ayumi Ono <ayum...@google.com>
            Gerrit-Comment-Date: Wed, 17 Dec 2025 06:28:08 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: Yes
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            chromeperf@appspot.gserviceaccount.com (Gerrit)

            unread,
            Dec 17, 2025, 1:52:58 AM (3 days ago) Dec 17
            to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
            Attention needed from Ayumi Ono and Stephen Nusko

            Message from chrom...@appspot.gserviceaccount.com

            📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

            See results at: https://pinpoint-dot-chromeperf.appspot.com/job/170d9bbcb10000

            Gerrit-Comment-Date: Wed, 17 Dec 2025 06:52:42 +0000
            Gerrit-HasComments: No
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            chromeperf@appspot.gserviceaccount.com (Gerrit)

            unread,
            Dec 17, 2025, 2:58:38 AM (3 days ago) Dec 17
            to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
            Attention needed from Ayumi Ono

            Message from chrom...@appspot.gserviceaccount.com

            📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

            See results at: https://pinpoint-dot-chromeperf.appspot.com/job/10a2e6cab10000

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Ayumi Ono
            Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement is not satisfiedCode-Owners
            • requirement is not satisfiedCode-Review
            • requirement is not satisfiedNo-Unresolved-Comments
            • requirement satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I217215f6db648ffba2f7313af2bdb546e36f6fe1
            Gerrit-Change-Number: 7206958
            Gerrit-PatchSet: 15
            Gerrit-Owner: Ayumi Ono <ayum...@google.com>
            Gerrit-Reviewer: Ayumi Ono <ayum...@google.com>
            Gerrit-Reviewer: Mikihito Matsuura <mi...@google.com>
            Gerrit-Reviewer: Stephen Nusko <nus...@chromium.org>
            Gerrit-CC: Kentaro Hara <har...@chromium.org>
            Gerrit-Attention: Ayumi Ono <ayum...@google.com>
            Gerrit-Comment-Date: Wed, 17 Dec 2025 07:58:23 +0000
            Gerrit-HasComments: No
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            chromeperf@appspot.gserviceaccount.com (Gerrit)

            unread,
            Dec 17, 2025, 3:58:00 AM (3 days ago) Dec 17
            to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
            Attention needed from Ayumi Ono

            Message from chrom...@appspot.gserviceaccount.com

            📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

            See results at: https://pinpoint-dot-chromeperf.appspot.com/job/10b494eab10000

            Gerrit-Comment-Date: Wed, 17 Dec 2025 08:57:44 +0000
            Gerrit-HasComments: No
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            chromeperf@appspot.gserviceaccount.com (Gerrit)

            unread,
            Dec 18, 2025, 7:47:43 PM (2 days ago) Dec 18
            to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
            Attention needed from Ayumi Ono

            Message from chrom...@appspot.gserviceaccount.com

            📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

            See results at: https://pinpoint-dot-chromeperf.appspot.com/job/1696b2d6b10000

            Gerrit-Comment-Date: Fri, 19 Dec 2025 00:47:28 +0000
            Gerrit-HasComments: No
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            chromeperf@appspot.gserviceaccount.com (Gerrit)

            unread,
            Dec 18, 2025, 7:50:38 PM (2 days ago) Dec 18
            to Ayumi Ono, Mikihito Matsuura, Stephen Nusko, Chromium LUCI CQ, chromium...@chromium.org, Kentaro Hara, bartek...@chromium.org, blink-re...@chromium.org, blink-...@chromium.org, kinuko...@chromium.org, lize...@chromium.org, lizeb...@chromium.org, spang...@chromium.org, tracing...@chromium.org, wfh+...@chromium.org
            Attention needed from Ayumi Ono

            Message from chrom...@appspot.gserviceaccount.com

            📍 Job mac-m1_mini_2020-perf/jetstream2 complete.

            See results at: https://pinpoint-dot-chromeperf.appspot.com/job/108077c4b10000

            Gerrit-Comment-Date: Fri, 19 Dec 2025 00:50:22 +0000
            Gerrit-HasComments: No
            Gerrit-Has-Labels: No
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy
            Reply all
            Reply to author
            Forward
            0 new messages