[test] Fix Multi-Mapped Mock Allocator

Rather than explicitly requesting MAP_HUGETLB mappings, which requires
kernel configuration, we should rely on the "Transparent Hugepages"
feature, where eligible allocation requests are automatically fulfilled
with huge page mappings.

Bug: chromium:1041232
Change-Id: I5263da7a23290316aa7b99e63881ca88e65b4e34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997442
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65741}

src/d8/d8.cc

@@ -233,11 +233,16 @@ class MultiMappedAllocator : public ArrayBufferAllocatorBase {
     size_t rounded_length = RoundUp(length, kChunkSize);
     int prot = PROT_READ | PROT_WRITE;
     // We have to specify MAP_SHARED to make {mremap} below do what we want.
-    // We specify MAP_HUGETLB to reduce TLB load (fewer, bigger mappings).
-    int flags = MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB;
+    int flags = MAP_SHARED | MAP_ANONYMOUS;
     void* real_alloc = mmap(nullptr, kChunkSize, prot, flags, -1, 0);
+    if (reinterpret_cast<intptr_t>(real_alloc) == -1) {
+      FATAL("mmap (real) failed with error %d: %s", errno, strerror(errno));
+    }
     void* virtual_alloc =
         mmap(nullptr, rounded_length, prot, flags | MAP_NORESERVE, -1, 0);
+    if (reinterpret_cast<intptr_t>(virtual_alloc) == -1) {
+      FATAL("mmap (virtual) failed with error %d: %s", errno, strerror(errno));
+    }
     i::Address virtual_base = reinterpret_cast<i::Address>(virtual_alloc);
     i::Address virtual_end = virtual_base + rounded_length;
     for (i::Address to_map = virtual_base; to_map < virtual_end;
@@ -248,8 +253,9 @@ class MultiMappedAllocator : public ArrayBufferAllocatorBase {
       void* result =
           mremap(real_alloc, 0, kChunkSize, MREMAP_MAYMOVE | MREMAP_FIXED,
                  reinterpret_cast<void*>(to_map));
-      DCHECK_NE(-1, reinterpret_cast<intptr_t>(result));
-      USE(result);
+      if (reinterpret_cast<intptr_t>(result) == -1) {
+        FATAL("mremap failed with error %d: %s", errno, strerror(errno));
+      }
     }
     regions_[virtual_alloc] = real_alloc;
     return virtual_alloc;

test/mjsunit/mjsunit.status

@@ -1083,6 +1083,12 @@
   'regress/wasm/regress-1032753': [SKIP],
 }],
 
+##############################################################################
+['system != linux', {
+  # Multi-mapped mock allocator is only available on Linux.
+  'regress/regress-crbug-1041232': [SKIP],
+}],
+
 ##############################################################################
 ['variant == turboprop', {
   # Deopts differently than TurboFan.

test/mjsunit/regress/regress-crbug-1041232.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --multi-mapped-mock-allocator
+
+// Chosen for stress runs on 32-bit systems. Physical memory is not an issue
+// thanks to the mock allocator, but virtual address space is still limited.
+let kSize = 512 * 1024 * 1024;
+// Must be >= MultiMappedMockAllocator::kChunkSize in d8.cc.
+let kChunkSize = 2 * 1024 * 1024;
+let a = new Uint8Array(kSize);
+
+for (let i = 0; i < kChunkSize; i++) {
+  a[i] = 42;
+}
+
+// Check that OOB accesses return undefined and all array elements are 42.
+// Importantly, nothing crashes.
+assertEquals(undefined, a[-kChunkSize - 1]);
+assertEquals(undefined, a[-kChunkSize]);
+assertEquals(undefined, a[-1]);
+assertEquals(42, a[0]);
+assertEquals(42, a[1]);
+// If this fails, then you probably tried to run this test without the
+// multi-mapped mock allocator.
+assertEquals(42, a[kChunkSize]);
+assertEquals(42, a[kChunkSize + 1]);
+assertEquals(42, a[kChunkSize + 1]);
+assertEquals(42, a[kSize - kChunkSize]);
+assertEquals(42, a[kSize - 1]);
+assertEquals(undefined, a[kSize]);
+assertEquals(undefined, a[kSize + 1]);
+assertEquals(undefined, a[kSize + kChunkSize]);
+assertEquals(undefined, a[kSize + kSize]);