Fix mimalloc arena alignment assertion for structure heap

.github/workflows/build-preview.yml

@@ -1,8 +1,8 @@
 name: Preview Build
 
 on:
-  issue_comment:
-    types: [created]
+  pull_request:
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
     inputs:
       pr_number:
@@ -16,98 +16,61 @@ permissions:
   issues: write
 
 concurrency:
-  group: preview-build-pr-${{ github.event.issue.number || inputs.pr_number }}
+  group: preview-build-pr-${{ github.event.pull_request.number || inputs.pr_number }}
   cancel-in-progress: true
 
 jobs:
   trigger:
     name: Trigger Preview Build
     runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.issue.pull_request && contains(github.event.comment.body, '/build-preview'))
     outputs:
       sha: ${{ steps.pr.outputs.sha }}
       short_sha: ${{ steps.pr.outputs.short_sha }}
       release_tag: ${{ steps.pr.outputs.release_tag }}
-      pr_number: ${{ steps.pr_number.outputs.number }}
+      pr_number: ${{ steps.pr.outputs.pr_number }}
 
     steps:
-      - name: Set PR number
-        id: pr_number
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "number=${{ inputs.pr_number }}" >> $GITHUB_OUTPUT
-          else
-            echo "number=${{ github.event.issue.number }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check permissions
-        if: github.event_name == 'issue_comment'
+      - name: Check org membership
+        if: github.event_name == 'pull_request'
         uses: actions/github-script@v7
         with:
           script: |
-            const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              username: context.payload.comment.user.login
-            });
-
-            if (!['admin', 'write'].includes(permission.permission)) {
-              await github.rest.reactions.createForIssueComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: context.payload.comment.id,
-                content: '-1'
+            try {
+              await github.rest.orgs.checkMembershipForUser({
+                org: 'oven-sh',
+                username: context.actor
               });
-              core.setFailed('❌ Only collaborators with write access can trigger preview builds');
+            } catch (e) {
+              core.setFailed(`${context.actor} is not a member of oven-sh. Preview builds must be triggered manually via workflow_dispatch.`);
             }
 
       - name: Get PR information
         id: pr
         uses: actions/github-script@v7
         with:
           script: |
-            const { data: pr } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: ${{ steps.pr_number.outputs.number }}
-            });
+            let sha, prNumber;
 
-            const shortSha = pr.head.sha.substring(0, 8);
-            const releaseTag = `autobuild-preview-pr-${{ steps.pr_number.outputs.number }}-${shortSha}`;
+            if (context.eventName === 'pull_request') {
+              sha = context.payload.pull_request.head.sha;
+              prNumber = context.payload.pull_request.number;
+            } else {
+              const { data: pr } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: ${{ inputs.pr_number || 0 }}
+              });
+              sha = pr.head.sha;
+              prNumber = ${{ inputs.pr_number || 0 }};
+            }
 
-            core.setOutput('sha', pr.head.sha);
+            const shortSha = sha.substring(0, 8);
+            const releaseTag = `autobuild-preview-pr-${prNumber}-${shortSha}`;
+
+            core.setOutput('sha', sha);
             core.setOutput('short_sha', shortSha);
             core.setOutput('release_tag', releaseTag);
-
-      - name: React to comment
-        if: github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: context.payload.comment.id,
-              content: 'eyes'
-            });
-
-      - name: Post starting message
-        if: github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const body = "🔄 Preview build started\n\n" +
-              "**Release tag**: `${{ steps.pr.outputs.release_tag }}`\n" +
-              "**Workflow**: [View progress](" + context.serverUrl + "/" + context.repo.owner + "/" + context.repo.repo + "/actions/runs/" + context.runId + ")";
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: ${{ steps.pr_number.outputs.number }},
-              body: body
-            });
+            core.setOutput('pr_number', prNumber);
 
   build:
     name: Build
@@ -146,18 +109,6 @@ jobs:
               body: body
             });
 
-      - name: React to failure
-        if: needs.build.result == 'failure' && github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: context.payload.comment.id,
-              content: '-1'
-            });
-
       - name: Post failure comment
         if: needs.build.result == 'failure'
         uses: actions/github-script@v7
@@ -179,7 +130,7 @@ jobs:
         with:
           script: |
             const body = "⚠️ Preview build was cancelled\n\n" +
-              "This may have been caused by a newer build being triggered for the same PR.";
+              "This may have been caused by a newer commit being pushed to the same PR.";
 
             await github.rest.issues.createComment({
               owner: context.repo.owner,

Dockerfile

@@ -203,6 +203,7 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     -DUSE_THIN_ARCHIVES=OFF \
     -DUSE_BUN_JSC_ADDITIONS=ON \
     -DUSE_BUN_EVENT_LOOP=ON \
+    -DUSE_MIMALLOC=ON \
     -DENABLE_FTL_JIT=ON \
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
     -DALLOW_LINE_AND_COLUMN_NUMBER_IN_BUILTINS=ON \

Dockerfile.musl

@@ -90,6 +90,7 @@ RUN --mount=type=tmpfs,target=/webkitbuild \
     -DUSE_THIN_ARCHIVES=OFF \
     -DUSE_BUN_JSC_ADDITIONS=ON \
     -DUSE_BUN_EVENT_LOOP=ON \
+    -DUSE_MIMALLOC=ON \
     -DENABLE_FTL_JIT=ON \
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
     -DALLOW_LINE_AND_COLUMN_NUMBER_IN_BUILTINS=ON \

Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp

@@ -139,9 +139,11 @@ class StructureMemoryManager {
         }
         m_usedBlocks.set(0);
 #elif USE(MIMALLOC)
-        void* memory = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(g_jscConfig.startOfStructureHeap) + MarkedBlock::blockSize);
-        size_t size = g_jscConfig.sizeOfStructureHeap - MarkedBlock::blockSize;
-        RELEASE_ASSERT(mi_manage_os_memory_ex(memory, size, false, false, false, -1, true, &structureArena));
+        // Pass the full structure heap range to mimalloc. The start address is aligned to
+        // mappedHeapSize (a large power of 2), satisfying mimalloc's arena alignment requirements.
+        // mimalloc stores its arena metadata at the beginning of the managed region, so no
+        // allocation will occur at offset 0 (avoiding conflict with the empty StructureID).
+        RELEASE_ASSERT(mi_manage_os_memory_ex(reinterpret_cast<void*>(g_jscConfig.startOfStructureHeap), g_jscConfig.sizeOfStructureHeap, false, false, false, -1, true, &structureArena));
         structureHeap = mi_heap_new_in_arena(structureArena);
 #else
         m_usedBlocks.set(0);

Source/JavaScriptCore/shell/CMakeLists.txt

@@ -18,6 +18,10 @@ if (WIN32)
     list(APPEND jsc_LIBRARIES Winmm)
 endif ()
 
+if (USE_MIMALLOC AND USE_BUN_JSC_ADDITIONS)
+    list(APPEND jsc_LIBRARIES $<TARGET_OBJECTS:mimalloc-obj>)
+endif ()
+
 if (ENABLE_FUZZILLI)
   list(APPEND jsc_SOURCES ../fuzzilli/Fuzzilli.cpp)
 endif ()

Source/bmalloc/CMakeLists.txt

@@ -649,7 +649,7 @@ if (ATOMICS_REQUIRE_LIBATOMIC)
     list(APPEND bmalloc_LIBRARIES atomic)
 endif ()
 
-if (USE_MIMALLOC)
+if (USE_MIMALLOC AND NOT USE_BUN_JSC_ADDITIONS)
     list(APPEND bmalloc_LIBRARIES $<TARGET_OBJECTS:mimalloc-obj>)
 endif ()
 

Source/bmalloc/bmalloc/VMAllocate.h

@@ -387,14 +387,8 @@ inline void vmZeroAndPurge(void* p, size_t vmSize, VMTag usage)
     BUNUSED_PARAM(usage);
 
     vmValidate(p, vmSize);
-    // DiscardVirtualMemory does not guarantee zeroing and fails on memory
-    // managed by libpas within reserved Gigacage regions. Use decommit+recommit
-    // which releases physical pages and provides demand-zeroed pages on next
-    // access, matching the behavior of mmap(MAP_FIXED|MAP_ANON) on Unix.
-    BOOL success = VirtualFree(p, vmSize, MEM_DECOMMIT);
-    RELEASE_BASSERT(success);
-    void* result = VirtualAlloc(p, vmSize, MEM_COMMIT, PAGE_READWRITE);
-    RELEASE_BASSERT(result == p);
+    DWORD result = DiscardVirtualMemory(p, vmSize);
+    RELEASE_BASSERT(result == ERROR_SUCCESS);
 }
 
 inline void vmDeallocatePhysicalPages(void* p, size_t vmSize)

Source/bmalloc/mimalloc/CMakeLists.txt

@@ -6,6 +6,10 @@ set(MI_BUILD_STATIC OFF CACHE BOOL "Build mimalloc static library" FORCE)
 set(MI_BUILD_OBJECT ON CACHE BOOL "Build mimalloc object library" FORCE)
 set(MI_BUILD_TESTS OFF CACHE BOOL "Build mimalloc tests" FORCE)
 
+if (USE_BUN_JSC_ADDITIONS)
+    set(MI_USE_CXX ON CACHE BOOL "Use C++ compiler for mimalloc (avoids GCC stdatomic.h incompatibility with clang)" FORCE)
+endif ()
+
 WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
 add_subdirectory(mimalloc)

build.ts

@@ -108,6 +108,7 @@ const getCommonFlags = (config: BuildConfig) => {
     "-DUSE_BUN_JSC_ADDITIONS=ON",
     "-DUSE_BUN_EVENT_LOOP=ON",
     "-DENABLE_FTL_JIT=ON",
+    "-DUSE_MIMALLOC=ON",
     "-G",
     "Ninja",
   ];
@@ -149,7 +150,6 @@ const getCommonFlags = (config: BuildConfig) => {
     flags.push(
       "-DENABLE_REMOTE_INSPECTOR=ON",
       "-DUSE_VISIBILITY_ATTRIBUTE=1",
-      "-DUSE_SYSTEM_MALLOC=ON",
       `-DCMAKE_LINKER=${lldLink}`,
       `-DICU_ROOT=${VCPKG_ROOT}`,
       `-DICU_LIBRARY=${icuPaths.ICU_LIBRARY}`,

mac-release.bash

@@ -27,12 +27,7 @@ if [ -n "$ENABLE_SANITIZERS" ]; then
     export ENABLE_ASSERTS="ON";
 fi
 
-export DEFAULT_MALLOC_HEAP_BREAKDOWN=${DEFAULT_MALLOC_HEAP_BREAKDOWN:-"OFF"}
-if [ "$CMAKE_BUILD_TYPE" == "Debug" ]; then
-    export DEFAULT_MALLOC_HEAP_BREAKDOWN="ON"
-fi
-
-ENABLE_MALLOC_HEAP_BREAKDOWN=${ENABLE_MALLOC_HEAP_BREAKDOWN:-$DEFAULT_MALLOC_HEAP_BREAKDOWN}
+ENABLE_MALLOC_HEAP_BREAKDOWN=${ENABLE_MALLOC_HEAP_BREAKDOWN:-"OFF"}
 
 echo "Building for mac: [ $ENABLE_MALLOC_HEAP_BREAKDOWN ] [ $ENABLE_SANITIZERS ]"
 
@@ -54,6 +49,7 @@ cmake \
     -DENABLE_MALLOC_HEAP_BREAKDOWN=$ENABLE_MALLOC_HEAP_BREAKDOWN \
     -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
     -DUSE_BUN_JSC_ADDITIONS=ON \
+    -DUSE_MIMALLOC=ON \
     -DENABLE_ASSERTS="$ENABLE_ASSERTS" \
     -DUSE_BUN_EVENT_LOOP=ON \
     -DCMAKE_AR="$AR" \

windows-release.ps1

@@ -380,8 +380,7 @@ cmake -S . -B $WebKitBuild `
     -DUSE_BUN_JSC_ADDITIONS=ON `
     -DUSE_BUN_EVENT_LOOP=ON `
     -DENABLE_BUN_SKIP_FAILING_ASSERTIONS=ON `
-    -DUSE_MIMALLOC=OFF `
-    -DUSE_LIBPAS=ON `
+    -DUSE_MIMALLOC=ON `
     "-DICU_ROOT=${ICU_STATIC_ROOT}" `
     "-DICU_LIBRARY=${ICU_STATIC_LIBRARY}" `
     "-DICU_INCLUDE_DIR=${ICU_STATIC_INCLUDE_DIR}" `