Fall back to the block bitmap when mimalloc rejects a small Structure heap reservation

[robobun]

Problem

• StructureMemoryManager::StructureMemoryManager() halves its 4 GB reservation request up to 8 times, down to 32 MB. Under USE(MIMALLOC) the 32 MB rung can never be used: RELEASE_ASSERT(mi_manage_os_memory_ex(...)) at StructureAlignedMemoryAllocator.cpp:147 fails and the process aborts before any JS runs. This is Sentry BUN-4NF7 on bun 1.4.0 (Linux x64).
• The cause: the constructor hands mimalloc 32 MiB - 16 KiB (one MarkedBlock is kept for StructureID 0). mimalloc aligns the start up to its 64 KiB slice size and then needs one whole chunk of slices, MI_ARENA_MIN_SIZE = 32 MiB. It sees 32704 KiB, needs 32768 KiB, and returns false. Every rung from 64 MB up passes.

Fix

• When mi_manage_os_memory_ex returns false, set m_useSystemHeap and hand out blocks from the reservation with the existing m_usedBlocks bitmap. That is the path JSC already uses when bmalloc is disabled, so a 32 MB reservation now gives a working 32 MB Structure heap instead of an abort.
• The mimalloc branch body did not change otherwise. The MADV_DOFORK / vm_inherit undo stays inside the mimalloc branch, because only the mimalloc arena puts process-wide data inside the reservation.
• Verified by reading: tryMallocStructureBlock and freeStructureBlock branch on m_useSystemHeap in both USE(LIBPAS) and USE(MIMALLOC) builds. The file compiles with -fsyntax-only in bun's USE_MIMALLOC=1 configuration. I did not build JSC here.
• To check with bun once this is picked up: BUN_JSC_structureHeapSizeInKB=32768 bun -e 1 aborts on bun 1.4.0 with the same trace string as BUN-4NF7 (65536 works). With this change it prints nothing and exits 0. bash -c 'ulimit -v 300000; exec bun -e 1' reaches the same assert through the halving loop.

Background

• The Structure heap is one aligned reservation whose upper 32 address bits are constant, so a StructureID can be 32 bits. sizeOfStructureHeap is whatever rung the reservation loop ended on.
• Under USE(MIMALLOC) the reservation (minus the first block) is registered as an exclusive mimalloc arena, and structureHeap allocates 16 KiB blocks from it. Under m_useSystemHeap the manager commits and decommits blocks of the reservation itself and tracks them in a BitVector.
• The halving loop only runs when address space is short: ulimit -v, a container limit, or vm.overcommit_memory=2. On bun 1.4.0 x64 Linux, ulimit -v between about 100 and 340 MB, 1.15 and 1.27 GB, and 2.20 and 2.33 GB ends on the 32 MB rung (bun's own 1 GiB mimalloc arena and the 1 GiB JIT pool are what eat the space in the upper two windows). The companion bun change (oven-sh/bun, crash_handler) turns the remaining case, no reservation at all, into an error message instead of a crash report.

[coderabbitai]

Warning

Review limit reached

Your included review limit has been reached.

You’re in a promotional period — use the checkbox below to run this review for free:

• Run review for free

_{On-demand reviews are free for the next 30 days. After that, they cost $0.25 per reviewed file.}

How can I continue?

Run this review now using the option above, or comment @coderabbitai review --use-credits.

You can also wait for the limit to reset (next review available in 10 minutes), then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9569a020-1063-4337-b2dd-746fde01e29b

📥 Commits

Reviewing files that changed from the base of the PR and between 51a6d25 and 9463c41.

📒 Files selected for processing (1)

• Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview Builds

Commit	Release	Date
9463c41a	autobuild-preview-pr-483-9463c41a	2026-08-21 14:41:33 UTC