| Index: third_party/WebKit/Source/wtf/PartitionAlloc.md
|
| diff --git a/third_party/WebKit/Source/wtf/PartitionAlloc.md b/third_party/WebKit/Source/wtf/PartitionAlloc.md
|
| index 13b0971c8e22932e49670e5aded7636fda9e1d26..dbcc0061c2b87da0519bda34467f691b63610ac5 100644
|
| --- a/third_party/WebKit/Source/wtf/PartitionAlloc.md
|
| +++ b/third_party/WebKit/Source/wtf/PartitionAlloc.md
|
| @@ -14,11 +14,9 @@ PartitionAlloc or Oilpan (but not yet done).
|
|
|
| ## Partitions and buckets
|
|
|
| -PartitionAlloc has four partitions. A partition is a heap that contains
|
| +PartitionAlloc has three partitions. A partition is a heap that contains
|
| certain types of objects. Specifically, PartitionAlloc allocates objects
|
| -on either of the following four partitions depending on their types.
|
| -
|
| -* Node partition: A partition to allocate Nodes.
|
| +on either of the following three partitions depending on their types:
|
|
|
| * LayoutObject partition: A partition to allocate LayoutObjects.
|
|
|
| @@ -36,10 +34,9 @@ with the closest bucket size. For example, if a partition has three buckets
|
| for 64 bytes, 256 bytes and 1024 bytes, then an object of 128 bytes is
|
| rounded up to 256 bytes and allocated on the second bucket.
|
|
|
| -The Node partition and the LayoutObject partition have buckets for all
|
| -N * sizeof(void*) (N = 1, 2, ..., N_max). This means that no extra padding
|
| -is needed to allocate a Node object. Different sizes of Node objects are
|
| -allocated on different buckets.
|
| +The LayoutObject partition has buckets for all N * sizeof(void*) (N = 1, 2, ..., N_max).
|
| +This means that no extra padding is needed to allocate a LayoutObject object.
|
| +Different sizes of LayoutObjects are allocated in different buckets.
|
|
|
| The Buffer partition and the FastMalloc partition have many buckets.
|
| They support any arbitrary size of allocations but padding may be added
|
| @@ -50,9 +47,9 @@ Large allocations (> 1 MB) are realized by direct memory mmapping.
|
|
|
| ## Performance
|
|
|
| -PartitionAlloc doesn't acquire a lock when allocating on the Node partition and
|
| -the LayoutObject partition, because it's guaranteed that Nodes and LayoutObjects
|
| -are allocated only by the main thread.
|
| +PartitionAlloc doesn't acquire a lock when allocating on the LayoutObject
|
| +partition, because it's guaranteed that LayoutObjects are allocated
|
| +only by the main thread.
|
|
|
| PartitionAlloc acquires a lock when allocating on the Buffer partition and
|
| the FastMalloc partition. PartitionAlloc uses a spin lock because thread contention
|
| @@ -63,8 +60,8 @@ PartitionAlloc is designed to be extremely fast in fast paths. Just two
|
| allocation and deallocation. The number of operations in the fast paths
|
| is minimized, leading to the possibility of inlining.
|
|
|
| -Having the dedicated partitions for Nodes and LayoutObjects is helpful
|
| -to improve cache locality and thus improve performance.
|
| +Having a dedicated partition for LayoutObjects is helpful to improve cache
|
| +locality and thus help improve performance.
|
|
|
| ## Security
|
|
|
| @@ -74,8 +71,8 @@ Different partitions are guaranteed to exist in separate address spaces.
|
| When objects contained in a page in a partition are all freed,
|
| the physical memory is returned to the system but the address space
|
| remains reserved. The address space may be reused later only for the partition.
|
| -Remember that PartitionAlloc puts Nodes into a dedicated partition.
|
| -This is because Nodes are likely to be a source of use-after-free.
|
| +Remember that PartitionAlloc puts LayoutObjects into a dedicated partition.
|
| +This is because LayoutObjects are likely to be a source of use-after-free.
|
| Simiarly, PartitionAlloc puts Strings, Vectors etc into the Buffer partition
|
| because the length and/or contents may be exploited by user scripts.
|
| This means that PartitionAlloc greedily uses virtual address spaces in favor of
|
|
|