Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(188)

Unified Diff: third_party/WebKit/Source/wtf/PartitionAlloc.md

Issue 1863753002: Remove ENABLE(OILPAN) uses in wtf/ (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: More comment syncing Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « third_party/WebKit/Source/wtf/ListHashSet.h ('k') | third_party/WebKit/Source/wtf/Partitions.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/WebKit/Source/wtf/PartitionAlloc.md
diff --git a/third_party/WebKit/Source/wtf/PartitionAlloc.md b/third_party/WebKit/Source/wtf/PartitionAlloc.md
index 13b0971c8e22932e49670e5aded7636fda9e1d26..dbcc0061c2b87da0519bda34467f691b63610ac5 100644
--- a/third_party/WebKit/Source/wtf/PartitionAlloc.md
+++ b/third_party/WebKit/Source/wtf/PartitionAlloc.md
@@ -14,11 +14,9 @@ PartitionAlloc or Oilpan (but not yet done).
## Partitions and buckets
-PartitionAlloc has four partitions. A partition is a heap that contains
+PartitionAlloc has three partitions. A partition is a heap that contains
certain types of objects. Specifically, PartitionAlloc allocates objects
-on either of the following four partitions depending on their types.
-
-* Node partition: A partition to allocate Nodes.
+on either of the following three partitions depending on their types:
* LayoutObject partition: A partition to allocate LayoutObjects.
@@ -36,10 +34,9 @@ with the closest bucket size. For example, if a partition has three buckets
for 64 bytes, 256 bytes and 1024 bytes, then an object of 128 bytes is
rounded up to 256 bytes and allocated on the second bucket.
-The Node partition and the LayoutObject partition have buckets for all
-N * sizeof(void*) (N = 1, 2, ..., N_max). This means that no extra padding
-is needed to allocate a Node object. Different sizes of Node objects are
-allocated on different buckets.
+The LayoutObject partition has buckets for all N * sizeof(void*) (N = 1, 2, ..., N_max).
+This means that no extra padding is needed to allocate a LayoutObject object.
+Different sizes of LayoutObjects are allocated in different buckets.
The Buffer partition and the FastMalloc partition have many buckets.
They support any arbitrary size of allocations but padding may be added
@@ -50,9 +47,9 @@ Large allocations (> 1 MB) are realized by direct memory mmapping.
## Performance
-PartitionAlloc doesn't acquire a lock when allocating on the Node partition and
-the LayoutObject partition, because it's guaranteed that Nodes and LayoutObjects
-are allocated only by the main thread.
+PartitionAlloc doesn't acquire a lock when allocating on the LayoutObject
+partition, because it's guaranteed that LayoutObjects are allocated
+only by the main thread.
PartitionAlloc acquires a lock when allocating on the Buffer partition and
the FastMalloc partition. PartitionAlloc uses a spin lock because thread contention
@@ -63,8 +60,8 @@ PartitionAlloc is designed to be extremely fast in fast paths. Just two
allocation and deallocation. The number of operations in the fast paths
is minimized, leading to the possibility of inlining.
-Having the dedicated partitions for Nodes and LayoutObjects is helpful
-to improve cache locality and thus improve performance.
+Having a dedicated partition for LayoutObjects is helpful to improve cache
+locality and thus help improve performance.
## Security
@@ -74,8 +71,8 @@ Different partitions are guaranteed to exist in separate address spaces.
When objects contained in a page in a partition are all freed,
the physical memory is returned to the system but the address space
remains reserved. The address space may be reused later only for the partition.
-Remember that PartitionAlloc puts Nodes into a dedicated partition.
-This is because Nodes are likely to be a source of use-after-free.
+Remember that PartitionAlloc puts LayoutObjects into a dedicated partition.
+This is because LayoutObjects are likely to be a source of use-after-free.
Simiarly, PartitionAlloc puts Strings, Vectors etc into the Buffer partition
because the length and/or contents may be exploited by user scripts.
This means that PartitionAlloc greedily uses virtual address spaces in favor of
« no previous file with comments | « third_party/WebKit/Source/wtf/ListHashSet.h ('k') | third_party/WebKit/Source/wtf/Partitions.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698