| Index: third_party/WebKit/Source/platform/heap/PagePool.h
|
| diff --git a/third_party/WebKit/Source/platform/heap/PagePool.h b/third_party/WebKit/Source/platform/heap/PagePool.h
|
| index ae4976acb8826cee002bac2a619ed05fdaca266e..7936d6329cca888e7c9c2b3a0a9a499835232b4b 100644
|
| --- a/third_party/WebKit/Source/platform/heap/PagePool.h
|
| +++ b/third_party/WebKit/Source/platform/heap/PagePool.h
|
| @@ -13,44 +13,35 @@ namespace blink {
|
|
|
| class PageMemory;
|
|
|
| -template <typename DataType>
|
| +// Once pages have been used for one type of thread heap they will never be
|
| +// reused for another type of thread heap. Instead of unmapping, we add the
|
| +// pages to a pool of pages to be reused later by a thread heap of the same
|
| +// type. This is done as a security feature to avoid type confusion. The
|
| +// heaps are type segregated by having separate thread arenas for different
|
| +// types of objects. Holding on to pages ensures that the same virtual address
|
| +// space cannot be used for objects of another type than the type contained
|
| +// in this page to begin with.
|
| class PagePool {
|
| USING_FAST_MALLOC(PagePool);
|
|
|
| - protected:
|
| - PagePool() {
|
| - for (int i = 0; i < BlinkGC::NumberOfArenas; ++i)
|
| - m_pool[i] = nullptr;
|
| - }
|
| + public:
|
| + PagePool();
|
| + ~PagePool();
|
| + void add(int, PageMemory*);
|
| + PageMemory* take(int);
|
|
|
| + private:
|
| class PoolEntry {
|
| USING_FAST_MALLOC(PoolEntry);
|
|
|
| public:
|
| - PoolEntry(DataType* data, PoolEntry* next) : data(data), next(next) {}
|
| + PoolEntry(PageMemory* data, PoolEntry* next) : data(data), next(next) {}
|
|
|
| - DataType* data;
|
| + PageMemory* data;
|
| PoolEntry* next;
|
| };
|
|
|
| PoolEntry* m_pool[BlinkGC::NumberOfArenas];
|
| -};
|
| -
|
| -// Once pages have been used for one type of thread heap they will never be
|
| -// reused for another type of thread heap. Instead of unmapping, we add the
|
| -// pages to a pool of pages to be reused later by a thread heap of the same
|
| -// type. This is done as a security feature to avoid type confusion. The
|
| -// heaps are type segregated by having separate thread arenas for different
|
| -// types of objects. Holding on to pages ensures that the same virtual address
|
| -// space cannot be used for objects of another type than the type contained
|
| -// in this page to begin with.
|
| -class FreePagePool : public PagePool<PageMemory> {
|
| - public:
|
| - ~FreePagePool();
|
| - void addFreePage(int, PageMemory*);
|
| - PageMemory* takeFreePage(int);
|
| -
|
| - private:
|
| Mutex m_mutex[BlinkGC::NumberOfArenas];
|
| };
|
|
|
|
|