Oilpan: Improve address space randomization for the Oilpan heap.

Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 34 matching lines @@
 #include "wtf/ThreadSafeRefCounted.h"
 
 #include <stdint.h>
 
 namespace WebCore {
 
 const size_t blinkPageSizeLog2 = 17;
 const size_t blinkPageSize = 1 << blinkPageSizeLog2;
 const size_t blinkPageOffsetMask = blinkPageSize - 1;
 const size_t blinkPageBaseMask = ~blinkPageOffsetMask;
+
+// We allocate pages at random addresses but in groups of
+// blinkPagesPerRegion at a given random address. We group pages to
+// not spread out too much over the address space which would blow
+// away the page tables and lead to bad performance.
+const size_t blinkPagesPerRegion = 10;
+
 // Double precision floats are more efficient when 8 byte aligned, so we 8 byte
 // align all allocations even on 32 bit.
 const size_t allocationGranularity = 8;
 const size_t allocationMask = allocationGranularity - 1;
 const size_t objectStartBitMapSize = (blinkPageSize + ((8 * allocationGranularity) - 1)) / (8 * allocationGranularity);
 const size_t reservedForObjectBitMap = ((objectStartBitMapSize + allocationMask) & ~allocationMask);
 const size_t maxHeapObjectSize = 1 << 27;
 
 const size_t markBitMask = 1;
 const size_t freeListMask = 2;
@@ skipping 751 matching lines @@
 
     ThreadState* threadState() { return m_threadState; }
     HeapStats& stats() { return m_threadState->stats(); }
     void flushHeapContainsCache()
     {
         m_threadState->heapContainsCache()->flush();
     }
 
     inline Address allocate(size_t, const GCInfo*);
     void addToFreeList(Address, size_t);
+    void addPageMemoryToPool(PageMemory*);
     void addPageToPool(HeapPage<Header>*);
     inline static size_t roundedAllocationSize(size_t size)
     {
         return allocationSizeFromSize(size) - sizeof(Header);
     }
 
 private:
     // Once pages have been used for one thread heap they will never
     // be reused for another thread heap. Instead of unmapping, we add
     // the pages to a pool of pages to be reused later by this thread
@@ skipping 1501 matching lines @@
 };
 
 template<typename T>
 struct IfWeakMember<WeakMember<T> > {
     static bool isDead(Visitor* visitor, const WeakMember<T>& t) { return !visitor->isAlive(t.get()); }
 };
 
 }
 
 #endif // Heap_h