mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 21:57:43 +00:00
LibJS: Segregate GC-allocated objects by type
This patch adds two macros to declare per-type allocators: - JS_DECLARE_ALLOCATOR(TypeName) - JS_DEFINE_ALLOCATOR(TypeName) When used, they add a type-specific CellAllocator that the Heap will delegate allocation requests to. The result of this is that GC objects of the same type always end up within the same HeapBlock, drastically reducing the ability to perform type confusion attacks. It also improves HeapBlock utilization, since each block now has cells sized exactly to the type used within that block. (Previously we only had a handful of block sizes available, and most GC allocations ended up with a large amount of slack in their tails.) There is a small performance hit from this, but I'm sure we can make up for it elsewhere. Note that the old size-based allocators still exist, and we fall back to them for any type that doesn't have its own CellAllocator.
This commit is contained in:
parent
84a8ee01e1
commit
3c74dc9f4d
428 changed files with 723 additions and 22 deletions
|
@ -14,6 +14,7 @@ namespace JS {
|
|||
|
||||
struct RemainingElements final : public Cell {
|
||||
JS_CELL(RemainingElements, Cell);
|
||||
JS_DECLARE_ALLOCATOR(RemainingElements);
|
||||
|
||||
u64 value { 0 };
|
||||
|
||||
|
@ -28,6 +29,7 @@ private:
|
|||
|
||||
class PromiseValueList final : public Cell {
|
||||
JS_CELL(PromiseValueList, Cell);
|
||||
JS_DECLARE_ALLOCATOR(PromiseValueList);
|
||||
|
||||
public:
|
||||
Vector<Value>& values() { return m_values; }
|
||||
|
@ -42,7 +44,8 @@ private:
|
|||
};
|
||||
|
||||
class PromiseResolvingElementFunction : public NativeFunction {
|
||||
JS_OBJECT(PromiseResolvingFunction, NativeFunction);
|
||||
JS_OBJECT(PromiseResolvingElementFunction, NativeFunction);
|
||||
JS_DECLARE_ALLOCATOR(PromiseResolvingElementFunction);
|
||||
|
||||
public:
|
||||
virtual void initialize(Realm&) override;
|
||||
|
@ -68,7 +71,8 @@ private:
|
|||
|
||||
// 27.2.4.1.3 Promise.all Resolve Element Functions, https://tc39.es/ecma262/#sec-promise.all-resolve-element-functions
|
||||
class PromiseAllResolveElementFunction final : public PromiseResolvingElementFunction {
|
||||
JS_OBJECT(PromiseResolvingFunction, NativeFunction);
|
||||
JS_OBJECT(PromiseAllResolveElementFunction, NativeFunction);
|
||||
JS_DECLARE_ALLOCATOR(PromiseAllResolveElementFunction);
|
||||
|
||||
public:
|
||||
static NonnullGCPtr<PromiseAllResolveElementFunction> create(Realm&, size_t, PromiseValueList&, NonnullGCPtr<PromiseCapability const>, RemainingElements&);
|
||||
|
@ -98,7 +102,8 @@ private:
|
|||
|
||||
// 27.2.4.2.3 Promise.allSettled Reject Element Functions, https://tc39.es/ecma262/#sec-promise.allsettled-reject-element-functions
|
||||
class PromiseAllSettledRejectElementFunction final : public PromiseResolvingElementFunction {
|
||||
JS_OBJECT(PromiseResolvingFunction, PromiseResolvingElementFunction);
|
||||
JS_OBJECT(PromiseAllSettledRejectElementFunction, PromiseResolvingElementFunction);
|
||||
JS_DECLARE_ALLOCATOR(PromiseAllSettledRejectElementFunction);
|
||||
|
||||
public:
|
||||
static NonnullGCPtr<PromiseAllSettledRejectElementFunction> create(Realm&, size_t, PromiseValueList&, NonnullGCPtr<PromiseCapability const>, RemainingElements&);
|
||||
|
@ -113,7 +118,8 @@ private:
|
|||
|
||||
// 27.2.4.3.2 Promise.any Reject Element Functions, https://tc39.es/ecma262/#sec-promise.any-reject-element-functions
|
||||
class PromiseAnyRejectElementFunction final : public PromiseResolvingElementFunction {
|
||||
JS_OBJECT(PromiseResolvingFunction, PromiseResolvingElementFunction);
|
||||
JS_OBJECT(PromiseAnyRejectElementFunction, PromiseResolvingElementFunction);
|
||||
JS_DECLARE_ALLOCATOR(PromiseAnyRejectElementFunction);
|
||||
|
||||
public:
|
||||
static NonnullGCPtr<PromiseAnyRejectElementFunction> create(Realm&, size_t, PromiseValueList&, NonnullGCPtr<PromiseCapability const>, RemainingElements&);
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue