LibJS: Segregate GC-allocated objects by type

This patch adds two macros to declare per-type allocators:

- JS_DECLARE_ALLOCATOR(TypeName)
- JS_DEFINE_ALLOCATOR(TypeName)

When used, they add a type-specific CellAllocator that the Heap will
delegate allocation requests to.

The result of this is that GC objects of the same type always end up
within the same HeapBlock, drastically reducing the ability to perform
type confusion attacks.

It also improves HeapBlock utilization, since each block now has cells
sized exactly to the type used within that block. (Previously we only
had a handful of block sizes available, and most GC allocations ended
up with a large amount of slack in their tails.)

There is a small performance hit from this, but I'm sure we can make
up for it elsewhere.

Note that the old size-based allocators still exist, and we fall back
to them for any type that doesn't have its own CellAllocator.

Userland/Libraries/LibJS/CMakeLists.txt

@@ -34,6 +34,7 @@ set(SOURCES
     ParserError.cpp
     Print.cpp
     Runtime/AbstractOperations.cpp
+    Runtime/Accessor.cpp
     Runtime/AggregateError.cpp
     Runtime/AggregateErrorConstructor.cpp
     Runtime/AggregateErrorPrototype.cpp

Userland/Libraries/LibJS/Contrib/Test262/262Object.cpp

@@ -21,6 +21,8 @@
 
 namespace JS::Test262 {
 
+JS_DEFINE_ALLOCATOR($262Object);
+
 $262Object::$262Object(Realm& realm)
     : Object(Object::ConstructWithoutPrototypeTag::Tag, realm)
 {

Userland/Libraries/LibJS/Contrib/Test262/262Object.h

@@ -15,6 +15,7 @@ namespace JS::Test262 {
 
 class $262Object final : public Object {
     JS_OBJECT($262Object, Object);
+    JS_DECLARE_ALLOCATOR($262Object);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Contrib/Test262/AgentObject.cpp

@@ -12,6 +12,8 @@
 
 namespace JS::Test262 {
 
+JS_DEFINE_ALLOCATOR(AgentObject);
+
 AgentObject::AgentObject(Realm& realm)
     : Object(Object::ConstructWithoutPrototypeTag::Tag, realm)
 {

Userland/Libraries/LibJS/Contrib/Test262/AgentObject.h

@@ -13,6 +13,7 @@ namespace JS::Test262 {
 
 class AgentObject final : public Object {
     JS_OBJECT(AgentObject, Object);
+    JS_DECLARE_ALLOCATOR(AgentObject);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Contrib/Test262/GlobalObject.cpp

@@ -14,6 +14,8 @@
 
 namespace JS::Test262 {
 
+JS_DEFINE_ALLOCATOR(GlobalObject);
+
 void GlobalObject::initialize(Realm& realm)
 {
     Base::initialize(realm);

Userland/Libraries/LibJS/Contrib/Test262/GlobalObject.h

@@ -13,6 +13,7 @@ namespace JS::Test262 {
 
 class GlobalObject final : public JS::GlobalObject {
     JS_OBJECT(GlobalObject, JS::GlobalObject);
+    JS_DECLARE_ALLOCATOR(GlobalObject);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Contrib/Test262/IsHTMLDDA.cpp

@@ -9,6 +9,8 @@
 
 namespace JS::Test262 {
 
+JS_DEFINE_ALLOCATOR(IsHTMLDDA);
+
 IsHTMLDDA::IsHTMLDDA(Realm& realm)
     // NativeFunction without prototype is currently not possible (only due to the lack of a ctor that supports it)
     : NativeFunction("IsHTMLDDA", realm.intrinsics().function_prototype())

Userland/Libraries/LibJS/Contrib/Test262/IsHTMLDDA.h

@@ -12,6 +12,7 @@ namespace JS::Test262 {
 
 class IsHTMLDDA final : public NativeFunction {
     JS_OBJECT(IsHTMLDDA, NativeFunction);
+    JS_DECLARE_ALLOCATOR(IsHTMLDDA);
 
 public:
     virtual ~IsHTMLDDA() override = default;

Userland/Libraries/LibJS/CyclicModule.cpp

@@ -15,6 +15,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(CyclicModule);
+
 CyclicModule::CyclicModule(Realm& realm, StringView filename, bool has_top_level_await, Vector<ModuleRequest> requested_modules, Script::HostDefined* host_defined)
     : Module(realm, filename, host_defined)
     , m_requested_modules(move(requested_modules))

Userland/Libraries/LibJS/CyclicModule.h

@@ -42,6 +42,7 @@ struct GraphLoadingState {
 // 16.2.1.5 Cyclic Module Records, https://tc39.es/ecma262/#cyclic-module-record
 class CyclicModule : public Module {
     JS_CELL(CyclicModule, Module);
+    JS_DECLARE_ALLOCATOR(CyclicModule);
 
 public:
     // Note: Do not call these methods directly unless you are HostResolveImportedModule.

Userland/Libraries/LibJS/Heap/CellAllocator.h

@@ -11,6 +11,12 @@
 #include <LibJS/Forward.h>
 #include <LibJS/Heap/HeapBlock.h>
 
+#define JS_DECLARE_ALLOCATOR(ClassName) \
+    static JS::TypeIsolatingCellAllocator<ClassName> cell_allocator;
+
+#define JS_DEFINE_ALLOCATOR(ClassName) \
+    JS::TypeIsolatingCellAllocator<ClassName> ClassName::cell_allocator;
+
 namespace JS {
 
 class CellAllocator {
@@ -40,11 +46,19 @@ public:
     void block_did_become_usable(Badge<Heap>, HeapBlock&);
 
 private:
-    const size_t m_cell_size;
+    size_t const m_cell_size;
 
     using BlockList = IntrusiveList<&HeapBlock::m_list_node>;
     BlockList m_full_blocks;
     BlockList m_usable_blocks;
 };
 
+template<typename T>
+class TypeIsolatingCellAllocator {
+public:
+    using CellType = T;
+
+    CellAllocator allocator { sizeof(T) };
+};
+
 }

Userland/Libraries/LibJS/Heap/Heap.cpp

@@ -70,17 +70,7 @@ Heap::~Heap()
     collect_garbage(CollectionType::CollectEverything);
 }
 
-ALWAYS_INLINE CellAllocator& Heap::allocator_for_size(size_t cell_size)
+void Heap::will_allocate(size_t size)
-{
-    for (auto& allocator : m_allocators) {
-        if (allocator->cell_size() >= cell_size)
-            return *allocator;
-    }
-    dbgln("Cannot get CellAllocator for cell size {}, largest available is {}!", cell_size, m_allocators.last()->cell_size());
-    VERIFY_NOT_REACHED();
-}
-
-Cell* Heap::allocate_cell(size_t size)
 {
     if (should_collect_on_every_allocation()) {
         m_allocated_bytes_since_last_gc = 0;
@@ -91,8 +81,6 @@ Cell* Heap::allocate_cell(size_t size)
     }
 
     m_allocated_bytes_since_last_gc += size;
-    auto& allocator = allocator_for_size(size);
-    return allocator.allocate_cell(*this);
 }
 
 static void add_possible_value(HashMap<FlatPtr, HeapRoot>& possible_pointers, FlatPtr data, HeapRoot origin, FlatPtr min_block_address, FlatPtr max_block_address)

Userland/Libraries/LibJS/Heap/Heap.h

@@ -38,7 +38,7 @@ public:
     template<typename T, typename... Args>
     NonnullGCPtr<T> allocate_without_realm(Args&&... args)
     {
-        auto* memory = allocate_cell(sizeof(T));
+        auto* memory = allocate_cell<T>();
         defer_gc();
         new (memory) T(forward<Args>(args)...);
         undefer_gc();
@@ -48,7 +48,7 @@ public:
     template<typename T, typename... Args>
     NonnullGCPtr<T> allocate(Realm& realm, Args&&... args)
     {
-        auto* memory = allocate_cell(sizeof(T));
+        auto* memory = allocate_cell<T>();
         defer_gc();
         new (memory) T(forward<Args>(args)...);
         undefer_gc();
@@ -91,7 +91,19 @@ private:
 
     static bool cell_must_survive_garbage_collection(Cell const&);
 
-    Cell* allocate_cell(size_t);
+    template<typename T>
+    Cell* allocate_cell()
+    {
+        will_allocate(sizeof(T));
+        if constexpr (requires { T::cell_allocator.allocate_cell(*this); }) {
+            if constexpr (IsSame<T, typename decltype(T::cell_allocator)::CellType>) {
+                return T::cell_allocator.allocate_cell(*this);
+            }
+        }
+        return allocator_for_size(sizeof(T)).allocate_cell(*this);
+    }
+
+    void will_allocate(size_t);
 
     void find_min_and_max_block_addresses(FlatPtr& min_address, FlatPtr& max_address);
     void gather_roots(HashMap<Cell*, HeapRoot>&);
@@ -101,7 +113,16 @@ private:
     void finalize_unmarked_cells();
     void sweep_dead_cells(bool print_report, Core::ElapsedTimer const&);
 
-    CellAllocator& allocator_for_size(size_t);
+    ALWAYS_INLINE CellAllocator& allocator_for_size(size_t cell_size)
+    {
+        // FIXME: Use binary search?
+        for (auto& allocator : m_allocators) {
+            if (allocator->cell_size() >= cell_size)
+                return *allocator;
+        }
+        dbgln("Cannot get CellAllocator for cell size {}, largest available is {}!", cell_size, m_allocators.last()->cell_size());
+        VERIFY_NOT_REACHED();
+    }
 
     template<typename Callback>
     void for_each_block(Callback callback)

Userland/Libraries/LibJS/Module.cpp

@@ -15,6 +15,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(Module);
+
 Module::Module(Realm& realm, DeprecatedString filename, Script::HostDefined* host_defined)
     : m_realm(realm)
     , m_host_defined(host_defined)

Userland/Libraries/LibJS/Module.h

@@ -58,6 +58,7 @@ struct ResolvedBinding {
 // 16.2.1.4 Abstract Module Records, https://tc39.es/ecma262/#sec-abstract-module-records
 class Module : public Cell {
     JS_CELL(Module, Cell);
+    JS_DECLARE_ALLOCATOR(Module);
 
 public:
     virtual ~Module() override;

Userland/Libraries/LibJS/Runtime/Accessor.cpp

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2023, Andreas Kling <kling@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <LibJS/Runtime/Accessor.h>
+
+namespace JS {
+
+JS_DEFINE_ALLOCATOR(Accessor);
+
+}

Userland/Libraries/LibJS/Runtime/Accessor.h

@@ -15,6 +15,7 @@ namespace JS {
 
 class Accessor final : public Cell {
     JS_CELL(Accessor, Cell);
+    JS_DECLARE_ALLOCATOR(Accessor);
 
 public:
     static NonnullGCPtr<Accessor> create(VM& vm, FunctionObject* getter, FunctionObject* setter)

Userland/Libraries/LibJS/Runtime/AggregateError.cpp

@@ -10,6 +10,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AggregateError);
+
 NonnullGCPtr<AggregateError> AggregateError::create(Realm& realm)
 {
     return realm.heap().allocate<AggregateError>(realm, realm.intrinsics().aggregate_error_prototype());

Userland/Libraries/LibJS/Runtime/AggregateError.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class AggregateError : public Error {
     JS_OBJECT(AggregateError, Error);
+    JS_DECLARE_ALLOCATOR(AggregateError);
 
 public:
     static NonnullGCPtr<AggregateError> create(Realm&);

Userland/Libraries/LibJS/Runtime/AggregateErrorConstructor.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AggregateErrorConstructor);
+
 AggregateErrorConstructor::AggregateErrorConstructor(Realm& realm)
     : NativeFunction(static_cast<Object&>(*realm.intrinsics().error_constructor()))
 {

Userland/Libraries/LibJS/Runtime/AggregateErrorConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AggregateErrorConstructor final : public NativeFunction {
     JS_OBJECT(AggregateErrorConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(AggregateErrorConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AggregateErrorPrototype.cpp

@@ -10,6 +10,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AggregateErrorPrototype);
+
 AggregateErrorPrototype::AggregateErrorPrototype(Realm& realm)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().error_prototype())
 {

Userland/Libraries/LibJS/Runtime/AggregateErrorPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AggregateErrorPrototype final : public Object {
     JS_OBJECT(AggregateErrorPrototype, Object);
+    JS_DECLARE_ALLOCATOR(AggregateErrorPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/ArgumentsObject.cpp

@@ -10,6 +10,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArgumentsObject);
+
 ArgumentsObject::ArgumentsObject(Realm& realm, Environment& environment)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().object_prototype(), MayInterfereWithIndexedPropertyAccess::Yes)
     , m_environment(environment)

Userland/Libraries/LibJS/Runtime/ArgumentsObject.h

@@ -14,6 +14,7 @@ namespace JS {
 
 class ArgumentsObject final : public Object {
     JS_OBJECT(ArgumentsObject, Object);
+    JS_DECLARE_ALLOCATOR(ArgumentsObject);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/Array.cpp

@@ -17,6 +17,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(Array);
+
 // 10.4.2.2 ArrayCreate ( length [ , proto ] ), https://tc39.es/ecma262/#sec-arraycreate
 ThrowCompletionOr<NonnullGCPtr<Array>> Array::create(Realm& realm, u64 length, Object* prototype)
 {

Userland/Libraries/LibJS/Runtime/Array.h

@@ -21,6 +21,7 @@ namespace JS {
 
 class Array : public Object {
     JS_OBJECT(Array, Object);
+    JS_DECLARE_ALLOCATOR(Array);
 
 public:
     static ThrowCompletionOr<NonnullGCPtr<Array>> create(Realm&, u64 length, Object* prototype = nullptr);

Userland/Libraries/LibJS/Runtime/ArrayBuffer.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayBuffer);
+
 ThrowCompletionOr<NonnullGCPtr<ArrayBuffer>> ArrayBuffer::create(Realm& realm, size_t byte_length)
 {
     auto buffer = ByteBuffer::create_zeroed(byte_length);

Userland/Libraries/LibJS/Runtime/ArrayBuffer.h

@@ -48,6 +48,7 @@ struct DataBlock {
 
 class ArrayBuffer : public Object {
     JS_OBJECT(ArrayBuffer, Object);
+    JS_DECLARE_ALLOCATOR(ArrayBuffer);
 
 public:
     static ThrowCompletionOr<NonnullGCPtr<ArrayBuffer>> create(Realm&, size_t);

Userland/Libraries/LibJS/Runtime/ArrayBufferConstructor.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayBufferConstructor);
+
 ArrayBufferConstructor::ArrayBufferConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.ArrayBuffer.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/ArrayBufferConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class ArrayBufferConstructor final : public NativeFunction {
     JS_OBJECT(ArrayBufferConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(ArrayBufferConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/ArrayBufferPrototype.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayBufferPrototype);
+
 ArrayBufferPrototype::ArrayBufferPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/ArrayBufferPrototype.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class ArrayBufferPrototype final : public PrototypeObject<ArrayBufferPrototype, ArrayBuffer> {
     JS_PROTOTYPE_OBJECT(ArrayBufferPrototype, ArrayBuffer, ArrayBuffer);
+    JS_DECLARE_ALLOCATOR(ArrayBufferPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/ArrayConstructor.cpp

@@ -22,6 +22,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayConstructor);
+
 ArrayConstructor::ArrayConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.Array.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/ArrayConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class ArrayConstructor final : public NativeFunction {
     JS_OBJECT(ArrayConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(ArrayConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/ArrayIterator.cpp

@@ -9,6 +9,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayIterator);
+
 NonnullGCPtr<ArrayIterator> ArrayIterator::create(Realm& realm, Value array, Object::PropertyKind iteration_kind)
 {
     return realm.heap().allocate<ArrayIterator>(realm, array, iteration_kind, realm.intrinsics().array_iterator_prototype());

Userland/Libraries/LibJS/Runtime/ArrayIterator.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class ArrayIterator final : public Object {
     JS_OBJECT(ArrayIterator, Object);
+    JS_DECLARE_ALLOCATOR(ArrayIterator);
 
 public:
     static NonnullGCPtr<ArrayIterator> create(Realm&, Value array, Object::PropertyKind iteration_kind);

Userland/Libraries/LibJS/Runtime/ArrayIteratorPrototype.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayIteratorPrototype);
+
 ArrayIteratorPrototype::ArrayIteratorPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().iterator_prototype())
 {

Userland/Libraries/LibJS/Runtime/ArrayIteratorPrototype.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class ArrayIteratorPrototype final : public PrototypeObject<ArrayIteratorPrototype, ArrayIterator> {
     JS_PROTOTYPE_OBJECT(ArrayIteratorPrototype, ArrayIterator, ArrayIterator);
+    JS_DECLARE_ALLOCATOR(ArrayIteratorPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/ArrayPrototype.cpp

@@ -27,6 +27,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ArrayPrototype);
+
 static HashTable<NonnullGCPtr<Object>> s_array_join_seen_objects;
 
 ArrayPrototype::ArrayPrototype(Realm& realm)

Userland/Libraries/LibJS/Runtime/ArrayPrototype.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class ArrayPrototype final : public Array {
     JS_OBJECT(ArrayPrototype, Array);
+    JS_DECLARE_ALLOCATOR(ArrayPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncFromSyncIterator.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncFromSyncIterator);
+
 NonnullGCPtr<AsyncFromSyncIterator> AsyncFromSyncIterator::create(Realm& realm, IteratorRecord sync_iterator_record)
 {
     return realm.heap().allocate<AsyncFromSyncIterator>(realm, realm, sync_iterator_record);

Userland/Libraries/LibJS/Runtime/AsyncFromSyncIterator.h

@@ -15,6 +15,7 @@ namespace JS {
 // 27.1.4.3 Properties of Async-from-Sync Iterator Instances, https://tc39.es/ecma262/#sec-properties-of-async-from-sync-iterator-instances
 class AsyncFromSyncIterator final : public Object {
     JS_OBJECT(AsyncFromSyncIterator, Object);
+    JS_DECLARE_ALLOCATOR(AsyncFromSyncIterator);
 
 public:
     static NonnullGCPtr<AsyncFromSyncIterator> create(Realm&, IteratorRecord sync_iterator_record);

Userland/Libraries/LibJS/Runtime/AsyncFromSyncIteratorPrototype.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DECLARE_ALLOCATOR(AsyncFromSyncIteratorPrototype);
+
 AsyncFromSyncIteratorPrototype::AsyncFromSyncIteratorPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().async_iterator_prototype())
 {

Userland/Libraries/LibJS/Runtime/AsyncFromSyncIteratorPrototype.h

@@ -17,6 +17,7 @@ namespace JS {
 // 27.1.4.2 The %AsyncFromSyncIteratorPrototype% Object, https://tc39.es/ecma262/#sec-%asyncfromsynciteratorprototype%-object
 class AsyncFromSyncIteratorPrototype final : public PrototypeObject<AsyncFromSyncIteratorPrototype, AsyncFromSyncIterator> {
     JS_PROTOTYPE_OBJECT(AsyncFromSyncIteratorPrototype, AsyncFromSyncIterator, AsyncFromSyncIterator);
+    JS_DECLARE_ALLOCATOR(AsyncFromSyncIteratorPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncFunctionConstructor.cpp

@@ -12,6 +12,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncFunctionConstructor);
+
 AsyncFunctionConstructor::AsyncFunctionConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.AsyncFunction.as_string(), realm.intrinsics().function_constructor())
 {

Userland/Libraries/LibJS/Runtime/AsyncFunctionConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AsyncFunctionConstructor final : public NativeFunction {
     JS_OBJECT(AsyncFunctionConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(AsyncFunctionConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncFunctionDriverWrapper.cpp

@@ -15,6 +15,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncFunctionDriverWrapper);
+
 NonnullGCPtr<Promise> AsyncFunctionDriverWrapper::create(Realm& realm, GeneratorObject* generator_object)
 {
     auto top_level_promise = Promise::create(realm);

Userland/Libraries/LibJS/Runtime/AsyncFunctionDriverWrapper.h

@@ -16,6 +16,7 @@ namespace JS {
 
 class AsyncFunctionDriverWrapper final : public Promise {
     JS_OBJECT(AsyncFunctionDriverWrapper, Promise);
+    JS_DECLARE_ALLOCATOR(AsyncFunctionDriverWrapper);
 
 public:
     enum class IsInitialExecution {

Userland/Libraries/LibJS/Runtime/AsyncFunctionPrototype.cpp

@@ -9,6 +9,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncFunctionPrototype);
+
 AsyncFunctionPrototype::AsyncFunctionPrototype(Realm& realm)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/AsyncFunctionPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AsyncFunctionPrototype final : public Object {
     JS_OBJECT(AsyncFunctionPrototype, Object);
+    JS_DECLARE_ALLOCATOR(AsyncFunctionPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncGenerator.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncGenerator);
+
 ThrowCompletionOr<NonnullGCPtr<AsyncGenerator>> AsyncGenerator::create(Realm& realm, Value initial_value, ECMAScriptFunctionObject* generating_function, ExecutionContext execution_context, Bytecode::CallFrame frame)
 {
     auto& vm = realm.vm();

Userland/Libraries/LibJS/Runtime/AsyncGenerator.h

@@ -17,6 +17,7 @@ namespace JS {
 // 27.6.2 Properties of AsyncGenerator Instances, https://tc39.es/ecma262/#sec-properties-of-asyncgenerator-intances
 class AsyncGenerator final : public Object {
     JS_OBJECT(AsyncGenerator, Object);
+    JS_DECLARE_ALLOCATOR(AsyncGenerator);
 
 public:
     enum class State {

Userland/Libraries/LibJS/Runtime/AsyncGeneratorFunctionConstructor.cpp

@@ -12,6 +12,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncGeneratorFunctionConstructor);
+
 AsyncGeneratorFunctionConstructor::AsyncGeneratorFunctionConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.AsyncGeneratorFunction.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/AsyncGeneratorFunctionConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AsyncGeneratorFunctionConstructor final : public NativeFunction {
     JS_OBJECT(AsyncGeneratorFunctionConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(AsyncGeneratorFunctionConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncGeneratorFunctionPrototype.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncGeneratorFunctionPrototype);
+
 AsyncGeneratorFunctionPrototype::AsyncGeneratorFunctionPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/AsyncGeneratorFunctionPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AsyncGeneratorFunctionPrototype final : public PrototypeObject<AsyncGeneratorFunctionPrototype, AsyncGeneratorFunction> {
     JS_PROTOTYPE_OBJECT(AsyncGeneratorFunctionPrototype, AsyncGeneratorFunction, AsyncGeneratorFunction);
+    JS_DECLARE_ALLOCATOR(AsyncGeneratorFunctionPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncGeneratorPrototype.cpp

@@ -12,6 +12,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncGeneratorPrototype);
+
 // 27.6.1 Properties of the AsyncGenerator Prototype Object, https://tc39.es/ecma262/#sec-properties-of-asyncgenerator-prototype
 AsyncGeneratorPrototype::AsyncGeneratorPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().async_iterator_prototype())

Userland/Libraries/LibJS/Runtime/AsyncGeneratorPrototype.h

@@ -14,6 +14,7 @@ namespace JS {
 
 class AsyncGeneratorPrototype final : public PrototypeObject<AsyncGeneratorPrototype, AsyncGenerator> {
     JS_PROTOTYPE_OBJECT(AsyncGeneratorPrototype, AsyncGenerator, AsyncGenerator)
+    JS_DECLARE_ALLOCATOR(AsyncGeneratorPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AsyncIteratorPrototype.cpp

@@ -8,6 +8,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AsyncIteratorPrototype);
+
 AsyncIteratorPrototype::AsyncIteratorPrototype(Realm& realm)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/AsyncIteratorPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AsyncIteratorPrototype final : public Object {
     JS_OBJECT(AsyncIteratorPrototype, Object)
+    JS_DECLARE_ALLOCATOR(AsyncIteratorPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/AtomicsObject.cpp

@@ -23,6 +23,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(AtomicsObject);
+
 // 25.4.2.1 ValidateIntegerTypedArray ( typedArray [ , waitable ] ), https://tc39.es/ecma262/#sec-validateintegertypedarray
 static ThrowCompletionOr<ArrayBuffer*> validate_integer_typed_array(VM& vm, TypedArrayBase& typed_array, bool waitable = false)
 {

Userland/Libraries/LibJS/Runtime/AtomicsObject.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class AtomicsObject : public Object {
     JS_OBJECT(AtomicsObject, Object);
+    JS_DECLARE_ALLOCATOR(AtomicsObject);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/BigInt.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BigInt);
+
 NonnullGCPtr<BigInt> BigInt::create(VM& vm, Crypto::SignedBigInteger big_integer)
 {
     return vm.heap().allocate_without_realm<BigInt>(move(big_integer));

Userland/Libraries/LibJS/Runtime/BigInt.h

@@ -11,11 +11,13 @@
 #include <AK/StringView.h>
 #include <LibCrypto/BigInt/SignedBigInteger.h>
 #include <LibJS/Heap/Cell.h>
+#include <LibJS/Heap/CellAllocator.h>
 
 namespace JS {
 
 class BigInt final : public Cell {
     JS_CELL(BigInt, Cell);
+    JS_DECLARE_ALLOCATOR(BigInt);
 
 public:
     [[nodiscard]] static NonnullGCPtr<BigInt> create(VM&, Crypto::SignedBigInteger);

Userland/Libraries/LibJS/Runtime/BigIntConstructor.cpp

@@ -15,6 +15,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BigIntConstructor);
+
 static const Crypto::SignedBigInteger BIGINT_ONE { 1 };
 
 BigIntConstructor::BigIntConstructor(Realm& realm)

Userland/Libraries/LibJS/Runtime/BigIntConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class BigIntConstructor final : public NativeFunction {
     JS_OBJECT(BigIntConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(BigIntConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/BigIntObject.cpp

@@ -9,6 +9,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BigIntObject);
+
 NonnullGCPtr<BigIntObject> BigIntObject::create(Realm& realm, BigInt& bigint)
 {
     return realm.heap().allocate<BigIntObject>(realm, bigint, realm.intrinsics().bigint_prototype());

Userland/Libraries/LibJS/Runtime/BigIntObject.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class BigIntObject final : public Object {
     JS_OBJECT(BigIntObject, Object);
+    JS_DECLARE_ALLOCATOR(BigIntObject);
 
 public:
     static NonnullGCPtr<BigIntObject> create(Realm&, BigInt&);

Userland/Libraries/LibJS/Runtime/BigIntPrototype.cpp

@@ -17,6 +17,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BigIntPrototype);
+
 BigIntPrototype::BigIntPrototype(Realm& realm)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/BigIntPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class BigIntPrototype final : public Object {
     JS_OBJECT(BigIntPrototype, Object);
+    JS_DECLARE_ALLOCATOR(BigIntPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/BooleanConstructor.cpp

@@ -13,6 +13,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BooleanConstructor);
+
 BooleanConstructor::BooleanConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.Boolean.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/BooleanConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class BooleanConstructor final : public NativeFunction {
     JS_OBJECT(BooleanConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(BooleanConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/BooleanObject.cpp

@@ -9,6 +9,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BooleanObject);
+
 NonnullGCPtr<BooleanObject> BooleanObject::create(Realm& realm, bool value)
 {
     return realm.heap().allocate<BooleanObject>(realm, value, realm.intrinsics().boolean_prototype());

Userland/Libraries/LibJS/Runtime/BooleanObject.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class BooleanObject : public Object {
     JS_OBJECT(BooleanObject, Object);
+    JS_DECLARE_ALLOCATOR(BooleanObject);
 
 public:
     static NonnullGCPtr<BooleanObject> create(Realm&, bool);

Userland/Libraries/LibJS/Runtime/BooleanPrototype.cpp

@@ -13,6 +13,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BooleanPrototype);
+
 BooleanPrototype::BooleanPrototype(Realm& realm)
     : BooleanObject(false, realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/BooleanPrototype.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class BooleanPrototype final : public BooleanObject {
     JS_OBJECT(BooleanPrototype, BooleanObject);
+    JS_DECLARE_ALLOCATOR(BooleanPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/BoundFunction.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(BoundFunction);
+
 // 10.4.1.3 BoundFunctionCreate ( targetFunction, boundThis, boundArgs ), https://tc39.es/ecma262/#sec-boundfunctioncreate
 ThrowCompletionOr<NonnullGCPtr<BoundFunction>> BoundFunction::create(Realm& realm, FunctionObject& target_function, Value bound_this, Vector<Value> bound_arguments)
 {

Userland/Libraries/LibJS/Runtime/BoundFunction.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class BoundFunction final : public FunctionObject {
     JS_OBJECT(BoundFunction, FunctionObject);
+    JS_DECLARE_ALLOCATOR(BoundFunction);
 
 public:
     static ThrowCompletionOr<NonnullGCPtr<BoundFunction>> create(Realm&, FunctionObject& target_function, Value bound_this, Vector<Value> bound_arguments);

Userland/Libraries/LibJS/Runtime/ConsoleObject.cpp

@@ -12,6 +12,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(ConsoleObject);
+
 ConsoleObject::ConsoleObject(Realm& realm)
     : Object(ConstructWithPrototypeTag::Tag, realm.intrinsics().object_prototype())
     , m_console(make<Console>(realm))

Userland/Libraries/LibJS/Runtime/ConsoleObject.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class ConsoleObject final : public Object {
     JS_OBJECT(ConsoleObject, Object);
+    JS_DECLARE_ALLOCATOR(ConsoleObject);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/DataView.cpp

@@ -8,6 +8,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DataView);
+
 NonnullGCPtr<DataView> DataView::create(Realm& realm, ArrayBuffer* viewed_buffer, size_t byte_length, size_t byte_offset)
 {
     return realm.heap().allocate<DataView>(realm, viewed_buffer, byte_length, byte_offset, realm.intrinsics().data_view_prototype());

Userland/Libraries/LibJS/Runtime/DataView.h

@@ -14,6 +14,7 @@ namespace JS {
 
 class DataView : public Object {
     JS_OBJECT(DataView, Object);
+    JS_DECLARE_ALLOCATOR(DataView);
 
 public:
     static NonnullGCPtr<DataView> create(Realm&, ArrayBuffer*, size_t byte_length, size_t byte_offset);

Userland/Libraries/LibJS/Runtime/DataViewConstructor.cpp

@@ -14,6 +14,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DataViewConstructor);
+
 DataViewConstructor::DataViewConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.DataView.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/DataViewConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class DataViewConstructor final : public NativeFunction {
     JS_OBJECT(DataViewConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(DataViewConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/DataViewPrototype.cpp

@@ -11,6 +11,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DataViewPrototype);
+
 DataViewPrototype::DataViewPrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/DataViewPrototype.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class DataViewPrototype final : public PrototypeObject<DataViewPrototype, DataView> {
     JS_PROTOTYPE_OBJECT(DataViewPrototype, DataView, DataView);
+    JS_DECLARE_ALLOCATOR(DataViewPrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/Date.cpp

@@ -17,6 +17,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(Date);
+
 static Crypto::SignedBigInteger const s_one_billion_bigint { 1'000'000'000 };
 static Crypto::SignedBigInteger const s_one_million_bigint { 1'000'000 };
 static Crypto::SignedBigInteger const s_one_thousand_bigint { 1'000 };

Userland/Libraries/LibJS/Runtime/Date.h

@@ -14,6 +14,7 @@ namespace JS {
 
 class Date final : public Object {
     JS_OBJECT(Date, Object);
+    JS_DECLARE_ALLOCATOR(Date);
 
 public:
     static NonnullGCPtr<Date> create(Realm&, double date_value);

Userland/Libraries/LibJS/Runtime/DateConstructor.cpp

@@ -23,6 +23,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DateConstructor);
+
 // 21.4.3.2 Date.parse ( string ), https://tc39.es/ecma262/#sec-date.parse
 static double parse_simplified_iso8601(DeprecatedString const& iso_8601)
 {

Userland/Libraries/LibJS/Runtime/DateConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class DateConstructor final : public NativeFunction {
     JS_OBJECT(DateConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(DateConstructor);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/DatePrototype.cpp

@@ -30,6 +30,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DatePrototype);
+
 DatePrototype::DatePrototype(Realm& realm)
     : PrototypeObject(realm.intrinsics().object_prototype())
 {

Userland/Libraries/LibJS/Runtime/DatePrototype.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class DatePrototype final : public PrototypeObject<DatePrototype, Date> {
     JS_PROTOTYPE_OBJECT(DatePrototype, Date, Date);
+    JS_DECLARE_ALLOCATOR(DatePrototype);
 
 public:
     virtual void initialize(Realm&) override;

Userland/Libraries/LibJS/Runtime/DeclarativeEnvironment.cpp

@@ -13,6 +13,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DeclarativeEnvironment);
+
 DeclarativeEnvironment* DeclarativeEnvironment::create_for_per_iteration_bindings(Badge<ForStatement>, DeclarativeEnvironment& other, size_t bindings_size)
 {
     auto bindings = other.m_bindings.span().slice(0, bindings_size);

Userland/Libraries/LibJS/Runtime/DeclarativeEnvironment.h

@@ -17,6 +17,7 @@ namespace JS {
 
 class DeclarativeEnvironment : public Environment {
     JS_ENVIRONMENT(DeclarativeEnvironment, Environment);
+    JS_DECLARE_ALLOCATOR(DeclarativeEnvironment);
 
     struct Binding {
         static FlatPtr value_offset() { return OFFSET_OF(Binding, value); }

Userland/Libraries/LibJS/Runtime/DisposableStack.cpp

@@ -8,6 +8,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DisposableStack);
+
 DisposableStack::DisposableStack(Vector<DisposableResource> stack, Object& prototype)
     : Object(ConstructWithPrototypeTag::Tag, prototype)
     , m_disposable_resource_stack(move(stack))

Userland/Libraries/LibJS/Runtime/DisposableStack.h

@@ -13,6 +13,7 @@ namespace JS {
 
 class DisposableStack final : public Object {
     JS_OBJECT(DisposableStack, Object);
+    JS_DECLARE_ALLOCATOR(DisposableStack);
 
 public:
     virtual ~DisposableStack() override = default;

Userland/Libraries/LibJS/Runtime/DisposableStackConstructor.cpp

@@ -10,6 +10,8 @@
 
 namespace JS {
 
+JS_DEFINE_ALLOCATOR(DisposableStackConstructor);
+
 DisposableStackConstructor::DisposableStackConstructor(Realm& realm)
     : NativeFunction(realm.vm().names.DisposableStack.as_string(), realm.intrinsics().function_prototype())
 {

Userland/Libraries/LibJS/Runtime/DisposableStackConstructor.h

@@ -12,6 +12,7 @@ namespace JS {
 
 class DisposableStackConstructor final : public NativeFunction {
     JS_OBJECT(DisposableStackConstructor, NativeFunction);
+    JS_DECLARE_ALLOCATOR(DisposableStackConstructor);
 
 public:
     virtual void initialize(Realm&) override;