This patch adds two macros to declare per-type allocators:
- JS_DECLARE_ALLOCATOR(TypeName)
- JS_DEFINE_ALLOCATOR(TypeName)
When used, they add a type-specific CellAllocator that the Heap will
delegate allocation requests to.
The result of this is that GC objects of the same type always end up
within the same HeapBlock, drastically reducing the ability to perform
type confusion attacks.
It also improves HeapBlock utilization, since each block now has cells
sized exactly to the type used within that block. (Previously we only
had a handful of block sizes available, and most GC allocations ended
up with a large amount of slack in their tails.)
There is a small performance hit from this, but I'm sure we can make
up for it elsewhere.
Note that the old size-based allocators still exist, and we fall back
to them for any type that doesn't have its own CellAllocator.
Note that as of this commit, there aren't any such throwers, and the
call site in Heap::allocate will drop exceptions on the floor. This
commit only serves to change the declaration of the overrides, make sure
they return an empty value, and to propagate OOM errors frm their base
initialize invocations.
This is a continuation of the previous commit.
Calling initialize() is the first thing that's done after allocating a
cell on the JS heap - and in the common case of allocating an object,
that's where properties are assigned and intrinsics occasionally
accessed.
Since those are supposed to live on the realm eventually, this is
another step into that direction.
No functional changes - we can still very easily get to the global
object via `Realm::global_object()`. This is in preparation of moving
the intrinsics to the realm and no longer having to pass a global
object when allocating any object.
In a few (now, and many more in subsequent commits) places we get a
realm using `GlobalObject::associated_realm()`, this is intended to be
temporary. For example, create() functions will later receive the same
treatment and are passed a realm instead of a global object.
This commit upstreams most of the C++ bits of the LibJS test262 runner
at https://github.com/linusg/libjs-test262/, specifically everything but
the main.cpp file serving as the actual executable.
Since all of these are just regular JS objects, I opted to put them in
LibJS itself, in a new Contrib/ directory like many other projects have
one. Other code that can end up there in the future is the runtime for
esvu, which might even share some functionality with test262's $262
object.
The code has been copied verbatim, and only a small number of changes
have been made:
- Putting everything into the JS::Test262 namespace
- Removing now redundant JS namespace prefixes
- Updating includes to use absolute <LibJS/...> paths
- Updating the SPDX-License-Identifier comments from MIT to BSD-2-Clause
I gained permission to change the license and upstream these changes
from all the major contributors to this code: Ali, Andrew, David, Idan.
The removal of the code from the source repository is here:
https://github.com/linusg/libjs-test262/pull/54
This is only the first step, the goal is to eventually upstream the
actual libjs-test262-runner executable and supporting Python scripts
into SerenityOS as well.
