<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[180829] releases/WebKitGTK/webkit-2.8/Source/bmalloc</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/180829">180829</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2015-02-28 03:31:11 -0800 (Sat, 28 Feb 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/180576">r180576</a> - bmalloc: Added a little more abstraction for large objects
https://bugs.webkit.org/show_bug.cgi?id=141978

Reviewed by Sam Weinig.

Previously, each client needed to manage the boundary tags of
a large object using free functions. This patch introduces a LargeObject
class that does things a little more automatically.

* bmalloc.xcodeproj/project.pbxproj:

* bmalloc/Allocator.cpp:
(bmalloc::Allocator::reallocate): Use the new LargeObject class.

* bmalloc/BeginTag.h:
(bmalloc::BeginTag::isInFreeList): Deleted. Moved this logic into the
LargeObject class.

* bmalloc/BoundaryTag.h:
(bmalloc::BoundaryTag::isSentinel):
(bmalloc::BoundaryTag::compactBegin):
(bmalloc::BoundaryTag::setRange):
(bmalloc::BoundaryTag::initSentinel): Added an explicit API for sentinels,
which we used to create and test for implicitly.

* bmalloc/BoundaryTagInlines.h:
(bmalloc::BoundaryTag::init):
(bmalloc::validate): Deleted.
(bmalloc::validatePrev): Deleted.
(bmalloc::validateNext): Deleted.
(bmalloc::BoundaryTag::mergeLeft): Deleted.
(bmalloc::BoundaryTag::mergeRight): Deleted.
(bmalloc::BoundaryTag::merge): Deleted.
(bmalloc::BoundaryTag::deallocate): Deleted.
(bmalloc::BoundaryTag::split): Deleted.
(bmalloc::BoundaryTag::allocate): Deleted. Moved this logic into the
LargeObject class.

* bmalloc/EndTag.h:
(bmalloc::EndTag::init):
(bmalloc::EndTag::operator=): Deleted. Re-reading this code, I found
special behavior in the assignment operator to be a surprising API.
So, I replaced the assignment operation with an explicit initializing
function.

* bmalloc/Heap.cpp:
(bmalloc::Heap::scavengeLargeRanges):
(bmalloc::Heap::allocateXLarge):
(bmalloc::Heap::findXLarge):
(bmalloc::Heap::deallocateXLarge):
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::deallocateLarge):
* bmalloc/Heap.h: No behavior changes here -- just adopting the
LargeObject interface.

* bmalloc/LargeObject.h: Added.
(bmalloc::LargeObject::operator!):
(bmalloc::LargeObject::begin):
(bmalloc::LargeObject::size):
(bmalloc::LargeObject::range):
(bmalloc::LargeObject::LargeObject):
(bmalloc::LargeObject::setFree):
(bmalloc::LargeObject::isFree):
(bmalloc::LargeObject::hasPhysicalPages):
(bmalloc::LargeObject::setHasPhysicalPages):
(bmalloc::LargeObject::isValidAndFree):
(bmalloc::LargeObject::merge):
(bmalloc::LargeObject::split):
(bmalloc::LargeObject::validateSelf):
(bmalloc::LargeObject::validate): Moved this code into a class, out of
BoundaryTag free functions.

New to the class are these features:

    (1) Every reference to an object is validated upon creation and use.

    (2) There's an explicit API for &quot;This is a reference to an object
    that might be stale (the DoNotValidate API)&quot;.

    (3) The begin and end tags are kept in sync automatically.

* bmalloc/SegregatedFreeList.cpp:
(bmalloc::SegregatedFreeList::insert):
(bmalloc::SegregatedFreeList::takeGreedy):
(bmalloc::SegregatedFreeList::take):
* bmalloc/SegregatedFreeList.h: Adopt the LargeObject interface.

* bmalloc/VMHeap.cpp:
(bmalloc::VMHeap::grow):
* bmalloc/VMHeap.h:
(bmalloc::VMHeap::allocateLargeRange):
(bmalloc::VMHeap::deallocateLargeRange): Adopt the LargeObject interface.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocChangeLog">releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocAllocatorcpp">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocBeginTagh">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BeginTag.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocBoundaryTagh">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTag.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocBoundaryTagInlinesh">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTagInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocEndTagh">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/EndTag.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocHeapcpp">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocHeaph">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocSegregatedFreeListcpp">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocSegregatedFreeListh">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocVMHeapcpp">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocVMHeaph">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.h</a></li>
<li><a href="#releasesWebKitGTKwebkit28Sourcebmallocbmallocxcodeprojprojectpbxproj">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit28SourcebmallocbmallocLargeObjecth">releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/LargeObject.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit28SourcebmallocChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/ChangeLog        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,3 +1,98 @@
</span><ins>+2015-02-24  Geoffrey Garen  &lt;ggaren@apple.com&gt;
+
+        bmalloc: Added a little more abstraction for large objects
+        https://bugs.webkit.org/show_bug.cgi?id=141978
+
+        Reviewed by Sam Weinig.
+
+        Previously, each client needed to manage the boundary tags of
+        a large object using free functions. This patch introduces a LargeObject
+        class that does things a little more automatically.
+
+        * bmalloc.xcodeproj/project.pbxproj:
+
+        * bmalloc/Allocator.cpp:
+        (bmalloc::Allocator::reallocate): Use the new LargeObject class.
+
+        * bmalloc/BeginTag.h:
+        (bmalloc::BeginTag::isInFreeList): Deleted. Moved this logic into the
+        LargeObject class.
+
+        * bmalloc/BoundaryTag.h:
+        (bmalloc::BoundaryTag::isSentinel):
+        (bmalloc::BoundaryTag::compactBegin):
+        (bmalloc::BoundaryTag::setRange):
+        (bmalloc::BoundaryTag::initSentinel): Added an explicit API for sentinels,
+        which we used to create and test for implicitly.
+
+        * bmalloc/BoundaryTagInlines.h:
+        (bmalloc::BoundaryTag::init):
+        (bmalloc::validate): Deleted.
+        (bmalloc::validatePrev): Deleted.
+        (bmalloc::validateNext): Deleted.
+        (bmalloc::BoundaryTag::mergeLeft): Deleted.
+        (bmalloc::BoundaryTag::mergeRight): Deleted.
+        (bmalloc::BoundaryTag::merge): Deleted.
+        (bmalloc::BoundaryTag::deallocate): Deleted.
+        (bmalloc::BoundaryTag::split): Deleted.
+        (bmalloc::BoundaryTag::allocate): Deleted. Moved this logic into the
+        LargeObject class.
+
+        * bmalloc/EndTag.h:
+        (bmalloc::EndTag::init):
+        (bmalloc::EndTag::operator=): Deleted. Re-reading this code, I found
+        special behavior in the assignment operator to be a surprising API.
+        So, I replaced the assignment operation with an explicit initializing
+        function.
+
+        * bmalloc/Heap.cpp:
+        (bmalloc::Heap::scavengeLargeRanges):
+        (bmalloc::Heap::allocateXLarge):
+        (bmalloc::Heap::findXLarge):
+        (bmalloc::Heap::deallocateXLarge):
+        (bmalloc::Heap::allocateLarge):
+        (bmalloc::Heap::deallocateLarge):
+        * bmalloc/Heap.h: No behavior changes here -- just adopting the
+        LargeObject interface.
+
+        * bmalloc/LargeObject.h: Added.
+        (bmalloc::LargeObject::operator!):
+        (bmalloc::LargeObject::begin):
+        (bmalloc::LargeObject::size):
+        (bmalloc::LargeObject::range):
+        (bmalloc::LargeObject::LargeObject):
+        (bmalloc::LargeObject::setFree):
+        (bmalloc::LargeObject::isFree):
+        (bmalloc::LargeObject::hasPhysicalPages):
+        (bmalloc::LargeObject::setHasPhysicalPages):
+        (bmalloc::LargeObject::isValidAndFree):
+        (bmalloc::LargeObject::merge):
+        (bmalloc::LargeObject::split):
+        (bmalloc::LargeObject::validateSelf):
+        (bmalloc::LargeObject::validate): Moved this code into a class, out of
+        BoundaryTag free functions.
+
+        New to the class are these features:
+
+            (1) Every reference to an object is validated upon creation and use.
+
+            (2) There's an explicit API for &quot;This is a reference to an object
+            that might be stale (the DoNotValidate API)&quot;.
+
+            (3) The begin and end tags are kept in sync automatically.
+
+        * bmalloc/SegregatedFreeList.cpp:
+        (bmalloc::SegregatedFreeList::insert):
+        (bmalloc::SegregatedFreeList::takeGreedy):
+        (bmalloc::SegregatedFreeList::take):
+        * bmalloc/SegregatedFreeList.h: Adopt the LargeObject interface.
+
+        * bmalloc/VMHeap.cpp:
+        (bmalloc::VMHeap::grow):
+        * bmalloc/VMHeap.h:
+        (bmalloc::VMHeap::allocateLargeRange):
+        (bmalloc::VMHeap::deallocateLargeRange): Adopt the LargeObject interface.
+
</ins><span class="cx"> 2015-02-20  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         bmalloc should implement malloc introspection (to stop false-positive leaks when MallocStackLogging is off)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocAllocatorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Allocator.cpp        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx"> #include &quot;Deallocator.h&quot;
</span><span class="cx"> #include &quot;Heap.h&quot;
</span><span class="cx"> #include &quot;LargeChunk.h&quot;
</span><ins>+#include &quot;LargeObject.h&quot;
</ins><span class="cx"> #include &quot;PerProcess.h&quot;
</span><span class="cx"> #include &quot;Sizes.h&quot;
</span><span class="cx"> #include &lt;algorithm&gt;
</span><span class="lines">@@ -116,8 +117,8 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     case Large: {
</span><del>-        BeginTag* beginTag = LargeChunk::beginTag(object);
-        oldSize = beginTag-&gt;size();
</del><ins>+        LargeObject largeObject(object);
+        oldSize = largeObject.size();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     case XLarge: {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocBeginTagh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BeginTag.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BeginTag.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BeginTag.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -31,15 +31,8 @@
</span><span class="cx"> namespace bmalloc {
</span><span class="cx"> 
</span><span class="cx"> class BeginTag : public BoundaryTag {
</span><del>-public:
-    bool isInFreeList(const Range&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><del>-inline bool BeginTag::isInFreeList(const Range&amp; range)
-{
-    return isFree() &amp;&amp; !isEnd() &amp;&amp; this-&gt;size() == range.size() &amp;&amp; this-&gt;compactBegin() == compactBegin(range);
-}
-
</del><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // BeginTag_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocBoundaryTagh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTag.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTag.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTag.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,9 +41,7 @@
</span><span class="cx"> class BoundaryTag {
</span><span class="cx"> public:
</span><span class="cx">     static Range init(LargeChunk*);
</span><del>-    static Range deallocate(void*);
-    static void allocate(const Range&amp;, size_t, Range&amp; leftover, bool&amp; hasPhysicalPages);
-    static unsigned compactBegin(const Range&amp;);
</del><ins>+    static unsigned compactBegin(void*);
</ins><span class="cx"> 
</span><span class="cx">     bool isFree() { return m_isFree; }
</span><span class="cx">     void setFree(bool isFree) { m_isFree = isFree; }
</span><span class="lines">@@ -62,6 +60,9 @@
</span><span class="cx"> 
</span><span class="cx">     void setRange(const Range&amp;);
</span><span class="cx">     
</span><ins>+    bool isSentinel() { return !m_compactBegin; }
+    void initSentinel();
+    
</ins><span class="cx">     EndTag* prev();
</span><span class="cx">     BeginTag* next();
</span><span class="cx"> 
</span><span class="lines">@@ -73,11 +74,6 @@
</span><span class="cx">     static_assert((1 &lt;&lt; compactBeginBits) - 1 &gt;= largeMin / largeAlignment, &quot;compactBegin must be encodable in a BoundaryTag.&quot;);
</span><span class="cx">     static_assert((1 &lt;&lt; sizeBits) - 1 &gt;= largeMax, &quot;largeMax must be encodable in a BoundaryTag.&quot;);
</span><span class="cx"> 
</span><del>-    static void split(const Range&amp;, size_t, BeginTag*, EndTag*&amp;, Range&amp; leftover);
-    static Range mergeLeft(const Range&amp;, BeginTag*&amp;, EndTag* prev, bool&amp; hasPhysicalPages);
-    static Range mergeRight(const Range&amp;, EndTag*&amp;, BeginTag* next, bool&amp; hasPhysicalPages);
-    static Range merge(const Range&amp;, BeginTag*&amp;, EndTag*&amp;);
-
</del><span class="cx">     bool m_isFree: 1;
</span><span class="cx">     bool m_isEnd: 1;
</span><span class="cx">     bool m_hasPhysicalPages: 1;
</span><span class="lines">@@ -85,17 +81,17 @@
</span><span class="cx">     unsigned m_size: sizeBits;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-inline unsigned BoundaryTag::compactBegin(const Range&amp; range)
</del><ins>+inline unsigned BoundaryTag::compactBegin(void* object)
</ins><span class="cx"> {
</span><span class="cx">     return static_cast&lt;unsigned&gt;(
</span><span class="cx">         reinterpret_cast&lt;uintptr_t&gt;(
</span><span class="cx">             rightShift(
</span><del>-                mask(range.begin(), largeMin - 1), largeAlignmentShift)));
</del><ins>+                mask(object, largeMin - 1), largeAlignmentShift)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void BoundaryTag::setRange(const Range&amp; range)
</span><span class="cx"> {
</span><del>-    m_compactBegin = compactBegin(range);
</del><ins>+    m_compactBegin = compactBegin(range.begin());
</ins><span class="cx">     m_size = static_cast&lt;unsigned&gt;(range.size());
</span><span class="cx">     BASSERT(this-&gt;size() == range.size());
</span><span class="cx"> }
</span><span class="lines">@@ -112,6 +108,12 @@
</span><span class="cx">     return reinterpret_cast&lt;BeginTag*&gt;(next);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline void BoundaryTag::initSentinel()
+{
+    setRange(Range(nullptr, largeMin));
+    setFree(false);
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // BoundaryTag_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocBoundaryTagInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTagInlines.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTagInlines.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/BoundaryTagInlines.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -34,48 +34,6 @@
</span><span class="cx"> 
</span><span class="cx"> namespace bmalloc {
</span><span class="cx"> 
</span><del>-static inline void validate(const Range&amp; range)
-{
-    UNUSED(range);
-IF_DEBUG(
-    BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-    EndTag* endTag = LargeChunk::endTag(range.begin(), range.size());
-
-    BASSERT(!beginTag-&gt;isEnd());
-    BASSERT(range.size() &gt;= largeMin);
-    BASSERT(beginTag-&gt;size() == range.size());
-
-    BASSERT(beginTag-&gt;size() == endTag-&gt;size());
-    BASSERT(beginTag-&gt;isFree() == endTag-&gt;isFree());
-    BASSERT(beginTag-&gt;hasPhysicalPages() == endTag-&gt;hasPhysicalPages());
-    BASSERT(static_cast&lt;BoundaryTag*&gt;(endTag) == static_cast&lt;BoundaryTag*&gt;(beginTag) || endTag-&gt;isEnd());
-);
-}
-
-static inline void validatePrev(EndTag* prev, void* object)
-{
-    size_t prevSize = prev-&gt;size();
-    void* prevObject = static_cast&lt;char*&gt;(object) - prevSize;
-    validate(Range(prevObject, prevSize));
-}
-
-static inline void validateNext(BeginTag* next, const Range&amp; range)
-{
-    if (next-&gt;size() == largeMin &amp;&amp; !next-&gt;compactBegin() &amp;&amp; !next-&gt;isFree()) // Right sentinel tag.
-        return;
-
-    void* nextObject = range.end();
-    size_t nextSize = next-&gt;size();
-    validate(Range(nextObject, nextSize));
-}
-
-static inline void validate(EndTag* prev, const Range&amp; range, BeginTag* next)
-{
-    validatePrev(prev, range.begin());
-    validate(range);
-    validateNext(next, range);
-}
-
</del><span class="cx"> inline Range BoundaryTag::init(LargeChunk* chunk)
</span><span class="cx"> {
</span><span class="cx">     Range range(chunk-&gt;begin(), chunk-&gt;end() - chunk-&gt;begin());
</span><span class="lines">@@ -86,7 +44,7 @@
</span><span class="cx">     beginTag-&gt;setHasPhysicalPages(false);
</span><span class="cx"> 
</span><span class="cx">     EndTag* endTag = LargeChunk::endTag(range.begin(), range.size());
</span><del>-    *endTag = *beginTag;
</del><ins>+    endTag-&gt;init(beginTag);
</ins><span class="cx"> 
</span><span class="cx">     // Mark the left and right edges of our chunk as allocated. This naturally
</span><span class="cx">     // prevents merging logic from overflowing beyond our chunk, without requiring
</span><span class="lines">@@ -94,127 +52,15 @@
</span><span class="cx">     
</span><span class="cx">     EndTag* leftSentinel = beginTag-&gt;prev();
</span><span class="cx">     BASSERT(leftSentinel &gt;= static_cast&lt;void*&gt;(chunk));
</span><del>-    leftSentinel-&gt;setRange(Range(nullptr, largeMin));
-    leftSentinel-&gt;setFree(false);
</del><ins>+    leftSentinel-&gt;initSentinel();
</ins><span class="cx"> 
</span><span class="cx">     BeginTag* rightSentinel = endTag-&gt;next();
</span><span class="cx">     BASSERT(rightSentinel &lt; static_cast&lt;void*&gt;(range.begin()));
</span><del>-    rightSentinel-&gt;setRange(Range(nullptr, largeMin));
-    rightSentinel-&gt;setFree(false);
</del><ins>+    rightSentinel-&gt;initSentinel();
</ins><span class="cx">     
</span><span class="cx">     return range;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline Range BoundaryTag::mergeLeft(const Range&amp; range, BeginTag*&amp; beginTag, EndTag* prev, bool&amp; hasPhysicalPages)
-{
-    Range left(range.begin() - prev-&gt;size(), prev-&gt;size());
-    Range merged(left.begin(), left.size() + range.size());
-
-    hasPhysicalPages &amp;= prev-&gt;hasPhysicalPages();
-
-    prev-&gt;clear();
-    beginTag-&gt;clear();
-
-    beginTag = LargeChunk::beginTag(merged.begin());
-    return merged;
-}
-
-inline Range BoundaryTag::mergeRight(const Range&amp; range, EndTag*&amp; endTag, BeginTag* next, bool&amp; hasPhysicalPages)
-{
-    Range right(range.end(), next-&gt;size());
-    Range merged(range.begin(), range.size() + right.size());
-
-    hasPhysicalPages &amp;= next-&gt;hasPhysicalPages();
-
-    endTag-&gt;clear();
-    next-&gt;clear();
-
-    endTag = LargeChunk::endTag(merged.begin(), merged.size());
-    return merged;
-}
-
-INLINE Range BoundaryTag::merge(const Range&amp; range, BeginTag*&amp; beginTag, EndTag*&amp; endTag)
-{
-    EndTag* prev = beginTag-&gt;prev();
-    BeginTag* next = endTag-&gt;next();
-    bool hasPhysicalPages = beginTag-&gt;hasPhysicalPages();
-
-    validate(prev, range, next);
-    
-    Range merged = range;
-
-    if (prev-&gt;isFree())
-        merged = mergeLeft(merged, beginTag, prev, hasPhysicalPages);
-
-    if (next-&gt;isFree())
-        merged = mergeRight(merged, endTag, next, hasPhysicalPages);
-
-    beginTag-&gt;setRange(merged);
-    beginTag-&gt;setFree(true);
-    beginTag-&gt;setHasPhysicalPages(hasPhysicalPages);
-
-    if (endTag != static_cast&lt;BoundaryTag*&gt;(beginTag))
-        *endTag = *beginTag;
-
-    validate(beginTag-&gt;prev(), merged, endTag-&gt;next());
-    return merged;
-}
-
-inline Range BoundaryTag::deallocate(void* object)
-{
-    BeginTag* beginTag = LargeChunk::beginTag(object);
-    BASSERT(!beginTag-&gt;isFree());
-
-    Range range(object, beginTag-&gt;size());
-    EndTag* endTag = LargeChunk::endTag(range.begin(), range.size());
-    return merge(range, beginTag, endTag);
-}
-
-INLINE void BoundaryTag::split(const Range&amp; range, size_t size, BeginTag* beginTag, EndTag*&amp; endTag, Range&amp; leftover)
-{
-    leftover = Range(range.begin() + size, range.size() - size);
-    Range split(range.begin(), size);
-
-    beginTag-&gt;setRange(split);
-
-    EndTag* splitEndTag = LargeChunk::endTag(split.begin(), size);
-    if (splitEndTag != static_cast&lt;BoundaryTag*&gt;(beginTag))
-        *splitEndTag = *beginTag;
-
-    BASSERT(leftover.size() &gt;= largeMin);
-    BeginTag* leftoverBeginTag = LargeChunk::beginTag(leftover.begin());
-    *leftoverBeginTag = *beginTag;
-    leftoverBeginTag-&gt;setRange(leftover);
-
-    if (leftoverBeginTag != static_cast&lt;BoundaryTag*&gt;(endTag))
-        *endTag = *leftoverBeginTag;
-
-    validate(beginTag-&gt;prev(), split, leftoverBeginTag);
-    validate(leftoverBeginTag-&gt;prev(), leftover, endTag-&gt;next());
-
-    endTag = splitEndTag;
-}
-
-INLINE void BoundaryTag::allocate(const Range&amp; range, size_t size, Range&amp; leftover, bool&amp; hasPhysicalPages)
-{
-    BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-    EndTag* endTag = LargeChunk::endTag(range.begin(), range.size());
-
-    BASSERT(beginTag-&gt;isFree());
-    validate(beginTag-&gt;prev(), range, endTag-&gt;next());
-
-    if (range.size() - size &gt; largeMin)
-        split(range, size, beginTag, endTag, leftover);
-
-    hasPhysicalPages = beginTag-&gt;hasPhysicalPages();
-
-    beginTag-&gt;setHasPhysicalPages(true);
-    beginTag-&gt;setFree(false);
-
-    endTag-&gt;setHasPhysicalPages(true);
-    endTag-&gt;setFree(false);
-}
-
</del><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // BoundaryTagInlines_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocEndTagh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/EndTag.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/EndTag.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/EndTag.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,14 +32,19 @@
</span><span class="cx"> 
</span><span class="cx"> class EndTag : public BoundaryTag {
</span><span class="cx"> public:
</span><del>-    EndTag&amp; operator=(const BeginTag&amp;);
</del><ins>+    void init(BeginTag*);
</ins><span class="cx"> };
</span><span class="cx"> 
</span><del>-inline EndTag&amp; EndTag::operator=(const BeginTag&amp; other)
</del><ins>+inline void EndTag::init(BeginTag* other)
</ins><span class="cx"> {
</span><del>-    std::memcpy(this, &amp;other, sizeof(BoundaryTag));
</del><ins>+    // To save space, an object can have only one tag, representing both
+    // its begin and its end. In that case, we must avoid initializing the
+    // end tag, since there is no end tag.
+    if (static_cast&lt;BoundaryTag*&gt;(this) == static_cast&lt;BoundaryTag*&gt;(other))
+        return;
+
+    std::memcpy(this, other, sizeof(BoundaryTag));
</ins><span class="cx">     setEnd(true);
</span><del>-    return *this;
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocHeapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.cpp (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.cpp        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.cpp        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -23,9 +23,9 @@
</span><span class="cx">  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx">  */
</span><span class="cx"> 
</span><del>-#include &quot;BoundaryTagInlines.h&quot;
</del><span class="cx"> #include &quot;Heap.h&quot;
</span><span class="cx"> #include &quot;LargeChunk.h&quot;
</span><ins>+#include &quot;LargeObject.h&quot;
</ins><span class="cx"> #include &quot;Line.h&quot;
</span><span class="cx"> #include &quot;MediumChunk.h&quot;
</span><span class="cx"> #include &quot;Page.h&quot;
</span><span class="lines">@@ -144,10 +144,10 @@
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        Range range = m_largeRanges.takeGreedy(vmPageSize);
-        if (!range)
</del><ins>+        LargeObject largeObject = m_largeObjects.takeGreedy(vmPageSize);
+        if (!largeObject)
</ins><span class="cx">             return;
</span><del>-        m_vmHeap.deallocateLargeRange(lock, range);
</del><ins>+        m_vmHeap.deallocateLargeRange(lock, largeObject);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -328,7 +328,7 @@
</span><span class="cx">     m_isAllocatingPages = true;
</span><span class="cx"> 
</span><span class="cx">     void* result = vmAllocate(alignment, size);
</span><del>-    m_xLargeRanges.push(Range(result, size));
</del><ins>+    m_xLargeObjects.push(Range(result, size));
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -339,7 +339,7 @@
</span><span class="cx"> 
</span><span class="cx"> Range Heap::findXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, void* object)
</span><span class="cx"> {
</span><del>-    for (auto&amp; range : m_xLargeRanges) {
</del><ins>+    for (auto&amp; range : m_xLargeObjects) {
</ins><span class="cx">         if (range.begin() != object)
</span><span class="cx">             continue;
</span><span class="cx">         return range;
</span><span class="lines">@@ -350,11 +350,11 @@
</span><span class="cx"> 
</span><span class="cx"> void Heap::deallocateXLarge(std::unique_lock&lt;StaticMutex&gt;&amp; lock, void* object)
</span><span class="cx"> {
</span><del>-    for (auto&amp; range : m_xLargeRanges) {
</del><ins>+    for (auto&amp; range : m_xLargeObjects) {
</ins><span class="cx">         if (range.begin() != object)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        Range toDeallocate = m_xLargeRanges.pop(&amp;range);
</del><ins>+        Range toDeallocate = m_xLargeObjects.pop(&amp;range);
</ins><span class="cx"> 
</span><span class="cx">         lock.unlock();
</span><span class="cx">         vmDeallocate(toDeallocate.begin(), toDeallocate.size());
</span><span class="lines">@@ -364,24 +364,24 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Heap::allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, const Range&amp; range, size_t size, Range&amp; leftover)
</del><ins>+void* Heap::allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, LargeObject&amp; largeObject, size_t size)
</ins><span class="cx"> {
</span><del>-    bool hasPhysicalPages;
-    BoundaryTag::allocate(range, size, leftover, hasPhysicalPages);
</del><ins>+    BASSERT(largeObject.isFree());
</ins><span class="cx"> 
</span><del>-    if (!hasPhysicalPages)
-        vmAllocatePhysicalPagesSloppy(range.begin(), range.size());
-}
</del><ins>+    if (largeObject.size() - size &gt; largeMin) {
+        std::pair&lt;LargeObject, LargeObject&gt; split = largeObject.split(size);
+        largeObject = split.first;
+        m_largeObjects.insert(split.second);
+    }
</ins><span class="cx"> 
</span><del>-void* Heap::allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, const Range&amp; range, size_t size)
-{
-    Range leftover;
-    allocateLarge(lock, range, size, leftover);
</del><ins>+    largeObject.setFree(false);
</ins><span class="cx"> 
</span><del>-    if (!!leftover)
-        m_largeRanges.insert(leftover);
</del><ins>+    if (!largeObject.hasPhysicalPages()) {
+        vmAllocatePhysicalPagesSloppy(largeObject.begin(), largeObject.size());
+        largeObject.setHasPhysicalPages(true);
+    }
</ins><span class="cx">     
</span><del>-    return range.begin();
</del><ins>+    return largeObject.begin();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void* Heap::allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t size)
</span><span class="lines">@@ -392,11 +392,11 @@
</span><span class="cx">     
</span><span class="cx">     m_isAllocatingPages = true;
</span><span class="cx"> 
</span><del>-    Range range = m_largeRanges.take(size);
-    if (!range)
-        range = m_vmHeap.allocateLargeRange(size);
</del><ins>+    LargeObject largeObject = m_largeObjects.take(size);
+    if (!largeObject)
+        largeObject = m_vmHeap.allocateLargeRange(size);
</ins><span class="cx"> 
</span><del>-    return allocateLarge(lock, range, size);
</del><ins>+    return allocateLarge(lock, largeObject, size);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void* Heap::allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t alignment, size_t size, size_t unalignedSize)
</span><span class="lines">@@ -413,31 +413,39 @@
</span><span class="cx"> 
</span><span class="cx">     m_isAllocatingPages = true;
</span><span class="cx"> 
</span><del>-    Range range = m_largeRanges.take(alignment, size, unalignedSize);
-    if (!range)
-        range = m_vmHeap.allocateLargeRange(alignment, size, unalignedSize);
</del><ins>+    LargeObject largeObject = m_largeObjects.take(alignment, size, unalignedSize);
+    if (!largeObject)
+        largeObject = m_vmHeap.allocateLargeRange(alignment, size, unalignedSize);
</ins><span class="cx"> 
</span><span class="cx">     size_t alignmentMask = alignment - 1;
</span><del>-    if (test(range.begin(), alignmentMask)) {
-        // Because we allocate left-to-right, we must explicitly allocate the
-        // unaligned space on the left in order to break off the aligned space
-        // we want in the middle.
-        Range aligned;
-        size_t unalignedSize = roundUpToMultipleOf(alignment, range.begin() + largeMin) - range.begin();
-        allocateLarge(lock, range, unalignedSize, aligned);
-        allocateLarge(lock, aligned, size);
-        deallocateLarge(lock, range.begin());
-        return aligned.begin();
-    }
</del><ins>+    if (!test(largeObject.begin(), alignmentMask))
+        return allocateLarge(lock, largeObject, size);
</ins><span class="cx"> 
</span><del>-    return allocateLarge(lock, range, size);
</del><ins>+    // Because we allocate VM left-to-right, we must explicitly allocate the
+    // unaligned space on the left in order to break off the aligned space
+    // we want in the middle.
+    size_t prefixSize = roundUpToMultipleOf(alignment, largeObject.begin() + largeMin) - largeObject.begin();
+    std::pair&lt;LargeObject, LargeObject&gt; pair = largeObject.split(prefixSize);
+    allocateLarge(lock, pair.first, prefixSize);
+    allocateLarge(lock, pair.second, size);
+    deallocateLarge(lock, pair.first);
+    return pair.second.begin();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Heap::deallocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, void* object)
</del><ins>+void Heap::deallocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, const LargeObject&amp; largeObject)
</ins><span class="cx"> {
</span><del>-    Range range = BoundaryTag::deallocate(object);
-    m_largeRanges.insert(range);
</del><ins>+    BASSERT(!largeObject.isFree());
+    largeObject.setFree(true);
+    
+    LargeObject merged = largeObject.merge();
+    m_largeObjects.insert(merged);
</ins><span class="cx">     m_scavenger.run();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void Heap::deallocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, void* object)
+{
+    LargeObject largeObject(object);
+    deallocateLarge(lock, largeObject);
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocHeaph"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/Heap.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -81,9 +81,8 @@
</span><span class="cx">     void deallocateSmallLine(std::lock_guard&lt;StaticMutex&gt;&amp;, SmallLine*);
</span><span class="cx">     void deallocateMediumLine(std::lock_guard&lt;StaticMutex&gt;&amp;, MediumLine*);
</span><span class="cx"> 
</span><del>-    void* allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, const Range&amp;, size_t);
-    void allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, const Range&amp;, size_t, Range&amp; leftover);
-    Range allocateLargeChunk();
</del><ins>+    void* allocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, LargeObject&amp;, size_t);
+    void deallocateLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, const LargeObject&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void splitLarge(BeginTag*, size_t, EndTag*&amp;, Range&amp;);
</span><span class="cx">     void mergeLarge(BeginTag*&amp;, EndTag*&amp;, Range&amp;);
</span><span class="lines">@@ -104,8 +103,8 @@
</span><span class="cx">     Vector&lt;SmallPage*&gt; m_smallPages;
</span><span class="cx">     Vector&lt;MediumPage*&gt; m_mediumPages;
</span><span class="cx"> 
</span><del>-    SegregatedFreeList m_largeRanges;
-    Vector&lt;Range&gt; m_xLargeRanges;
</del><ins>+    SegregatedFreeList m_largeObjects;
+    Vector&lt;Range&gt; m_xLargeObjects;
</ins><span class="cx"> 
</span><span class="cx">     bool m_isAllocatingPages;
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocLargeObjecth"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/LargeObject.h (0 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/LargeObject.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/LargeObject.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -0,0 +1,242 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LargeObject_h
+#define LargeObject_h
+
+#include &quot;BeginTag.h&quot;
+#include &quot;EndTag.h&quot;
+#include &quot;LargeChunk.h&quot;
+
+namespace bmalloc {
+
+class LargeObject {
+public:
+    LargeObject();
+    LargeObject(void*);
+
+    enum DoNotValidateTag { DoNotValidate };
+    LargeObject(DoNotValidateTag, void*);
+    
+    bool operator!() { return !m_object; }
+
+    char* begin() const { return static_cast&lt;char*&gt;(m_object); }
+    size_t size() const { return m_beginTag-&gt;size(); }
+    Range range() const { return Range(m_object, size()); }
+
+    void setFree(bool) const;
+    bool isFree() const;
+    
+    bool hasPhysicalPages() const;
+    void setHasPhysicalPages(bool) const;
+    
+    bool isValidAndFree(size_t) const;
+
+    LargeObject merge() const;
+    std::pair&lt;LargeObject, LargeObject&gt; split(size_t) const;
+
+private:
+    LargeObject(BeginTag*, EndTag*, void*);
+
+    void validate() const;
+    void validateSelf() const;
+
+    BeginTag* m_beginTag;
+    EndTag* m_endTag;
+    void* m_object;
+};
+
+inline LargeObject::LargeObject()
+    : m_beginTag(nullptr)
+    , m_endTag(nullptr)
+    , m_object(nullptr)
+{
+}
+
+inline LargeObject::LargeObject(void* object)
+    : m_beginTag(LargeChunk::beginTag(object))
+    , m_endTag(LargeChunk::endTag(object, m_beginTag-&gt;size()))
+    , m_object(object)
+{
+    validate();
+}
+
+inline LargeObject::LargeObject(DoNotValidateTag, void* object)
+    : m_beginTag(LargeChunk::beginTag(object))
+    , m_endTag(LargeChunk::endTag(object, m_beginTag-&gt;size()))
+    , m_object(object)
+{
+}
+
+inline LargeObject::LargeObject(BeginTag* beginTag, EndTag* endTag, void* object)
+    : m_beginTag(beginTag)
+    , m_endTag(endTag)
+    , m_object(object)
+{
+}
+
+inline void LargeObject::setFree(bool isFree) const
+{
+    validate();
+    m_beginTag-&gt;setFree(isFree);
+    m_endTag-&gt;setFree(isFree);
+}
+
+inline bool LargeObject::isFree() const
+{
+    validate();
+    return m_beginTag-&gt;isFree();
+}
+
+inline bool LargeObject::hasPhysicalPages() const
+{
+    validate();
+    return m_beginTag-&gt;hasPhysicalPages();
+}
+
+inline void LargeObject::setHasPhysicalPages(bool hasPhysicalPages) const
+{
+    validate();
+    m_beginTag-&gt;setHasPhysicalPages(hasPhysicalPages);
+    m_endTag-&gt;setHasPhysicalPages(hasPhysicalPages);
+}
+
+inline bool LargeObject::isValidAndFree(size_t expectedSize) const
+{
+    if (!m_beginTag-&gt;isFree())
+        return false;
+    
+    if (m_beginTag-&gt;isEnd())
+        return false;
+
+    if (m_beginTag-&gt;size() != expectedSize)
+        return false;
+    
+    if (m_beginTag-&gt;compactBegin() != BoundaryTag::compactBegin(m_object))
+        return false;
+
+    return true;
+}
+
+inline LargeObject LargeObject::merge() const
+{
+    validate();
+    BASSERT(isFree());
+
+    bool hasPhysicalPages = m_beginTag-&gt;hasPhysicalPages();
+
+    BeginTag* beginTag = m_beginTag;
+    EndTag* endTag = m_endTag;
+    Range range = this-&gt;range();
+    
+    EndTag* prev = beginTag-&gt;prev();
+    if (prev-&gt;isFree()) {
+        Range left(range.begin() - prev-&gt;size(), prev-&gt;size());
+        range = Range(left.begin(), left.size() + range.size());
+        hasPhysicalPages &amp;= prev-&gt;hasPhysicalPages();
+
+        prev-&gt;clear();
+        beginTag-&gt;clear();
+
+        beginTag = LargeChunk::beginTag(range.begin());
+    }
+
+    BeginTag* next = endTag-&gt;next();
+    if (next-&gt;isFree()) {
+        Range right(range.end(), next-&gt;size());
+        range = Range(range.begin(), range.size() + right.size());
+
+        hasPhysicalPages &amp;= next-&gt;hasPhysicalPages();
+
+        endTag-&gt;clear();
+        next-&gt;clear();
+
+        endTag = LargeChunk::endTag(range.begin(), range.size());
+    }
+
+    beginTag-&gt;setRange(range);
+    beginTag-&gt;setFree(true);
+    beginTag-&gt;setHasPhysicalPages(hasPhysicalPages);
+    endTag-&gt;init(beginTag);
+
+    return LargeObject(beginTag, endTag, range.begin());
+}
+
+inline std::pair&lt;LargeObject, LargeObject&gt; LargeObject::split(size_t size) const
+{
+    BASSERT(isFree());
+
+    Range split(begin(), size);
+    Range leftover = Range(split.end(), this-&gt;size() - size);
+    BASSERT(leftover.size() &gt;= largeMin);
+
+    BeginTag* splitBeginTag = m_beginTag;
+    EndTag* splitEndTag = LargeChunk::endTag(split.begin(), size);
+
+    BeginTag* leftoverBeginTag = LargeChunk::beginTag(leftover.begin());
+    EndTag* leftoverEndTag = m_endTag;
+
+    splitBeginTag-&gt;setRange(split);
+    splitEndTag-&gt;init(splitBeginTag);
+
+    *leftoverBeginTag = *splitBeginTag;
+    leftoverBeginTag-&gt;setRange(leftover);
+    leftoverEndTag-&gt;init(leftoverBeginTag);
+
+    return std::make_pair(
+        LargeObject(splitBeginTag, splitEndTag, split.begin()),
+        LargeObject(leftoverBeginTag, leftoverEndTag, leftover.begin()));
+}
+
+inline void LargeObject::validateSelf() const
+{
+    BASSERT(!m_beginTag-&gt;isEnd());
+    BASSERT(m_endTag-&gt;isEnd() || static_cast&lt;BoundaryTag*&gt;(m_endTag) == static_cast&lt;BoundaryTag*&gt;(m_beginTag));
+
+    BASSERT(size() &gt;= largeMin);
+
+    BASSERT(m_beginTag-&gt;size() == m_endTag-&gt;size());
+    BASSERT(m_beginTag-&gt;isFree() == m_endTag-&gt;isFree());
+    BASSERT(m_beginTag-&gt;hasPhysicalPages() == m_endTag-&gt;hasPhysicalPages());
+}
+
+inline void LargeObject::validate() const
+{
+    if (!m_beginTag-&gt;prev()-&gt;isSentinel()) {
+        LargeObject prev(DoNotValidate, begin() - m_beginTag-&gt;prev()-&gt;size());
+        prev.validateSelf();
+    }
+
+    validateSelf();
+
+    if (!m_endTag-&gt;next()-&gt;isSentinel()) {
+        LargeObject next(DoNotValidate, begin() + size());
+        next.validateSelf();
+    }
+}
+
+} // namespace bmalloc
+
+#endif // LargeObject_h
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocSegregatedFreeListcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.cpp (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.cpp        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.cpp        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -35,74 +35,68 @@
</span><span class="cx">     BASSERT(static_cast&lt;size_t&gt;(&amp;select(largeMax) - m_lists.begin()) == m_lists.size() - 1);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void SegregatedFreeList::insert(const Range&amp; range)
</del><ins>+void SegregatedFreeList::insert(const LargeObject&amp; largeObject)
</ins><span class="cx"> {
</span><del>-IF_DEBUG(
-    BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-    BASSERT(beginTag-&gt;isInFreeList(range));
-)
-
-    auto&amp; list = select(range.size());
-    list.push(range);
</del><ins>+    BASSERT(largeObject.isFree());
+    auto&amp; list = select(largeObject.size());
+    list.push(largeObject.range());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Range SegregatedFreeList::takeGreedy(size_t size)
</del><ins>+LargeObject SegregatedFreeList::takeGreedy(size_t size)
</ins><span class="cx"> {
</span><span class="cx">     for (size_t i = m_lists.size(); i-- &gt; 0; ) {
</span><del>-        Range range = takeGreedy(m_lists[i], size);
-        if (!range)
</del><ins>+        LargeObject largeObject = takeGreedy(m_lists[i], size);
+        if (!largeObject)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        return range;
</del><ins>+        return largeObject;
</ins><span class="cx">     }
</span><del>-    return Range();
</del><ins>+    return LargeObject();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Range SegregatedFreeList::takeGreedy(List&amp; list, size_t size)
</del><ins>+LargeObject SegregatedFreeList::takeGreedy(List&amp; list, size_t size)
</ins><span class="cx"> {
</span><span class="cx">     for (size_t i = list.size(); i-- &gt; 0; ) {
</span><del>-        Range range = list[i];
-
</del><span class="cx">         // We don't eagerly remove items when we merge and/or split ranges,
</span><span class="cx">         // so we need to validate each free list entry before using it.
</span><del>-        BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-        if (!beginTag-&gt;isInFreeList(range)) {
</del><ins>+        LargeObject largeObject(LargeObject::DoNotValidate, list[i].begin());
+        if (!largeObject.isValidAndFree(list[i].size())) {
</ins><span class="cx">             list.pop(i);
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (range.size() &lt; size)
</del><ins>+        if (largeObject.size() &lt; size)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="cx">         list.pop(i);
</span><del>-        return range;
</del><ins>+        return largeObject;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return Range();
</del><ins>+    return LargeObject();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Range SegregatedFreeList::take(size_t size)
</del><ins>+LargeObject SegregatedFreeList::take(size_t size)
</ins><span class="cx"> {
</span><span class="cx">     for (auto* list = &amp;select(size); list != m_lists.end(); ++list) {
</span><del>-        Range range = take(*list, size);
-        if (!range)
</del><ins>+        LargeObject largeObject = take(*list, size);
+        if (!largeObject)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        return range;
</del><ins>+        return largeObject;
</ins><span class="cx">     }
</span><del>-    return Range();
</del><ins>+    return LargeObject();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-Range SegregatedFreeList::take(size_t alignment, size_t size, size_t unalignedSize)
</del><ins>+LargeObject SegregatedFreeList::take(size_t alignment, size_t size, size_t unalignedSize)
</ins><span class="cx"> {
</span><span class="cx">     for (auto* list = &amp;select(size); list != m_lists.end(); ++list) {
</span><del>-        Range range = take(*list, alignment, size, unalignedSize);
-        if (!range)
</del><ins>+        LargeObject largeObject = take(*list, alignment, size, unalignedSize);
+        if (!largeObject)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        return range;
</del><ins>+        return largeObject;
</ins><span class="cx">     }
</span><del>-    return Range();
</del><ins>+    return LargeObject();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> INLINE auto SegregatedFreeList::select(size_t size) -&gt; List&amp;
</span><span class="lines">@@ -116,61 +110,57 @@
</span><span class="cx">     return m_lists[result];
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-INLINE Range SegregatedFreeList::take(List&amp; list, size_t size)
</del><ins>+INLINE LargeObject SegregatedFreeList::take(List&amp; list, size_t size)
</ins><span class="cx"> {
</span><del>-    Range first;
</del><ins>+    LargeObject first;
</ins><span class="cx">     size_t end = list.size() &gt; segregatedFreeListSearchDepth ? list.size() - segregatedFreeListSearchDepth : 0;
</span><span class="cx">     for (size_t i = list.size(); i-- &gt; end; ) {
</span><del>-        Range range = list[i];
-
</del><span class="cx">         // We don't eagerly remove items when we merge and/or split ranges, so
</span><span class="cx">         // we need to validate each free list entry before using it.
</span><del>-        BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-        if (!beginTag-&gt;isInFreeList(range)) {
</del><ins>+        LargeObject largeObject(LargeObject::DoNotValidate, list[i].begin());
+        if (!largeObject.isValidAndFree(list[i].size())) {
</ins><span class="cx">             list.pop(i);
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (range.size() &lt; size)
</del><ins>+        if (largeObject.size() &lt; size)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        if (!!first &amp;&amp; first &lt; range)
</del><ins>+        if (!!first &amp;&amp; first.begin() &lt; largeObject.begin())
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        first = range;
</del><ins>+        first = largeObject;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     return first;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-INLINE Range SegregatedFreeList::take(List&amp; list, size_t alignment, size_t size, size_t unalignedSize)
</del><ins>+INLINE LargeObject SegregatedFreeList::take(List&amp; list, size_t alignment, size_t size, size_t unalignedSize)
</ins><span class="cx"> {
</span><span class="cx">     BASSERT(isPowerOfTwo(alignment));
</span><span class="cx">     size_t alignmentMask = alignment - 1;
</span><span class="cx"> 
</span><del>-    Range first;
</del><ins>+    LargeObject first;
</ins><span class="cx">     size_t end = list.size() &gt; segregatedFreeListSearchDepth ? list.size() - segregatedFreeListSearchDepth : 0;
</span><span class="cx">     for (size_t i = list.size(); i-- &gt; end; ) {
</span><del>-        Range range = list[i];
-
</del><span class="cx">         // We don't eagerly remove items when we merge and/or split ranges, so
</span><span class="cx">         // we need to validate each free list entry before using it.
</span><del>-        BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-        if (!beginTag-&gt;isInFreeList(range)) {
</del><ins>+        LargeObject largeObject(LargeObject::DoNotValidate, list[i].begin());
+        if (!largeObject.isValidAndFree(list[i].size())) {
</ins><span class="cx">             list.pop(i);
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (range.size() &lt; size)
</del><ins>+        if (largeObject.size() &lt; size)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        if (test(range.begin(), alignmentMask) &amp;&amp; range.size() &lt; unalignedSize)
</del><ins>+        if (test(largeObject.begin(), alignmentMask) &amp;&amp; largeObject.size() &lt; unalignedSize)
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        if (!!first &amp;&amp; first &lt; range)
</del><ins>+        if (!!first &amp;&amp; first.begin() &lt; largeObject.begin())
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        first = range;
</del><ins>+        first = largeObject;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     return first;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocSegregatedFreeListh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/SegregatedFreeList.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -26,7 +26,7 @@
</span><span class="cx"> #ifndef SegregatedFreeList_h
</span><span class="cx"> #define SegregatedFreeList_h
</span><span class="cx"> 
</span><del>-#include &quot;Range.h&quot;
</del><ins>+#include &quot;LargeObject.h&quot;
</ins><span class="cx"> #include &quot;Vector.h&quot;
</span><span class="cx"> #include &lt;array&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -36,34 +36,34 @@
</span><span class="cx"> public:
</span><span class="cx">     SegregatedFreeList();
</span><span class="cx"> 
</span><del>-    void insert(const Range&amp;);
</del><ins>+    void insert(const LargeObject&amp;);
</ins><span class="cx"> 
</span><del>-    // Returns a reasonable fit for the provided size, or Range() if no fit
-    // is found. May return Range() spuriously if searching takes too long.
</del><ins>+    // Returns a reasonable fit for the provided size, or LargeObject() if no fit
+    // is found. May return LargeObject() spuriously if searching takes too long.
</ins><span class="cx">     // Incrementally removes stale items from the free list while searching.
</span><del>-    // Does not eagerly remove the returned range from the free list.
-    Range take(size_t);
</del><ins>+    // Does not eagerly remove the returned object from the free list.
+    LargeObject take(size_t);
</ins><span class="cx"> 
</span><span class="cx">     // Returns a reasonable fit for the provided alignment and size, or
</span><del>-    // a reasonable fit for the provided unaligned size, or Range() if no fit
-    // is found. May return Range() spuriously if searching takes too long.
-    // Incrementally removes stale items from the free list while searching.
-    // Does not eagerly remove the returned range from the free list.
-    Range take(size_t alignment, size_t, size_t unalignedSize);
</del><ins>+    // a reasonable fit for the provided unaligned size, or LargeObject() if no
+    // fit is found. May return LargeObject() spuriously if searching takes too
+    // long. Incrementally removes stale items from the free list while
+    // searching. Does not eagerly remove the returned object from the free list.
+    LargeObject take(size_t alignment, size_t, size_t unalignedSize);
</ins><span class="cx"> 
</span><del>-    // Returns an unreasonable fit for the provided size, or Range() if no fit
-    // is found. Never returns Range() spuriously.
-    // Incrementally removes stale items from the free list while searching.
-    // Eagerly removes the returned range from the free list.
-    Range takeGreedy(size_t);
</del><ins>+    // Returns an unreasonable fit for the provided size, or LargeObject() if no
+    // fit is found. Never returns LargeObject() spuriously. Incrementally
+    // removes stale items from the free list while searching. Eagerly removes
+    // the returned object from the free list.
+    LargeObject takeGreedy(size_t);
</ins><span class="cx">     
</span><span class="cx"> private:
</span><span class="cx">     typedef Vector&lt;Range&gt; List;
</span><span class="cx"> 
</span><span class="cx">     List&amp; select(size_t);
</span><del>-    Range take(List&amp;, size_t);
-    Range take(List&amp;, size_t alignment, size_t, size_t unalignedSize);
-    Range takeGreedy(List&amp;, size_t);
</del><ins>+    LargeObject take(List&amp;, size_t);
+    LargeObject take(List&amp;, size_t alignment, size_t, size_t unalignedSize);
+    LargeObject takeGreedy(List&amp;, size_t);
</ins><span class="cx"> 
</span><span class="cx">     std::array&lt;List, 19&gt; m_lists;
</span><span class="cx"> };
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocVMHeapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.cpp (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.cpp        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.cpp        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -53,7 +53,7 @@
</span><span class="cx">         m_mediumPages.push(it);
</span><span class="cx"> 
</span><span class="cx">     LargeChunk* largeChunk = superChunk-&gt;largeChunk();
</span><del>-    m_largeRanges.insert(BoundaryTag::init(largeChunk));
</del><ins>+    m_largeObjects.insert(LargeObject(BoundaryTag::init(largeChunk).begin()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28SourcebmallocbmallocVMHeaph"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.h (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.h        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc/VMHeap.h        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx"> #include &quot;AsyncTask.h&quot;
</span><span class="cx"> #include &quot;FixedVector.h&quot;
</span><span class="cx"> #include &quot;LargeChunk.h&quot;
</span><ins>+#include &quot;LargeObject.h&quot;
</ins><span class="cx"> #include &quot;MediumChunk.h&quot;
</span><span class="cx"> #include &quot;Range.h&quot;
</span><span class="cx"> #include &quot;SegregatedFreeList.h&quot;
</span><span class="lines">@@ -51,19 +52,19 @@
</span><span class="cx"> 
</span><span class="cx">     SmallPage* allocateSmallPage();
</span><span class="cx">     MediumPage* allocateMediumPage();
</span><del>-    Range allocateLargeRange(size_t);
-    Range allocateLargeRange(size_t alignment, size_t, size_t unalignedSize);
</del><ins>+    LargeObject allocateLargeRange(size_t);
+    LargeObject allocateLargeRange(size_t alignment, size_t, size_t unalignedSize);
</ins><span class="cx"> 
</span><span class="cx">     void deallocateSmallPage(std::unique_lock&lt;StaticMutex&gt;&amp;, SmallPage*);
</span><span class="cx">     void deallocateMediumPage(std::unique_lock&lt;StaticMutex&gt;&amp;, MediumPage*);
</span><del>-    void deallocateLargeRange(std::unique_lock&lt;StaticMutex&gt;&amp;, Range);
</del><ins>+    void deallocateLargeRange(std::unique_lock&lt;StaticMutex&gt;&amp;, LargeObject&amp;);
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     void grow();
</span><span class="cx"> 
</span><span class="cx">     Vector&lt;SmallPage*&gt; m_smallPages;
</span><span class="cx">     Vector&lt;MediumPage*&gt; m_mediumPages;
</span><del>-    SegregatedFreeList m_largeRanges;
</del><ins>+    SegregatedFreeList m_largeObjects;
</ins><span class="cx"> #if BOS(DARWIN)
</span><span class="cx">     Zone m_zone;
</span><span class="cx"> #endif
</span><span class="lines">@@ -85,26 +86,26 @@
</span><span class="cx">     return m_mediumPages.pop();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline Range VMHeap::allocateLargeRange(size_t size)
</del><ins>+inline LargeObject VMHeap::allocateLargeRange(size_t size)
</ins><span class="cx"> {
</span><del>-    Range range = m_largeRanges.take(size);
-    if (!range) {
</del><ins>+    LargeObject largeObject = m_largeObjects.take(size);
+    if (!largeObject) {
</ins><span class="cx">         grow();
</span><del>-        range = m_largeRanges.take(size);
-        BASSERT(range);
</del><ins>+        largeObject = m_largeObjects.take(size);
+        BASSERT(largeObject);
</ins><span class="cx">     }
</span><del>-    return range;
</del><ins>+    return largeObject;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline Range VMHeap::allocateLargeRange(size_t alignment, size_t size, size_t unalignedSize)
</del><ins>+inline LargeObject VMHeap::allocateLargeRange(size_t alignment, size_t size, size_t unalignedSize)
</ins><span class="cx"> {
</span><del>-    Range range = m_largeRanges.take(alignment, size, unalignedSize);
-    if (!range) {
</del><ins>+    LargeObject largeObject = m_largeObjects.take(alignment, size, unalignedSize);
+    if (!largeObject) {
</ins><span class="cx">         grow();
</span><del>-        range = m_largeRanges.take(alignment, size, unalignedSize);
-        BASSERT(range);
</del><ins>+        largeObject = m_largeObjects.take(alignment, size, unalignedSize);
+        BASSERT(largeObject);
</ins><span class="cx">     }
</span><del>-    return range;
</del><ins>+    return largeObject;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void VMHeap::deallocateSmallPage(std::unique_lock&lt;StaticMutex&gt;&amp; lock, SmallPage* page)
</span><span class="lines">@@ -125,27 +126,20 @@
</span><span class="cx">     m_mediumPages.push(page);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline void VMHeap::deallocateLargeRange(std::unique_lock&lt;StaticMutex&gt;&amp; lock, Range range)
</del><ins>+inline void VMHeap::deallocateLargeRange(std::unique_lock&lt;StaticMutex&gt;&amp; lock, LargeObject&amp; largeObject)
</ins><span class="cx"> {
</span><del>-    BeginTag* beginTag = LargeChunk::beginTag(range.begin());
-    EndTag* endTag = LargeChunk::endTag(range.begin(), range.size());
-    
</del><span class="cx">     // Temporarily mark this range as allocated to prevent clients from merging
</span><span class="cx">     // with it and then reallocating it while we're messing with its physical pages.
</span><del>-    beginTag-&gt;setFree(false);
-    endTag-&gt;setFree(false);
</del><ins>+    largeObject.setFree(false);
</ins><span class="cx"> 
</span><span class="cx">     lock.unlock();
</span><del>-    vmDeallocatePhysicalPagesSloppy(range.begin(), range.size());
</del><ins>+    vmDeallocatePhysicalPagesSloppy(largeObject.begin(), largeObject.size());
</ins><span class="cx">     lock.lock();
</span><span class="cx"> 
</span><del>-    beginTag-&gt;setFree(true);
-    endTag-&gt;setFree(true);
</del><ins>+    largeObject.setFree(true);
+    largeObject.setHasPhysicalPages(false);
</ins><span class="cx"> 
</span><del>-    beginTag-&gt;setHasPhysicalPages(false);
-    endTag-&gt;setHasPhysicalPages(false);
-
-    m_largeRanges.insert(range);
</del><ins>+    m_largeObjects.insert(largeObject);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit28Sourcebmallocbmallocxcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj (180828 => 180829)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj        2015-02-28 11:29:06 UTC (rev 180828)
+++ releases/WebKitGTK/webkit-2.8/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj        2015-02-28 11:31:11 UTC (rev 180829)
</span><span class="lines">@@ -22,6 +22,7 @@
</span><span class="cx">                 1448C30118F3754C00502839 /* bmalloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 1448C2FE18F3754300502839 /* bmalloc.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14895D911A3A319C0006235D /* Environment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14895D8F1A3A319C0006235D /* Environment.cpp */; };
</span><span class="cx">                 14895D921A3A319C0006235D /* Environment.h in Headers */ = {isa = PBXBuildFile; fileRef = 14895D901A3A319C0006235D /* Environment.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                14C6216F1A9A9A6200E72293 /* LargeObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C6216E1A9A9A6200E72293 /* LargeObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 14C919C918FCC59F0028DB43 /* BPlatform.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C919C818FCC59F0028DB43 /* BPlatform.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14CC394C18EA8858004AFE34 /* libbmalloc.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 14F271BE18EA3963008C152F /* libbmalloc.a */; };
</span><span class="cx">                 14DD788C18F48CAE00950702 /* LargeChunk.h in Headers */ = {isa = PBXBuildFile; fileRef = 147AAA8818CD17CE002201E4 /* LargeChunk.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -132,6 +133,7 @@
</span><span class="cx">                 14B650C618F39F4800751968 /* bmalloc.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = bmalloc.xcconfig; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 14B650C718F39F4800751968 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 14B650C918F3A04200751968 /* mbmalloc.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = mbmalloc.xcconfig; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                14C6216E1A9A9A6200E72293 /* LargeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LargeObject.h; path = bmalloc/LargeObject.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 14C919C818FCC59F0028DB43 /* BPlatform.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BPlatform.h; path = bmalloc/BPlatform.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 14CC394418EA8743004AFE34 /* libmbmalloc.dylib */ = {isa = PBXFileReference; explicitFileType = &quot;compiled.mach-o.dylib&quot;; includeInIndex = 0; path = libmbmalloc.dylib; sourceTree = BUILT_PRODUCTS_DIR; };
</span><span class="cx">                 14D9DB4517F2447100EAAB79 /* FixedVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; name = FixedVector.h; path = bmalloc/FixedVector.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</span><span class="lines">@@ -218,6 +220,7 @@
</span><span class="cx">                                 14105E7B18DBD7AF003A106E /* BoundaryTagInlines.h */,
</span><span class="cx">                                 1417F64618B54A700076FA3F /* EndTag.h */,
</span><span class="cx">                                 147AAA8818CD17CE002201E4 /* LargeChunk.h */,
</span><ins>+                                14C6216E1A9A9A6200E72293 /* LargeObject.h */,
</ins><span class="cx">                                 146BEE2118C845AE0002D5A2 /* SegregatedFreeList.cpp */,
</span><span class="cx">                                 146BEE1E18C841C50002D5A2 /* SegregatedFreeList.h */,
</span><span class="cx">                         );
</span><span class="lines">@@ -319,6 +322,7 @@
</span><span class="cx">                                 143CB81D19022BC900B16A45 /* StaticMutex.h in Headers */,
</span><span class="cx">                                 14DD78B918F48D6B00950702 /* MediumTraits.h in Headers */,
</span><span class="cx">                                 1448C30118F3754C00502839 /* bmalloc.h in Headers */,
</span><ins>+                                14C6216F1A9A9A6200E72293 /* LargeObject.h in Headers */,
</ins><span class="cx">                                 14DD789A18F48D4A00950702 /* Deallocator.h in Headers */,
</span><span class="cx">                                 1400274C18F89C3D00115C97 /* SegregatedFreeList.h in Headers */,
</span><span class="cx">                                 14DD788D18F48CC600950702 /* BeginTag.h in Headers */,
</span></span></pre>
</div>
</div>

</body>
</html>