<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197762] releases/WebKitGTK/webkit-2.12/Source/bmalloc</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197762">197762</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-03-08 06:28:40 -0800 (Tue, 08 Mar 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/197545">r197545</a> - Unreviewed, rolling in <a href="http://trac.webkit.org/projects/webkit/changeset/197174">r197174</a>.
https://bugs.webkit.org/show_bug.cgi?id=154762

The right calculation for alignment is actually:

    vmAlignment - getpagesize() + vmSize

instead of:

    vmAlignment - vmPageSize + vmSize

The vmPageSize might be larger than getpagesize().

Restored changeset:

&quot;bmalloc: Added a fast XLarge allocator&quot;
https://bugs.webkit.org/show_bug.cgi?id=154720
http://trac.webkit.org/changeset/197174</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocCMakeListstxt">releases/WebKitGTK/webkit-2.12/Source/bmalloc/CMakeLists.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocChangeLog">releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocAlgorithmh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Algorithm.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocAllocatorcpp">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Allocator.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocHeapcpp">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocHeaph">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocLargeObjecth">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/LargeObject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocObjectTypeh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/ObjectType.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocRangeh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocSizesh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Sizes.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocVMAllocateh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMAllocate.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocVMHeapcpp">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocVMHeaph">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocVMStateh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMState.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocVectorh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Vector.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212Sourcebmallocbmallocxcodeprojprojectpbxproj">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocSortedVectorh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/SortedVector.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeMapcpp">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeMaph">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.h</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeRangeh">releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeRange.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212SourcebmallocCMakeListstxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/CMakeLists.txt (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/CMakeLists.txt        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/CMakeLists.txt        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -13,6 +13,7 @@
</span><span class="cx">     bmalloc/SegregatedFreeList.cpp
</span><span class="cx">     bmalloc/StaticMutex.cpp
</span><span class="cx">     bmalloc/VMHeap.cpp
</span><ins>+    bmalloc/XLargeMap.cpp
</ins><span class="cx">     bmalloc/mbmalloc.cpp
</span><span class="cx"> )
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/ChangeLog        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2016-03-03  Geoffrey Garen  &lt;ggaren@apple.com&gt;
+
+        Unreviewed, rolling in r197174.
+        https://bugs.webkit.org/show_bug.cgi?id=154762
+
+        The right calculation for alignment is actually:
+
+            vmAlignment - getpagesize() + vmSize
+
+        instead of:
+
+            vmAlignment - vmPageSize + vmSize
+
+        The vmPageSize might be larger than getpagesize().
+
+        Restored changeset:
+
+        &quot;bmalloc: Added a fast XLarge allocator&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=154720
+        http://trac.webkit.org/changeset/197174
+
</ins><span class="cx"> 2016-02-22  Konstantin Tokarev  &lt;annulen@yandex.ru&gt;
</span><span class="cx"> 
</span><span class="cx">         Fixed compilation of bmalloc with GCC 4.8 after r196873.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocAlgorithmh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Algorithm.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Algorithm.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Algorithm.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -75,10 +75,16 @@
</span><span class="cx">     return roundUpToMultipleOf(divisor, x);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;typename T&gt; inline T roundDownToMultipleOf(size_t divisor, T x)
+{
+    BASSERT(isPowerOfTwo(divisor));
+    return reinterpret_cast&lt;T&gt;(mask(reinterpret_cast&lt;uintptr_t&gt;(x), ~(divisor - 1ul)));
+}
+
</ins><span class="cx"> template&lt;size_t divisor, typename T&gt; inline constexpr T roundDownToMultipleOf(T x)
</span><span class="cx"> {
</span><span class="cx">     static_assert(isPowerOfTwo(divisor), &quot;'divisor' must be a power of two.&quot;);
</span><del>-    return reinterpret_cast&lt;T&gt;(mask(reinterpret_cast&lt;uintptr_t&gt;(x), ~(divisor - 1ul)));
</del><ins>+    return roundDownToMultipleOf(divisor, x);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt; void divideRoundingUp(T numerator, T denominator, T&amp; quotient, T&amp; remainder)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocAllocatorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Allocator.cpp (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Allocator.cpp        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Allocator.cpp        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (size &lt;= xLargeMax) {
</span><span class="cx">         std::lock_guard&lt;StaticMutex&gt; lock(PerProcess&lt;Heap&gt;::mutex());
</span><del>-        return PerProcess&lt;Heap&gt;::getFastCase()-&gt;tryAllocateXLarge(lock, superChunkSize, roundUpToMultipleOf&lt;xLargeAlignment&gt;(size));
</del><ins>+        return PerProcess&lt;Heap&gt;::getFastCase()-&gt;tryAllocateXLarge(lock, alignment, size);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return nullptr;
</span><span class="lines">@@ -90,7 +90,7 @@
</span><span class="cx">     if (size &lt;= largeMax &amp;&amp; alignment &lt;= largeMax) {
</span><span class="cx">         size = std::max(largeMin, roundUpToMultipleOf&lt;largeAlignment&gt;(size));
</span><span class="cx">         alignment = roundUpToMultipleOf&lt;largeAlignment&gt;(alignment);
</span><del>-        size_t unalignedSize = largeMin + alignment + size;
</del><ins>+        size_t unalignedSize = largeMin + alignment - largeAlignment + size;
</ins><span class="cx">         if (unalignedSize &lt;= largeMax &amp;&amp; alignment &lt;= largeChunkSize / 2) {
</span><span class="cx">             std::lock_guard&lt;StaticMutex&gt; lock(PerProcess&lt;Heap&gt;::mutex());
</span><span class="cx">             return PerProcess&lt;Heap&gt;::getFastCase()-&gt;allocateLarge(lock, alignment, size, unalignedSize);
</span><span class="lines">@@ -98,8 +98,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (size &lt;= xLargeMax &amp;&amp; alignment &lt;= xLargeMax) {
</span><del>-        size = roundUpToMultipleOf&lt;xLargeAlignment&gt;(size);
-        alignment = std::max(superChunkSize, alignment);
</del><span class="cx">         std::lock_guard&lt;StaticMutex&gt; lock(PerProcess&lt;Heap&gt;::mutex());
</span><span class="cx">         return PerProcess&lt;Heap&gt;::getFastCase()-&gt;allocateXLarge(lock, alignment, size);
</span><span class="cx">     }
</span><span class="lines">@@ -144,36 +142,15 @@
</span><span class="cx">             break;
</span><span class="cx"> 
</span><span class="cx">         std::unique_lock&lt;StaticMutex&gt; lock(PerProcess&lt;Heap&gt;::mutex());
</span><del>-        Range&amp; range = PerProcess&lt;Heap&gt;::getFastCase()-&gt;findXLarge(lock, object);
-        oldSize = range.size();
</del><ins>+        oldSize = PerProcess&lt;Heap&gt;::getFastCase()-&gt;xLargeSize(lock, object);
</ins><span class="cx"> 
</span><del>-        newSize = roundUpToMultipleOf&lt;xLargeAlignment&gt;(newSize);
-
</del><span class="cx">         if (newSize == oldSize)
</span><span class="cx">             return object;
</span><span class="cx"> 
</span><span class="cx">         if (newSize &lt; oldSize &amp;&amp; newSize &gt; largeMax) {
</span><del>-            newSize = roundUpToMultipleOf&lt;xLargeAlignment&gt;(newSize);
-            if (oldSize - newSize &gt;= xLargeAlignment) {
-                lock.unlock();
-                vmDeallocate(static_cast&lt;char*&gt;(object) + newSize, oldSize - newSize);
-                lock.lock();
-
-                range = Range(object, newSize);
-            }
</del><ins>+            PerProcess&lt;Heap&gt;::getFastCase()-&gt;shrinkXLarge(lock, Range(object, oldSize), newSize);
</ins><span class="cx">             return object;
</span><span class="cx">         }
</span><del>-
-        if (newSize &gt; oldSize) {
-            lock.unlock();
-            bool wasExtended = tryVMExtend(object, oldSize, newSize);
-            lock.lock();
-
-            if (wasExtended) {
-                range = Range(object, newSize);
-                return object;
-            }
-        }
</del><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     }
</span><span class="lines">@@ -229,7 +206,6 @@
</span><span class="cx"> 
</span><span class="cx"> NO_INLINE void* Allocator::allocateXLarge(size_t size)
</span><span class="cx"> {
</span><del>-    size = roundUpToMultipleOf&lt;xLargeAlignment&gt;(size);
</del><span class="cx">     std::lock_guard&lt;StaticMutex&gt; lock(PerProcess&lt;Heap&gt;::mutex());
</span><span class="cx">     return PerProcess&lt;Heap&gt;::getFastCase()-&gt;allocateXLarge(lock, size);
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocHeapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.cpp        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -86,6 +86,7 @@
</span><span class="cx"> 
</span><span class="cx">     scavengeSmallPages(lock, sleepDuration);
</span><span class="cx">     scavengeLargeObjects(lock, sleepDuration);
</span><ins>+    scavengeXLargeObjects(lock, sleepDuration);
</ins><span class="cx"> 
</span><span class="cx">     sleep(lock, sleepDuration);
</span><span class="cx"> }
</span><span class="lines">@@ -106,6 +107,22 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void Heap::scavengeXLargeObjects(std::unique_lock&lt;StaticMutex&gt;&amp; lock, std::chrono::milliseconds sleepDuration)
+{
+    while (XLargeRange range = m_xLargeMap.takePhysical()) {
+        lock.unlock();
+        vmDeallocatePhysicalPagesSloppy(range.begin(), range.size());
+        lock.lock();
+        
+        range.setVMState(VMState::Virtual);
+        m_xLargeMap.addVirtual(range);
+
+        waitUntilFalse(lock, sleepDuration, m_isAllocatingPages);
+    }
+
+    m_xLargeMap.shrinkToFit();
+}
+
</ins><span class="cx"> void Heap::allocateSmallBumpRanges(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t sizeClass, BumpAllocator&amp; allocator, BumpRangeCache&amp; rangeCache)
</span><span class="cx"> {
</span><span class="cx">     BASSERT(!rangeCache.size());
</span><span class="lines">@@ -202,52 +219,6 @@
</span><span class="cx">     m_scavenger.run();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void* Heap::allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t alignment, size_t size)
-{
-    void* result = tryAllocateXLarge(lock, alignment, size);
-    RELEASE_BASSERT(result);
-    return result;
-}
-
-void* Heap::allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t size)
-{
-    return allocateXLarge(lock, superChunkSize, size);
-}
-
-void* Heap::tryAllocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, size_t alignment, size_t size)
-{
-    BASSERT(isPowerOfTwo(alignment));
-    BASSERT(alignment &gt;= superChunkSize);
-    BASSERT(size == roundUpToMultipleOf&lt;xLargeAlignment&gt;(size));
-
-    void* result = tryVMAllocate(alignment, size);
-    if (!result)
-        return nullptr;
-    m_xLargeObjects.push(Range(result, size));
-    return result;
-}
-
-Range&amp; Heap::findXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, void* object)
-{
-    for (auto&amp; range : m_xLargeObjects) {
-        if (range.begin() != object)
-            continue;
-        return range;
-    }
-
-    RELEASE_BASSERT(false);
-    return *static_cast&lt;Range*&gt;(nullptr); // Silence compiler error.
-}
-
-void Heap::deallocateXLarge(std::unique_lock&lt;StaticMutex&gt;&amp; lock, void* object)
-{
-    Range toDeallocate = m_xLargeObjects.pop(&amp;findXLarge(lock, object));
-
-    lock.unlock();
-    vmDeallocate(toDeallocate.begin(), toDeallocate.size());
-    lock.lock();
-}
-
</del><span class="cx"> inline LargeObject&amp; Heap::splitAndAllocate(LargeObject&amp; largeObject, size_t size)
</span><span class="cx"> {
</span><span class="cx">     BASSERT(largeObject.isFree());
</span><span class="lines">@@ -372,4 +343,102 @@
</span><span class="cx">     deallocateLarge(lock, largeObject);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void* Heap::allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t alignment, size_t size)
+{
+    void* result = tryAllocateXLarge(lock, alignment, size);
+    RELEASE_BASSERT(result);
+    return result;
+}
+
+void* Heap::allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t size)
+{
+    return allocateXLarge(lock, alignment, size);
+}
+
+XLargeRange Heap::splitAndAllocate(XLargeRange&amp; range, size_t alignment, size_t size)
+{
+    XLargeRange prev;
+    XLargeRange next;
+
+    size_t alignmentMask = alignment - 1;
+    if (test(range.begin(), alignmentMask)) {
+        size_t prefixSize = roundUpToMultipleOf(alignment, range.begin()) - range.begin();
+        std::pair&lt;XLargeRange, XLargeRange&gt; pair = range.split(prefixSize);
+        prev = pair.first;
+        range = pair.second;
+    }
+
+    if (range.size() - size &gt;= xLargeAlignment) {
+        size_t alignedSize = roundUpToMultipleOf&lt;xLargeAlignment&gt;(size);
+        std::pair&lt;XLargeRange, XLargeRange&gt; pair = range.split(alignedSize);
+        range = pair.first;
+        next = pair.second;
+    }
+
+    // At this point our range might contain an unused tail fragment. This is
+    // common. We can't allocate the tail fragment because it's aligned to less
+    // than xLargeAlignment. So, we pair the allocation with its tail fragment
+    // in the allocated list. This is an important optimization because it
+    // keeps the free list short, speeding up allocation and merging.
+
+    std::pair&lt;XLargeRange, XLargeRange&gt; allocated = range.split(roundUpToMultipleOf&lt;vmPageSize&gt;(size));
+    if (allocated.first.vmState().hasVirtual()) {
+        vmAllocatePhysicalPagesSloppy(allocated.first.begin(), allocated.first.size());
+        allocated.first.setVMState(VMState::Physical);
+    }
+
+    m_xLargeMap.addAllocated(prev, allocated, next);
+    return allocated.first;
+}
+
+void* Heap::tryAllocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, size_t alignment, size_t size)
+{
+    BASSERT(isPowerOfTwo(alignment));
+    BASSERT(alignment &lt; xLargeMax);
+
+    m_isAllocatingPages = true;
+
+    alignment = roundUpToMultipleOf&lt;xLargeAlignment&gt;(alignment);
+
+    XLargeRange range = m_xLargeMap.takeFree(alignment, size);
+    if (!range) {
+        // We allocate VM in aligned multiples to increase the chances that
+        // the OS will provide contiguous ranges that we can merge.
+        size_t alignedSize = roundUpToMultipleOf&lt;xLargeAlignment&gt;(size);
+
+        void* begin = tryVMAllocate(alignment, alignedSize);
+        if (!begin)
+            return nullptr;
+        range = XLargeRange(begin, alignedSize, VMState::Virtual);
+    }
+
+    return splitAndAllocate(range, alignment, size).begin();
+}
+
+size_t Heap::xLargeSize(std::unique_lock&lt;StaticMutex&gt;&amp;, void* object)
+{
+    return m_xLargeMap.getAllocated(object).size();
+}
+
+void Heap::shrinkXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, const Range&amp; object, size_t newSize)
+{
+    BASSERT(object.size() &gt; newSize);
+
+    if (object.size() - newSize &lt; vmPageSize)
+        return;
+    
+    XLargeRange range = m_xLargeMap.takeAllocated(object.begin());
+    splitAndAllocate(range, xLargeAlignment, newSize);
+
+    m_scavenger.run();
+}
+
+void Heap::deallocateXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, void* object)
+{
+    XLargeRange range = m_xLargeMap.takeAllocated(object);
+    m_xLargeMap.addFree(range);
+    
+    m_scavenger.run();
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocHeaph"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Heap.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -36,6 +36,7 @@
</span><span class="cx"> #include &quot;SmallPage.h&quot;
</span><span class="cx"> #include &quot;VMHeap.h&quot;
</span><span class="cx"> #include &quot;Vector.h&quot;
</span><ins>+#include &quot;XLargeMap.h&quot;
</ins><span class="cx"> #include &lt;array&gt;
</span><span class="cx"> #include &lt;mutex&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -61,7 +62,8 @@
</span><span class="cx">     void* allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, size_t);
</span><span class="cx">     void* allocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, size_t alignment, size_t);
</span><span class="cx">     void* tryAllocateXLarge(std::lock_guard&lt;StaticMutex&gt;&amp;, size_t alignment, size_t);
</span><del>-    Range&amp; findXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, void*);
</del><ins>+    size_t xLargeSize(std::unique_lock&lt;StaticMutex&gt;&amp;, void*);
+    void shrinkXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, const Range&amp;, size_t newSize);
</ins><span class="cx">     void deallocateXLarge(std::unique_lock&lt;StaticMutex&gt;&amp;, void*);
</span><span class="cx"> 
</span><span class="cx">     void scavenge(std::unique_lock&lt;StaticMutex&gt;&amp;, std::chrono::milliseconds sleepDuration);
</span><span class="lines">@@ -81,10 +83,13 @@
</span><span class="cx">     void mergeLarge(BeginTag*&amp;, EndTag*&amp;, Range&amp;);
</span><span class="cx">     void mergeLargeLeft(EndTag*&amp;, BeginTag*&amp;, Range&amp;, bool&amp; inVMHeap);
</span><span class="cx">     void mergeLargeRight(EndTag*&amp;, BeginTag*&amp;, Range&amp;, bool&amp; inVMHeap);
</span><del>-    
</del><ins>+
+    XLargeRange splitAndAllocate(XLargeRange&amp;, size_t alignment, size_t);
+
</ins><span class="cx">     void concurrentScavenge();
</span><span class="cx">     void scavengeSmallPages(std::unique_lock&lt;StaticMutex&gt;&amp;, std::chrono::milliseconds);
</span><span class="cx">     void scavengeLargeObjects(std::unique_lock&lt;StaticMutex&gt;&amp;, std::chrono::milliseconds);
</span><ins>+    void scavengeXLargeObjects(std::unique_lock&lt;StaticMutex&gt;&amp;, std::chrono::milliseconds);
</ins><span class="cx"> 
</span><span class="cx">     std::array&lt;std::array&lt;LineMetadata, smallLineCount&gt;, smallMax / alignment&gt; m_smallLineMetadata;
</span><span class="cx"> 
</span><span class="lines">@@ -93,7 +98,8 @@
</span><span class="cx">     Vector&lt;SmallPage*&gt; m_smallPages;
</span><span class="cx"> 
</span><span class="cx">     SegregatedFreeList m_largeObjects;
</span><del>-    Vector&lt;Range&gt; m_xLargeObjects;
</del><ins>+    
+    XLargeMap m_xLargeMap;
</ins><span class="cx"> 
</span><span class="cx">     bool m_isAllocatingPages;
</span><span class="cx">     AsyncTask&lt;Heap, decltype(&amp;Heap::concurrentScavenge)&gt; m_scavenger;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocLargeObjecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/LargeObject.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/LargeObject.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/LargeObject.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -219,6 +219,7 @@
</span><span class="cx"> 
</span><span class="cx"> inline std::pair&lt;LargeObject, LargeObject&gt; LargeObject::split(size_t size) const
</span><span class="cx"> {
</span><ins>+    BASSERT(size &lt;= this-&gt;size());
</ins><span class="cx">     Range split(begin(), size);
</span><span class="cx">     Range leftover = Range(split.end(), this-&gt;size() - size);
</span><span class="cx">     BASSERT(leftover.size() &gt;= largeMin);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocObjectTypeh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/ObjectType.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/ObjectType.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/ObjectType.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> 
</span><span class="cx"> inline bool isXLarge(void* object)
</span><span class="cx"> {
</span><del>-    return !test(object, ~superChunkMask);
</del><ins>+    return !test(object, ~xLargeMask);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace bmalloc
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocRangeh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #ifndef Range_h
</span><span class="cx"> #define Range_h
</span><span class="cx"> 
</span><ins>+#include &lt;algorithm&gt;
</ins><span class="cx"> #include &lt;cstddef&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace bmalloc {
</span><span class="lines">@@ -49,6 +50,7 @@
</span><span class="cx">     size_t size() const { return m_size; }
</span><span class="cx">     
</span><span class="cx">     bool operator!() const { return !m_size; }
</span><ins>+    explicit operator bool() const { return !!*this; }
</ins><span class="cx">     bool operator&lt;(const Range&amp; other) const { return m_begin &lt; other.m_begin; }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="lines">@@ -56,6 +58,16 @@
</span><span class="cx">     size_t m_size;
</span><span class="cx"> };
</span><span class="cx"> 
</span><ins>+inline bool canMerge(const Range&amp; a, const Range&amp; b)
+{
+    return a.begin() == b.end() || a.end() == b.begin();
+}
+
+inline Range merge(const Range&amp; a, const Range&amp; b)
+{
+    return Range(std::min(a.begin(), b.begin()), a.size() + b.size());
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // Range_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocSizesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Sizes.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Sizes.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Sizes.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -73,7 +73,8 @@
</span><span class="cx">     static const size_t largeChunkMetadataSize = 4 * kB; // sizeof(LargeChunk)
</span><span class="cx">     static const size_t largeMax = largeChunkSize - largeChunkMetadataSize;
</span><span class="cx"> 
</span><del>-    static const size_t xLargeAlignment = vmPageSize;
</del><ins>+    static const size_t xLargeAlignment = superChunkSize;
+    static const size_t xLargeMask = ~(xLargeAlignment - 1);
</ins><span class="cx">     static const size_t xLargeMax = std::numeric_limits&lt;size_t&gt;::max() - xLargeAlignment; // Make sure that rounding up to xLargeAlignment does not overflow.
</span><span class="cx"> 
</span><span class="cx">     static const size_t freeListSearchDepth = 16;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocSortedVectorh"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/SortedVector.h (0 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/SortedVector.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/SortedVector.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -0,0 +1,169 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef SortedVector_h
+#define SortedVector_h
+
+#include &quot;Vector.h&quot;
+#include &lt;algorithm&gt;
+
+namespace bmalloc {
+
+template&lt;typename T&gt;
+class SortedVector {
+    static_assert(std::is_trivially_destructible&lt;T&gt;::value, &quot;SortedVector must have a trivial destructor.&quot;);
+
+    struct Bucket {
+        explicit Bucket(T value)
+            : value(value)
+            , isDeleted(false)
+        {
+        }
+        
+        template&lt;typename U&gt; bool operator&lt;(const U&amp; other) const
+        {
+            return value &lt; other;
+        }
+
+        T value;
+        bool isDeleted;
+    };
+
+public:
+    class iterator : public std::iterator&lt;std::forward_iterator_tag, T&gt; {
+    public:
+        iterator(Bucket* bucket, Bucket* end)
+            : m_bucket(bucket)
+            , m_end(end)
+        {
+            skipDeletedBuckets();
+        }
+        
+        iterator(const iterator&amp; other)
+            : m_bucket(other.m_bucket)
+            , m_end(other.m_end)
+        {
+        }
+
+        iterator&amp; operator++()
+        {
+            BASSERT(m_bucket != m_end);
+            ++m_bucket;
+            skipDeletedBuckets();
+            return *this;
+        }
+
+        bool operator!=(const iterator&amp; other)
+        {
+            return m_bucket != other.m_bucket;
+        }
+
+        T&amp; operator*()
+        {
+            BASSERT(m_bucket &lt; m_end);
+            BASSERT(!m_bucket-&gt;isDeleted);
+            return m_bucket-&gt;value;
+        }
+
+        T* operator-&gt;()  { return &amp;operator*(); }
+
+    private:
+        friend class SortedVector;
+
+        void skipDeletedBuckets()
+        {
+            while (m_bucket != m_end &amp;&amp; m_bucket-&gt;isDeleted)
+                ++m_bucket;
+        }
+
+        Bucket* m_bucket;
+        Bucket* m_end;
+    };
+
+    iterator begin() { return iterator(m_vector.begin(), m_vector.end()); }
+    iterator end() { return iterator(m_vector.end(), m_vector.end()); }
+
+    void insert(const T&amp;);
+
+    template&lt;typename U&gt; iterator find(const U&amp;);
+    template&lt;typename U&gt; T get(const U&amp;);
+    template&lt;typename U&gt; T take(const U&amp;);
+
+    void shrinkToFit();
+
+private:
+    Vector&lt;Bucket&gt; m_vector;
+};
+
+template&lt;typename T&gt;
+void SortedVector&lt;T&gt;::insert(const T&amp; value)
+{
+    auto it = std::lower_bound(m_vector.begin(), m_vector.end(), value);
+    if (it != m_vector.end() &amp;&amp; it-&gt;isDeleted) {
+        *it = Bucket(value);
+        return;
+    }
+
+    m_vector.insert(it, Bucket(value));
+}
+
+template&lt;typename T&gt; template&lt;typename U&gt;
+typename SortedVector&lt;T&gt;::iterator SortedVector&lt;T&gt;::find(const U&amp; value)
+{
+    auto it = std::lower_bound(m_vector.begin(), m_vector.end(), value);
+    return iterator(it, m_vector.end());
+}
+
+template&lt;typename T&gt; template&lt;typename U&gt;
+T SortedVector&lt;T&gt;::get(const U&amp; value)
+{
+    return *find(value);
+}
+
+template&lt;typename T&gt; template&lt;typename U&gt;
+T SortedVector&lt;T&gt;::take(const U&amp; value)
+{
+    auto it = find(value);
+    it.m_bucket-&gt;isDeleted = true;
+    return it.m_bucket-&gt;value;
+}
+
+template&lt;typename T&gt;
+void SortedVector&lt;T&gt;::shrinkToFit()
+{
+    auto isDeleted = [](const Bucket&amp; bucket) {
+        return bucket.isDeleted;
+    };
+
+    auto newEnd = std::remove_if(m_vector.begin(), m_vector.end(), isDeleted);
+    size_t newSize = newEnd - m_vector.begin();
+    m_vector.shrink(newSize);
+
+    m_vector.shrinkToFit();
+}
+
+} // namespace bmalloc
+
+#endif // SortedVector_h
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocVMAllocateh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMAllocate.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMAllocate.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMAllocate.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -82,29 +82,6 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline bool tryVMExtend(void* p, size_t vmOldSize, size_t vmNewSize)
-{
-    vmValidate(vmOldSize);
-    vmValidate(vmNewSize);
-    
-    BASSERT(vmOldSize &lt; vmNewSize);
-
-    void* nextAddress = static_cast&lt;char*&gt;(p) + vmOldSize;
-    size_t extentionSize = vmNewSize - vmOldSize;
-
-    void* result = mmap(nextAddress, extentionSize, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, BMALLOC_VM_TAG, 0);
-
-    if (result == MAP_FAILED)
-        return false;
-
-    if (result != nextAddress) {
-        munmap(result, extentionSize);
-        return false;
-    }
-    
-    return true;
-}
-
</del><span class="cx"> inline void* vmAllocate(size_t vmSize)
</span><span class="cx"> {
</span><span class="cx">     void* result = tryVMAllocate(vmSize);
</span><span class="lines">@@ -126,7 +103,10 @@
</span><span class="cx">     vmValidate(vmSize);
</span><span class="cx">     vmValidate(vmAlignment);
</span><span class="cx"> 
</span><del>-    size_t mappedSize = std::max(vmSize, vmAlignment) + vmAlignment;
</del><ins>+    // We use getpagesize() here instead of vmPageSize because vmPageSize is
+    // allowed to be larger than the OS's true page size.
+
+    size_t mappedSize = vmAlignment - getpagesize() + vmSize;
</ins><span class="cx">     char* mapped = static_cast&lt;char*&gt;(tryVMAllocate(mappedSize));
</span><span class="cx">     if (!mapped)
</span><span class="cx">         return nullptr;
</span><span class="lines">@@ -135,6 +115,8 @@
</span><span class="cx">     char* aligned = roundUpToMultipleOf(vmAlignment, mapped);
</span><span class="cx">     char* alignedEnd = aligned + vmSize;
</span><span class="cx">     
</span><ins>+    RELEASE_BASSERT(alignedEnd &lt;= mappedEnd);
+    
</ins><span class="cx">     if (size_t leftExtra = aligned - mapped)
</span><span class="cx">         vmDeallocate(mapped, leftExtra);
</span><span class="cx">     
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocVMHeapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.cpp (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.cpp        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.cpp        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -47,15 +47,14 @@
</span><span class="cx">         m_smallPages.push(it);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void VMHeap::allocateLargeChunk(std::lock_guard&lt;StaticMutex&gt;&amp; lock)
</del><ins>+LargeObject VMHeap::allocateLargeChunk(std::lock_guard&lt;StaticMutex&gt;&amp; lock)
</ins><span class="cx"> {
</span><span class="cx">     if (!m_largeChunks.size())
</span><span class="cx">         allocateSuperChunk(lock);
</span><span class="cx"> 
</span><span class="cx">     // We initialize chunks lazily to avoid dirtying their metadata pages.
</span><span class="cx">     LargeChunk* largeChunk = new (m_largeChunks.pop()-&gt;largeChunk()) LargeChunk;
</span><del>-    LargeObject largeObject(largeChunk-&gt;begin());
-    m_largeObjects.insert(largeObject);
</del><ins>+    return LargeObject(largeChunk-&gt;begin());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void VMHeap::allocateSuperChunk(std::lock_guard&lt;StaticMutex&gt;&amp;)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocVMHeaph"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMHeap.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx">     
</span><span class="cx"> private:
</span><span class="cx">     void allocateSmallChunk(std::lock_guard&lt;StaticMutex&gt;&amp;);
</span><del>-    void allocateLargeChunk(std::lock_guard&lt;StaticMutex&gt;&amp;);
</del><ins>+    LargeObject allocateLargeChunk(std::lock_guard&lt;StaticMutex&gt;&amp;);
</ins><span class="cx">     void allocateSuperChunk(std::lock_guard&lt;StaticMutex&gt;&amp;);
</span><span class="cx"> 
</span><span class="cx">     Vector&lt;SmallPage*&gt; m_smallPages;
</span><span class="lines">@@ -85,26 +85,20 @@
</span><span class="cx"> 
</span><span class="cx"> inline LargeObject VMHeap::allocateLargeObject(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t size)
</span><span class="cx"> {
</span><del>-    LargeObject largeObject = m_largeObjects.take(size);
-    if (!largeObject) {
-        allocateLargeChunk(lock);
-        largeObject = m_largeObjects.take(size);
-        BASSERT(largeObject);
-    }
</del><ins>+    if (LargeObject largeObject = m_largeObjects.take(size))
+        return largeObject;
</ins><span class="cx"> 
</span><del>-    return largeObject;
</del><ins>+    BASSERT(size &lt;= largeMax);
+    return allocateLargeChunk(lock);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline LargeObject VMHeap::allocateLargeObject(std::lock_guard&lt;StaticMutex&gt;&amp; lock, size_t alignment, size_t size, size_t unalignedSize)
</span><span class="cx"> {
</span><del>-    LargeObject largeObject = m_largeObjects.take(alignment, size, unalignedSize);
-    if (!largeObject) {
-        allocateLargeChunk(lock);
-        largeObject = m_largeObjects.take(alignment, size, unalignedSize);
-        BASSERT(largeObject);
-    }
</del><ins>+    if (LargeObject largeObject = m_largeObjects.take(alignment, size, unalignedSize))
+        return largeObject;
</ins><span class="cx"> 
</span><del>-    return largeObject;
</del><ins>+    BASSERT(unalignedSize &lt;= largeMax);
+    return allocateLargeChunk(lock);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void VMHeap::deallocateSmallPage(std::unique_lock&lt;StaticMutex&gt;&amp; lock, SmallPage* page)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocVMStateh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMState.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMState.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/VMState.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -74,6 +74,13 @@
</span><span class="cx">     State m_state;
</span><span class="cx"> };
</span><span class="cx"> 
</span><ins>+inline VMState merge(VMState a, VMState b)
+{
+    VMState result(a);
+    result.merge(b);
+    return result;
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // VMState_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocVectorh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Vector.h (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Vector.h        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Vector.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -40,14 +40,17 @@
</span><span class="cx"> class Vector {
</span><span class="cx">     static_assert(std::is_trivially_destructible&lt;T&gt;::value, &quot;Vector must have a trivial destructor.&quot;);
</span><span class="cx"> public:
</span><ins>+    typedef T* iterator;
+    typedef const T* const_iterator;
+
</ins><span class="cx">     Vector(const Vector&amp;) = delete;
</span><span class="cx">     Vector&amp; operator=(const Vector&amp;) = delete;
</span><span class="cx"> 
</span><span class="cx">     Vector();
</span><span class="cx">     ~Vector();
</span><span class="cx"> 
</span><del>-    T* begin() { return m_buffer; }
-    T* end() { return m_buffer + m_size; }
</del><ins>+    iterator begin() { return m_buffer; }
+    iterator end() { return m_buffer + m_size; }
</ins><span class="cx"> 
</span><span class="cx">     size_t size() { return m_size; }
</span><span class="cx">     size_t capacity() { return m_capacity; }
</span><span class="lines">@@ -56,19 +59,23 @@
</span><span class="cx">     T&amp; last() { return m_buffer[m_size - 1]; }
</span><span class="cx"> 
</span><span class="cx">     void push(const T&amp;);
</span><del>-    void push(const T*, const T*);
</del><ins>+
</ins><span class="cx">     T pop();
</span><span class="cx">     T pop(size_t);
</span><del>-    T pop(const T* it) { return pop(it - begin()); }
</del><ins>+    T pop(const_iterator it) { return pop(it - begin()); }
+    
+    void insert(iterator, const T&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void shrink(size_t);
</span><span class="cx"> 
</span><ins>+    void shrinkToFit();
+
</ins><span class="cx"> private:
</span><span class="cx">     static const size_t growFactor = 2;
</span><span class="cx">     static const size_t shrinkFactor = 4;
</span><span class="cx">     static const size_t initialCapacity = vmPageSize / sizeof(T);
</span><span class="cx"> 
</span><del>-    void growCapacity(size_t size);
</del><ins>+    void growCapacity();
</ins><span class="cx">     void shrinkCapacity();
</span><span class="cx">     void reallocateBuffer(size_t);
</span><span class="cx"> 
</span><span class="lines">@@ -103,21 +110,11 @@
</span><span class="cx"> INLINE void Vector&lt;T&gt;::push(const T&amp; value)
</span><span class="cx"> {
</span><span class="cx">     if (m_size == m_capacity)
</span><del>-        growCapacity(m_size);
</del><ins>+        growCapacity();
</ins><span class="cx">     m_buffer[m_size++] = value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt;
</span><del>-void Vector&lt;T&gt;::push(const T* begin, const T* end)
-{
-    size_t newSize = m_size + (end - begin);
-    if (newSize &gt; m_capacity)
-        growCapacity(newSize);
-    std::memcpy(this-&gt;end(), begin, (end - begin) * sizeof(T));
-    m_size = newSize;
-}
-
-template&lt;typename T&gt;
</del><span class="cx"> inline T Vector&lt;T&gt;::pop()
</span><span class="cx"> {
</span><span class="cx">     BASSERT(m_size);
</span><span class="lines">@@ -135,6 +132,20 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt;
</span><ins>+void Vector&lt;T&gt;::insert(iterator it, const T&amp; value)
+{
+    size_t index = it - begin();
+    size_t moveCount = end() - it;
+
+    if (m_size == m_capacity)
+        growCapacity();
+
+    std::memmove(&amp;m_buffer[index + 1], &amp;m_buffer[index], moveCount * sizeof(T));
+    m_buffer[index] = value;
+    m_size++;
+}
+
+template&lt;typename T&gt;
</ins><span class="cx"> inline void Vector&lt;T&gt;::shrink(size_t size)
</span><span class="cx"> {
</span><span class="cx">     BASSERT(size &lt;= m_size);
</span><span class="lines">@@ -147,7 +158,7 @@
</span><span class="cx"> void Vector&lt;T&gt;::reallocateBuffer(size_t newCapacity)
</span><span class="cx"> {
</span><span class="cx">     size_t vmSize = bmalloc::vmSize(newCapacity * sizeof(T));
</span><del>-    T* newBuffer = static_cast&lt;T*&gt;(vmAllocate(vmSize));
</del><ins>+    T* newBuffer = vmSize ? static_cast&lt;T*&gt;(vmAllocate(vmSize)) : nullptr;
</ins><span class="cx">     if (m_buffer) {
</span><span class="cx">         std::memcpy(newBuffer, m_buffer, m_size * sizeof(T));
</span><span class="cx">         vmDeallocate(m_buffer, bmalloc::vmSize(m_capacity * sizeof(T)));
</span><span class="lines">@@ -165,12 +176,19 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt;
</span><del>-NO_INLINE void Vector&lt;T&gt;::growCapacity(size_t size)
</del><ins>+NO_INLINE void Vector&lt;T&gt;::growCapacity()
</ins><span class="cx"> {
</span><del>-    size_t newCapacity = max(initialCapacity, size * growFactor);
</del><ins>+    size_t newCapacity = max(initialCapacity, m_size * growFactor);
</ins><span class="cx">     reallocateBuffer(newCapacity);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;typename T&gt;
+void Vector&lt;T&gt;::shrinkToFit()
+{
+    if (m_size &lt; m_capacity)
+        reallocateBuffer(m_size);
+}
+
</ins><span class="cx"> } // namespace bmalloc
</span><span class="cx"> 
</span><span class="cx"> #endif // Vector_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeMapcpp"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.cpp (0 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.cpp                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.cpp        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -0,0 +1,151 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;XLargeMap.h&quot;
+
+namespace bmalloc {
+
+XLargeRange XLargeMap::takeFree(size_t alignment, size_t size)
+{
+    size_t alignmentMask = alignment - 1;
+
+    XLargeRange* candidate = m_free.end();
+    for (XLargeRange* it = m_free.begin(); it != m_free.end(); ++it) {
+        if (it-&gt;size() &lt; size)
+            continue;
+
+        if (candidate != m_free.end() &amp;&amp; candidate-&gt;begin() &lt; it-&gt;begin())
+            continue;
+
+        if (test(it-&gt;begin(), alignmentMask)) {
+            char* aligned = roundUpToMultipleOf(alignment, it-&gt;begin());
+            if (aligned &lt; it-&gt;begin()) // Check for overflow.
+                continue;
+
+            char* alignedEnd = aligned + size;
+            if (alignedEnd &lt; aligned) // Check for overflow.
+                continue;
+
+            if (alignedEnd &gt; it-&gt;end())
+                continue;
+        }
+
+        candidate = it;
+    }
+    
+    if (candidate == m_free.end())
+        return XLargeRange();
+
+    return m_free.pop(candidate);
+}
+
+void XLargeMap::addFree(const XLargeRange&amp; range)
+{
+    XLargeRange merged = range;
+
+    for (size_t i = 0; i &lt; m_free.size(); ++i) {
+        auto&amp; other = m_free[i];
+
+        if (!canMerge(merged, other))
+            continue;
+
+        merged = merge(merged, m_free.pop(i--));
+    }
+    
+    m_free.push(merged);
+}
+
+void XLargeMap::addAllocated(const XLargeRange&amp; prev, const std::pair&lt;XLargeRange, XLargeRange&gt;&amp; allocated, const XLargeRange&amp; next)
+{
+    if (prev)
+        m_free.push(prev);
+    
+    if (next)
+        m_free.push(next);
+
+    m_allocated.insert({ allocated.first, allocated.second });
+}
+
+XLargeRange XLargeMap::getAllocated(void* object)
+{
+    return m_allocated.find(object)-&gt;object;
+}
+
+XLargeRange XLargeMap::takeAllocated(void* object)
+{
+    Allocation allocation = m_allocated.take(object);
+    return merge(allocation.object, allocation.unused);
+}
+
+void XLargeMap::shrinkToFit()
+{
+    m_free.shrinkToFit();
+    m_allocated.shrinkToFit();
+}
+
+XLargeRange XLargeMap::takePhysical() {
+    auto hasPhysical = [](const XLargeRange&amp; range) {
+        return range.vmState().hasPhysical();
+    };
+
+    auto it = std::find_if(m_free.begin(), m_free.end(), hasPhysical);
+    if (it != m_free.end())
+        return m_free.pop(it);
+
+    auto hasUnused = [](const Allocation&amp; allocation) {
+        return allocation.unused &amp;&amp; allocation.unused.vmState().hasPhysical();
+    };
+    
+    XLargeRange swapped;
+    auto it2 = std::find_if(m_allocated.begin(), m_allocated.end(), hasUnused);
+    if (it2 != m_allocated.end())
+        std::swap(it2-&gt;unused, swapped);
+    
+    return swapped;
+}
+
+void XLargeMap::addVirtual(const XLargeRange&amp; range)
+{
+    auto canMerge = [&amp;range](const Allocation&amp; other) {
+        return other.object.end() == range.begin();
+    };
+
+    if (range.size() &lt; xLargeAlignment) {
+        // This is an unused fragment, so it might belong in the allocated list.
+        auto it = std::find_if(m_allocated.begin(), m_allocated.end(), canMerge);
+        if (it != m_allocated.end()) {
+            BASSERT(!it-&gt;unused);
+            it-&gt;unused = range;
+            return;
+        }
+
+        // If we didn't find a neighbor in the allocated list, our neighbor must
+        // have been freed. We'll merge with it below.
+    }
+
+    addFree(range);
+}
+
+} // namespace bmalloc
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeMaphfromrev197761releasesWebKitGTKwebkit212SourcebmallocbmallocRangeh"></a>
<div class="copfile"><h4>Copied: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.h (from rev 197761, releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h) (0 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeMap.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -0,0 +1,65 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef XLargeMap_h
+#define XLargeMap_h
+
+#include &quot;SortedVector.h&quot;
+#include &quot;Vector.h&quot;
+#include &quot;XLargeRange.h&quot;
+#include &lt;algorithm&gt;
+
+namespace bmalloc {
+
+class XLargeMap {
+public:
+    void addFree(const XLargeRange&amp;);
+    XLargeRange takeFree(size_t alignment, size_t);
+
+    void addAllocated(const XLargeRange&amp; prev, const std::pair&lt;XLargeRange, XLargeRange&gt;&amp;, const XLargeRange&amp; next);
+    XLargeRange getAllocated(void*);
+    XLargeRange takeAllocated(void*);
+
+    XLargeRange takePhysical();
+    void addVirtual(const XLargeRange&amp;);
+    
+    void shrinkToFit();
+
+private:
+    struct Allocation {
+        bool operator&lt;(const Allocation&amp; other) const { return object &lt; other.object; }
+        bool operator&lt;(void* ptr) const { return object.begin() &lt; ptr; }
+
+        XLargeRange object;
+        XLargeRange unused;
+    };
+
+    Vector&lt;XLargeRange&gt; m_free;
+    SortedVector&lt;Allocation&gt; m_allocated;
+};
+
+} // namespace bmalloc
+
+#endif // XLargeMap_h
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourcebmallocbmallocXLargeRangehfromrev197761releasesWebKitGTKwebkit212SourcebmallocbmallocRangeh"></a>
<div class="copfile"><h4>Copied: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeRange.h (from rev 197761, releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/Range.h) (0 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeRange.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc/XLargeRange.h        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -0,0 +1,86 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef XLargeRange_h
+#define XLargeRange_h
+
+#include &quot;VMState.h&quot;
+
+namespace bmalloc {
+
+class XLargeRange : public Range {
+public:
+    XLargeRange()
+        : Range()
+        , m_vmState(VMState::Virtual)
+    {
+    }
+
+    XLargeRange(void* begin, size_t size, VMState vmState)
+        : Range(begin, size)
+        , m_vmState(vmState)
+    {
+    }
+    
+    VMState vmState() const { return m_vmState; }
+    void setVMState(VMState vmState) { m_vmState = vmState; }
+
+    std::pair&lt;XLargeRange, XLargeRange&gt; split(size_t) const;
+
+private:
+    VMState m_vmState;
+};
+
+inline bool canMerge(const XLargeRange&amp; a, const XLargeRange&amp; b)
+{
+    if (a.end() == b.begin())
+        return true;
+    
+    if (b.end() == a.begin())
+        return true;
+    
+    return false;
+}
+
+inline XLargeRange merge(const XLargeRange&amp; a, const XLargeRange&amp; b)
+{
+    return XLargeRange(
+        std::min(a.begin(), b.begin()),
+        a.size() + b.size(),
+        merge(a.vmState(), b.vmState()));
+}
+
+inline std::pair&lt;XLargeRange, XLargeRange&gt; XLargeRange::split(size_t size) const
+{
+    BASSERT(size &lt;= this-&gt;size());
+
+    XLargeRange left(begin(), size, vmState());
+    XLargeRange right(left.end(), this-&gt;size() - size, vmState());
+    return std::make_pair(left, right);
+}
+
+} // namespace bmalloc
+
+#endif // XLargeRange_h
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212Sourcebmallocbmallocxcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj (197761 => 197762)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj        2016-03-08 14:23:18 UTC (rev 197761)
+++ releases/WebKitGTK/webkit-2.12/Source/bmalloc/bmalloc.xcodeproj/project.pbxproj        2016-03-08 14:28:40 UTC (rev 197762)
</span><span class="lines">@@ -21,6 +21,9 @@
</span><span class="cx">                 1440AFCD1A9527AF00837FAA /* Zone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440AFCC1A9527AF00837FAA /* Zone.cpp */; };
</span><span class="cx">                 1448C30018F3754600502839 /* mbmalloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1448C2FF18F3754300502839 /* mbmalloc.cpp */; };
</span><span class="cx">                 1448C30118F3754C00502839 /* bmalloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 1448C2FE18F3754300502839 /* bmalloc.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                144C07F41C7B70260051BB6A /* XLargeMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144C07F21C7B70260051BB6A /* XLargeMap.cpp */; };
+                144C07F51C7B70260051BB6A /* XLargeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 144C07F31C7B70260051BB6A /* XLargeMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                146041E71C7FF2EF00E9F94E /* SortedVector.h in Headers */ = {isa = PBXBuildFile; fileRef = 146041E61C7FF2EF00E9F94E /* SortedVector.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 14895D911A3A319C0006235D /* Environment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14895D8F1A3A319C0006235D /* Environment.cpp */; };
</span><span class="cx">                 14895D921A3A319C0006235D /* Environment.h in Headers */ = {isa = PBXBuildFile; fileRef = 14895D901A3A319C0006235D /* Environment.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14C6216F1A9A9A6200E72293 /* LargeObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 14C6216E1A9A9A6200E72293 /* LargeObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -52,6 +55,7 @@
</span><span class="cx">                 14DD78CE18F48D7500950702 /* Syscall.h in Headers */ = {isa = PBXBuildFile; fileRef = 1417F64F18B7280C0076FA3F /* Syscall.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14DD78CF18F48D7500950702 /* Vector.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479E21217A1A255006D4E9D /* Vector.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 14DD78D018F48D7500950702 /* VMAllocate.h in Headers */ = {isa = PBXBuildFile; fileRef = 1479E21417A1A63E006D4E9D /* VMAllocate.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                14EB79EA1C7C1BC4005E834F /* XLargeRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 14EB79E81C7C1BC4005E834F /* XLargeRange.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 14F271C318EA3978008C152F /* Allocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 145F6855179DC8CA00D65598 /* Allocator.cpp */; };
</span><span class="cx">                 14F271C418EA397B008C152F /* Cache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 144469E417A46BFE00F9EA1D /* Cache.cpp */; };
</span><span class="cx">                 14F271C518EA397E008C152F /* Deallocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 145F6859179DC90200D65598 /* Deallocator.cpp */; };
</span><span class="lines">@@ -97,6 +101,8 @@
</span><span class="cx">                 14446A0717A61FA400F9EA1D /* PerProcess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PerProcess.h; path = bmalloc/PerProcess.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 1448C2FE18F3754300502839 /* bmalloc.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = bmalloc.h; path = bmalloc/bmalloc.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 1448C2FF18F3754300502839 /* mbmalloc.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = mbmalloc.cpp; path = bmalloc/mbmalloc.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                144C07F21C7B70260051BB6A /* XLargeMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = XLargeMap.cpp; path = bmalloc/XLargeMap.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                144C07F31C7B70260051BB6A /* XLargeMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = XLargeMap.h; path = bmalloc/XLargeMap.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 144DCED617A649D90093B2F2 /* Mutex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Mutex.h; path = bmalloc/Mutex.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 144F7BFB18BFC517003537F3 /* VMHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = VMHeap.cpp; path = bmalloc/VMHeap.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 144F7BFC18BFC517003537F3 /* VMHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = VMHeap.h; path = bmalloc/VMHeap.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -107,6 +113,7 @@
</span><span class="cx">                 145F685A179DC90200D65598 /* Deallocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; name = Deallocator.h; path = bmalloc/Deallocator.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</span><span class="cx">                 145F6874179DF84100D65598 /* Sizes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Sizes.h; path = bmalloc/Sizes.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 145F6878179E3A4400D65598 /* Range.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; name = Range.h; path = bmalloc/Range.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</span><ins>+                146041E61C7FF2EF00E9F94E /* SortedVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SortedVector.h; path = bmalloc/SortedVector.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 146BEE1E18C841C50002D5A2 /* SegregatedFreeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SegregatedFreeList.h; path = bmalloc/SegregatedFreeList.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 146BEE2118C845AE0002D5A2 /* SegregatedFreeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SegregatedFreeList.cpp; path = bmalloc/SegregatedFreeList.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 1479E21217A1A255006D4E9D /* Vector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; name = Vector.h; path = bmalloc/Vector.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</span><span class="lines">@@ -128,6 +135,7 @@
</span><span class="cx">                 14D9DB4517F2447100EAAB79 /* FixedVector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; name = FixedVector.h; path = bmalloc/FixedVector.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</span><span class="cx">                 14DA320C18875B09007269E0 /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Heap.h; path = bmalloc/Heap.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 14DA320E18875D9F007269E0 /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Heap.cpp; path = bmalloc/Heap.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                14EB79E81C7C1BC4005E834F /* XLargeRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = XLargeRange.h; path = bmalloc/XLargeRange.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 14F271BE18EA3963008C152F /* libbmalloc.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libbmalloc.a; sourceTree = BUILT_PRODUCTS_DIR; };
</span><span class="cx"> /* End PBXFileReference section */
</span><span class="cx"> 
</span><span class="lines">@@ -159,6 +167,16 @@
</span><span class="cx">                         name = api;
</span><span class="cx">                         sourceTree = &quot;&lt;group&gt;&quot;;
</span><span class="cx">                 };
</span><ins>+                144C07F71C7B707D0051BB6A /* heap: xlarge */ = {
+                        isa = PBXGroup;
+                        children = (
+                                144C07F21C7B70260051BB6A /* XLargeMap.cpp */,
+                                144C07F31C7B70260051BB6A /* XLargeMap.h */,
+                                14EB79E81C7C1BC4005E834F /* XLargeRange.h */,
+                        );
+                        name = &quot;heap: xlarge&quot;;
+                        sourceTree = &quot;&lt;group&gt;&quot;;
+                };
</ins><span class="cx">                 145F6836179DC45F00D65598 = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><span class="lines">@@ -166,6 +184,7 @@
</span><span class="cx">                                 14D9DB4D17F2865C00EAAB79 /* cache */,
</span><span class="cx">                                 147AAA9C18CE6010002201E4 /* heap: large */,
</span><span class="cx">                                 147AAA9A18CE5FD3002201E4 /* heap: small */,
</span><ins>+                                144C07F71C7B707D0051BB6A /* heap: xlarge */,
</ins><span class="cx">                                 14D9DB4E17F2866E00EAAB79 /* heap */,
</span><span class="cx">                                 14D9DB4F17F2868900EAAB79 /* stdlib */,
</span><span class="cx">                                 14B650C418F39F4800751968 /* Configurations */,
</span><span class="lines">@@ -268,6 +287,7 @@
</span><span class="cx">                                 14446A0717A61FA400F9EA1D /* PerProcess.h */,
</span><span class="cx">                                 144469FD17A61F1F00F9EA1D /* PerThread.h */,
</span><span class="cx">                                 145F6878179E3A4400D65598 /* Range.h */,
</span><ins>+                                146041E61C7FF2EF00E9F94E /* SortedVector.h */,
</ins><span class="cx">                                 143CB81A19022BC900B16A45 /* StaticMutex.cpp */,
</span><span class="cx">                                 143CB81B19022BC900B16A45 /* StaticMutex.h */,
</span><span class="cx">                                 1417F64F18B7280C0076FA3F /* Syscall.h */,
</span><span class="lines">@@ -311,6 +331,7 @@
</span><span class="cx">                                 14DD789018F48CEB00950702 /* Sizes.h in Headers */,
</span><span class="cx">                                 14DD78C718F48D7500950702 /* BAssert.h in Headers */,
</span><span class="cx">                                 14DD78D018F48D7500950702 /* VMAllocate.h in Headers */,
</span><ins>+                                14EB79EA1C7C1BC4005E834F /* XLargeRange.h in Headers */,
</ins><span class="cx">                                 1440AFC91A95142400837FAA /* SuperChunk.h in Headers */,
</span><span class="cx">                                 143EF9B01A9FABF6004F5C77 /* FreeList.h in Headers */,
</span><span class="cx">                                 14DD78CE18F48D7500950702 /* Syscall.h in Headers */,
</span><span class="lines">@@ -324,7 +345,9 @@
</span><span class="cx">                                 14DD78C518F48D7500950702 /* Algorithm.h in Headers */,
</span><span class="cx">                                 14DD78BD18F48D6B00950702 /* SmallPage.h in Headers */,
</span><span class="cx">                                 14DD788E18F48CCD00950702 /* BoundaryTag.h in Headers */,
</span><ins>+                                146041E71C7FF2EF00E9F94E /* SortedVector.h in Headers */,
</ins><span class="cx">                                 14DD78C818F48D7500950702 /* FixedVector.h in Headers */,
</span><ins>+                                144C07F51C7B70260051BB6A /* XLargeMap.h in Headers */,
</ins><span class="cx">                                 14D2CD9B1AA12CFB00770440 /* VMState.h in Headers */,
</span><span class="cx">                                 14DD78BC18F48D6B00950702 /* SmallLine.h in Headers */,
</span><span class="cx">                                 14DD789818F48D4A00950702 /* Allocator.h in Headers */,
</span><span class="lines">@@ -418,6 +441,7 @@
</span><span class="cx">                                 143EF9AF1A9FABF6004F5C77 /* FreeList.cpp in Sources */,
</span><span class="cx">                                 14F271C718EA3990008C152F /* Heap.cpp in Sources */,
</span><span class="cx">                                 14F271C918EA3990008C152F /* VMHeap.cpp in Sources */,
</span><ins>+                                144C07F41C7B70260051BB6A /* XLargeMap.cpp in Sources */,
</ins><span class="cx">                                 14F271C818EA3990008C152F /* ObjectType.cpp in Sources */,
</span><span class="cx">                                 14F271C518EA397E008C152F /* Deallocator.cpp in Sources */,
</span><span class="cx">                                 14F271C418EA397B008C152F /* Cache.cpp in Sources */,
</span></span></pre>
</div>
</div>

</body>
</html>