Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: aa27d10f9deaaa9ca8c5e4aec0cfc1cfd4af05eb
https://github.com/WebKit/WebKit/commit/aa27d10f9deaaa9ca8c5e4aec0cfc1cfd4af05eb
Author: Ahmad Saleem <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
M Source/WebCore/bindings/js/JSImageDataCustom.cpp
M Source/WebCore/dom/CollectionIndexCache.cpp
M Source/WebCore/html/ImageData.cpp
M Source/WebCore/html/ImageData.h
M Source/WebCore/html/ImageData.idl
Log Message:
-----------
Pair reportExtraMemoryAllocated with reportExtraMemoryVisited for
SourceBuffer, collection index caches and ImageData
https://bugs.webkit.org/show_bug.cgi?id=296676
rdar://157080340
Reviewed by Yusuke Suzuki.
`deprecatedReportExtraMemory` and `reportExtraMemoryAllocated` are not
interchangeable. `deprecatedReportExtraMemory` adds the cost to
`m_deprecatedExtraMemorySize`, which keeps contributing to `extraMemorySize()`
until the next full collection zeroes it. `reportExtraMemoryAllocated` adds
nothing to that total by itself -- it only does `didAllocate()` plus
`collectIfNecessaryOrDefer()` (and re-reports through the barrier if the owning
cell is already black). The cost only enters `extraMemorySize()` via the
matching
`reportExtraMemoryVisited()` performed while the owning cell is visited.
So swapping one for the other without a visit counterpart hides the memory from
the collector for good, which is what the comment on
`Heap::reportExtraMemoryAllocated` warns about: "Be sure to call both of these
functions: Calling only one may trigger catastropic memory growth."
This patch therefore only converts the call sites whose owning wrapper already
reports the same cost while being visited. `SourceBuffer`, `HTMLCollection` and
`NodeList` are annotated `[ReportExtraMemoryCost]`, so CodeGeneratorJS.pm emits
`visitor.reportExtraMemoryVisited(thisObject->wrapped().memoryCost())` into
their
`visitChildren()`, and `memoryCost()` already covers exactly what these call
sites report. They were double counting until now: once into the deprecated
bucket at allocation time, and again into `m_extraMemorySize` on every
collection. `ImageData` adopts `[ReportExtraMemoryCost]` here so its pixel data
is paired the same way.
* Source/WebCore/Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::reportExtraMemoryAllocated):
`SourceBuffer.idl` is `[ReportExtraMemoryCost]` and `memoryCost()` returns
`sizeof(SourceBuffer) + m_extraMemoryCost`, which is the total this function has
just recorded, so reporting the delta as allocated is correctly paired.
* Source/WebCore/dom/CollectionIndexCache.cpp:
(WebCore::reportExtraMemoryAllocatedForCollectionIndexCache):
Every `CollectionIndexCache` owner is a `CachedHTMLCollection`, `ChildNodeList`
or `LiveNodeList`, and both `HTMLCollection.idl` and `NodeList.idl` are
`[ReportExtraMemoryCost]` with a `memoryCost()` that returns the index cache and
named element cache costs. The capacity deltas reported here are already covered
on the visit side.
* Source/WebCore/html/ImageData.idl:
Annotate the interface `[ReportExtraMemoryCost]` so `JSImageData` reports the
pixel data in `finishCreation()` and re-reports it in `visitChildren()`.
* Source/WebCore/html/ImageData.h:
(WebCore::ImageData::memoryCost const):
* Source/WebCore/html/ImageData.cpp:
(WebCore::ImageData::ImageData):
Add `memoryCost()`. The generated `visitChildren()` calls it from a GC thread,
so
the byte length is computed once in the constructor instead of being read off
the
array buffer view on demand: `ArrayBufferView::byteLength()` consults
`isDetached()` and, for a resizable or growable-shared buffer, dereferences
`m_buffer`, neither of which is safe to race with a detach. `m_data` is assigned
only in the constructor, so a `const size_t` snapshot is accurate for the
lifetime of the object.
* Source/WebCore/bindings/js/JSImageDataCustom.cpp:
(WebCore::toJSNewlyCreated):
Drop the manual report now that the generated wrapper does it, and note where
the
reporting moved to.
Canonical link: https://commits.webkit.org/319569@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
