Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dbed4f5203d9dab0131c4687d6b87a87a932d5c8
https://github.com/WebKit/WebKit/commit/dbed4f5203d9dab0131c4687d6b87a87a932d5c8
Author: Marcus Plutowski <[email protected]>
Date: 2026-06-24 (Wed, 24 Jun 2026)
Changed paths:
M Source/bmalloc/libpas/Documentation.md
M Source/bmalloc/libpas/src/libpas/bmalloc_heap.c
M Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h
M Source/bmalloc/libpas/src/libpas/pas_deallocate.h
Log Message:
-----------
[libpas] Split pas_deallocate into inline-only and casual variants
https://bugs.webkit.org/show_bug.cgi?id=317687
rdar://problem/180447990
Reviewed by Yusuke Suzuki.
Consumers of libpas, e.g. bmalloc, must explicitly call the
inline-only allocation fast-path if they want to be able to allocate
with minimal latency. If that fails, then they are expected to call into
the slow path. This is more complicated than if libpas presented a
single try_allocate function, but that complexity is paid for by the
additional flexibility, as evidenced by pathways like the Gigacage and
other auxiliary heaps, as the fast-path of the main heap can be
preserved while still allowing callers to allocate from other heaps.
This patch applies the same approach to the deallocation pathway.
This has not previously been necessary, but is important for the ongoing
refactor of our MTE implementation, and for the Sequestered Heap
thereafter. In particular, we want to be able to preserve the fastest
fast-path on the deallocation side (i.e. the TLC-present
small-segregated free-to-scavenger) while still allowing the caller to
e.g. try freeing objects from multiple different candidate heaps.
This is not necessary for auxiliary heaps because they share megapage
tables and can thus participate in the same pas_deallocate lookup chain,
but distinct pas_heaps do not.
I intend to build on this patch with another one which will incorporate
the tagged-bmalloc-heap into our normal allocation paths. As with the
Gigacage today, the bmalloc layer will dispatch to either the normal
bmalloc_heap or the tagged_bmalloc_heap; on the deallocation side,
bmalloc's free will first try calling pas_deallocate_inline_only with
the untagged pas_heap_config, then if that fails fall back to the MTE
one, and finally to the casual case.
* Source/bmalloc/libpas/src/libpas/bmalloc_heap.c:
(bmalloc_deallocate_casual):
* Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h:
(bmalloc_deallocate_inline):
* Source/bmalloc/libpas/src/libpas/pas_deallocate.h:
(pas_try_deallocate_inline_only):
(pas_try_deallocate_casual_case):
(pas_deallocate_casual_case):
(pas_try_deallocate):
(pas_try_deallocate_impl): Deleted.
Canonical link: https://commits.webkit.org/315745@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
