blink/wtf: Make FastMalloc() malloc() when PartitionAlloc is malloc().

There is no reason to use FastMalloc() when PartitionAlloc is
malloc(). Aside from increasing memory usage and heap fragmentation,
this reduces the number of pointers allocated out of the GigaCage, which
matters for CheckedPtr.

To address that, make USING_FAST_MALLOC() a no-op in this case, and
redirect the remaining callers of FastMalloc() to malloc().

Bug: 998048
Change-Id: I3bd04570cabc7c8e9d36908013bb1c82a65acddf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2310334
Commit-Queue: Benoit L <lizeb@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Cr-Commit-Position: refs/heads/master@{#829272}

third_party/blink/renderer/platform/wtf/DEPS

 include_rules = [
     # To only allow a subset of base/ in Blink, we explicitly list all
     # directories and files instead of writing 'base/'.
+    "+base/allocator/buildflags.h",
     "+base/allocator/partition_allocator",
     "+base/atomic_ref_count.h",
     "+base/auto_reset.h",

third_party/blink/renderer/platform/wtf/allocator/allocator.h

@@ -7,6 +7,7 @@
 
 #include <atomic>
 
+#include "base/allocator/partition_allocator/partition_alloc.h"
 #include "base/check_op.h"
 #include "build/build_config.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/partitions.h"
@@ -108,6 +109,58 @@ class __thisIsHereToForceASemicolonAfterThisMacro;
 //    };
 //
 
+// In official builds, do not include type info string literals to avoid
+// bloating the binary.
+#if defined(OFFICIAL_BUILD)
+#define WTF_HEAP_PROFILER_TYPE_NAME(T) nullptr
+#else
+#define WTF_HEAP_PROFILER_TYPE_NAME(T) ::WTF::GetStringWithTypeName<T>()
+#endif
+
+// Both of these macros enable fast malloc and provide type info to the heap
+// profiler. The regular macro does not provide type info in official builds,
+// to avoid bloating the binary with type name strings. The |WITH_TYPE_NAME|
+// variant provides type info unconditionally, so it should be used sparingly.
+// Furthermore, the |WITH_TYPE_NAME| variant does not work if |type| is a
+// template argument; |USING_FAST_MALLOC| does.
+#define USING_FAST_MALLOC(type) \
+  USING_FAST_MALLOC_INTERNAL(type, WTF_HEAP_PROFILER_TYPE_NAME(type))
+#define USING_FAST_MALLOC_WITH_TYPE_NAME(type) \
+  USING_FAST_MALLOC_INTERNAL(type, #type)
+
+// FastMalloc doesn't provide isolation, only a (hopefully fast) malloc(). When
+// PartitionAlloc is already the malloc() implementation, there is nothing to
+// do.
+//
+// Note that we could keep the two heaps separate, but each PartitionAlloc's
+// root has a cost, both in used memory and in virtual address space. Don't pay
+// it when we don't have to.
+#if BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
+
+// Still using operator overaloading to be closer to the other case, and not
+// require code changes to DISALLOW_NEW() objects.
+#define USING_FAST_MALLOC_INTERNAL(type, typeName)           \
+ public:                                                     \
+  void* operator new(size_t, void* p) { return p; }          \
+  void* operator new[](size_t, void* p) { return p; }        \
+                                                             \
+  void* operator new(size_t size) { return malloc(size); }   \
+                                                             \
+  void operator delete(void* p) { free(p); }                 \
+                                                             \
+  void* operator new[](size_t size) { return malloc(size); } \
+                                                             \
+  void operator delete[](void* p) { free(p); }               \
+  void* operator new(size_t, NotNullTag, void* location) {   \
+    DCHECK(location);                                        \
+    return location;                                         \
+  }                                                          \
+                                                             \
+ private:                                                    \
+  friend class ::WTF::internal::__thisIsHereToForceASemicolonAfterThisMacro
+
+#else
+
 #define USING_FAST_MALLOC_INTERNAL(type, typeName)                    \
  public:                                                              \
   void* operator new(size_t, void* p) { return p; }                   \
@@ -132,24 +185,7 @@ class __thisIsHereToForceASemicolonAfterThisMacro;
  private:                                                             \
   friend class ::WTF::internal::__thisIsHereToForceASemicolonAfterThisMacro
 
-// In official builds, do not include type info string literals to avoid
-// bloating the binary.
-#if defined(OFFICIAL_BUILD)
-#define WTF_HEAP_PROFILER_TYPE_NAME(T) nullptr
-#else
-#define WTF_HEAP_PROFILER_TYPE_NAME(T) ::WTF::GetStringWithTypeName<T>()
-#endif
-
-// Both of these macros enable fast malloc and provide type info to the heap
-// profiler. The regular macro does not provide type info in official builds,
-// to avoid bloating the binary with type name strings. The |WITH_TYPE_NAME|
-// variant provides type info unconditionally, so it should be used sparingly.
-// Furthermore, the |WITH_TYPE_NAME| variant does not work if |type| is a
-// template argument; |USING_FAST_MALLOC| does.
-#define USING_FAST_MALLOC(type) \
-  USING_FAST_MALLOC_INTERNAL(type, WTF_HEAP_PROFILER_TYPE_NAME(type))
-#define USING_FAST_MALLOC_WITH_TYPE_NAME(type) \
-  USING_FAST_MALLOC_INTERNAL(type, #type)
+#endif  // !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
 
 // TOOD(omerkatz): replace these casts with std::atomic_ref (C++20) once it
 // becomes available
@@ -359,4 +395,4 @@ inline void* operator new(size_t, NotNullTag, void* location) {
   return location;
 }
 
-#endif /* WTF_Allocator_h */
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_WTF_ALLOCATOR_ALLOCATOR_H_

third_party/blink/renderer/platform/wtf/allocator/partitions.cc

@@ -54,7 +54,9 @@ bool Partitions::initialized_ = false;
 
 // These statics are inlined, so cannot be LazyInstances. We create the values,
 // and then set the pointers correctly in Initialize().
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
 base::ThreadSafePartitionRoot* Partitions::fast_malloc_root_ = nullptr;
+#endif
 base::ThreadSafePartitionRoot* Partitions::array_buffer_root_ = nullptr;
 base::ThreadSafePartitionRoot* Partitions::buffer_root_ = nullptr;
 base::ThreadUnsafePartitionRoot* Partitions::layout_root_ = nullptr;
@@ -67,26 +69,22 @@ void Partitions::Initialize() {
 
 // static
 bool Partitions::InitializeOnce() {
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   static base::PartitionAllocator fast_malloc_allocator{};
+  fast_malloc_allocator.init(
+      {base::PartitionOptions::Alignment::kRegular,
+       base::PartitionOptions::ThreadCache::kEnabled,
+       base::PartitionOptions::PCScan::kDisabledByDefault});
+
+  fast_malloc_root_ = fast_malloc_allocator.root();
+#endif  // !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
+
   static base::PartitionAllocator array_buffer_allocator{};
   static base::PartitionAllocator buffer_allocator{};
   static base::ThreadUnsafePartitionAllocator layout_allocator{};
 
   base::PartitionAllocGlobalInit(&Partitions::HandleOutOfMemory);
 
-  // Only one thread cache at a time is supported, in this case it is already
-  // claimed by malloc().
-#if BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
-  fast_malloc_allocator.init(
-      {base::PartitionOptions::Alignment::kRegular,
-       base::PartitionOptions::ThreadCache::kDisabled,
-       base::PartitionOptions::PCScan::kDisabledByDefault});
-#else
-  fast_malloc_allocator.init(
-      {base::PartitionOptions::Alignment::kRegular,
-       base::PartitionOptions::ThreadCache::kEnabled,
-       base::PartitionOptions::PCScan::kDisabledByDefault});
-#endif
   array_buffer_allocator.init(
       {base::PartitionOptions::Alignment::kRegular,
        base::PartitionOptions::ThreadCache::kDisabled,
@@ -98,14 +96,15 @@ bool Partitions::InitializeOnce() {
                          base::PartitionOptions::ThreadCache::kDisabled,
                          base::PartitionOptions::PCScan::kAlwaysDisabled});
 
-  fast_malloc_root_ = fast_malloc_allocator.root();
   array_buffer_root_ = array_buffer_allocator.root();
   buffer_root_ = buffer_allocator.root();
   layout_root_ = layout_allocator.root();
 
   if (base::features::IsPartitionAllocPCScanEnabled() ||
       base::FeatureList::IsEnabled(kPCScanBlinkPartitions)) {
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
     fast_malloc_root_->EnablePCScan();
+#endif
     buffer_root_->EnablePCScan();
   }
 
@@ -130,8 +129,10 @@ void Partitions::DumpMemoryStats(
   // accessed only on the main thread.
   DCHECK(IsMainThread());
 
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   FastMallocPartition()->DumpStats("fast_malloc", is_light_dump,
                                    partition_stats_dumper);
+#endif
   ArrayBufferPartition()->DumpStats("array_buffer", is_light_dump,
                                     partition_stats_dumper);
   BufferPartition()->DumpStats("buffer", is_light_dump, partition_stats_dumper);
@@ -167,8 +168,10 @@ size_t Partitions::TotalSizeOfCommittedPages() {
   DCHECK(initialized_);
   size_t total_size = 0;
   // Racy reads below: this is fine to collect statistics.
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   total_size +=
       TS_UNCHECKED_READ(FastMallocPartition()->total_size_of_committed_pages);
+#endif
   total_size +=
       TS_UNCHECKED_READ(ArrayBufferPartition()->total_size_of_committed_pages);
   total_size +=
@@ -261,20 +264,36 @@ size_t Partitions::BufferActualSize(size_t n) {
   return BufferPartition()->ActualSize(n);
 }
 
+// Ideally this would be removed when PartitionAlloc is malloc(), but there are
+// quite a few callers. Just forward to the C functions instead.  Most of the
+// usual callers will never reach here though, as USING_FAST_MALLOC() becomes a
+// no-op.
 // static
 void* Partitions::FastMalloc(size_t n, const char* type_name) {
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   return FastMallocPartition()->Alloc(n, type_name);
+#else
+  return malloc(n);
+#endif
 }
 
 // static
 void* Partitions::FastZeroedMalloc(size_t n, const char* type_name) {
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   return FastMallocPartition()->AllocFlags(base::PartitionAllocZeroFill, n,
                                            type_name);
+#else
+  return calloc(n, 1);
+#endif
 }
 
 // static
 void Partitions::FastFree(void* p) {
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   FastMallocPartition()->Free(p);
+#else
+  free(p);
+#endif
 }
 
 // static

third_party/blink/renderer/platform/wtf/allocator/partitions.h

@@ -89,16 +89,20 @@ class WTF_EXPORT Partitions {
   static void HandleOutOfMemory(size_t size);
 
  private:
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   ALWAYS_INLINE static base::ThreadSafePartitionRoot* FastMallocPartition() {
     DCHECK(initialized_);
     return fast_malloc_root_;
   }
+#endif  // !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
 
   static bool InitializeOnce();
 
   static bool initialized_;
   // See Allocator.md for a description of these partitions.
+#if !BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC)
   static base::ThreadSafePartitionRoot* fast_malloc_root_;
+#endif
   static base::ThreadSafePartitionRoot* array_buffer_root_;
   static base::ThreadSafePartitionRoot* buffer_root_;
   static base::ThreadUnsafePartitionRoot* layout_root_;