Closed Bug 1028345 Opened 6 years ago Closed 1 year ago

Allocate DOM nodes in a separate heap partition

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1377999

People

(Reporter: mccr8, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug, )

Details

Apparently both IE and Chrome allocate DOM nodes into some kind of separate heap partition.  This is a weaker mitigation measure than frame poisoning, because things with different vtables can still get allocated to the same location, but I suppose it reduces problems where a typed array buffer gets allocated in the former location of a DOM node.  The main drawback would presumably be increased heap fragmentation.
We sort of tried this before FF 3, because of perf reasons. And it was good for perf, but
bad for memory consumption. See bug 403830.
Priority: -- → P5
Summary: Considering allocating DOM nodes in a separate heap partition → Allocate DOM nodes in a separate heap partition
Priority: P5 → P3
Component: DOM → DOM: Core & HTML

Bug 1377999 is now doing the same thing.

Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1377999
You need to log in before you can comment on or make changes to this bug.