)]}' { "log": [ { "commit": "ed4dc364672b67eee2acf2618c72d73cb758ab2e", "tree": "1ab67f7be0d8211282a147ace77b623501d4442a", "parents": [ "cf4e6581d2404fdd11b903ca1e7c3e04e679751b" ], "author": { "name": "Wez", "email": "wez@chromium.org", "time": "Mon Nov 09 15:37:03 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Nov 09 15:42:51 2026" }, "message": "[fuchsia] Remove legacy CFv1/sysmem1 remnants and unused HLCPP deps\n\nRemove remaining CFv1 and Modular remnants:\n- Drop obsolete fuchsia.modular assert_no_deps rule in fuchsia_web/runners.\n- Remove unused kFakeAgentUrl (fake_agent.cmx) from FakeApplicationConfigManager.\n- Remove obsolete *.cmx rules from fuchsia_web OWNERS files.\n- Remove obsolete killall web_instance.cmx call from browser_runner.py.\n\nClean up residual fuchsia.sysmem v1 references:\n- Remove unused SetBufferCollection and WatchBufferCollection v1 stubs from\n FakeCameraStream, and drop the unused fuchsia.sysmem.Allocator service from\n VideoCaptureDeviceFuchsiaTest.\n- Replace stale \u003cfuchsia/sysmem/cpp/fidl.h\u003e includes and fuchsia.sysmem_hlcpp\n GN dependencies with fuchsia.sysmem2 in media/fuchsia and Flatland Ozone.\n\nRemove unused HLCPP/SDK headers, GN dependencies, and dead helpers:\n- Remove unused ScopedDefaultJobForTest from base/fuchsia/default_job.\n- Remove unused MemBufferFromString16, MemBufferFromFile, and CloneBuffer\n helpers from base/fuchsia/mem_buffer_util.\n- Remove unused CloneViewRef from fuchsia_web/shell/present_frame.cc.\n- Remove unused \u003clib/fidl/cpp/binding.h\u003e, \u003clib/sys/cpp/component_context.h\u003e,\n and \u003cfuchsia/images/cpp/fidl.h\u003e headers and corresponding GN dependencies\n from targets already migrated to new C++ FIDL bindings.\n\nChange-Id: I588c95085854d60fde10dfebfcaf5fdae0fd8fa2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8677119\nReviewed-by: Zijie He \u003czijiehe@google.com\u003e\nCommit-Queue: Wez \u003cwez@chromium.org\u003e\nReviewed-by: Sergey Ulanov \u003csergeyu@chromium.org\u003e\nOwners-Override: Wez \u003cwez@chromium.org\u003e\nAuto-Submit: Wez \u003cwez@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1739151}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 270628ffde91bbfb8c442e40ff47d11619012b80\n" }, { "commit": "cf4e6581d2404fdd11b903ca1e7c3e04e679751b", "tree": "ba1cbe79aeda73fb9c66793b0189854933f4f2aa", "parents": [ "c1cc22f23b2aed3693933870278893fb88d34563" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Mon Nov 09 07:23:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Nov 09 07:28:46 2026" }, "message": "AsanBrp: support non-BRP PartitionRoot-s\n\nSince AsanBrp uses memory_tool_replaces_allocation\u003dtrue, PartitionRoot-s\nare replaced with Asan-Allocator. This causes that all memory\nallocations and deallocations are done by only 1 PartitionRoot with\nbrp-enabled.\n\nThis CL does:\n- make brp_enabled() available if AsanBrp is enabled,\n- make PartitionAllocHook to provide brp_enabled() info.\n- hook PartitionAllocHook::AllocationObserverHook.\n- AsanBrp removes BRP-marks from memory allocated from non-BRP roots.\n\nBug: 553120509\nChange-Id: Id9ab8b81cdd34dab6ffa02f90fe5951c6fda831b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8316217\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1738844}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2dfd4f3b7b64f051b82e85cf66683ec5b9c43db3\n" }, { "commit": "c1cc22f23b2aed3693933870278893fb88d34563", "tree": "90adbc84726fd0e8475d7c0b75874bb176369107", "parents": [ "adf067b03805fc1d2c15fd85dae56ff32e1b56dd" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Sat Nov 07 07:12:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Nov 07 07:27:35 2026" }, "message": "[PA] Add capacity-unlimited option to SchedulerLoopQuarantine\n\nAdd a capacity-unlimited configuration flag and capacity_unlimited_\nfield to SchedulerLoopQuarantineBranch. When capacity_unlimited_ is\ntrue, GetCapacityInBytes() returns std::numeric_limits\u003csize_t\u003e::max()\n(used by IsQuarantineTarget()), and Quarantine() skips the capacity\ncheck, purge, and random slot shuffle since all entries are purged at\nthe end of a task.\n\nAs a temporary compatibility workaround for existing Finch\nconfigurations, make GetSchedulerLoopQuarantineConfiguration() treat\nbranch-capacity-in-bytes \u003d\u003d INT_MAX (2147483647) as\ncapacity_unlimited \u003d true when capacity-unlimited is omitted.\n\nhttps://pinpoint-dot-chromeperf.appspot.com/job/102385ab990000\nhttps://pinpoint-dot-chromeperf.appspot.com/job/1438fb4f990000\n\nBug: 582527150\nChange-Id: I810831a6c3c7ea9e9a67fc7d00aa5e386a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8749136\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nAuto-Submit: Gregg Tavares \u003cgman@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1738381}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6c28e025f9141bfb990512e66bb2d7c7e451fb28\n" }, { "commit": "adf067b03805fc1d2c15fd85dae56ff32e1b56dd", "tree": "0d35871bc361ca029e1b9ca1ff41b3f0c3ea16c0", "parents": [ "f7d4af97eb1cd0d700ac7b67ab1138d012ffce78" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Fri Nov 06 09:27:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Nov 06 09:32:21 2026" }, "message": "Use base::span and std::ranges::fill in intended_leak.cc\n\nReplaces raw pointer arithmetic and PA_UNSAFE_TODO with\nmemory.\n\nbase: :span::split_at and std::ranges::fill when zapping quarantined slot\nChange-Id: Idb38dee657aa95268a478d4efcf920b35c955146\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8723981\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1737372}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8085d43c4bd5a85ef4ff344e545086ec179dc634\n" }, { "commit": "f7d4af97eb1cd0d700ac7b67ab1138d012ffce78", "tree": "df9630bf9fcc0fa82516389bd5812047c592445e", "parents": [ "77b4e12a8b29bb445f9fad91eb2d6500097d025f" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Fri Nov 06 03:21:14 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Nov 06 03:28:13 2026" }, "message": "[PA] Optimize slot insertion and random swap in SchedulerLoopQuarantine\n\nIn `SchedulerLoopQuarantineBranch::Quarantine()`, inserting a slot into\n`slots_` and swapping it with a random element has three codegen\nbottlenecks even under PGO + `thinlto_optimize_max` (`--lto-O2`):\n1. `random_.RandUint32()` is not inlined, emitting a function call\n (`callq RandUint32`) around ~8 ALU instructions of XorShift128+\n arithmetic.\n2. `random_.RandUint32() % slots_.size()` emits a 64-bit hardware\n division (`divq %rsi`) on every call that inserts a slot because\n `slots_.size()` is only known at runtime.\n3. `std::swap(slots_[random_index], slots_.back())` copies\n `slots_[random_index]` to a stack temporary and re-reads\n `slots_.back()` with one 16-byte load right after `slots_.push_back()`\n wrote it with two 8-byte stores, which can\u0027t be store-forwarded.\n\nThis CL resolves all three bottlenecks:\n1. Moves `InsecureRandomGenerator::RandUint64()` and `RandUint32()`\n inline into `rand_util.h` with `PA_ALWAYS_INLINE`.\n2. Replaces `% slots_.size()` with Lemire\u0027s fast multiplication-shift\n range reduction (`(static_cast\u003cuint64_t\u003e(random_.RandUint32()) *\n slots_.size()) \u003e\u003e 32`).\n3. Appends an empty slot (`slots_.push_back({})`), copies\n `random_slot` (`slots_[random_index]`) to `slots_.back()`, and writes\n `{slot_start, bucket_index}` directly into `random_slot`, avoiding\n the stack spill and the reload of `slots_.back()`.\n\nSchedulerLoopQuarantinePerfTest results on Pinpoint (\"all lines\" rows\nread every cache line of each object before freeing it, like a\ndestructor that reads all fields):\n\nSignificance: ◆ p \u003c 0.05, ◆◆ p \u003c 0.01, ◆◆◆ p \u003c 0.001\n\nWindows (win-11-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/123c0fd3190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.4 90.5 -2.1% [ -2.6, -1.5] ◆◆◆\n all lines 95.3 93.8 -1.6% [ -2.2, -1.0] ◆◆◆\nstorm_8k_cold 89.9 88.0 -2.1% [ -2.5, -1.7] ◆◆◆\n all lines 95.8 95.3 -0.5% [ -0.8, -0.2] ◆◆\nstorm_8k_cold_random_order 90.9 89.5 -1.5% [ -1.9, -1.2] ◆◆◆\n all lines 97.5 96.9 -0.7% [ -1.0, -0.4] ◆◆◆\nstorm_50k 99.4 97.9 -1.5% [ -2.9, -0.1] ◆\n all lines 104.4 103.4 -0.9% [ -2.1, +0.2]\nstorm_50k_random_order 93.9 92.4 -1.6% [ -2.3, -1.0] ◆◆◆\n all lines 103.1 102.6 -0.5% [ -1.3, +0.3]\nstorm_300k 108.2 106.5 -1.6% [ -1.9, -1.4] ◆◆◆\n all lines 111.8 110.7 -1.0% [ -1.3, -0.8] ◆◆◆\nsteady_churn 58.8 57.3 -2.6% [ -2.9, -2.3] ◆◆◆\n all lines 65.1 63.6 -2.3% [ -2.6, -2.0] ◆◆◆\n\nWindows (win-11-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/123c0fd3190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.4 90.2 -2.4% [ -2.8, -1.9] ◆◆◆\n all lines 95.2 93.6 -1.6% [ -2.0, -1.2] ◆◆◆\nstorm_8k_cold 85.2 83.3 -2.3% [ -2.6, -1.9] ◆◆◆\n all lines 90.4 89.2 -1.4% [ -1.7, -1.0] ◆◆◆\nstorm_8k_cold_random_order 86.2 84.2 -2.3% [ -2.6, -2.0] ◆◆◆\n all lines 92.0 91.0 -1.0% [ -1.3, -0.8] ◆◆◆\nstorm_50k 83.3 81.1 -2.6% [ -3.2, -2.1] ◆◆◆\n all lines 89.3 88.1 -1.4% [ -1.8, -1.0] ◆◆◆\nstorm_50k_random_order 86.6 84.1 -2.8% [ -3.4, -2.3] ◆◆◆\n all lines 93.9 93.0 -0.9% [ -1.7, -0.2] ◆\nstorm_300k 110.7 108.7 -1.7% [ -2.1, -1.3] ◆◆◆\n all lines 113.4 111.7 -1.5% [ -1.8, -1.1] ◆◆◆\nsteady_churn 177.2 173.6 -2.0% [ -2.8, -1.3] ◆◆◆\n all lines 180.9 177.5 -1.9% [ -2.7, -1.1] ◆◆◆\n\nMac (mac-m1_mini_2020-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/15291b63190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 39.2 39.0 -0.6% [ -1.0, -0.2] ◆◆\n all lines 39.9 39.7 -0.6% [ -1.1, -0.1] ◆\nstorm_8k_cold 57.9 57.6 -0.4% [ -0.6, -0.1] ◆◆\n all lines 57.1 56.9 -0.4% [ -0.7, -0.0] ◆\nstorm_8k_cold_random_order 62.1 61.9 -0.3% [ -0.6, +0.0]\n all lines 61.8 61.5 -0.4% [ -0.8, -0.1] ◆\nstorm_50k 48.3 48.0 -0.5% [ -0.7, -0.4] ◆◆◆\n all lines 50.3 50.1 -0.3% [ -0.5, -0.1] ◆◆\nstorm_50k_random_order 48.9 48.6 -0.6% [ -0.8, -0.4] ◆◆◆\n all lines 51.3 51.2 -0.2% [ -0.9, +0.5]\nstorm_300k 63.2 63.0 -0.3% [ -0.6, -0.0] ◆\n all lines 62.7 62.7 -0.0% [ -0.3, +0.2]\nsteady_churn 43.0 42.6 -1.0% [ -1.1, -1.0] ◆◆◆\n all lines 44.9 44.5 -0.9% [ -1.0, -0.8] ◆◆◆\n\nMac (mac-m1_mini_2020-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/15291b63190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 39.1 39.0 -0.3% [ -0.5, +0.0]\n all lines 39.8 39.5 -0.9% [ -1.5, -0.3] ◆◆\nstorm_8k_cold 52.8 52.6 -0.3% [ -0.6, -0.0] ◆\n all lines 51.8 51.6 -0.4% [ -0.7, -0.1] ◆\nstorm_8k_cold_random_order 56.9 56.7 -0.4% [ -0.7, -0.1] ◆\n all lines 56.3 56.2 -0.2% [ -0.5, +0.0]\nstorm_50k 41.3 41.0 -0.6% [ -0.8, -0.4] ◆◆◆\n all lines 43.0 42.7 -0.6% [ -0.7, -0.4] ◆◆◆\nstorm_50k_random_order 42.1 41.8 -0.7% [ -0.9, -0.5] ◆◆◆\n all lines 44.3 44.2 -0.4% [ -1.1, +0.3]\nstorm_300k 62.7 62.4 -0.5% [ -1.0, -0.1] ◆\n all lines 62.1 61.7 -0.8% [ -0.9, -0.6] ◆◆◆\nsteady_churn 89.7 87.1 -2.9% [ -3.0, -2.8] ◆◆◆\n all lines 94.0 91.1 -3.1% [ -3.2, -2.9] ◆◆◆\n\n- Positive impact: Reduces time by 1.4%-2.8% on Windows across `storm_*`\n and `steady_churn`, and by 0.3%-1.0% on Mac `browser_main` (up to\n 2.9%-3.1% on Mac `unlimited` `steady_churn`, where `Quarantine()` is\n the only quarantine work in the timed loop).\n- No impact: A few `all lines` storm variants show smaller or\n non-significant relative deltas because reading every cache line of\n each object before freeing dominates total per-free time.\n- Negative impact: None.\n\nBug: 568824848\nChange-Id: I8301a661ff8f524a446393bf6ede592b14c22d06\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8670759\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1737171}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5f86746ca808cab7297e1666b107a886341d1ebd\n" }, { "commit": "77b4e12a8b29bb445f9fad91eb2d6500097d025f", "tree": "ecb0bcd0d3d7f03bd797fa3365cb19eba6b6ac50", "parents": [ "f613c99e934accc431d1c7c3752b38cc1f08f0bd" ], "author": { "name": "Jeffrey Yu", "email": "yuje@chromium.org", "time": "Thu Nov 05 17:26:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Nov 05 17:31:49 2026" }, "message": "Reserve capacity for proc maps regions on Linux\n\nPre-allocates capacity in the regions vector based on the number of\nlines to avoid unnecessary reallocations while parsing /proc/self/maps.\n\nThese were reported to be some of the biggest unreserved vectors in the\nChromium codebase, peaking at \u003e10,000+ entries.\n\nAlso hoisted the check for the last, empty line out of the loop,\nsimplifying it and reducing the amount of work done.\n\nBug: 580948068\nChange-Id: I3034a6d2def02a4f1e0fa47e1a750a9984875b1a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8740181\nReviewed-by: Lei Zhang \u003cthestig@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nAuto-Submit: Jeffrey Yu \u003cyuje@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1736553}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e89e37fc0824d9ce70d05afb2b55fefa574ea864\n" }, { "commit": "f613c99e934accc431d1c7c3752b38cc1f08f0bd", "tree": "a6cb930ca87b4a9d1cf2ea2a0fef8bc0cec0b12d", "parents": [ "5844e9360ea97a04415ef3913b214469f8bd49a8" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Thu Nov 05 09:21:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Nov 05 09:32:48 2026" }, "message": "Check reference count upper bound in InSlotMetadata\n\nIn InSlotMetadata::AcquireCommon(), the reference count boundary limit\nwas validated using an exact inequality check against kMaxCount. If\nconcurrent operations advanced the masked reference count into the\nreserved upper range beyond kMaxCount, the inequality evaluated to true\nrather than terminating. Additionally, calculating the incremented count\nprior to validation could wrap around on builds tracking unprotected\npointers.\n\nThis change updates AcquireCommon() to validate that the pre-increment\nmasked count is strictly less than kMaxCount, ensuring any value at or\nabove the threshold triggers a fatal check. The slow-path condition is\nalso updated to evaluate the masked count prior to addition, avoiding\narithmetic wraparound.\n\nTAG\u003dagy\nCONV\u003d4e1ece9e-e656-4274-8fb7-8cfcad8bebc6\n\nFixed: 577445653\nChange-Id: I94fcc49a093f73e95254d4ca89b855d02aba2926\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8722215\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1736142}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 91eff21d6d236adc5e6c469510adefbe563b00d2\n" }, { "commit": "5844e9360ea97a04415ef3913b214469f8bd49a8", "tree": "179377c8a3473c50a7aca8c33dc6e69a220102b2", "parents": [ "bd588517ffb7218d4ae07ecdbf30194a97c0db29" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Wed Nov 04 08:24:02 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Nov 04 08:34:56 2026" }, "message": "Use std::ranges::fill and base::span in PartitionRoot\n\nReplaces std::fill_n on slot_usage with std::ranges::fill over a\nbase::span subspan to improve bounds safety and tracking.\n\nBug: 581351423\nChange-Id: Ic3a9a35e86c4b913211c759a1e35a82dfa685e70\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8723328\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1734865}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 367ca4e72512032a6d3e2705c6d28a82909863e2\n" }, { "commit": "bd588517ffb7218d4ae07ecdbf30194a97c0db29", "tree": "6ecc9209711e735c0a5811f9aef95b99928c7dba", "parents": [ "ea6f892c93114e85cb9359a5b028d3a2e1e2a660" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Nov 04 05:44:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Nov 04 05:50:27 2026" }, "message": "[PA] Add zap-max option to SchedulerLoopQuarantine\n\nDefine a \"zap-max\" configuration parameter for Scheduler-Loop Quarantine that sets an upper bound in bytes on the zapped region when zapping is enabled. If an object\u0027s usable size exceeds zap_max, only the first zap_max bytes are zapped.\n\nChange-Id: Ifdd41b4986c058be9c16155028336be8b2c60325\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8720948\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1734776}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b29bd9ccec8e788b02a80c7f4cc5f7a1a8f21ec0\n" }, { "commit": "ea6f892c93114e85cb9359a5b028d3a2e1e2a660", "tree": "98b49897c83c9e1a267af857672540de021f7be4", "parents": [ "413e00dc7b84a409e004740219d36abcc1a57425" ], "author": { "name": "Yuki Shiino", "email": "yukishiino@chromium.org", "time": "Wed Nov 04 02:44:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Nov 04 03:21:51 2026" }, "message": "PA: Update shim/HowToInterposeOrIntercept.md\n\nAdds the Windows section to the doc.\n\nBug: 566942780\nChange-Id: I203a395df90d97a003b3708dc8cef9d96280887b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8689688\nAuto-Submit: Yuki Shiino \u003cyukishiino@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1734685}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a68c8de021bda0c5e90388359ed0edcb13346e97\n" }, { "commit": "413e00dc7b84a409e004740219d36abcc1a57425", "tree": "e5d53c9090555b9de2b3d49b8e5ccc945ba4240b", "parents": [ "33a662ac6f2d789a9f345c4a6a41ebb4a8968015" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Tue Nov 03 23:01:59 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Nov 03 23:09:49 2026" }, "message": "[PA] Introduce Clang AllocToken\u0027s TypeFuncHash mode\n\nSwitch AllocToken from the default typehashpointersplit mode to\ntypefunchashpointersplit. The typefunchashpointersplit derives the token\nfrom both the allocated type and the name of the function containing the\nallocation, providing finer-grained tokens.\n\nTo compile PartitionAlloc\u0027s tests with the production token mode rather\nthan Clang\u0027s default one, stop excluding all of PartitionAlloc from\ninstrumentation. Only allocator_shim, which defines the __alloc_token_*\nfunctions, is still excluded via a new allocator_shim_remove_configs. As\n__builtin_infer_alloc_token() cannot be used in constant expressions in\nthis mode, the test tokens are now returned by helper functions instead\nof constexpr variables.\n\nBug: 477186304\nChange-Id: I14309580fb0b5ebf8c844af8921117f44ed80986\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8603136\nMega-CQ: Ai Nozaki \u003cainozaki@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1734513}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ae0b25bdd57f2ede7e51fe9d6eef2c4ab39f466e\n" }, { "commit": "33a662ac6f2d789a9f345c4a6a41ebb4a8968015", "tree": "995a243a62c6389e8fe7604b5643c1c5c5e9aaab", "parents": [ "61304c1ec6c871980996f6064a94994c772d90b4" ], "author": { "name": "Andrew Williams", "email": "awillia@chromium.org", "time": "Tue Nov 03 22:10:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Nov 03 22:16:27 2026" }, "message": "[PA] Skip RepeatedAllocReturnNullDirect/0 under UBSan\n\nSkip the kNeutral non-pkey instantiation (/0) under UNDEFINED_SANITIZER\nwhile the underlying PartitionDirectMap() fix is prepared, keeping the\nkDenser instantiation (/1) enabled.\n\nBug: 581064697\nChange-Id: I64fbb159c60953344e64066e63a13b854303189f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8717410\nReviewed-by: Marijn Kruisselbrink \u003cmek@chromium.org\u003e\nCommit-Queue: Andrew Williams \u003cawillia@chromium.org\u003e\nOwners-Override: Marijn Kruisselbrink \u003cmek@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1734454}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 11e45691654c7c8b25fc136e4e4bc3b7aff65fda\n" }, { "commit": "61304c1ec6c871980996f6064a94994c772d90b4", "tree": "f2e48605e50816ee237684e136f5a8d439af994f", "parents": [ "ef52fbb504e6ed04a47ef4f541c8b054dc596700" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Mon Nov 02 17:08:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Nov 02 17:17:54 2026" }, "message": "[PA] Always zap quarantined slots in SchedulerLoopQuarantine\n\nSchedulerLoopQuarantine will never launch with `enable_quarantine` and\n`!enable_zapping` (crrev.com/c/8670441). Remove\n`SchedulerLoopQuarantineConfig::enable_zapping`,\n`SchedulerLoopQuarantineBranch::enable_zapping_`, and the\n\"enable-zapping\" JSON config key, and always zap slots when\nquarantining.\n\nUnknown keys in the JSON config are ignored by `base::DictValue`, so\nexisting Finch configs specifying `\"enable-zapping\": true` remain\ncompatible.\n\nBug: 568824848\nChange-Id: I20dbf3027f96ee4761b3b73ebafa31e0ba423c81\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8695376\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1732982}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c7cdcdc50f6b1c1c89bb1188d87e8920ad69254b\n" }, { "commit": "ef52fbb504e6ed04a47ef4f541c8b054dc596700", "tree": "16cb4e6a88f987a3a4ce091fd0cc00f66ff0bb91", "parents": [ "0273c73594f28b8effd6f9d635618e70c6144c4d" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Sat Oct 31 02:11:46 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Oct 31 02:17:56 2026" }, "message": "[PA] Skip ThreadCache poisoning for zapped SchedulerLoopQuarantine slots\n\n`ThreadCache::PutInBucket()` poisons the remainder of the first 64-byte\ncache line with `0xbadbad00` (`HAS_FREELIST_SHADOW_ENTRY` on x86_64)\nbefore writing the freelist entry. In `perf annotate` of\n`SchedulerLoopQuarantinePerfTest` (`thinlto_optimize_max`), this\npoisoning loop accounts for 32.4% of CPU samples in\n`SchedulerLoopQuarantineBranch::PurgeInternal()`. When\n`enable_zapping_` is true (as in `browser_main` and\n`browser_main_unlimited`), `Quarantine()` already zaps the entire\nusable slot with `kFreedByte` (`0xcd`) upon entry to the quarantine,\nmaking the second poisoning pass in `PutInBucket()` redundant.\n\nThis CL templates `ThreadCache::MaybePutInCache()` and\n`ThreadCache::PutInBucket()` on `bool poison \u003d true`, and calls\n`MaybePutInCache\u003cfalse\u003e()` from `ReleaseDequarantinedSlot()` when\n`enable_zapping_` is true.\n\nSchedulerLoopQuarantinePerfTest results on Pinpoint (\"all lines\" rows\nread every cache line of each object before freeing it, like a\ndestructor that reads all fields):\n\nSignificance: ◆ p \u003c 0.05, ◆◆ p \u003c 0.01, ◆◆◆ p \u003c 0.001\n\nWindows (win-11-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/11aa2d3b190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.6 86.8 -6.3% [ -6.9, -5.7] ◆◆◆\n all lines 95.4 89.6 -6.1% [ -6.6, -5.6] ◆◆◆\nstorm_8k_cold 89.5 84.7 -5.4% [ -5.8, -4.9] ◆◆◆\n all lines 95.5 90.2 -5.5% [ -5.8, -5.2] ◆◆◆\nstorm_8k_cold_random_order 90.7 85.8 -5.3% [ -5.7, -5.0] ◆◆◆\n all lines 97.2 91.9 -5.5% [ -5.9, -5.0] ◆◆◆\nstorm_50k 98.7 93.8 -4.9% [ -6.8, -3.0] ◆◆◆\n all lines 102.9 98.1 -4.6% [ -6.1, -3.2] ◆◆◆\nstorm_50k_random_order 93.2 88.6 -5.0% [ -5.7, -4.2] ◆◆◆\n all lines 102.3 97.1 -5.1% [ -5.9, -4.2] ◆◆◆\nstorm_300k 107.9 103.1 -4.5% [ -4.8, -4.2] ◆◆◆\n all lines 111.5 105.9 -5.0% [ -5.3, -4.7] ◆◆◆\nsteady_churn 58.9 54.4 -7.6% [ -8.0, -7.1] ◆◆◆\n all lines 65.1 59.9 -8.0% [ -8.4, -7.7] ◆◆◆\n\nWindows (win-11-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/11aa2d3b190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.5 87.0 -6.0% [ -6.6, -5.4] ◆◆◆\n all lines 95.0 89.4 -6.0% [ -6.3, -5.6] ◆◆◆\nstorm_8k_cold 85.2 79.9 -6.2% [ -6.6, -5.8] ◆◆◆\n all lines 90.2 84.8 -5.9% [ -6.3, -5.6] ◆◆◆\nstorm_8k_cold_random_order 86.1 80.7 -6.2% [ -6.6, -5.8] ◆◆◆\n all lines 91.9 86.4 -6.1% [ -6.4, -5.7] ◆◆◆\nstorm_50k 82.8 77.8 -6.0% [ -6.6, -5.5] ◆◆◆\n all lines 88.8 83.4 -6.1% [ -6.7, -5.4] ◆◆◆\nstorm_50k_random_order 85.6 80.5 -6.0% [ -6.8, -5.1] ◆◆◆\n all lines 92.8 88.2 -4.9% [ -5.7, -4.2] ◆◆◆\nstorm_300k 110.4 106.1 -3.8% [ -4.2, -3.4] ◆◆◆\n all lines 112.9 108.6 -3.8% [ -4.1, -3.5] ◆◆◆\nsteady_churn 176.8 177.5 +0.4% [ -0.6, +1.5]\n all lines 181.1 180.6 -0.3% [ -1.3, +0.7]\n\nMac (mac-m1_mini_2020-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/12f704d0990000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 39.2 39.1 -0.2% [ -0.6, +0.3]\n all lines 39.8 39.9 +0.3% [ -0.2, +0.7]\nstorm_8k_cold 58.0 58.0 +0.0% [ -0.3, +0.3]\n all lines 57.3 57.3 +0.1% [ -0.1, +0.4]\nstorm_8k_cold_random_order 62.2 62.2 -0.0% [ -0.4, +0.3]\n all lines 61.9 62.0 +0.2% [ -0.2, +0.5]\nstorm_50k 48.3 48.3 -0.1% [ -0.5, +0.3]\n all lines 50.4 50.4 +0.0% [ -0.3, +0.4]\nstorm_50k_random_order 49.0 48.9 -0.1% [ -0.5, +0.2]\n all lines 51.4 51.4 +0.2% [ -0.1, +0.5]\nstorm_300k 63.4 63.3 -0.2% [ -0.4, +0.1]\n all lines 62.9 62.9 +0.0% [ -0.3, +0.3]\nsteady_churn 43.1 43.1 +0.1% [ -0.2, +0.5]\n all lines 45.0 45.0 +0.1% [ -0.2, +0.4]\n\nMac (mac-m1_mini_2020-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/12f704d0990000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 39.1 39.1 +0.1% [ -0.4, +0.6]\n all lines 39.8 39.9 +0.3% [ -0.1, +0.8]\nstorm_8k_cold 52.8 52.8 +0.1% [ -0.2, +0.4]\n all lines 52.0 52.0 +0.1% [ -0.2, +0.3]\nstorm_8k_cold_random_order 56.9 57.0 +0.1% [ -0.3, +0.4]\n all lines 56.5 56.5 +0.1% [ -0.2, +0.4]\nstorm_50k 41.3 41.3 -0.0% [ -0.4, +0.4]\n all lines 43.0 43.0 +0.1% [ -0.2, +0.4]\nstorm_50k_random_order 42.1 42.1 +0.1% [ -0.3, +0.4]\n all lines 44.4 44.4 +0.1% [ -0.1, +0.4]\nstorm_300k 62.7 62.7 -0.0% [ -0.2, +0.1]\n all lines 62.2 62.2 +0.1% [ -0.2, +0.4]\nsteady_churn 89.8 89.9 +0.1% [ -0.4, +0.6]\n all lines 94.0 94.0 +0.0% [ -0.4, +0.4]\n\n- Positive impact: On Windows (x86_64), reduces time by 3.8%-6.3% across\n all `storm_*` benchmarks and by 7.6%-8.0% on `steady_churn`\n (`browser_main`).\n- No impact: On Windows `steady_churn` (`unlimited`), `RunSteadyChurn()`\n stops its timer before the end-of-task purge, so no slots are\n dequarantined during the timed window. On Mac (ARM64),\n `PutInBucket()`\u0027s poisoning loop is guarded by\n `PA_BUILDFLAG(PA_ARCH_CPU_X86_64)`, so codegen is unchanged.\n- Negative impact: None.\n\nBug: 568824848\nChange-Id: Ifb75c202aa5c7ed4b45d162d392db62546d77804\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8670441\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1732121}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 296a15b5190a98b91fbfcbc6207df4b921c75bad\n" }, { "commit": "0273c73594f28b8effd6f9d635618e70c6144c4d", "tree": "8e1686e62f96f3c78d4e0f1e551249eda709114e", "parents": [ "0c290106ed35868e221b0d00d7805c29d7973b81" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Fri Oct 30 10:07:08 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 30 10:12:52 2026" }, "message": "[PA] Avoid ThreadCache overflow churn during bulk SLQ purge\n\nDuring task-end bulk quarantine purges, stop inserting dequarantined\nslots into ThreadCache once a bucket is half full (its post-clear target\nlevel) and flush the rest directly via BatchFreeQueue. This avoids\nrepeatedly filling and clearing the same ThreadCache buckets mid-purge.\n\nSchedulerLoopQuarantinePerfTest results on Pinpoint (\"all lines\" rows\nread every cache line of each object before freeing it, like a\ndestructor that reads all fields):\n\nSignificance: ◆ p \u003c 0.05, ◆◆ p \u003c 0.01, ◆◆◆ p \u003c 0.001\n\nLinux (linux-r350-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/1568c4e7190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 83.6 83.5 -0.1% [ -0.8, +0.6]\n all lines 91.4 91.2 -0.2% [ -0.9, +0.4]\nstorm_8k_cold 82.5 78.6 -4.7% [ -5.2, -4.1] ◆◆◆\n all lines 93.3 89.5 -4.1% [ -4.6, -3.6] ◆◆◆\nstorm_8k_cold_random_order 82.8 78.9 -4.8% [ -5.3, -4.3] ◆◆◆\n all lines 94.5 90.2 -4.6% [ -5.0, -4.2] ◆◆◆\nstorm_50k 86.6 85.9 -0.8% [ -1.4, -0.2] ◆◆\n all lines 98.2 97.3 -0.9% [ -1.5, -0.3] ◆◆\nstorm_50k_random_order 89.7 87.9 -2.0% [ -4.0, -0.0] ◆\n all lines 103.3 102.1 -1.2% [ -1.8, -0.5] ◆◆◆\nstorm_300k 102.9 103.1 +0.2% [ -0.2, +0.6]\n all lines 113.7 113.6 -0.1% [ -0.3, +0.2]\nsteady_churn 58.5 58.5 +0.1% [ -0.7, +0.8]\n all lines 63.8 64.0 +0.3% [ -0.4, +1.0]\n\nLinux (linux-r350-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/1568c4e7190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 83.1 83.0 -0.2% [ -0.8, +0.5]\n all lines 91.5 91.0 -0.6% [ -1.3, +0.0]\nstorm_8k_cold 78.0 66.7 -14.6% [-15.1, -14.0] ◆◆◆\n all lines 87.7 76.1 -13.2% [-13.6, -12.8] ◆◆◆\nstorm_8k_cold_random_order 78.4 67.2 -14.2% [-14.8, -13.6] ◆◆◆\n all lines 89.1 77.5 -13.0% [-13.5, -12.5] ◆◆◆\nstorm_50k 79.7 64.7 -18.8% [-19.4, -18.2] ◆◆◆\n all lines 90.6 75.1 -17.2% [-17.6, -16.7] ◆◆◆\nstorm_50k_random_order 82.8 67.0 -19.1% [-21.1, -17.2] ◆◆◆\n all lines 94.9 79.4 -16.4% [-16.9, -15.8] ◆◆◆\nstorm_300k 107.3 89.7 -16.4% [-16.8, -16.0] ◆◆◆\n all lines 116.9 98.8 -15.4% [-15.7, -15.2] ◆◆◆\nsteady_churn 173.0 172.5 -0.3% [ -0.6, -0.0] ◆\n all lines 182.7 182.1 -0.3% [ -0.6, -0.0] ◆\n\nWindows (win-11-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/136f5170990000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.2 92.3 +0.2% [ -0.4, +0.7]\n all lines 95.4 95.3 -0.0% [ -0.6, +0.6]\nstorm_8k_cold 90.4 86.6 -4.2% [ -4.6, -3.8] ◆◆◆\n all lines 96.8 92.9 -4.1% [ -4.5, -3.6] ◆◆◆\nstorm_8k_cold_random_order 91.6 87.4 -4.6% [ -5.0, -4.2] ◆◆◆\n all lines 98.5 94.5 -4.1% [ -4.4, -3.9] ◆◆◆\nstorm_50k 101.7 101.3 -0.4% [ -1.2, +0.3]\n all lines 106.7 106.3 -0.4% [ -1.0, +0.3]\nstorm_50k_random_order 95.4 94.4 -1.0% [ -1.6, -0.4] ◆◆\n all lines 104.8 103.9 -0.8% [ -1.3, -0.4] ◆◆◆\nstorm_300k 109.8 109.6 -0.2% [ -0.4, +0.1]\n all lines 113.3 113.3 +0.0% [ -0.2, +0.3]\nsteady_churn 59.4 59.9 +0.9% [ +0.4, +1.3] ◆◆\n all lines 65.7 66.1 +0.5% [ +0.1, +0.9] ◆\n\nWindows (win-11-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/136f5170990000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 92.2 92.4 +0.1% [ -0.3, +0.6]\n all lines 95.2 95.1 -0.1% [ -0.5, +0.4]\nstorm_8k_cold 85.6 74.0 -13.5% [-13.9, -13.2] ◆◆◆\n all lines 90.8 79.3 -12.7% [-13.0, -12.4] ◆◆◆\nstorm_8k_cold_random_order 86.3 74.8 -13.3% [-13.7, -13.0] ◆◆◆\n all lines 92.5 81.2 -12.2% [-12.6, -11.9] ◆◆◆\nstorm_50k 83.9 69.2 -17.6% [-18.0, -17.2] ◆◆◆\n all lines 90.3 75.5 -16.3% [-16.9, -15.7] ◆◆◆\nstorm_50k_random_order 87.2 72.8 -16.6% [-17.4, -15.8] ◆◆◆\n all lines 94.9 80.7 -14.9% [-15.4, -14.5] ◆◆◆\nstorm_300k 111.3 93.8 -15.8% [-16.0, -15.5] ◆◆◆\n all lines 114.1 96.2 -15.6% [-15.9, -15.4] ◆◆◆\nsteady_churn 176.6 177.4 +0.4% [ +0.0, +0.8] ◆\n all lines 180.7 180.9 +0.1% [ -0.1, +0.4]\n\nBug: 576977477\nChange-Id: I8f1cef7193c094fd4e795da15d4db66f2d9eae23\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8644835\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1731278}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a3509a5e8394dc9556e152a9657d56add1e03427\n" }, { "commit": "0c290106ed35868e221b0d00d7805c29d7973b81", "tree": "6e300b40dd71f076f31f78736cbf7a0f730f3232", "parents": [ "2b864a17731ee7ae5a994ea308178da1e444ba29" ], "author": { "name": "Alex Ovsienko", "email": "ovsienko@google.com", "time": "Fri Oct 30 03:26:33 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 30 03:32:17 2026" }, "message": "Ruff lint: format and fix lint in //base.\n\nAdd .ruff.toml and RunRuff in //base/PRESUBMIT.py, and format and fix\nRuff lint findings across //base.\n\nLSC Doc: https://docs.google.com/document/d/1QRhY2yqlicseeVRVLa_gk4YXL4IBSM913-ZW1SdPZLU/edit?tab\u003dt.0\nBYPASS_LARGE_CHANGE_WARNING: Mechanical Ruff lint and formatting.\n\nBug: 539486220\nChange-Id: If9ffafea715a1370084bd065b1a6f4962482be57\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8667123\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Alex Ovsienko \u003covsienko@google.com\u003e\nCommit-Queue: Alex Ovsienko \u003covsienko@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1731082}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 62c4cdb8ec24695a58d9aa291f44b3a14d705d1f\n" }, { "commit": "2b864a17731ee7ae5a994ea308178da1e444ba29", "tree": "273bf5daeedcd79613ae4bdcf851e2265d0aee88", "parents": [ "0fe1ad7d1e9931dbe1714395a77606dc4f2b2c5d" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Thu Oct 29 22:11:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 29 22:17:42 2026" }, "message": "[PA] Add a feature to provision more slots at once\n\nWhen a slot span runs out of provisioned slots, the allocation slow\npath provisions only the slots that fit in the system page(s) holding\nthe next slot [1]. On Windows (lazy commit), each of these steps commits\nmemory with a VirtualAlloc(MEM_COMMIT) syscall under the partition lock\n[2], accounting for 0.99% of browser-process jank on Windows Stable (2/3\nin VirtualAlloc):\nhttp://pprof/?id\u003dab7058cecbaf7cce6835330413b40c73\u0026pivot\u003dPartitionBucket::ProvisionMoreSlotsAndAllocOne\n\nAdd the PartitionAllocMinProvisioningSize feature (disabled by default)\nto provision whole slots covering at least\nPartitionAllocMinProvisioningSizeInBytes (default: 16 KiB, capped by the\nslot span size) at once.\n\nProvisioning in larger steps means fewer trips through the slow path,\nand on Windows, fewer syscalls. The cost is memory for slots provisioned\nbefore they\u0027re needed: committed on Windows, and resident on other\nplatforms, where a freelist entry is written in every provisioned slot.\n\nAlso add SlotProvisioningPerfTest:\n- fresh_alloc_*: time to allocate and initialize 16 MiB of objects from\n decommitted slot spans (ns/alloc).\n- one_object_per_bucket: committed memory with one object per bucket up\n to 16 KiB (worst-case overhead). This doesn\u0027t capture the cost on\n non-Windows platforms, where slot spans are committed upfront: with\n resident instead of committed bytes, it is +3.1% (16 KiB) and +4.3%\n (32 KiB) on Linux (measured locally).\n\nThe biggest speed impact is on Windows, because of the saved syscalls.\nOn other platforms, only the CPU cost of the slow path is saved. On Mac,\nthis shows up with 32 KiB only (up to -3.4%), because Apple Silicon\nalready uses 16 KiB system pages. On Linux, the impact is negligible\n(-0.6% to +0.7%).\n\nField experiments on Windows and Mac (with 32 KiB on Mac) will measure\nthe actual speed vs. PMF trade-off with real workloads. We don\u0027t intend\nto enable this on other platforms, given the negligible speed impact on\nLinux.\n\nSignificance: ◆ p \u003c 0.05, ◆◆ p \u003c 0.01, ◆◆◆ p \u003c 0.001\n\nWindows (win-11-perf, 30 runs) - https://pinpoint-dot-chromeperf.appspot.com/job/1020cf95190000\nBenchmark Base Exp Variation [95% CI]\n--------------------------------------------------------------------\nfresh_alloc_mixed (ns)\n 16 KiB 72.4 61.8 -14.6% [-15.0, -14.3] ◆◆◆\n 32 KiB 72.4 61.4 -15.2% [-15.7, -14.7] ◆◆◆\nfresh_alloc_32 (ns)\n 16 KiB 35.0 32.8 -6.3% [ -6.6, -6.0] ◆◆◆\n 32 KiB 35.0 32.8 -6.3% [ -6.6, -5.9] ◆◆◆\nfresh_alloc_128 (ns)\n 16 KiB 67.0 58.8 -12.2% [-12.3, -12.1] ◆◆◆\n 32 KiB 67.0 58.8 -12.2% [-12.3, -12.1] ◆◆◆\nfresh_alloc_1024 (ns)\n 16 KiB 305.5 235.9 -22.8% [-23.0, -22.5] ◆◆◆\n 32 KiB 305.5 235.9 -22.8% [-23.0, -22.5] ◆◆◆\nfresh_alloc_4096 (ns)\n 16 KiB 1098.8 824.2 -25.0% [-25.7, -24.3] ◆◆◆\n 32 KiB 1098.8 821.8 -25.2% [-26.0, -24.4] ◆◆◆\none_object_per_bucket (KiB)\n 16 KiB 8952 9268 +3.5% [ +3.5, +3.5] ◆◆◆\n 32 KiB 8952 9540 +6.6% [ +6.6, +6.6] ◆◆◆\n\nMac (mac-m1_mini_2020-perf, 30 runs) - https://pinpoint-dot-chromeperf.appspot.com/job/16711224190000\nBenchmark Base Exp Variation [95% CI]\n--------------------------------------------------------------------\nfresh_alloc_mixed (ns)\n 16 KiB 15.3 15.3 +0.2% [ -0.0, +0.4]\n 32 KiB 15.3 15.2 -1.0% [ -1.1, -0.8] ◆◆◆\nfresh_alloc_32 (ns)\n 16 KiB 11.6 11.6 -0.0% [ -0.1, +0.1]\n 32 KiB 11.6 11.6 +0.2% [ +0.1, +0.2] ◆◆◆\nfresh_alloc_128 (ns)\n 16 KiB 16.5 16.5 +0.0% [ -0.1, +0.2]\n 32 KiB 16.5 16.3 -1.2% [ -1.4, -1.0] ◆◆◆\nfresh_alloc_1024 (ns)\n 16 KiB 41.7 41.6 -0.0% [ -0.2, +0.1]\n 32 KiB 41.7 40.2 -3.4% [ -3.7, -3.2] ◆◆◆\nfresh_alloc_4096 (ns)\n 16 KiB 127.1 127.0 -0.1% [ -0.2, +0.1]\n 32 KiB 127.1 126.1 -0.8% [ -0.9, -0.6] ◆◆◆\none_object_per_bucket (KiB)\n 16 KiB 10896 10896 +0.0% [ +0.0, +0.0]\n 32 KiB 10896 10896 +0.0% [ +0.0, +0.0]\n\nLinux (linux-r350-perf, 30 runs) - https://pinpoint-dot-chromeperf.appspot.com/job/119a114d190000\nBenchmark Base Exp Variation [95% CI]\n--------------------------------------------------------------------\nfresh_alloc_mixed (ns)\n 16 KiB 52.4 52.4 -0.0% [ -0.1, +0.0]\n 32 KiB 52.4 52.3 -0.2% [ -0.2, -0.2] ◆◆◆\nfresh_alloc_32 (ns)\n 16 KiB 29.1 29.0 -0.5% [ -0.5, -0.5] ◆◆◆\n 32 KiB 29.1 29.0 -0.5% [ -0.5, -0.4] ◆◆◆\nfresh_alloc_128 (ns)\n 16 KiB 46.8 46.6 -0.6% [ -0.6, -0.5] ◆◆◆\n 32 KiB 46.8 46.6 -0.6% [ -0.6, -0.5] ◆◆◆\nfresh_alloc_1024 (ns)\n 16 KiB 209.0 210.0 +0.5% [ +0.4, +0.5] ◆◆◆\n 32 KiB 209.0 209.9 +0.5% [ +0.4, +0.5] ◆◆◆\nfresh_alloc_4096 (ns)\n 16 KiB 761.2 766.3 +0.7% [ +0.6, +0.7] ◆◆◆\n 32 KiB 761.2 765.4 +0.5% [ +0.5, +0.6] ◆◆◆\none_object_per_bucket (KiB)\n 16 KiB 10128 10128 +0.0% [ +0.0, +0.0]\n 32 KiB 10128 10128 +0.0% [ +0.0, +0.0]\n\n[1] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/partition_bucket.cc;l\u003d914-924;drc\u003ddc4601072eecf55ca3f1ee0b211fc4486b20afed\n[2] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/partition_bucket.cc;l\u003d926-943;drc\u003ddc4601072eecf55ca3f1ee0b211fc4486b20afed\n\nBug: 568824848\nChange-Id: If010fbeb333f857fbb0a198d030158dcb818bdca\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8504591\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1730806}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 08c0826a5c05495852c6b9feeaec148e36213b5f\n" }, { "commit": "0fe1ad7d1e9931dbe1714395a77606dc4f2b2c5d", "tree": "11c98593089a334ad6ca836642eb15cfed27b686", "parents": [ "cf8e694bdaa464559f11d2fc44fc0164a7871add" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Tue Oct 27 06:16:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 27 06:22:03 2026" }, "message": "[PA] Remove ThreadCacheRegistry\n\nSince PartitionTlsRegistry tracks all live PartitionTls instances and\neach PartitionTls directly embeds the thread\u0027s ThreadCache storage, the\nseparate ThreadCacheRegistry intrusive doubly-linked list is redundant.\n\n- Remove ThreadCacheRegistry and the intrusive next_/prev_ pointers from\n ThreadCache (reducing kThreadCacheStorageSize by 2 * sizeof(void*)).\n- Move cross-thread operations (DumpStats, PurgeAll, RunPeriodicPurge,\n SetThreadCacheMultiplier, ForcePurgeAllThreadAfterForkUnsafe) to\n static methods on internal::ThreadCache, iterating over\n PartitionTlsRegistry under PartitionTlsRegistry::GetLock().\n- Synchronize ThreadCache bucket initialization and root_ publication in\n ThreadCache::ThreadCache() under PartitionTlsRegistry::GetLock(), and\n unregister PartitionTls before destroying ThreadCaches in\n TlsDestructor and ThreadCache::DeleteForTesting().\n- Update pa_tcache_inspect and pa_dump_heap to inspect ThreadCaches via\n PartitionTlsRegistry.\n\nChange-Id: I2005fc8c72d19a0e5a3fe3f66e2a410c11325dd6\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8529669\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1727781}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7f1218fa57966353a54b2ee2eed7d27f0c18a05f\n" }, { "commit": "cf8e694bdaa464559f11d2fc44fc0164a7871add", "tree": "499c5c3025b2393a143022cafa547da0a69ffef1", "parents": [ "72cc1f7ea4f1034dd9ad334c7d245054ca575fc9" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Tue Oct 27 01:42:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 27 01:47:59 2026" }, "message": "[PA] Move ThreadCacheStats from ThreadCache to PartitionTls\n\nMove ThreadCacheStats out of ThreadCache and into PartitionTls, placed\ndirectly after thread_cache_storage in the same per-thread allocation.\nThis shrinks sizeof(ThreadCache) by sizeof(ThreadCacheStats) (88 bytes,\nor 984 bytes with THREAD_CACHE_ALLOC_STATS) and keeps statistics per\nthread rather than per ThreadCache.\n\nWhen kMaxThreadCacheIndex \u003d\u003d 1, ThreadCache::GetEnclosingTls() recovers\nthe enclosing PartitionTls via pointer arithmetic on `this` using\noffsetof(PartitionTls, thread_cache_storage), avoiding an OS TLS lookup\nand folding counter updates into a single constant-displacement memory\noperand from `this`.\n\nUpdate kThreadCacheStorageSize in partition_tls.h to match the new\nsizeof(ThreadCache) across 64-bit and 32-bit configurations, document\nits layout and buildflag terms, and enforce both upper and lower bounds\nvia two-way static_asserts in ThreadCache::Create().\n\nAccumulate ThreadCacheStats in PartitionTlsRegistry::DumpStats() so each\nthread\u0027s counters are counted once regardless of ThreadCache count.\n\nChange-Id: Ia28af08c1e1b0199662729631c18e122435277d7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8366066\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1727596}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 362dd45409e200c99eccd1fbbb35a2f5ad1f653c\n" }, { "commit": "72cc1f7ea4f1034dd9ad334c7d245054ca575fc9", "tree": "445bc13748c94173ecc9eb32f43a084e2ab8ebf9", "parents": [ "aa167f8248caf3a54aef67752b3a6f25b43ecfae" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Mon Oct 26 09:10:04 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Oct 26 09:15:24 2026" }, "message": "AsanRawPtrV2: Implement reentrancy guard\n\nTo support MiracleObject-quarantine, we need to guard against sanitizer\nhooks re-entering sanitizer hooks. Because the quarantine may cause\n`purge` to make room for the given new entry. The `purge` will cause\n`free()` and sanitizer hooks will be invoked.\n\nBYPASS_LARGE_CHANGE_WARNING: the reentrancy_guard.{h,cc} doesn\u0027t affect production code, because the code are used only if is_asan\u003dtrue.\n\nBug: 501144567\nChange-Id: I9a8dc52632e97216acb6d77eeabbad277be011ee\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8404705\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Greg Thompson \u003cgrt@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1726825}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 09e084865a11fd85247fad543361c2b44e184cee\n" }, { "commit": "aa167f8248caf3a54aef67752b3a6f25b43ecfae", "tree": "6af22cff79a4e193b45f3ae1d66945a1e63c4158", "parents": [ "313a7b9762f1abf72a53250841b71bf2d1f30ae0" ], "author": { "name": "Omer Katz", "email": "omerkatz@chromium.org", "time": "Mon Oct 26 08:33:04 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Oct 26 08:38:41 2026" }, "message": "[PA] Support memory protection keys in ConfigurablePool\n\nA ConfigurablePool can be initialized with memory that is pkey\nprotected. In such cases, freeing pages via UnreserveAndDecommit will\nreset the pkey for these pages due to relying on\nmmap(MAP_FIXED, PROT_NONE). If the pages are then reallocated, they\nwill be missing the right pkey permission and user code that assumes\nthe pkey is set, will trigger a PKU fault and crash when trying to\naccess the pages.\n\nThis CL addresses this issue by allowing to set a pkey when configuring\na ConfigurablePool and enforcing that all memory in the pool is always\nprotected with that pkey.\n\nBug: 573577000\nChange-Id: I74271efd7c50095ae022010e80d31f535b55bfa7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8619732\nCommit-Queue: Omer Katz \u003comerkatz@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1726815}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0b629d1eedc1c850776f173c4e71bf347946ac50\n" }, { "commit": "313a7b9762f1abf72a53250841b71bf2d1f30ae0", "tree": "e3f71444d2d648d84db6c18e48255191732be215", "parents": [ "6a8bc3a6c553f2712a71f56e1957cc321ed4686a" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Mon Oct 26 03:19:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Oct 26 03:23:55 2026" }, "message": "Checked Span: Enable tightened checking for iOS\n\nThis was primarily an issue with an unqualified dereference of\n`InSlotMetadata` before BackupRefPtr was initialized (see CL 8609352).\n\nBug: 568703257\nChange-Id: Ib913b84bcd94d5089b88f2c7d69f5e33f552a02b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8641771\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1726721}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: bd21617eeb3fc14654c974dac2517571380e7fdc\n" }, { "commit": "6a8bc3a6c553f2712a71f56e1957cc321ed4686a", "tree": "cc57845df701081b86c015c879a731c65a7cdd39", "parents": [ "566ebad54d97777c36615883259a9f9d2c106d37" ], "author": { "name": "Matt Stark", "email": "msta@google.com", "time": "Mon Oct 26 03:06:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Oct 26 03:10:54 2026" }, "message": "Switch to the new check_includes_strict_exceptions format\n\nUpdates build/strict_deps_failures.gni and .gn to use the new\ncheck_includes_strict_exceptions list rather than per-target\nCHECK_INCLUDES_STRICT_PUBLIC_INCLUDES_PRIVATE overrides.\n\nRemoves temporary check_includes_strict opt-outs across BUILD.gn\nfiles now handled by the global exceptions list.\n\nThis is part of the check_includes_strict LSC (https://docs.google.com/document/d/1zYUC_zuFrZozo9ogFHcf0Rzkiw9W7RVnaY-1fzfQ0AM/edit?usp\u003dsharing)\n\nBug: 555455099\nChange-Id: Ic45045e2c15d46e531775b91fb2697b26a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8603473\nAuto-Submit: Matt Stark \u003cmsta@google.com\u003e\nCommit-Queue: Matt Stark \u003cmsta@google.com\u003e\nOwners-Override: Matt Stark \u003cmsta@google.com\u003e\nReviewed-by: Junji Watanabe \u003cjwata@google.com\u003e\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1726718}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7884a0ffb844f411f89d3a62d9bfd026ed85d221\n" }, { "commit": "566ebad54d97777c36615883259a9f9d2c106d37", "tree": "4d877b89450530ecbd12ca94938474b3a52edbce", "parents": [ "9b01c14e4298a6234633ef2646d697c1c2d03b1c" ], "author": { "name": "Arthur Milchior", "email": "arthurmilchior@google.com", "time": "Sat Oct 24 04:16:05 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Oct 24 04:22:31 2026" }, "message": "[PartitionAlloc] Re-enable DynamicSizeThresholdPurge\n\nPartitionAllocThreadCacheTest.DynamicSizeThresholdPurge was disabled\nin crrev.com/c/3395415 (crbug.com/1287811) due to flakiness.\n\nThe test verifies that lowering the dynamic size threshold traps\npreviously-cached large allocations and that Purge() successfully\nreclaims them. Subsequent optimizations and fixes across\nPartitionAlloc\u0027s thread cache have resolved the underlying instability.\nLocal verification across 50 iterations (100 test runs across both\nAlternateBucketDistributionAndPartitionFreeList parameterizations)\npassed with 0 failures or flakes.\n\nThis CL removes the DISABLED_ modifier and re-enables\nDynamicSizeThresholdPurge.\n\nTest: base_unittests --gtest_filter\u003d\"*DynamicSizeThresholdPurge*\"\nChange-Id: Ifc50c6a86380d3ccff83a19941d506ff42eb9302\nFixed: 1287811\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8644810\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nAuto-Submit: Arthur Milchior \u003carthurmilchior@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1726452}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 858068f8d9000b1020bc06171519cfef7411ff03\n" }, { "commit": "9b01c14e4298a6234633ef2646d697c1c2d03b1c", "tree": "1e5c54802f7e5dbcf0f16222421b04fadb09f57d", "parents": [ "0ad36ea8042f50b82eaae3f16a7ba82529e88c4d" ], "author": { "name": "Andrew Lim", "email": "andysjlim@chromium.org", "time": "Fri Oct 23 21:07:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 23 21:12:24 2026" }, "message": "[PA] Accept new Clang reference-binding diagnostic in raw_ptr_nocompile.nc\n\nAfter upstream LLVM commit da827529a7fe\n(https://github.com/llvm/llvm-project/pull/233482, \"[Clang][Sema] Fix\nrejecting valid reference initialization with conversion function\ntemplates\"), Clang specializes conversion function templates in\nTryRefInitWithConversionFunction before rejecting invalid reference\nbindings. As a result, binding `raw_ptr\u003cDerivedProducer\u003e\u0026` to\n`raw_ptr\u003cProducer\u003e` now emits:\n no viable conversion from \u0027raw_ptr\u003cProducer\u003e\u0027 to \u0027raw_ptr\u003cDerivedProducer\u003e\u0027\ninstead of:\n non-const lvalue reference to type \u0027raw_ptr\u003cDerivedProducer\u003e\u0027 cannot bind to a value of unrelated type \u0027raw_ptr\u003cProducer\u003e\u0027\nUse `expected-error-re` to accept both diagnostics until the next Clang\nroll lands.\n\nBug: 576944525, 576214311\nChange-Id: I60088bdd83255f2fcfa1bd41d2794a2d43934f1f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8643633\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nCommit-Queue: Andy Lim \u003candysjlim@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1726208}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cc44b4383cc223096168f59e70651a0a8855d277\n" }, { "commit": "0ad36ea8042f50b82eaae3f16a7ba82529e88c4d", "tree": "d938e0647919f023e39c90cc049f89329e1cd61e", "parents": [ "5f3eb5e59ce364af597d9a1c190a81ae1cdf6ae9" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Fri Oct 23 15:52:26 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 23 16:02:04 2026" }, "message": "[PA] Batch SchedulerLoopQuarantine stats updates\n\nEvery quarantined entry did 4 atomic read-modify-write operations on\nthe SchedulerLoopQuarantineRoot stats, and every purge 2 more. These\natomics are shared by all the branches of a root (i.e. by all threads),\nso they are both slow on their own and prone to cache line contention.\n\nIn the Windows Stable congestion (jank) profile of the browser main\nthread, 1.95% of samples are in Quarantine(), where these updates are\ninlined:\nhttp://pprof/?id\u003d6f6060560ac44f3cec78b4b91c2176c3\u0026pivot\u003dpartition_alloc::internal::SchedulerLoopQuarantineBranch%3C1,0%3E::Quarantine\n\nAccumulate the stats in the branch instead, and publish them to the\nroot every 64 quarantined entries and whenever the branch is fully\npurged (e.g. at the end of a task). The only consumer of these stats is\nthe memory-infra dump provider, for which slightly lagging stats are\nfine. Tests can force publication with PublishStatsForTesting().\n\nThis grows ThreadCache by 32 bytes, which fits thanks to the parent CL.\n\nSchedulerLoopQuarantinePerfTest results on Pinpoint (\"all lines\" rows\nread every cache line of each object before freeing it, like a\ndestructor that reads all fields):\n\nSignificance: ◆ p \u003c 0.05, ◆◆ p \u003c 0.01, ◆◆◆ p \u003c 0.001\n\nLinux (linux-r350-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/14051fb9190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 96.0 84.4 -12.0% [-12.8, -11.2] ◆◆◆\n all lines 102.7 92.1 -10.4% [-11.1, -9.6] ◆◆◆\nstorm_8k_cold 96.2 83.5 -13.2% [-13.7, -12.6] ◆◆◆\n all lines 105.1 94.4 -10.2% [-10.7, -9.7] ◆◆◆\nstorm_8k_cold_random_order 96.3 83.8 -12.9% [-13.4, -12.4] ◆◆◆\n all lines 105.7 95.6 -9.6% [-10.0, -9.1] ◆◆◆\nstorm_50k 101.5 87.9 -13.4% [-13.9, -12.9] ◆◆◆\n all lines 110.5 99.2 -10.3% [-10.7, -9.9] ◆◆◆\nstorm_50k_random_order 102.3 89.8 -12.3% [-12.7, -11.8] ◆◆◆\n all lines 114.0 104.1 -8.6% [ -9.1, -8.2] ◆◆◆\nstorm_300k 116.5 104.3 -10.5% [-10.9, -10.1] ◆◆◆\n all lines 125.9 115.0 -8.7% [ -9.0, -8.3] ◆◆◆\nsteady_churn 70.4 59.8 -15.0% [-15.5, -14.5] ◆◆◆\n all lines 74.2 66.2 -10.8% [-11.1, -10.4] ◆◆◆\n\nLinux (linux-r350-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/14051fb9190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 95.9 83.8 -12.6% [-13.5, -11.7] ◆◆◆\n all lines 102.8 91.7 -10.8% [-11.6, -10.0] ◆◆◆\nstorm_8k_cold 91.8 78.7 -14.3% [-14.9, -13.7] ◆◆◆\n all lines 99.2 88.0 -11.3% [-11.8, -10.8] ◆◆◆\nstorm_8k_cold_random_order 91.8 79.3 -13.6% [-14.2, -13.0] ◆◆◆\n all lines 99.6 89.6 -10.1% [-10.6, -9.6] ◆◆◆\nstorm_50k 94.3 80.5 -14.7% [-15.2, -14.2] ◆◆◆\n all lines 102.0 90.7 -11.1% [-11.5, -10.7] ◆◆◆\nstorm_50k_random_order 95.4 82.5 -13.5% [-14.0, -13.0] ◆◆◆\n all lines 104.5 95.0 -9.1% [ -9.5, -8.7] ◆◆◆\nstorm_300k 120.5 108.4 -10.0% [-10.5, -9.6] ◆◆◆\n all lines 128.4 117.4 -8.6% [ -8.9, -8.2] ◆◆◆\nsteady_churn 189.6 174.8 -7.8% [ -8.2, -7.3] ◆◆◆\n all lines 198.5 184.8 -6.9% [ -7.4, -6.5] ◆◆◆\n\nWindows (win-11-perf, 30 runs), config: browser_main - https://pinpoint-dot-chromeperf.appspot.com/job/13c4f904190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 102.8 90.8 -11.7% [-12.1, -11.2] ◆◆◆\n all lines 105.0 94.1 -10.3% [-10.7, -10.0] ◆◆◆\nstorm_8k_cold 101.6 89.1 -12.3% [-12.6, -11.9] ◆◆◆\n all lines 105.4 95.6 -9.3% [ -9.5, -9.0] ◆◆◆\nstorm_8k_cold_random_order 102.5 90.4 -11.8% [-12.1, -11.5] ◆◆◆\n all lines 107.0 97.4 -8.9% [ -9.2, -8.7] ◆◆◆\nstorm_50k 110.4 98.8 -10.6% [-12.1, -9.1] ◆◆◆\n all lines 113.7 103.1 -9.3% [-10.9, -7.6] ◆◆◆\nstorm_50k_random_order 105.0 93.0 -11.4% [-12.0, -10.7] ◆◆◆\n all lines 111.6 102.8 -7.9% [ -8.5, -7.2] ◆◆◆\nstorm_300k 119.8 107.7 -10.1% [-10.3, -9.8] ◆◆◆\n all lines 122.1 111.7 -8.5% [ -8.7, -8.2] ◆◆◆\nsteady_churn 69.0 59.8 -13.5% [-13.7, -13.2] ◆◆◆\n all lines 73.5 66.5 -9.6% [ -9.8, -9.3] ◆◆◆\n\nWindows (win-11-perf, 30 runs), config: unlimited - https://pinpoint-dot-chromeperf.appspot.com/job/13c4f904190000\nBenchmark (ns) Base Exp Variation [95% CI]\n-------------------------------------------------------------------\nstorm_1k_cold 102.6 90.5 -11.8% [-12.3, -11.3] ◆◆◆\n all lines 104.7 93.8 -10.4% [-10.8, -10.0] ◆◆◆\nstorm_8k_cold 97.4 84.3 -13.4% [-13.7, -13.1] ◆◆◆\n all lines 99.5 89.7 -9.9% [-10.2, -9.6] ◆◆◆\nstorm_8k_cold_random_order 98.1 85.3 -13.1% [-13.4, -12.8] ◆◆◆\n all lines 101.0 91.4 -9.5% [ -9.7, -9.2] ◆◆◆\nstorm_50k 95.3 82.0 -14.0% [-14.5, -13.4] ◆◆◆\n all lines 98.1 88.2 -10.0% [-10.6, -9.4] ◆◆◆\nstorm_50k_random_order 97.4 85.1 -12.6% [-13.5, -11.8] ◆◆◆\n all lines 101.6 92.9 -8.6% [ -9.3, -7.8] ◆◆◆\nstorm_300k 121.3 109.5 -9.7% [-10.0, -9.4] ◆◆◆\n all lines 122.7 112.2 -8.6% [ -8.8, -8.3] ◆◆◆\nsteady_churn 193.9 178.4 -7.9% [ -8.7, -7.1] ◆◆◆\n all lines 196.5 182.1 -7.3% [ -8.1, -6.5] ◆◆◆\n\nBug: 568824848\nChange-Id: I5f0b77f86ff31268ce39a3bf4f667c4b69d7fef4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8508644\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1725848}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4d299dc1aa88dc8642664409be5a349e809c7a64\n" }, { "commit": "5f3eb5e59ce364af597d9a1c190a81ae1cdf6ae9", "tree": "309fcb9de23c0b93642aa884ab195cf70aa74b36", "parents": [ "45c5f59e91f3041f23f4a6fec93ccab2900c8b7b" ], "author": { "name": "Michael Lippautz", "email": "mlippautz@chromium.org", "time": "Fri Oct 23 07:48:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 23 08:09:28 2026" }, "message": "partition_alloc: Enable user space zero segment on Android\n\nAndroid 17+ uses the Native Zygote for renderer processes, leaving the\nfirst 4GB of virtual address space unmapped instead of occupied by ART.\nEnable the user space zero segment on 64-bit Android builds to reserve\nthis range when available.\n\nTAG\u003dagy\nCONV\u003df8c9fd9a-39de-4b57-88d6-11344885094e\n\nBug: 40925855\nChange-Id: Ib476ee48c99f0d0abecdb8d7387f9ad33d84c676\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8639949\nReviewed-by: Anton Bikineev \u003cbikineev@chromium.org\u003e\nAuto-Submit: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Anton Bikineev \u003cbikineev@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1725569}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 64e760aa452e0534468b978565d9589b8ffb4081\n" }, { "commit": "45c5f59e91f3041f23f4a6fec93ccab2900c8b7b", "tree": "1f47dc704b5767ab5b4f0d7f213f49b712dafa72", "parents": [ "acc32948e41fdf95b5d1c39bffc4a24084460169" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Thu Oct 22 09:01:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 22 09:07:07 2026" }, "message": "Enable BackupRefPtr in PartitionAlloc default dispatch shim\n\nConditionally enable BackupRefPtr for the allocator shim\u0027s PartitionRoot\nbased on the build flags ENABLE_BACKUP_REF_PTR_SUPPORT and\nFORCE_DISABLE_BACKUP_REF_PTR_FEATURE, instead of unconditionally\ndisabling it.\n\nThis extends BRP coverage to all pointers even before we configure\nPartitionAlloc after FeatureListInit, this is now possible because the\nlaunch of BRP for all platforms and all processes as of M157 (so we can\nmake it the default before FeatureList checking as well).\n\nRemaining changes are to remove dangling pointers discovered during this\nprocess.\n\nBug: 570542820\nChange-Id: I90c21b5f9a504bc33d9386d25045082bc00bd637\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8567537\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Rohit Rao \u003crohitrao@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1724550}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a246bc6b2e8d31c9abe2d505bdf95368af1cbc47\n" }, { "commit": "acc32948e41fdf95b5d1c39bffc4a24084460169", "tree": "ccab49aa886334cf057f9c4dda111911ddcb4d1f", "parents": [ "ba6ccf800e4d1c1902fb41fd2a31e5a5616e1229" ], "author": { "name": "Michael Lippautz", "email": "mlippautz@chromium.org", "time": "Thu Oct 22 08:32:42 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 22 08:38:18 2026" }, "message": "partition_alloc: Improve user space zero segment reservation\n\nThe overall goal of this CL is to increase N in the unwritable region\n0-4G+N. V8 has the need of a larger N here (likely in the 100s of KB),\ninstead of just 4K.\n\nThe patch improves the zero segment logic in:\n\n1. On macOS/GetWellKnownReadOnlyRegions(): Walk consecutive regions\n starting from 0x0 via mach_vm_region() in and include all\n contiguous or subsequent regions that are neither writable nor can\n ever become writable. This covers the binary\u0027s __TEXT segment when\n ASLR places it immediately after __PAGEZERO.\n2. InitZeroSegment(): iterate over all well-known read-only regions\n and reserve the gaps between them using SystemAllocPages() directly,\n avoiding internal ASLR on Windows.\n3. Update the death tests to test write faults rather than read faults\n as that\u0027s the security contract for the segment.\n\nDrive-by: Document the behavior on Windows better.\n\nTAG\u003dagy\nCONV\u003d572aa046-fb5f-4680-9d0c-10edbc504215\n\nBug: 40925855, 574732380, 558640961\nChange-Id: Id5c7d5a502f016ad16c1d354dcd215269d0879d0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8616082\nReviewed-by: Anton Bikineev \u003cbikineev@chromium.org\u003e\nCommit-Queue: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1724531}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f82b12a306a100e14a2b26c972f12213fea23693\n" }, { "commit": "ba6ccf800e4d1c1902fb41fd2a31e5a5616e1229", "tree": "c4e9727ae9fb3c1fcbf6853f30e29f5379faf3e5", "parents": [ "bc1cfeaa9c14f6c1b5f0b022ac218471836ecc27" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Thu Oct 22 06:47:05 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 22 06:54:28 2026" }, "message": "PA: Add `use_brp` to AllocationNotificationData\n\nMake AllocationObserverHook to see whether the `address` is allocated\nfrom BRP-enabled PartitionRoot or not. It will be used by\nAsanRawPtrService.\n\nBug: 553120509, 555037375\nChange-Id: I06ab82f8fe859d636f338c06e79ddb80bb1fd359\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8547914\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1724478}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ae1ccb9a052b66ed6b5ebbcabe62431164166fb2\n" }, { "commit": "bc1cfeaa9c14f6c1b5f0b022ac218471836ecc27", "tree": "59cd808c1d4618d9d304742241fa986226182274", "parents": [ "5804984eed0939087be1f70208b06371750a5046" ], "author": { "name": "Erik Chen", "email": "erikchen@chromium.org", "time": "Thu Oct 22 00:26:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 22 00:30:53 2026" }, "message": "[PA][base] Gate Lock ownership tracking on EXPENSIVE_DCHECKS_ARE_ON\n\nOn dcheck_always_on \u003d true builds, base::Lock and\npartition_alloc::internal::Lock track owning_thread_ref_ via\nPlatformThread::CurrentRef() (which reads TLS viaCurrentId()) and force\nout-of-line Lock::Acquire()/Release() calls on every lock acquisition\nand release. Across browser_tests, lock ownership tracking and\nper-thread held-lock tracking account for ~3.5-4.5% of total CPU\n(~200-250 ms CPU per test).\n\nGate owning_thread_ref_ and GetTrackedLocksHeldByCurrentThread() in\nbase::Lock, base::ConditionVariable, base::SequenceCheckerImpl, and\npartition_alloc::internal::Lock on EXPENSIVE_DCHECKS_ARE_ON() /\nPA_BUILDFLAG(EXPENSIVE_DCHECKS_ARE_ON) instead of DCHECK_IS_ON(),\nallowing Lock::Acquire() and Lock::Release() to inline directly to\nLockImpl when expensive DCHECKs are disabled while preserving Clang\u0027s\ncompile-time -Wthread-safety annotations.\n\nExpected cost savings: ~3.5-4.5% of total browser_tests CPU (~200-250 ms\nCPU per test).\n\nBug: 573256256\nAgent-Generated: true\nChange-Id: Ibaa5eca485664924b7a1e5a60aba2a223105184a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8616900\nCommit-Queue: Erik Chen \u003cerikchen@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1724296}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5683154490c9895c01139b8869f1c35164b18961\n" }, { "commit": "5804984eed0939087be1f70208b06371750a5046", "tree": "3ffb37173fabdb050636b60b209f94fa0b37a695", "parents": [ "91c2746f5d81777a0e633d300cf0f1da53fd9a95" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Wed Oct 21 18:22:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 21 18:28:39 2026" }, "message": "[PA] Mark LeakySingleton::GetSlowPath() with PA_NOINLINE\n\nWith PGO (re-enabled for PartitionAlloc in https://crrev.com/c/7005886\nand https://crrev.com/c/7481069), LLVM inlines the following call chain\ninto PartitionAllocFunctionsInternal\u003ckNoHooks, kNoHooks\u003e::Malloc() [1]\nand (via indirect call promotion of delegate-\u003ealloc_function)\nDelegatedAllocFn() [2]:\n Malloc()\n -\u003e Allocator() [3]\n -\u003e LeakySingleton::Get() [4]\n -\u003e LeakySingleton::GetSlowPath() [5]\n -\u003e MainPartitionConstructor::New() [6]\n\nWithout PGO, the [[likely]] branch in LeakySingleton::Get() [4] makes\nthe GetSlowPath() call site cold (inline threshold 45). With PGO, a call\nsite is only cold if its profile count is at most 2. This branch is\ntaken a few dozen times in the profile, so it gets the regular threshold\n(250) [7].\n\nNew() puts a 224-byte PartitionOptions on the stack, so every malloc()\nthrough the default dispatch pays for a 240-byte stack frame, a stack\nprotector canary check, and a non-tail call to PartitionRoot::Alloc()\n[8].\n\nPA_NOINLINE on GetSlowPath() fixes this: Malloc() shrinks from 352 to 47\nbytes and tail-calls PartitionRoot::Alloc() [8]. In\npartition_alloc_perftests (Linux x64, is_official_build\u003dtrue,\nchrome_pgo_phase\u003d2, linked with --lto-O2 as Chrome is [9]), this gives\nsmall (0.4-1.7%) improvements in single-threaded System malloc\nthroughput.\n\n[1] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d256-261;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[2] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d847-850;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[3] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d187-189;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[4] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d88-95;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[5] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d125-155;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[6] https://source.chromium.org/chromium/chromium/src/+/main:base/allocator/partition_allocator/src/partition_alloc/shim/allocator_shim_default_dispatch_to_partition_alloc.cc;l\u003d159-170;drc\u003dafff432d76ede098d6638042dacdd39e71c47e19\n[7] Compiling allocator_shim_default_dispatch_to_partition_alloc.cc with\n `-Rpass\u003dinline -Rpass-missed\u003dinline` and `-S -emit-llvm`\n (profile chrome-linux-main-1792237914):\n Without -fprofile-use: GetSlowPath() not inlined into Malloc()\n (cost\u003d185, threshold\u003d45)\n With -fprofile-use: GetSlowPath() inlined into Malloc()\n (cost\u003d170, threshold\u003d250)\n !{i32 999999, i64 2, i32 716494} ; cold cutoff min count \u003d 2\n !{!\"branch_weights\", i32 47, i32 38319252}\n[8] `llvm-objdump -d out/rel/partition_alloc_perftests`, Malloc():\n Before: subq $0xf0, %rsp; movq %fs:0x28, %rax; ...;\n callq PartitionRoot::Alloc; ...; callq __stack_chk_fail\n After: testq %rdi, %rdi; je \u003ccall GetSlowPath()\u003e; ...;\n jmp PartitionRoot::Alloc\n[9] https://crrev.com/c/8588699 (perftests otherwise link with\n --lto-O0).\n\nBug: 338094768\nChange-Id: I7a38e10479d1ab3c1249c36acb38205f1fe2b072\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8576938\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1724010}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f220ed13c0e0125b9709ede40f3c9eb5516fc2f9\n" }, { "commit": "91c2746f5d81777a0e633d300cf0f1da53fd9a95", "tree": "3b9fdfc5f11d27bac5b4c9325d785d0b29d3789d", "parents": [ "3f11a9bc6312d7203715e7b9e89b885dfef37acd" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Wed Oct 21 18:22:02 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 21 18:27:33 2026" }, "message": "[PA] Add a purge headroom option to SchedulerLoopQuarantine\n\nOnce a SchedulerLoopQuarantine branch is full, which is the steady\nstate on the browser main thread during long tasks, every quarantined\nentry triggers a purge that dequarantines just enough entries to make\nroom for it. The fixed cost of each purge is then paid on every free.\n\nIn the Windows Stable congestion (jank) profile of the browser main\nthread, 0.80% of samples are in PurgeInternal() called from\nQuarantine(), i.e. in purges that make room for a new entry:\nhttp://pprof/?id\u003d6f6060560ac44f3cec78b4b91c2176c3\u0026pivot\u003dpartition_alloc::internal::SchedulerLoopQuarantineBranch%3C1,0%3E::PurgeInternal\n\nAdd a \"purge-headroom-percent\" option: when the branch is full,\ndequarantine enough entries to free up this percentage of the\ncapacity, so that the next entries can be quarantined without purging.\nThe trade-off is a slightly lower average quarantine occupancy: with\n10%, the branch holds between 90% and 100% of its capacity once full\n(vs. ~100% today). The default (0) keeps the current behavior, so this\ncan be evaluated via Finch, by adding e.g.\n`\"purge-headroom-percent\": 10` to the browser \"main\" branch in the\nPartitionAllocSchedulerLoopQuarantine config.\n\nThe new field fits in existing padding of SchedulerLoopQuarantineBranch\n(ThreadCache size is unchanged).\n\nSchedulerLoopQuarantine perftests on a Lenovo IdeaPad 5 (Ryzen 7 5700U,\nWindows 11 26200), \"browser_main\" vs. \"browser_main_purge_headroom_10\"\n(same process), 20 runs (95% CIs: percentile bootstrap of the median of\nper-run ratios). \"all lines\" rows read every cache line of each object\nbefore freeing it, like a destructor that reads all fields.\n\nScenario (ns) browser_main headroom_10 Delta [95% CI]\nstorm_1k_cold 185.0 186.5 +0.8% [+0.3, +1.6]\n all lines 176.0 178.0 +0.6% [+0.0, +1.7]\nstorm_8k_cold 163.6 158.9 -2.8% [-3.1, -2.0]\n all lines 154.2 149.1 -3.3% [-3.6, -2.7]\nstorm_8k_cold_random_order 164.0 160.2 -2.5% [-2.8, -2.0]\n all lines 157.1 152.6 -2.8% [-3.2, -2.7]\nstorm_50k 149.9 142.1 -5.1% [-5.3, -4.8]\n all lines 148.5 140.6 -5.6% [-5.7, -5.4]\nstorm_50k_random_order 170.9 164.3 -4.0% [-4.3, -3.8]\n all lines 174.1 167.5 -3.7% [-4.2, -3.5]\nstorm_300k 160.4 159.4 -1.5% [-4.6, -0.3]\n all lines 159.8 157.1 -5.1% [-6.6, -0.9]\nsteady_churn 81.0 76.2 -5.8% [-6.3, -5.1]\n all lines 91.9 85.7 -6.3% [-6.8, -5.8]\n\nBug: 568824848\nChange-Id: I2a5b13be84589e84a95401b8bb9a4164cfc914ec\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8501635\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1724009}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: fcd1596ef14c07d58a9af4f1fad4b60133569f42\n" }, { "commit": "3f11a9bc6312d7203715e7b9e89b885dfef37acd", "tree": "55c5b05bd13a83999c43f0b4582f388d27907fc6", "parents": [ "4841d4b0a39b2ccdc192105ce5e1d2d423fadf51" ], "author": { "name": "Erik Chen", "email": "erikchen@chromium.org", "time": "Wed Oct 21 15:47:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 21 15:54:21 2026" }, "message": "[PA] Gate use_partition_cookie on enable_expensive_dchecks\n\nPartitionAlloc\u0027s partition cookie writes a 16-byte canary pattern at the\nend of every single allocation and verifies it on every free. Across\nlinux-chromeos-rel browser_tests, `PartitionCookieWriteValue` and\n`PartitionCookieCheckValue` consume ~4.0% of total CPU samples (~225 ms\nCPU per test, or ~6% of all DCHECK overhead) in addition to increasing\nslot size and memory pressure on every allocation.\n\nGate the `partition_alloc_dcheck_always_on` branch of\n`use_partition_cookie` in `partition_alloc.gni` on\n`enable_expensive_dchecks` (when defined in the build overrides) so that\nCQ trybuilders with `enable_expensive_dchecks \u003d false` skip\nper-allocation cookie writes and checks while CI waterfalls and local\ndeveloper builds continue verifying partition cookies by default.\n\nBug: 573256256\nAgent-Generated: true\nChange-Id: I394936ae4bf9ab1d6c7488891d754818b6334f93\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8616097\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCommit-Queue: Erik Chen \u003cerikchen@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1723856}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d22ad373515056e157b838228ca1f5fbe6d93f9c\n" }, { "commit": "4841d4b0a39b2ccdc192105ce5e1d2d423fadf51", "tree": "1e8a1fe05bcf3f13a8d20a99512b42a8ca601d2e", "parents": [ "9c337d48f2539ee272417986ceabf9f51f4fcfb2" ], "author": { "name": "Gregg Tavares", "email": "gman@google.com", "time": "Wed Oct 21 14:24:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 21 14:29:50 2026" }, "message": "[PA] Track and emit UMA for max InSlotMetadata ref count\n\nTrack the highest power-of-two BRP reference count (\u003e\u003d 2^12) in\nInSlotMetadata::Acquire() and\nInSlotMetadata::AcquireFromUnprotectedPtr().\nFolding the overflow PA_CHECK into the \u003e\u003d 2^12 [[unlikely]] branch and\ngating UpdateMaxRefCountSlow() on std::has_single_bit() avoids any extra\nbranches or memory accesses on the fast path and limits atomic updates\nto at most once per power-of-two boundary. Report this value through\nMallocDumpProvider and emit it to UMA as\nMemory.Experimental.{Process}2.Custom.Malloc.MaxBRPRefCount.\n\nBug: 572999423\nChange-Id: I32486b9b1969ab07af4a19c72161e8256a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8562461\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Thiabaud Engelbrecht \u003cthiabaud@google.com\u003e\nCommit-Queue: Thiabaud Engelbrecht \u003cthiabaud@google.com\u003e\nAuto-Submit: Gregg Tavares \u003cgman@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1723777}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: baea8be16c4cc173c1eb4b73a91a178e2481fb7d\n" }, { "commit": "9c337d48f2539ee272417986ceabf9f51f4fcfb2", "tree": "2f23cab7aeae802d4421b4701406f0faa9bdc13b", "parents": [ "f974591375e8dd149bab746537d3e13ee2dc00d2" ], "author": { "name": "David Sanders", "email": "dsanders11@ucsbalum.com", "time": "Wed Oct 21 00:32:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 21 00:37:25 2026" }, "message": "Remove unused \u003cutility\u003e include in partition_address_space.h\n\nAdds a missing include to fix the build\n\nBug: 40318405\nChange-Id: If49c1d1686b74f5801248eaeb3aa77a7e6d92d0e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8602090\nCommit-Queue: David Sanders \u003cdsanders11@ucsbalum.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1723410}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 30d98628da31ef7e698dcdfe12ab449c9b367233\n" }, { "commit": "f974591375e8dd149bab746537d3e13ee2dc00d2", "tree": "cfdf690b5265e2ff73bf109fa165c79bed0b898f", "parents": [ "f4d088a34b6c589fee0a174c4b0af0e15ceca822" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Tue Oct 20 18:42:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 18:50:38 2026" }, "message": "[PA] Remove SchedulerLoopQuarantineBranch::config_for_testing_\n\nSchedulerLoopQuarantineBranch keeps a copy of its\nSchedulerLoopQuarantineConfig (56 bytes on 64-bit, mostly the branch\nname) only so that one test can check whether the quarantine is\nenabled. Replace GetConfigurationForTesting() with\nIsQuarantineEnabledForTesting() and remove the copy. No behavior\nchange.\n\nThis makes room in ThreadCache, which must fit in\nkThreadCacheStorageSize, for the stats added by crrev.com/c/8508644,\nwithout increasing the thread-local storage of every thread.\n\nBug: 568824848\nChange-Id: I4de5a5c0c961c4048a72f44427aea0c9e215c391\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8504961\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1723100}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2cb21b2ad23d725250bdb5c46104b9e99c5d0380\n" }, { "commit": "f4d088a34b6c589fee0a174c4b0af0e15ceca822", "tree": "9f8c20ca42e37d353cbcf0cee73feb7b61476de4", "parents": [ "b4c3272b9dd790e18758f1bd4dc88c39f054a62b" ], "author": { "name": "Erik Chen", "email": "erikchen@chromium.org", "time": "Tue Oct 20 14:34:38 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 14:39:35 2026" }, "message": "[PA] Gate RawPtrBackupRefImpl checks on EXPENSIVE_DCHECKS_ARE_ON\n\nIn dcheck_always_on\u003dtrue builds, RawPtrBackupRefImpl executes expensive\nvalidation on every raw_ptr wrap, release, and dereference:\n\n1. SafelyUnwrapPtrForDereference() calls out-of-line IsPointeeAlive() on\n every raw_ptr::operator-\u003e(), operator*(), and get() dereference,\n performing a ReservationOffsetTable lookup, SlotSpanMetadata::FromAddr\n translation, reciprocal multiplication, and InSlotMetadata::IsAlive()\n check.\n\n2. IsSupportedAndNotNull() calls out-of-line\n CheckThatAddressIsntWithinFirstPartitionPage() on every raw_ptr\n construction, copy, destruction, and dereference.\n\nIn CPU profiles of browser_tests on linux-chromeos-rel (21-test batch,\n143.36s total CPU), RawPtrBackupRefImpl::IsPointeeAlive (6.20s) and\nCheckThatAddressIsntWithinFirstPartitionPage (5.53s) together account\nfor 11.73s (8.2% of total browser_tests CPU, or ~13% of all DCHECK\ncompute).\n\nGate these checks behind PA_BUILDFLAG(EXPENSIVE_DCHECKS_ARE_ON) ||\nPA_BUILDFLAG(ENABLE_BACKUP_REF_PTR_SLOW_CHECKS) instead of\nPA_BUILDFLAG(DCHECKS_ARE_ON) so they remain enabled on CI and local\ndebug builds while avoiding the overhead when enable_expensive_dchecks\nis false on CQ release trybuilders.\n\nBug: 573256256\nAgent-Generated: true\nChange-Id: I201523d7a0d9008a807108d9b66c2f550d9c7b80\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8577596\nCommit-Queue: Erik Chen \u003cerikchen@chromium.org\u003e\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1722894}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0aa19d89e71684b8535f251c647a2ea7cbca6097\n" }, { "commit": "b4c3272b9dd790e18758f1bd4dc88c39f054a62b", "tree": "54d603a0f79bdef6dbcd11fcb2b3b789b0147a25", "parents": [ "f9fb8535fbb8481189460ca0be2c51029d9f3527" ], "author": { "name": "Erik Chen", "email": "erikchen@chromium.org", "time": "Tue Oct 20 14:33:22 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 14:38:38 2026" }, "message": "[PA] Gate hot malloc/free metadata checks on EXPENSIVE_DCHECKS_ARE_ON\n\nIn dcheck_always_on\u003dtrue builds, PartitionAlloc\u0027s inline malloc() and\nfree() fast paths perform heavy SlotSpanMetadata and slot-alignment\nvalidation on every allocation and deallocation:\n\n1. PartitionRoot::AllocInternalNoHooks() validates thread-cache hits\n (95% of allocations) by calling SlotSpanMetadata::FromSlotStart(),\n DeducedRootIsValid(), and GetSlotUsableSize(), touching super-page\n metadata and buckets that the thread-cache fast path otherwise\n avoids completely.\n\n2. PartitionRoot::GetSlotStartAndSlotSpanFromAddress() calls out-of-line\n SlotStart::Checked() on every free() before calling\n SlotSpanMetadata::FromAddr(), and FreeNoHooksImmediateInternal()\n repeats DeducedRootIsValid(slot_span).\n\n3. PartitionPageMetadata::FromAddr(), SlotSpanMetadata::FromAddr(),\n SlotSpanMetadata::FromSlotStart(), and\n SlotSpanMetadata::FromObjectInnerAddr() validate super-page payload\n bounds, out-of-line DeducedRootIsValid(), and slot-size alignment on\n every metadata lookup.\n\nGate these hot-path checks behind PA_BUILDFLAG(EXPENSIVE_DCHECKS_ARE_ON)\nso they remain active on CI and local debug builds while avoiding ~5-6%\nof total browser_tests CPU overhead on CQ release trybuilders where\nenable_expensive_dchecks is false.\n\nBug: 573256256\nAgent-Generated: true\nChange-Id: Ibcd8e817aa25d3279599c90fa9b92c11369d3321\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8615077\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCommit-Queue: Erik Chen \u003cerikchen@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1722892}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4821aed3cfe4ea1cb449446c97934d2d699913bf\n" }, { "commit": "f9fb8535fbb8481189460ca0be2c51029d9f3527", "tree": "3569127893b5badb7ccaca6f9e53578801a0a05a", "parents": [ "d2e96eaf4661f951d7b10fb04de67aa6f0aed9c7" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Tue Oct 20 14:21:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 14:25:56 2026" }, "message": "[PA] Avoid needless work in SchedulerLoopQuarantine purges\n\nSchedulerLoopQuarantineBranch::PurgeInternal() is called for every\nquarantined entry (to make room for it) and at the end of every task\non the browser main thread. Most calls have nothing to dequarantine,\nbut still:\n- construct a BatchFreeQueue, whose 256-byte storage is\n zero-initialized (-ftrivial-auto-var-init\u003dzero), and\n- do 2 atomic read-modify-write operations on the shared\n SchedulerLoopQuarantineRoot stats, with a value of 0.\n\nIn the Windows Stable congestion (jank) profile of the browser main\nthread, 0.89% of samples are in PurgeInternal(), including the actual\ndequarantining work:\nhttp://pprof/?id\u003d6f6060560ac44f3cec78b4b91c2176c3\u0026pivot\u003dpartition_alloc::internal::SchedulerLoopQuarantineBranch%3C1,0%3E::PurgeInternal\n\nReturn early when there is nothing to dequarantine, and construct the\nBatchFreeQueue lazily, since thread-bound branches only need it for\nentries larger than the thread cache\u0027s size limit. No behavior change.\n\nSchedulerLoopQuarantine perftests on a Lenovo IdeaPad 5 (Ryzen 7 5700U,\nWindows 11 26200), before vs. after this CL, 20 interleaved runs of each\n(95% CIs: percentile bootstrap of the median of per-run ratios). \"all\nlines\" rows read every cache line of each object before freeing it, like\na destructor that reads all fields.\n\nDelta, median [95% CI]:\n\nScenario browser_main unlimited\nstorm_1k_cold -7.8% [-8.2, -6.9] -7.6% [-8.2, -6.8]\n all lines -6.9% [-7.1, -6.6] -6.9% [-7.4, -6.4]\nstorm_8k_cold -7.5% [-7.6, -7.2] -8.9% [-9.4, -8.6]\n all lines -6.1% [-6.3, -5.7] -7.5% [-7.8, -7.3]\nstorm_8k_cold_random_order -7.4% [-7.8, -6.8] -8.9% [-9.1, -8.3]\n all lines -5.1% [-5.6, -4.8] -6.9% [-7.5, -6.4]\nstorm_50k -6.9% [-7.7, -6.7] -8.5% [-8.8, -8.2]\n all lines -6.3% [-6.9, -5.7] -7.5% [-7.8, -7.1]\nstorm_50k_random_order -7.0% [-7.7, -6.3] -8.5% [-8.8, -8.1]\n all lines -4.7% [-4.9, -4.4] -6.4% [-7.0, -5.6]\nstorm_300k -8.9% [-10.3, -5.0] -6.2% [-7.0, -5.4]\n all lines -6.0% [-6.5, -3.2] -5.6% [-6.2, -5.2]\nsteady_churn -10.9% [-11.1, -10.5] -2.2% [-3.2, -1.5]\n all lines -9.4% [-10.0, -8.5] -2.1% [-3.1, -1.8]\n\nTime per free (per free+alloc for steady_churn), median (ns):\n\n browser_main unlimited\nScenario Before After Before After\nstorm_1k_cold 205.0 189.0 206.0 190.0\n all lines 197.0 184.0 197.0 183.0\nstorm_8k_cold 180.2 166.7 178.8 162.9\n all lines 168.5 158.6 167.9 155.3\nstorm_8k_cold_random_order 180.6 167.1 180.1 164.1\n all lines 170.6 161.6 170.1 158.2\nstorm_50k 168.4 156.6 181.8 166.1\n all lines 163.4 152.9 173.2 160.4\nstorm_50k_random_order 186.4 173.4 200.7 183.9\n all lines 185.3 176.2 198.5 185.4\nstorm_300k 184.7 166.9 239.1 224.3\n all lines 180.8 169.9 239.1 224.7\nsteady_churn 103.8 92.4 310.9 303.2\n all lines 113.9 102.9 322.4 314.0\n\nBug: 568824848\nChange-Id: I57f7b76fa862847b602a6dc536d62fe1ffaf6199\n\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8502364\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1722885}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 80a66de8e38aff4590ca8c1e0022371451b40acb\n" }, { "commit": "d2e96eaf4661f951d7b10fb04de67aa6f0aed9c7", "tree": "40f7af7693cd7f39cd35f68f1b0c5326a6ddf2e3", "parents": [ "62b9bed2d702c6371f16e3b51dac2870a1be55c4" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Oct 20 03:31:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 03:37:06 2026" }, "message": "Reland \"Checked Span: Enable tightened checking\"\n\nThis is a reland of commit a27e1a2c28881022a9eb7a7d2f0d1e7f90ecafc4.\nThe CL (flipping a buildflag) is basically unchanged, but it now\nexcludes iOS, in hopes that we can get soak time on other platforms.\n\nAdditionally, this CL is landed atop\nhttps://skia-review.googlesource.com/c/skia/+/1242277,\nso Skia should now directly allocate a good size (from PartitionAlloc)\nand not call `malloc_usable_size()` to use more than it requested. See\nthe linked bugs for more details.\n\nOriginal change\u0027s description:\n\u003e Checked Span: Enable tightened checking\n\u003e\n\u003e This enables tightened bounds-checking. Checked Span now refers to the\n\u003e hidden, originally requested size provided by the caller, and will crash\n\u003e if a `base::span` any larger than that is requested. (Exceptions apply,\n\u003e specific to the implementation of PartitionAlloc.)\n\u003e\n\u003e Fixed: 534387022\n\u003e Change-Id: Id74f51b31ba2e59c6a5b7889305f54b0476c1340\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8491851\n\u003e Commit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\n\u003e Reviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1709778}\n\nBug: 534387022, 568703257\nFixed: 568687585\nChange-Id: I2fcacc783292fb3fe9f1798886710b003b841f09\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8548053\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1722554}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 592a0539b79f8f92361b5fbca05964de483b7138\n" }, { "commit": "62b9bed2d702c6371f16e3b51dac2870a1be55c4", "tree": "b0bd68f73b6979e040b5b299e31f696710ce9e43", "parents": [ "5fd05e022fbc2914e64a4ced88d75bc661cf3087" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Tue Oct 20 00:22:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 00:27:19 2026" }, "message": "Expand Clang\u0027s AllocToken coverage\n\nAllocToken (-fsanitize\u003dalloc-token) rewrites allocation calls into\ntoken-aware variants such as __alloc_token__Znwm(size, token). Since\nonly allocator_shim defines them, the alloc_token config is currently\napplied only to allocator_shim\u0027s dependents via all_dependent_configs.\nAs a result, components that don\u0027t depend on allocator_shim, mainly\nthird-party libraries, are not instrumented.\n\nThis CL applies the config to all code and links weak fallbacks for the\n__alloc_token_* functions into every binary. The fallbacks drop the\ntoken and call the regular allocation functions. In binaries that link\nallocator_shim, its strong definitions override the fallbacks, so tokens\nstill reach PartitionAlloc. AllocToken stays disabled by default for\nnow.\n\nThis CL includes the following key modifications:\n- Add the use_alloc_token GN arg to enable AllocToken.\n- Add the alloc_token config to default_compiler_configs, instead of\n propagating it via allocator_shim\u0027s all_dependent_configs.\n- Add the weak fallbacks (//build/sanitizers/alloc_token_aliases.c and\n alloc_token_aliases_cxx.cc) to //build/config:common_deps.\n- Opt out no_default_deps binaries\u0027 own sources automatically, and\n libraries linked into them explicitly (jni_zero, ui/qt, gcapi_mac).\n- Remove the ignorelists and drop component build support.\n\nBug: 477186304\nChange-Id: Ia4facf48eb3702d090ebe74d8174a48adc9a0520\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8483472\nReviewed-by: Hans Wennborg \u003chans@chromium.org\u003e\nReviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Thomas Anderson \u003cthomasanderson@chromium.org\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1722463}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2123f8d5a5444ef0c3973977d7ee54d680f9f41f\n" }, { "commit": "5fd05e022fbc2914e64a4ced88d75bc661cf3087", "tree": "db76a90a731378c3265592fd1e8e290b388eed13", "parents": [ "31ae6a7f08daf9cfeb18d295a3c4e40a8640d97d" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Oct 20 00:20:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 20 00:26:21 2026" }, "message": "Checked Span: Gate `InSlotMetadata` dereference\n\nIn the \"can store raw size\" arm of the the realloc routine,\nthis `DCHECK()` incorrectly dereferences `ref_count` without\n`brp_enabled()`. This causes a crash on iOS.\n\nBug: 534387022, 568703257\nChange-Id: Id51fdc82c80405b92a116ce26b5cc481b168df15\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8609352\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1722461}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: da3de4ccc16c58fc397775ef9617c175f6949c06\n" }, { "commit": "31ae6a7f08daf9cfeb18d295a3c4e40a8640d97d", "tree": "4a24bbfe7161a5fc91738d7c9b894f4442012665", "parents": [ "46f76ba3ebd67554e30823e9974a5baccb74789c" ], "author": { "name": "Erik Chen", "email": "erikchen@chromium.org", "time": "Fri Oct 16 17:39:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 16 17:46:53 2026" }, "message": "[PA] Avoid 64-bit hardware division and duplicate checks in DCHECKs\n\nIn dcheck_always_on\u003dtrue builds, PartitionAlloc hot paths execute slow\n64-bit hardware integer division (divq) and redundant metadata lookups\non every allocation, deallocation, and raw_ptr operation:\n\n1. PartitionBucket::GetSlotNumber() computes the slot index via\n reciprocal multiplication to avoid integer division, but then asserts\n PA_DCHECK(offset_in_slot_span / slot_size \u003d\u003d offset_in_slot), adding\n a 64-bit hardware division to every SlotAddressAndSize::From() call\n (i.e. every raw_ptr construction, copy, destruction, and dereference).\n Replace this with the equivalent division-free bounds check:\n PA_DCHECK(offset_in_slot * slot_size \u003c\u003d offset_in_slot_span);\n PA_DCHECK(offset_in_slot_span - offset_in_slot * slot_size \u003c\n slot_size);\n which also CSEs offset_in_slot * slot_size with the caller.\n\n2. SlotStart::Check() and SlotSpanMetadata::FromSlotStart() assert\n !(offset_in_slot_span % slot_size) via 64-bit hardware modulo. For\n normal buckets (\u003c\u003d kMaxBucketSize), use GetSlotNumber() * slot_size\n \u003d\u003d offset_in_slot_span instead.\n\n3. PartitionRoot::GetSlotStartAndSlotSpanFromAddress() calls\n SlotStart::Checked() and then calls SlotSpanMetadata::FromSlotStart()\n twice in a row, performing the full FromAddr + ToSlotSpanStart +\n slot-alignment validation 3 times on every free(). Use\n SlotSpanMetadata::FromAddr() after SlotStart::Checked() and drop the\n duplicate FromSlotStart() and IsReservationStart() checks.\n\nEstimated impact: Saves ~350-500 ms of CPU per browser_test (~5-7% of\ntotal browser_tests CPU on linux-chromeos-rel).\n\nBug: 573256256\nAgent-Generated: true\nChange-Id: I4f462612da3295d84c5fa6b727fce11a4b264377\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8574623\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nReviewed-by: Erik Chen \u003cerikchen@chromium.org\u003e\nCommit-Queue: Erik Chen \u003cerikchen@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1720867}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0f93b3e10716c5500b23a4acef7e6c767d79db42\n" }, { "commit": "46f76ba3ebd67554e30823e9974a5baccb74789c", "tree": "7c61785571962f5eed6b8462471c0fc394a87173", "parents": [ "ac4bb0cb7b8d61c73b461af7cf733ec5d9a4d8b8" ], "author": { "name": "François Doray", "email": "fdoray@chromium.org", "time": "Fri Oct 16 12:03:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 16 12:13:05 2026" }, "message": "[PA] Add SchedulerLoopQuarantine perftests\n\nThe SchedulerLoopQuarantine (SLQ) is 2.1% of browser UI thread jank\non Windows:\nhttps://pprof.corp.google.com/?id\u003d6f6060560ac44f3cec78b4b91c2176c3\u0026pivot\u003dpartition_alloc::internal::SchedulerLoopQuarantineBranch\n\nAdd micro-benchmarks for the thread-bound SLQ, to evaluate upcoming\noptimizations:\n- FreeStorm: a task frees N objects (e.g. destroying a large\n base::Value tree), including the end-of-task purge. Variations:\n cold/warm CPU caches, allocation/random free order, 1k to 300k\n objects.\n- SteadyChurn: alloc/free churn within a long task, while the\n quarantine is full (unless its capacity is unlimited).\n\nEach scenario has two variants, which bound the work of destructors\nbefore objects are freed: the default reads only the first cache line\nof each object, and \"_all_lines\" reads all of its cache lines. This\nmatters because zapping writes the whole object: it misses the CPU\ncache on lines that weren\u0027t read, and is cheaper on lines that were.\n\nEach scenario is run with the quarantine disabled (\"no_quarantine\"),\nwith the configuration of the browser main thread on desktop\n(\"browser_main\": 512 KiB, zapping, purge at the end of each task), and\nwith a candidate configuration with an unlimited capacity\n(\"browser_main_unlimited\": only purged at the end of each task).\nConfigurations run alternately in the same process, and the median is\nreported. Tasks are delimited with\nScopedSchedulerLoopQuarantineTaskScope, like in base::TaskAnnotator.\n\nAllocation sizes follow the distribution of malloc() slot sizes\nmeasured on the browser main thread of a non-official Windows build,\nwhich counts allocations per bucket in ThreadCacheStats, during startup\nfollowed by the opening of 11 tabs: median 64 B, 81% \u003c\u003d 128 B,\n98% \u003c\u003d 1 KiB. Each allocation requests a slot size minus the\nper-allocation extras of the partition (e.g. in-slot BackupRefPtr\nmetadata), so that it uses the same bucket on all platforms.\n\nResults on a Lenovo IdeaPad 5 (Ryzen 7 5700U, Windows 11 26200), 50\nruns (95% CIs: percentile bootstrap of the median of per-run ratios):\n\nOverhead vs. no_quarantine, median [95% CI]:\n\nScenario browser_main unlimited\nstorm_1k_cold +75.4% [74.8, 76.3] +75.8% [75.5, 76.5]\n all lines +28.9% [28.0, 29.2] +28.7% [28.0, 30.0]\nstorm_8k_cold +81.4% [78.2, 82.4] +79.1% [76.3, 80.0]\n all lines +33.7% [33.4, 33.9] +32.3% [31.8, 32.6]\nstorm_8k_cold_random_order +50.1% [49.9, 50.3] +49.3% [48.9, 49.5]\n all lines +25.1% [25.0, 25.3] +23.9% [23.7, 24.1]\nstorm_50k +98.7% [98.5, 99.1] +115.7% [115.2, 116.1]\n all lines +44.3% [44.1, 44.4] +54.0% [53.8, 54.1]\nstorm_50k_random_order +101.7% [100.7, 102.7] +116.6% [115.7, 117.4]\n all lines +32.5% [32.2, 32.7] +41.5% [41.2, 41.8]\nstorm_300k +82.6% [81.2, 83.3] +138.1% [137.4, 138.9]\n all lines +40.0% [39.7, 40.4] +85.0% [84.0, 85.8]\nsteady_churn +107.0% [106.7, 107.3] +534.9% [525.2, 535.9]\n all lines +82.7% [82.5, 82.9] +432.2% [429.6, 433.1]\n\nTime per free (per free+alloc for steady_churn), median:\n\nScenario (ns) no_quarantine browser_main unlimited\nstorm_1k_cold 115.0 202.0 203.0\n all lines 149.5 192.0 193.0\nstorm_8k_cold 98.0 177.7 175.4\n all lines 124.7 166.5 164.9\nstorm_8k_cold_random_order 118.4 178.1 177.2\n all lines 135.1 168.9 167.4\nstorm_50k 83.1 165.1 179.0\n all lines 111.5 160.9 171.7\nstorm_50k_random_order 91.2 184.2 197.7\n all lines 138.9 184.1 196.6\nstorm_300k 99.2 179.8 235.4\n all lines 127.0 177.8 234.8\nsteady_churn 50.1 103.7 317.9\n all lines 62.2 113.6 331.1\n\nRun with:\n partition_alloc_perftests \\\n --gtest_filter\u003dSchedulerLoopQuarantinePerfTest.*\n\nBug: 568824848\nChange-Id: I330fc0bbcd3aa54fb96f82f1d7f32d5c6435e434\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8501572\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1720604}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f495fba29cddf35faecee1272aad4a0c70bec5ba\n" }, { "commit": "ac4bb0cb7b8d61c73b461af7cf733ec5d9a4d8b8", "tree": "79734466a7eccc1253c31c5c9a16ec2a5e5e1ad4", "parents": [ "37558a9b55844ad28666ddf44e44e78ef9442d65" ], "author": { "name": "Benoît Lizé", "email": "lizeb@google.com", "time": "Fri Oct 16 07:39:39 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 16 07:44:07 2026" }, "message": "[pa] Allocate direct-mapped superpages from the top of the GigaCage\n\nNormal-bucket superpage reservations are never returned to the\nAddressPoolManager pool, whereas direct-mapped allocations unreserve\nand return their superpages upon free. When both allocate bottom-up\nfrom the beginning of the pool, normal-bucket superpages allocated\nafter transient direct-mapped allocations permanently pin higher\nvirtual addresses and fragment the pool.\n\nTo reduce GigaCage fragmentation, allocate direct-mapped superpages\ntop-down (from high addresses downward via Pool::FindChunkFromEnd),\nwhile keeping normal-bucket superpages using their sequential\nnext_super_page_ hint and bottom-up fallback (Pool::FindChunk).\nCallers select the placement with the new\nAddressPoolManager::ReservationLifetime enum (kPersistent or\nkTransient). This only affects 64-bit platforms; on 32-bit, address\nspace is reserved directly from the OS.\n\nSince direct maps now live at the opposite end of the pool from\nnormal-bucket superpages, a few additional upper-level page table\npages may be needed to map both regions. This overhead is negligible\ncompared to the fragmentation it avoids.\n\nBug: 562457545, 573472737\nChange-Id: I23d142b9564352c2783e0f98a8b14f17260e7d7a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8580362\nCommit-Queue: Benoit Lize \u003clizeb@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1720480}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 95e2cb15fe65aff22b420abf9821cc746e89a710\n" }, { "commit": "37558a9b55844ad28666ddf44e44e78ef9442d65", "tree": "5438ece142b55072e999bb096e98c61d08a02b61", "parents": [ "5e9105b9283aa4416e5bd267a2efc7d3fdea4d56" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Fri Oct 16 02:42:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 16 02:49:14 2026" }, "message": "PA: make ReallocInline() invoke override and observer hooks when MEMORY_TOOL_REPLACES_ALLOCATOR\u003d1\n\nFix the issue that no override and observer hooks are invoked at\nReallocInline(). Also added memory_tool_replaces_unittest.cc to test\nPartitionAllocHooks when MEMORY_TOOL_REPLACES_ALLOCATOR\u003d1.\n\nBug: 553120509, 555037375\nChange-Id: I4343908ec7d646bfa63427bf8b93530e142dc200\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8523987\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1720322}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 15ae40326bdedc581ea88095512fbaf642d826d6\n" }, { "commit": "5e9105b9283aa4416e5bd267a2efc7d3fdea4d56", "tree": "b855c53993a58fdd476f0a918d0a12338379f4e2", "parents": [ "d90b3041f76f0a15976a4cb9337ae9075ab22bcd" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Thu Oct 15 15:41:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 15 15:50:08 2026" }, "message": "[PA] Remove unused ref_counted / scoped_refptr / AtomicRefCount\n\nAn include/usage census of partition_alloc_base shows that\nmemory/ref_counted.{h,cc}, memory/scoped_refptr.h and\natomic_ref_count.h have no users anywhere in PartitionAlloc\n(production or tests), nor in the few external files that include\npartition_alloc_base headers. ref_counted.cc was still being compiled\ninto allocator_base. Delete the cluster (~680 LoC) and drop the\nBUILD.gn entries.\n\nBug: none\nChange-Id: I8e221f38f43562d7fabd396e4c55e6e831870728\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8586556\nAuto-Submit: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1719718}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 37f66d968e7bff7e3dfcfa44f0aee7877dee1334\n" }, { "commit": "d90b3041f76f0a15976a4cb9337ae9075ab22bcd", "tree": "17a8ea91a1e723c6eff0bba69611f53c94036731", "parents": [ "13ec88bc7e51b16cda72118c482198703aa20068" ], "author": { "name": "Benoit", "email": "lizeb@google.com", "time": "Thu Oct 15 11:21:39 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 15 11:33:11 2026" }, "message": "[tools] Update PA tools to visualize GigaCage fragmentation\n\nCrash report analysis shows that mapping failures in PartitionAlloc\u0027s\nGigaCage happen, and cause a non-trivial number of browser\ncrashes. These crashes are usually due to high memory usage, but also\nGigaCage fragmentation. This CL adds tooling to visualize GigaCage\nfragmentation.\n\nBug: 573472737\nChange-Id: Ieba16a6b6f2e3c82da2f69b6afa12388b32af4a0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8580488\nCommit-Queue: Egor Pasko \u003cpasko@chromium.org\u003e\nCommit-Queue: Benoit Lize \u003clizeb@chromium.org\u003e\nAuto-Submit: Benoit Lize \u003clizeb@chromium.org\u003e\nReviewed-by: Egor Pasko \u003cpasko@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1719529}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4fc22c1403a9941ca0b2fb004c95d22fc391beaf\n" }, { "commit": "13ec88bc7e51b16cda72118c482198703aa20068", "tree": "2833a4e103e47a90ec0adc3d472c5bc3fdcd08ef", "parents": [ "1b65ca87736e9edb51911e15915573bf4cda7245" ], "author": { "name": "Benoît Lizé", "email": "lizeb@google.com", "time": "Tue Oct 13 18:42:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Oct 13 18:48:03 2026" }, "message": "[pa] Trigger a memory pressure event when GigaCage is almost full\n\nPartitionAlloc has a hard limit on memory that can be allocated: if an\nallocation request doesn\u0027t fit in the GigaCage limits, the allocation\nrequest fails, which (in Chromium) typically crashes the\napplication. There are known cases in the codebase (from field crashes)\nwhere a renderer (or an extension) can trigger multiple GiB allocations\nin the browser process, which can make it crash due to GigaCage\nexhaustion.\n\nAn (imperfect) solution is to allow the GigaCage to communicate that\nit\u0027s almost full to the application. This is what this CL does, namely:\n- When the GigaCage gets 90% full, it calls an application-level\n function\n- This function then triggers a critical memory pressure notification\n\nTo make this CL simpler, it only handles 64 bit POSIX builds. This\napproach would likely not work on 32 bit builds anyway due to the\ndifferent GigaCage implementation and the address space layout. POSIX is\nthe only target in scope for this CL, as it makes code easier to review,\nand I cannot test locally on Windows. However, a similar async-safe\nnotification mechanism exists on Windows, and will be added later.\n\nBug: 562457545\nChange-Id: I8886806cd45d3af2d8235e535f2fe9d396ad0b81\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8425821\nCommit-Queue: Benoit Lize \u003clizeb@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1717663}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 04875c40bc09f67a965de0cb349d0dde2faaaa0f\n" }, { "commit": "1b65ca87736e9edb51911e15915573bf4cda7245", "tree": "b40096ba871c262fe26a6fe98145126bcc6dd9bf", "parents": [ "e99269c417c6d51a255188ca6557c2ad6815b48b" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Thu Oct 08 04:26:46 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 08 04:32:34 2026" }, "message": "MiraclePtr: Introduce UnprotectedInReleaseForPerformance trait\n\nAdd UnprotectedInReleaseForPerformance to RawPtrTraits in PartitionAlloc\nfor pointers identified as verified performance hotspots (e.g. in\nSpeedometer 3).\n\nAlso add the remove_unprotected_in_release_trait GN argument and\nREMOVE_UNPROTECTED_IN_RELEASE_TRAIT buildflag (default false), allowing\nprotection on UnprotectedInRelease to subsequently be enabled without\naffecting performance hotspots or debug/DCHECK builds.\n\nAnnotate verified performance hotspot fields across Blink HTML\ntokenizer/parser, graphics/font metrics, and base task runner/message\nloop with UnprotectedInReleaseForPerformance.\nPlan: https://docs.google.com/document/d/1QnD9RuBDKb7j4f0eM7izoaYU7yx4vg5WBXugLCHWcM8/edit?usp\u003dsharing\n\nTAG\u003dagy\nCONV\u003daced7526-7cac-4267-a5f8-8c57c34bc538\n\nBug: 566006164\nChange-Id: Ie5c9a3f1deb3ce91029c0a83e2ec282b5759b0f1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8521662\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1714148}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8ac71046803ea7b9e38e9d0d07cf59f3bebba1ba\n" }, { "commit": "e99269c417c6d51a255188ca6557c2ad6815b48b", "tree": "fecb5b3794c245eb5b35cb8f3436866f449dcea1", "parents": [ "97b6065b7a4a07324bf8b21e4542883ddf0a742a" ], "author": { "name": "Sergio Solano", "email": "sergiosolano@google.com", "time": "Wed Oct 07 23:46:35 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 23:52:31 2026" }, "message": "Replace TODO(sergiosolano) with bug references\n\n- PartitionAlloc span.h: set start_lifetime_as_array TODO comment\n to crbug.com/570737624.\n- PartitionAlloc span_unittest.cc: remove redundant TODO comment.\n- base/cpu_unittest.cc: set byte_span_from_ref() TODO comment to\n crbug.com/570746342.\n\nBug: 570737624, 570746342\nChange-Id: I565918a1bf724825237ca739bd55f16d86aab5a1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8528386\nAuto-Submit: Sergio Solano \u003csergiosolano@google.com\u003e\nReviewed-by: Sergio Solano \u003csergiosolano@google.com\u003e\nCommit-Queue: Sergio Solano \u003csergiosolano@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1714003}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dd2db3b624b14ae13a6f6501782cd38804009681\n" }, { "commit": "97b6065b7a4a07324bf8b21e4542883ddf0a742a", "tree": "85d75c66eb8ac19484c61d0021846f12b63dfc7b", "parents": [ "28bd627eb04ea8a8e7b03dc9b94ea2aea0034079" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Oct 07 12:22:42 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 12:37:55 2026" }, "message": "Reland \"[PA] Introduce PartitionTlsRegistry to track PartitionTls instances\"\n\nThis reverts commit 9467d08d9e085700a4e184f5ff22568291b718eb.\n\nReason for revert: Parent CL relanded https://crrev.com/c/8483734\n\nOriginal change\u0027s description:\n\u003e Revert \"[PA] Introduce PartitionTlsRegistry to track PartitionTls instances\"\n\u003e\n\u003e This reverts commit 33ce22068bdb197fc227e9313a5d49432b30bd6b.\n\u003e\n\u003e Reason for revert: Dependent on CL chain suspected to cause memory regression\n\u003e\n\u003e Failure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [PA] Introduce PartitionTlsRegistry to track PartitionTls instances\n\u003e \u003e\n\u003e \u003e With this, we can iterate through active `PartitionTls` members.\n\u003e \u003e\n\u003e \u003e Change-Id: Id7b0ed89c768cf70b351e00e6ab521377c78f372\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8366011\n\u003e \u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e \u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1695581}\n\u003e\n\u003e Change-Id: I5e7d58532c3789beb8433234c157057ede2575e5\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8413365\n\u003e Owners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\n\u003e Bot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\n\u003e Reviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\n\u003e Commit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1698070}\n\nChange-Id: I3e88ab4606858b0ee5e3aa46d89afa9ee7be056f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8494351\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1713331}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a52590b208ce1cf2d64865443c3f2e6acf29af6b\n" }, { "commit": "28bd627eb04ea8a8e7b03dc9b94ea2aea0034079", "tree": "19869bf02c5590d7f8ca581b1ebd2eb9e11dbf6a", "parents": [ "15da91abd8ebe372f0d334f9c7a16211abbc5943" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Oct 07 09:14:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 09:23:38 2026" }, "message": "[PA] Simplify BucketIndexLookup and PartitionRoot::SizeToBucketIndex()\n\nUnify the linear and exponential bucket mappings directly in\nBucketIndexLookup::GetIndexForDenserBuckets() and GetBucketSize()\nwithout separate helper classes, 64-bit rotations, or branches.\n\nAlso move BucketDistribution to bucket_lookup.h and add\nBucketIndexLookup::GetIndex() so PartitionRoot::SizeToBucketIndex()\ncompiles to a single branchless sequence without duplicating\nGetIndexForDenserBuckets().\n\nNo behavior change.\n\nOn x86_64, this reduces the inlined SizeToBucketIndex() sequence in\nPartitionRoot::Alloc() from 230 bytes (two duplicated 28-instruction\nblocks) to 68 bytes (~17 instructions on the denser path), improving\npartition_alloc_perftests throughput by +6.1% to +7.8% in\nMultiBucketWithFreeWithSize and up to +13.5% in SingleBucket.\n\nNO_IFTTT\u003dNo behavior change to bucket sizes or constants.\n\nChange-Id: Ib2fd0bcab607e5566e242c7c2ce163ed3776342f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8514458\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1713235}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 138956eb878297a352aa9fa03a2f6eaf35f3cbd5\n" }, { "commit": "15da91abd8ebe372f0d334f9c7a16211abbc5943", "tree": "b06b4ffc9926b7c185c9f86c62d28400e8c750ce", "parents": [ "4e138df493e7b8396c9fbabc1b97cab2d36b662b" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Oct 07 06:04:05 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 06:10:04 2026" }, "message": "Reland \"[PA] Replace largest_active_bucket_index_ with active_bucket_count_\"\n\nThis reverts commit 7722d5682e81c10e435d72e0b4a6ed1fc67853a9.\n\nReason for revert: Parent CL relanded https://crrev.com/c/8483734\n\nOriginal change\u0027s description:\n\u003e Revert \"[PA] Replace largest_active_bucket_index_ with active_bucket_count_\"\n\u003e\n\u003e This reverts commit 75f790d6fca4e88282c5d68c8f0faa40c45022c7.\n\u003e\n\u003e Reason for revert: Parent CL is suspected cause of memory regression\n\u003e\n\u003e Failure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [PA] Replace largest_active_bucket_index_ with active_bucket_count_\n\u003e \u003e\n\u003e \u003e This CL renames `largest_active_bucket_index_` to `active_bucket_count_`\n\u003e \u003e in `ThreadCache` and `ThreadCacheRegistry`, and optimizes hot-path\n\u003e \u003e validity and bucket bounds checks in PartitionAlloc (`bucket_index \u003c\n\u003e \u003e tcache-\u003eactive_bucket_count()`).\n\u003e \u003e\n\u003e \u003e This makes use of zero-initialized `ThreadCache` safer - it simply\n\u003e \u003e denotes there is no active bucket and routes every allocation to the\n\u003e \u003e global root instead.\n\u003e \u003e\n\u003e \u003e TAG\u003dagy\n\u003e \u003e CONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\u003e \u003e\n\u003e \u003e Change-Id: Ie599f94695b8f5d1662da26f5efd2ad9fa6b021a\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8254723\n\u003e \u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e \u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1690469}\n\u003e\n\u003e Change-Id: I399006f53b684b1575abf5ffe32eae791e4fa03f\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8408627\n\u003e Owners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\n\u003e Bot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\n\u003e Commit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\n\u003e Reviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1698072}\n\nChange-Id: I13150a4521b8734bbcf37c741b7278fa6c72e2e5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8494331\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1713096}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b80cc90857d3b89dfaed62fbfb201ad888795b6c\n" }, { "commit": "4e138df493e7b8396c9fbabc1b97cab2d36b662b", "tree": "61e808c34991c293a621ec58f2a58f1f5e4661e7", "parents": [ "747e409971c9de24b21ca88bf890fff9bf2a7ad7" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Oct 07 03:32:51 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 03:39:26 2026" }, "message": "[PA] Split PartitionRoot entry points after their prologue\n\nMove what several PartitionRoot entry points do after their prologue\ninto functions of their own, and likewise how the scheduler-loop\nquarantine releases a purged slot. No behavior change.\n\nThis prepares for event hooks (https://crrev.com/c/8302832), which\nfire an event between an entry point\u0027s prologue and the rest, and then\ncall the rest, as a function, unless a hook took the operation over:\n- FreeAfterProlog(): what FreeInlineInternal() does after FreeProlog():\n looks up the object\u0027s slot and frees it. FreeInlineInUnknownRoot()\n now calls FreeAfterProlog() directly, rather than\n FreeInlineInternal\u003ckNoHooks\u003e(), whose second FreeProlog() did\n nothing.\n- ReallocInPlaceOrMove(): what ReallocInline() does once the request\n is neither an allocation, a free nor too large: resizes the object\n in place if it can, and moves it otherwise. The allocation it moves\n the object to is AllocForRealloc(), which event hooks also hand to\n the early reallocation hook.\n- GetExternalUsableSizeFromMetadata(): what GetExternalUsableSize()\n does for a non-null pointer.\n- ZapBrpQuarantinedObject(): what QuarantineForBrp() does without a\n QuarantineOverrideHook.\n- ReleaseDequarantinedSlot(): how the scheduler-loop quarantine\n releases a purged slot, into the thread cache or batched in its\n BatchFreeQueue. The purge now takes the entry off its list before\n releasing it, rather than after, so that a release that re-enters\n the purge cannot find the entry again.\n\nChange-Id: I20666743027d9194b858150ca4e9c7c64448554a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8492673\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1713016}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2c4ab6adfb4563898f394b9e060e876549d953ad\n" }, { "commit": "747e409971c9de24b21ca88bf890fff9bf2a7ad7", "tree": "dbf9a7644e9ff36019257d4044a353cc020c049f", "parents": [ "1925f3553c0c8e5fb30edaa9f89436ec20a2e811" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Oct 07 03:32:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Oct 07 03:38:10 2026" }, "message": "[PA] Replace FreeFlags::kWith*Hint with typed FreeHint arguments\n\nReplace FreeFlags::kWithSizeHint, FreeFlags::kWithAlignmentHint, and\nFreeFlags::kWithTypeIdHint (and the FreeHintType\u003c...\u003e struct) with\nstrongly-typed hint arguments (FreeSizeHint, FreeAlignmentHint,\nFreeTypeIdHint) constrained by the FreeHint concept.\n\nThis unifies the hinted and unhinted overloads of PartitionRoot\u0027s\nFree*() entry points into a single variadic template:\n template \u003cFreeFlags flags \u003d FreeFlags::kNone, FreeHint... Hint\u003e\nand moves the alignment-adjusted size calculation into\nFreeNoHooksImmediate() so that FreeInlineInUnknownRoot() can call\nFreeInlineInternal\u003ckNoHooks\u003e() directly instead of the out-of-line\nFreeInline\u003ckNoHooks\u003e() when a hint is provided.\n\nNo behavior change.\n\nChange-Id: Ie70b59fb5c34a05fc033fb58e60db729e03930ae\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8522224\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1713015}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0af2c54dcc1d0bc9f8436429800d963cd4736d04\n" }, { "commit": "1925f3553c0c8e5fb30edaa9f89436ec20a2e811", "tree": "305e1169ad541f9639c808a99669ee512b6d1e31", "parents": [ "d79d2991fe0eb274c401d867841492cff69cdeb6" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Mon Oct 05 05:08:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Oct 05 05:14:29 2026" }, "message": "Rename ADVANCED_MEMORY_SAFETY_CHECKS to SANITIZED_OBJECT\n\nThis is a mechanical rewrite change.\n\nRename the `ADVANCED_MEMORY_SAFETY_CHECKS` macro to `SANITIZED_OBJECT`,\n`INHERIT_MEMORY_SAFETY_CHECKS` to `INHERIT_SANITIZED_OBJECT`, and\n`DEFAULT_MEMORY_SAFETY_CHECKS` to `NO_SANITIZED_OBJECT`.\n\nAlso rename `base/memory/advanced_memory_safety_checks.{h,cc}` to\n`base/memory/sanitized_object.{h,cc}` and update remaining\n`AdvancedMemorySafetyChecks` / `advanced_memory_safety_checks`\nidentifiers in `base/`, `partition_alloc/`, and `PRESUBMIT.py`.\n\nHere is the script AI used to rewrite the annotation users:\n```\nimport subprocess\nfiles \u003d [ ... ] # 54 caller files outside base/\nfor f in files:\n with open(f, \"r\") as fp:\n content \u003d fp.read()\n new_content \u003d content.replace(\n \"#include \\\"base/memory/advanced_memory_safety_checks.h\\\"\",\n \"#include \\\"base/memory/sanitized_object.h\\\"\"\n ).replace(\"ADVANCED_MEMORY_SAFETY_CHECKS\", \"SANITIZED_OBJECT\")\n with open(f, \"w\") as fp:\n fp.write(new_content)\nsubprocess.run([\"git\", \"cl\", \"format\"], check\u003dTrue)\n```\n\nTAG\u003dagy\nCONV\u003d1688e889-a808-401a-854c-f80e12b2fe32\n\nBypass-Check-License: Renamed file.\nChange-Id: I60650ea5f59b8ce7c9f28a78c47802fac8fc28cb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8506057\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nOwners-Override: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1710992}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b761f7b645d16671aa6931ae52a185d9d06928b8\n" }, { "commit": "d79d2991fe0eb274c401d867841492cff69cdeb6", "tree": "68a962bbc31995dfdb5f989166f8f49bf802be46", "parents": [ "b21fbb490d360f14df9d95aaef6132d1741716ce" ], "author": { "name": "Pier-Alexandre Bouchard", "email": "pabouchard@google.com", "time": "Fri Oct 02 13:39:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 13:46:11 2026" }, "message": "Revert \"Checked Span: Enable tightened checking\"\n\nThis reverts commit a27e1a2c28881022a9eb7a7d2f0d1e7f90ecafc4.\n\nReason for revert: Caused widespread iOS EarlGrey test crashes across simulator builders (identified by LUCI Bisection: https://ci.chromium.org/ui/p/chromium/bisection/test-analysis/b/4703653093965824, sample build: https://ci.chromium.org/b/8669067950653156817).\n\nNo-Try: true\nChange-Id: I62e4196a7a130ecf225378181ea83f17d5e0db2a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8507374\nOwners-Override: Pier-Alexandre Bouchard \u003cpabouchard@google.com\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nAuto-Submit: Pier-Alexandre Bouchard \u003cpabouchard@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1709981}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 36b2532313c795127f5dcf7d6b703ec0ee6dcbed\n" }, { "commit": "b21fbb490d360f14df9d95aaef6132d1741716ce", "tree": "5fd3bbea6f37023f409dea8eb3010ac5e95a8c6b", "parents": [ "e149680670299a95a7a6084df62c3a6d9072f1b4" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Fri Oct 02 12:04:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 12:09:08 2026" }, "message": "[PA] Check auto partitioning in PartitionIndexFromAllocToken\n\nCurrently, `PartitionIndexFromAllocToken()` can return\n`kPointerPartitionIndex` even when `ENABLE_AUTO_PARTITIONING` is\ndisabled, relying on `Allocator()` to fall back to\n`kDefaultPartitionIndex`.\n\nThis CL moves the `ENABLE_AUTO_PARTITIONING` check into\n`PartitionIndexFromAllocToken()` and guards `kPointerPartitionIndex`\nbehind the buildflag.\n\nBug: 549500187, 477186304\nChange-Id: I6151e58e378d2a3dc8857e2d14a5078998f3ca87\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8506336\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1709933}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a78193eb9893e6be7aa59654a99bd4c42db56be6\n" }, { "commit": "e149680670299a95a7a6084df62c3a6d9072f1b4", "tree": "cfd08a037010e0540ac11c7cfd08d0a142507d0a", "parents": [ "9b3ecf73bcd609f490cc7c07689fe60cf7e645a8" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Fri Oct 02 07:46:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 07:52:37 2026" }, "message": "Reland \"[PA] Consolidate PartitionAlloc TLS into a single structure.\"\n\nThis reverts commit 438d489235fc95769492fdb88920a78acee41f65.\n\nReason for revert: Regression cut by 75% in https://crrev.com/c/8487305\n\nOriginal change\u0027s description:\n\u003e Revert \"[PA] Consolidate PartitionAlloc TLS into a single structure.\"\n\u003e\n\u003e This reverts commit 67b58121286da3189afe0e05570f4e0c70499cf8.\n\u003e\n\u003e Reason for revert: Suspected cause of memory regression\n\u003e\n\u003e Failure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [PA] Consolidate PartitionAlloc TLS into a single structure.\n\u003e \u003e\n\u003e \u003e This CL renames partition_tls.h to tls.h and defines a single\n\u003e \u003e `PartitionTls` structure that holds all thread-unique objects used\n\u003e \u003e within PartitionAlloc. Specifically, it now holds the ThreadCache\n\u003e \u003e pointers and the disallow_allocations flag.\n\u003e \u003e\n\u003e \u003e This consolidation reduces TLS slot usage and minimizes code\n\u003e \u003e duplication. TLS creation remains non-allocating.\n\u003e \u003e\n\u003e \u003e To minimize overhead on allocation and deallocation hot paths:\n\u003e \u003e - Placed scalar flags at byte offset 0 of struct PartitionTls for\n\u003e \u003e D-cache locality.\n\u003e \u003e - Combined thread cache validity and bucket size checks into a single\n\u003e \u003e branch (bucket_index \u003c thread_cache-\u003eactive_bucket_count()) on hot\n\u003e \u003e paths, removing duplicate checks and redundant TLS lookups.\n\u003e \u003e\n\u003e \u003e TAG\u003dagy\n\u003e \u003e CONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\u003e \u003e\n\u003e \u003e Bug: 329027914\n\u003e \u003e Change-Id: If05f8f540281a135eba36aba872df424a4c208be\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8264055\n\u003e \u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e \u003e Reviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\n\u003e \u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1688851}\n\u003e\n\u003e Bug: 329027914\n\u003e Change-Id: Ic0a1771902cd4159e4571c563989e13e15fa0235\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8412606\n\u003e Reviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\n\u003e Commit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\n\u003e Owners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1698073}\n\nBug: 329027914\nChange-Id: Ib8d2a5211fc766697a9e35a585358a281592a10a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8483734\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1709815}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 554afb3648fc97bdd2ffe82ad46847221dc2da04\n" }, { "commit": "9b3ecf73bcd609f490cc7c07689fe60cf7e645a8", "tree": "8af8c81b17533507ecd17eeb66e91cb41cd364fe", "parents": [ "ee2c2f9afa25177e69ebfa0f3394fd6a4e01c289" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Fri Oct 02 07:18:01 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 07:23:49 2026" }, "message": "partition_alloc: Move Flags to partition_alloc_public_constants.h\n\nMove AllocFlags and FreeFlags out of partition_alloc_constants.h into\npartition_alloc_public_constants.h so files that only need these flags\n(such as array_buffer_contents.h) can include a smaller header.\n\nInclude partition_alloc_public_constants.h directly in files that use\nAllocFlags or FreeFlags, and replace partition_alloc_constants.h\nincludes where its constants are no longer needed. Many of these\nmodified files are outside of //base/allocator, so\npartition_alloc_public_constants.h is more appropriate anyway.\n\nTAG\u003dagy\nCONV\u003dd1d1c71f-a023-4057-8123-fa1a368aca3a\n\nChange-Id: I4a46c9c4d6373c6bab72cd276defc987e7f2227d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8470312\nAuto-Submit: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nOwners-Override: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1709792}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f4faac0c922b64133e6fd3c5db6c029a413c76b6\n" }, { "commit": "ee2c2f9afa25177e69ebfa0f3394fd6a4e01c289", "tree": "e7e8096098e317b7d90622736632f269e89fc6fb", "parents": [ "5e6ecff4b592f482c1683dd67b319cbf24191c5c" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Fri Oct 02 06:45:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 06:52:31 2026" }, "message": "Checked Span: Enable tightened checking\n\nThis enables tightened bounds-checking. Checked Span now refers to the\nhidden, originally requested size provided by the caller, and will crash\nif a `base::span` any larger than that is requested. (Exceptions apply,\nspecific to the implementation of PartitionAlloc.)\n\nFixed: 534387022\nChange-Id: Id74f51b31ba2e59c6a5b7889305f54b0476c1340\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8491851\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1709778}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a27e1a2c28881022a9eb7a7d2f0d1e7f90ecafc4\n" }, { "commit": "5e6ecff4b592f482c1683dd67b319cbf24191c5c", "tree": "54e0ec63a799c74c90d739397af1cd4d9ae68aee", "parents": [ "69c064d353a116a6aac89fdd2170051f3b222f9f" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Fri Oct 02 06:42:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 06:47:27 2026" }, "message": "Checked Span: Tighten bounds\n\nChange `IsExtentOutOfBounds()` to use the smuggled size when available,\nproviding a tighter bound on what\u0027s considered in bounds.\n\nBug: 534387022\nChange-Id: I84dcf5c3842022b24acfade6dcd5e68e0cd3d450\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8461864\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1709777}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e64c3f7a5b2bc41a3bb96951e419b7d304b1c3b7\n" }, { "commit": "69c064d353a116a6aac89fdd2170051f3b222f9f", "tree": "ff45afa9d454cc52ec0a6c3557a0b986fb379c97", "parents": [ "dcd4ebe1b0282c8f5c79ef8af7651642e179fc6b" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Fri Oct 02 04:15:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Oct 02 04:21:18 2026" }, "message": "[PA] Fix kDefaultAllocToken in ShimCppAlignedNewNoThrow\n\nhttps://crrev.com/c/8264052 replaced kDefaultPartitionIndex with\nkDefaultAllocToken for default AllocToken parameters, but missed\nShimCppAlignedNewNoThrow. This CL fixes it.\n\nBug: 549500187\nChange-Id: I51dc22c22b03662f842e4a6706ebe961eb420d96\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8505616\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1709714}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d3dfb0a42ba5a569de1d260d193bfddc92a6865b\n" }, { "commit": "dcd4ebe1b0282c8f5c79ef8af7651642e179fc6b", "tree": "9f1cc02eabea3a418305f6c9949c9ebcf7cfe15e", "parents": [ "dc6144ac93b23232ea8d2b931f661a917ad7d4fd" ], "author": { "name": "Marco Bartoli", "email": "marcobartoli@microsoft.com", "time": "Thu Oct 01 21:32:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 01 21:41:50 2026" }, "message": "[PA] Add UncheckedAlignedCalloc() for Rust\u0027s aligned alloc_zeroed()\n\ncrrev.com/c/8480972 makes alloc_zeroed() of the Rust global allocator\nuse UncheckedCalloc() for the allocations that PartitionAlloc\ndirect-maps (larger than 983040 bytes), whose pages are zeroed already,\ninstead of UncheckedAlloc() and memset(), which writes, and faults in,\nevery page. But only when the alignment is at most\nalignof(std::max_align_t): larger alignments need the aligned\nallocation functions, and the allocator shim has no aligned calloc().\n\nAdd allocator_shim::UncheckedAlignedCalloc(n, size, align), backed by a\nnew AllocatorDispatch::aligned_calloc_unchecked_function:\n* PartitionAlloc: the same as AlignedAllocUnchecked(), with kZeroFill,\n which doesn\u0027t zero fresh pages again.\n* Windows heap: WinHeapAlignedMalloc(), then memset(), sharing the\n code of calloc().\n* The allocation event dispatcher and GWP-ASan\u0027s sampling shims handle\n it like the other allocation functions. GWP-ASan shares the code of\n its unchecked calloc() hook, which is now tested too.\n* The other dispatch tables leave it null, like\n aligned_malloc_unchecked_function.\nIts memory is resized and freed like that of UncheckedAlignedAlloc(),\nwith UncheckedAlignedRealloc() and UncheckedAlignedFree().\n\nalloc_zeroed() now uses it for these large allocations when the\nalignment is larger than alignof(std::max_align_t), up to\nkMaxSupportedAlignment. Other allocations run the same code as before.\n\nTime to allocate and free with alloc_zeroed() and an alignment of 64\nwhen the memory isn\u0027t used (Apple M4 Pro, release build, fastest of 2\nalternating runs of a Rust benchmark linked into a C++ executable, so\nthat it uses this allocator):\n\n Size Before After Speedup Page faults\n 983041 bytes 43.7 us 4.5 us 10x 62 -\u003e 2\n 1 MiB 45.6 us 4.6 us 10x 65 -\u003e 2\n 4 MiB 174 us 6.6 us 26x 257 -\u003e 2\n 16 MiB 708 us 15.2 us 47x 1025 -\u003e 2\n 64 MiB 3.31 ms 23.8 us 139x 4097 -\u003e 2\n\nAn alignment of 4096 gives similar results (9-132x). When every page\nis used, it\u0027s still 2-17% faster, since the memory is no longer zeroed\ntwice (by the kernel, then by memset()).\n\nChange-Id: I3cea9397b704635cfc4be908fef26f64f15d4f3c\nBug: 567953858\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8479893\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Łukasz Anforowicz \u003clukasza@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Marco Bartoli \u003cmarcobartoli@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1709409}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0bf32c45ff4bfe7a666e009eb8636289734407b4\n" }, { "commit": "dc6144ac93b23232ea8d2b931f661a917ad7d4fd", "tree": "0a90dc79cd8f66cfd65aa602de38b9c980ef3e63", "parents": [ "9aca3482ad9ef083c372d06dbf7b19e13333a097" ], "author": { "name": "Marco Bartoli", "email": "marcobartoli@microsoft.com", "time": "Thu Oct 01 12:07:48 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Oct 01 12:14:58 2026" }, "message": "[rust] Use UncheckedCalloc() for large alloc_zeroed() allocations\n\nalloc_zeroed() of the Rust global allocator called alloc(), i.e.\nallocator_shim::UncheckedAlloc(), and then zeroed the memory with\nmemset(), because there was no unchecked zeroed allocation function.\nNow that allocator_shim::UncheckedCalloc() exists, use it for the\nallocations that PartitionAlloc direct-maps: those larger than its\nlargest bucket (983040 bytes), with an alignment of at most\nalignof(std::max_align_t).\n\nDirect-mapped allocations always get fresh pages, which are already\nzeroed, so PartitionAlloc doesn\u0027t zero them again. The pages that are\nnever written are then never faulted in, instead of all being written,\nand made resident, by memset(). This applies to all large zeroed\nallocations of Rust code, e.g. vec![0u8; n].\n\nSmaller allocations are unchanged. They usually reuse freed memory,\nwhich has to be zeroed anyway, and UncheckedCalloc() would zero their\nwhole slot rather than only the requested size, which is slower: e.g.\ncalloc() of 16385 bytes (a 20480-byte slot) takes 1.25x as long as\nalloc() + memset().\n\nAdd partition_alloc::IsAlwaysDirectMapped() for this size check, so\nthat //build doesn\u0027t depend on PartitionAlloc\u0027s bucket sizes. Both\nways return zeroed memory, so the check only affects performance.\n\nTime to allocate and free with alloc_zeroed() when the memory isn\u0027t\nused (Apple M4 Pro, release build, fastest of 4 runs of a Rust\nbenchmark linked into a C++ executable, so that it uses this\nallocator):\n\n Size Before After Speedup Page faults\n 983041 bytes 42.8 us 5.4 us 8x 62 -\u003e 2\n 1 MiB 45.5 us 4.7 us 10x 65 -\u003e 2\n 4 MiB 174 us 6.8 us 26x 257 -\u003e 2\n 16 MiB 747 us 15.3 us 49x 1025 -\u003e 2\n 64 MiB 3.24 ms 22.9 us 141x 4097 -\u003e 2\n\nWhen every page is used, it\u0027s still 7-13% faster, since the memory is\nno longer zeroed twice (by the kernel, then by memset()). vec![0u8; n]\ngives similar results.\n\nTests:\n* PartitionAllocTest.IsAlwaysDirectMapped: PartitionAlloc direct-maps\n these sizes, for aligned and unaligned allocations.\n* RustStaticTest.RustAllocZeroed: alloc_zeroed() returns zeroed memory\n for sizes on both sides of the threshold, after freeing memory with\n non-zero bytes that the allocator can reuse.\n\nBug: 567809069\nChange-Id: Id3f5e66e8eae74dd2bb1f7deb1e5f7cfd25e8891\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8480972\nReviewed-by: Łukasz Anforowicz \u003clukasza@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Marco Bartoli \u003cmarcobartoli@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1708881}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 82718f99a64c0fe65482b0032f4c02fb3f7aa545\n" }, { "commit": "9aca3482ad9ef083c372d06dbf7b19e13333a097", "tree": "64db03d53b3ea893d4510de343bbc8f17ad06810", "parents": [ "60f68266052d3478e20cece9c770b7bda71fa80f" ], "author": { "name": "Michał Kaczmarczyk", "email": "mickaczmarczyk@google.com", "time": "Wed Sep 30 12:10:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 30 12:16:10 2026" }, "message": "Disable use_checked_span under MSan.\n\nUpdates the use_checked_span build flag to evaluate to false when\nis_msan is true, matching the existing behavior for ASan, UBSan, and\nTSan.\n\nBug: 567860311\nChange-Id: I281c8d0d0e6758a991277b942d3d0c741c2e412e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8484401\nOwners-Override: Michał Kaczmarczyk \u003cmickaczmarczyk@google.com\u003e\nReviewed-by: Mikołaj Wałachowski \u003cmwalachowski@google.com\u003e\nCommit-Queue: Michał Kaczmarczyk \u003cmickaczmarczyk@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1707986}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 27c498312fe1572ce81a55daa609c87a499d306c\n" }, { "commit": "60f68266052d3478e20cece9c770b7bda71fa80f", "tree": "e20b8fd7d8a173f4770f14e72cb652f70cf7dce4", "parents": [ "4dd6a9f723c6ffdb44147b073ea23b6f9a0d5751" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Sep 30 07:50:01 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 30 07:59:06 2026" }, "message": "[PA] Reduce kMaxThreadCacheIndex to 1 when auto-partitioning is off.\n\nIn default production builds (!PA_BUILDFLAG(ENABLE_AUTO_PARTITIONING)),\nonly a single ThreadCache per thread (kDefaultRootThreadCacheIndex \u003d 0)\nis ever used. Reducing kMaxThreadCacheIndex from 4 to 1 in those builds\ncuts per-thread ThreadCache storage allocation by 4x (e.g., from 6,016\nbytes to 1,504 bytes on 64-bit official Android builds) and eliminates\nredundant loop iterations across unused indices during purge and thread\nteardown.\n\nTAG\u003dagy\nCONV\u003d1688e889-a808-401a-854c-f80e12b2fe32\n\nBug: 467243745, 561995364\nChange-Id: I47e2d0e9104bbc7f6a8f51a5bfe63996e0768d50\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8487305\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1707853}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2040c5f2ff37ac408475e1d9c49c327cd9b21d62\n" }, { "commit": "4dd6a9f723c6ffdb44147b073ea23b6f9a0d5751", "tree": "a8724fdcb5cb744e669cb213ea4a6fbcc02fd92c", "parents": [ "1cc29fac8004c1c29c18ce6d1eba12442fbeeac5" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Wed Sep 30 06:09:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 30 06:14:03 2026" }, "message": "partition_alloc: Use inline constexpr for more public constants\n\nIn partition_alloc_public_constants.h, mark `kGiB` and the super page\nconstants as `inline constexpr` instead of just `constexpr`.\n\nWithout `inline`, namespace-scope `constexpr` variables have internal\nlinkage, which can result in duplicate copies across translation units\nif ODR-used (e.g. passed by const reference) and potential ODR\nviolations when used in inline functions or templates. Using\n`inline constexpr` ensures a single definition across all translation\nunits.\n\nChange-Id: I7b1d311b292917026c69188f46b8ab35afbce476\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8478113\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1707812}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 48f63521e57d0912fc18d7609d4c76e3d778a946\n" }, { "commit": "1cc29fac8004c1c29c18ce6d1eba12442fbeeac5", "tree": "8f05e677fb28e5664778033c1b829380ff5b3603", "parents": [ "f92038806c2403118ea2a71955dad606ec53a48a" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Sep 30 05:27:30 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 30 05:32:16 2026" }, "message": "[PA] Use `kNoOverrideHooks` explicitly for the internal partition\n\nThe internal partition allocates with a named constant,\nkInternalAllocFlags \u003d kNoHooks | kNoOverrideHooks, instead of kNoHooks\nalone. It holds PartitionAlloc\u0027s own data (e.g. thread caches), so no\nhook may observe or serve its allocations.\n\nNo change in behavior: today kNoHooks already skips the override\nhooks. I plan to remove this implicit relation soon and this CL is the\nfirst step.\n\nTAG\u003dagy\nCONV\u003d73ddf428-b5d7-45a3-b839-ec3d55cef35c\n\nChange-Id: I0308524e0069c52ea8f79a405b70393a732a3f15\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8486447\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1707793}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8ff9601dafe602d186399c3c1b32a34bfabcd4ee\n" }, { "commit": "f92038806c2403118ea2a71955dad606ec53a48a", "tree": "5e0cb35ebb5adf88efe7179f4b42dbc6b9a92686", "parents": [ "4f4b9e4df36d75a7f8b8773faff03ab298ff6703" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Sep 30 05:27:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 30 05:31:16 2026" }, "message": "[PA] Pack BucketSizeDetails into one word and pass it by value\n\nBucketSizeDetails becomes a class that packs `bucket_index` and\n`slot_size` into one 64-bit word. It is passed by value everywhere\ninstead of by const reference. No change in behavior.\n\nThis change allows us to save number of registers usage per function\ncall.\n\nTAG\u003dagy\nCONV\u003d73ddf428-b5d7-45a3-b839-ec3d55cef35c\n\nChange-Id: I80989d3b7ec95dd19839bc6441a0691c65a054d8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8483735\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1707792}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cf4459b3059ac20e60d38e8b5ec85031b14c27cb\n" }, { "commit": "4f4b9e4df36d75a7f8b8773faff03ab298ff6703", "tree": "65b9c164146c1e89d3556e1a243b7fe18814139d", "parents": [ "e7ef85c263a6a70068983a3bd8011de63eb9b6a5" ], "author": { "name": "Egor Pasko", "email": "pasko@chromium.org", "time": "Tue Sep 29 10:13:10 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 29 10:18:17 2026" }, "message": "cleanup: Maintain pointers to stack as uintptr_t for stack scanning\n\nTL;DR:\n This is a mostly LLM-generated refactor to adjust some return types\n for consistency. No changes in semantics expected.\n\nOur _conservative_ stack scanning (upcoming with MiracleObject project)\nneeds to inspect every pointer-size-aligned location in a given range to\nwhat the memory allocator knows about.\n\nThe range of addresses on the stack is determined by two functions:\n```\n uintptr_t* GetStackPointer();\n void* GetStackTop();\n```\n\nInterestingly, the return types are not matching. The void* is a natural\nchoice in some sense because this is what POSIX APIs return. On the\nother hand, the `uintptr_t*` might be coming from the idea that when we\nwalk the stack we inspect every location as an unsigned integer.\n\nHowever, we did not avoid integer arithmetics on those return values\nlike in GetStackTop():\n```\n PA_UNSAFE_TODO(reinterpret_cast\u003cuint8_t*\u003e(base) + size);\n```\n\nIn upcoming changes we need to compare a stack pointer and replace it\nwith a larger one. Conceptually these stack pointers are closer to\nintegers than pointers. The `uintptr_t*` as something that points to a\nplace on the stack is especially confusing.\n\nLet\u0027s instead have the same type for both positions on the stack:\n```\n uintptr_t GetStackPointer();\n uintptr_t GetStackTop();\n\n class StackVisitor {\n public:\n void VisitStack(uintptr_t stack_ptr, uintptr_t stack_top) \u003d 0;\n };\n```\n\nAlso re-enable stack_unittest.cc, which remains in the codebase, but\nsomehow got removed from GN.\n\nBug: 564950844\nChange-Id: If0dd83926c48208faa923cf0674c618dfc382349\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8458953\nCommit-Queue: Egor Pasko \u003cpasko@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1706914}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 86faf64c0ae5ca48a71c6b368bba2d25c7348454\n" }, { "commit": "e7ef85c263a6a70068983a3bd8011de63eb9b6a5", "tree": "58d12a0f552bfcea446c40c88f3a06dca3d85a89", "parents": [ "9d9116ce65c66b30d4bb2fdc90bb1775d5e22cc6" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Tue Sep 29 08:25:27 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 29 08:33:54 2026" }, "message": "PA: Enable PattitionAllocHooks if MEMORY_TOOL_REPLACES_ALLOCATOR\u003d1\n\nIf MEMORY_TOOL_REPLACES_ALLOCATOR\u003d1, PartitionAlloc directly invokes\nmalloc() or aligned_malloc() or posix_memalign(), ...\nSo memory allocations (and also deallocations) look just system\nallocator\u0027s. There is no way to obtain information about Partition-\nRoot-s. This makes it not possible for clients to see whether\nthe PartitionRoot-s are BRP-enabled or not.\n\nBug: crbug.com/555036300\nChange-Id: Ie273fea736cb70936f165c0dfbe89ef0b55a1afa\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8367005\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1706850}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a16fff27eca74002eac67cd70e075cf83565200d\n" }, { "commit": "9d9116ce65c66b30d4bb2fdc90bb1775d5e22cc6", "tree": "ee8f1c4631a0e70a35c8cce5c3027d762d0e9f2a", "parents": [ "40ecc50518d3e23df99fdd6412f3cd3635da7573" ], "author": { "name": "Martin Kong", "email": "martinkong@google.com", "time": "Mon Sep 28 18:14:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Sep 28 18:20:20 2026" }, "message": "Store \"pseudo stack top\" in the StackTopRegistry on Android\n\nInstead of using GetStackTop() to compute the real stack top during\nstartup, which is quite slow, we want to compute and store a\n\"pseudo stack top\". The idea is that we can approximate such a\nstack top by calling GetStackPointer() early at entry points into the\nChrome native library on the UI thread. There are two good entry\npoints into the message loop: NonDelayedLooperCallback and\nDelayedLooperCallback. Running any native message loop task on\nUI thread requires running through these entry points first.\nThese entry points are called by the Android Looper, which listens for\nupdates and runs callbacks in an infinite loop. Since the Looper\nstarts running before Chrome code even gets loaded, and the Looper\nnever returns, taking a stack address next to it would separate the\nparts of Chrome stack from the parts of Android Framework stack.\n\nTo summarize, we call GetStackPointer() at the beginning of\nNonDelayedLooperCallback and DelayedLooperCallback, and store the\nvalue in the StackTopRegistry. We keep the highest address we have\nseen so far, and we only update the StackTopRegistry if we see an\neven higher value, which should be very rare.\n\nThe design doc for this CL is written by pasko@ and can be found here:\nhttps://docs.google.com/document/d/1chca6OSjqaMaR7uqEiJMc-Rppq_Mkq2gTtwl2yJ3-jI\n\nTesting: Ran out/Release/bin/trichrome_chrome_google_bundle run\n--args\u003d\u0027--enable-features\u003dPartitionAllocSchedulerLoopQuarantine,PartitionAllocWithAdvancedChecks:enabled-processes/all-processes\u0027,\nand the app starts up successfully.\nNot sure if there is anything else to test.\n\nBug: 518605818, 564950844\nChange-Id: I2430e09e77a44fc0378abb688bd73e1c6960f93a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8415278\nReviewed-by: Egor Pasko \u003cpasko@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Martin Kong \u003cmartinkong@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1706285}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 88307a9b38cfc504f97a869886485df3731dbbfe\n" }, { "commit": "40ecc50518d3e23df99fdd6412f3cd3635da7573", "tree": "c3dff0ad9ac929a3100232a1ad41dcac1d8a134b", "parents": [ "17cdbbbabef0e41ed21badf3576d404cfe775a8a" ], "author": { "name": "Andreas Haas", "email": "ahaas@chromium.org", "time": "Mon Sep 28 16:24:33 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Sep 28 16:28:53 2026" }, "message": "[partitionalloc] Delete dead code\n\nBug: 40055619\nChange-Id: I295ceb8005082437879ea4a9c54221c7dc0f04c1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8471437\nReviewed-by: Lei Zhang \u003cthestig@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1706189}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e0c6ce5174a7c99078558ec644a34d750f886f80\n" }, { "commit": "17cdbbbabef0e41ed21badf3576d404cfe775a8a", "tree": "792f8c6e85b2ee5ffa2d02fd7b440d8b4f1ffdc1", "parents": [ "79fd9e456294baf7c67c4853c0b290649d772932" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Sep 28 03:02:26 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Sep 28 03:08:09 2026" }, "message": "partition_alloc: Avoid \u003calgorithm\u003e in partition_alloc_forward.h\n\nAdd integral_max.h to provide a consteval IntegralMax() helper for\nsize_t values in namespace partition_alloc::internal. Use IntegralMax()\nin partition_alloc_forward.h to compute kAlignment instead of\nstd::max(), removing the cxx_wrapper/algorithm.h include and reducing\ntransitive \u003calgorithm\u003e includes from raw_ptr.h.\n\nThen do IWYU to add missing \u003calgorithm\u003e includes to files that relied on\nthe transitive include.\n\nTAG\u003dagy\nCONV\u003dd1d1c71f-a023-4057-8123-fa1a368aca3a\n\nChange-Id: I02147a2583ea5b68f183f1812df1f7a7e21cd1ef\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8446788\nAuto-Submit: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1705811}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2b001d85d0ec0d112deaae81268f66961e63b911\n" }, { "commit": "79fd9e456294baf7c67c4853c0b290649d772932", "tree": "98bea6e45517e8742070c90f1656c7c9545e2abc", "parents": [ "58cd8b2e09c98334b2d3196742e2091253d64171" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Fri Sep 25 19:20:58 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 25 19:42:14 2026" }, "message": "partition_alloc: Split out constants from partition_alloc_constants.h\n\nMove several constants out of partition_alloc_constants.h into\npartition_alloc_public_constants.h to reduce transitive include\ndependencies from raw_ptr.h.\n\nWith these constants moved to a public header, use the new header in\nplace of partition_alloc_constants.h where possible. Then do IWYU to fix\nthe build.\n\nTAG\u003dagy\nCONV\u003d26c7b74f-941c-4ae0-bf84-4dcac323d067\n\nChange-Id: I0d31489bb0a554a4cd69dfc734457968a067f9f1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8436298\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nOwners-Override: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1705041}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 606da26eafdbed40a823f64eda2c3b3d52248a8a\n" }, { "commit": "58cd8b2e09c98334b2d3196742e2091253d64171", "tree": "0fba5c7f698199fe5e5c5b8f1cc7be4d4db7cc44", "parents": [ "7d32155483e455df1a39e81158160b7cdd68f098" ], "author": { "name": "Kramer Ge", "email": "fangzhoug@chromium.org", "time": "Thu Sep 24 18:49:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Sep 24 18:55:31 2026" }, "message": "[Partition Alloc]Restrict ASLR mask for ARM64 ChromeOS\n\nOn ARM64 ChromeOS devices, /proc/\u003crenderer\u003e/maps shows the address space\nis 39 bit. This is configured in kernel:\nkernel/v*/chromeos/config/chromeos/arm64/common.config\n\nThis results in 512GB virtual address space. Due to ASLR, partition\nalloc is scattered around this space, leaving the address space\nfragmented. V8 sandbox allocation fails to fully reserve\n128GB+64GB*2\u003d256GB and hence falls back to 64GB partially reserved.\n\nAlso limit the kPoolMaxSize to 8GiB.\n\nTo make v8 sandbox fully reserved, this and https://crrev.com/c/8352330\nare both required.\n\nBug: b/537767842\nChange-Id: Ie01504c8bb01e481bca14f9deffa763b5165475f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8417967\nCommit-Queue: Kramer Ge \u003cfangzhoug@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1704471}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1e55346e35defc741624e519dd3b50395ab8c84e\n" }, { "commit": "7d32155483e455df1a39e81158160b7cdd68f098", "tree": "e1b066ef830b5bc0e725f7cac34ce24878ec391a", "parents": [ "cb2e081ed25370358a8cf53fb0382fc1b38adcc6" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Thu Sep 24 09:54:05 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Sep 24 09:59:54 2026" }, "message": "Promote pointer count underflow DCHECK to PA_CHECK in InSlotMetadata\n\nChanges the underflow check following the pointer count decrement from\nPA_DCHECK to PA_CHECK to ensure underflows are caught in release builds.\n\nThis is just hardening, we have no reason to believe that this should\never be firing.\n\nBug: 562509433\nChange-Id: Ie4956d54eb32669a21a1950f9cdefb42b4f3235e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8457943\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1704168}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1c8158a9d7b55c16e7a17075448f354ae384f1d6\n" }, { "commit": "cb2e081ed25370358a8cf53fb0382fc1b38adcc6", "tree": "9d9606b0aa1e9a6be99f69bbf054548a5879ea78", "parents": [ "6e87f6fbb73607878dcbf66021a71f890adee1cd" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Thu Sep 24 07:32:13 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Sep 24 07:41:19 2026" }, "message": "Zap usable size in scheduler loop quarantine\n\nPreviously, the quarantine zapped the entire slot size for\nMiracleObject. This simplifies the logic to always zap the slot usable\nsize regardless of the quarantine target.\n\nThis prevents zapping of important metadata like the ref count for\nraw_ptr (which has to be zero when zapping) thus it remains at zero\nwhile in the quarantine and it will be possible to determine if it was\nstored again into a raw_ptr while it was in the quarantine.\n\nBug: 562509433\nChange-Id: I5aa92fa0a71d3706bc6f8d5f67fad8399b43ad36\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8455724\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1704090}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0ae3393ee4bd8618e5d6358ddd1dc37c248da116\n" }, { "commit": "6e87f6fbb73607878dcbf66021a71f890adee1cd", "tree": "b786aeed0c2736597aeb79218a1ac0f60758ea86", "parents": [ "ef07e421fcfb2a0243a6e02f50764277eca205c1" ], "author": { "name": "Andreas Haas", "email": "ahaas@chromium.org", "time": "Thu Sep 24 04:56:42 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Sep 24 05:06:16 2026" }, "message": "Allow larger JS ArrayBuffer allocations in PartitionAlloc\n\nAllow allocating larger JS ArrayBuffers directly without needing the\nworkaround of allocating a WebAssembly memory.\n\nTo support allocations up to ~16 GiB (16 GiB - kSuperPageSize) for\nArrayBuffers without adding runtime overhead for normal allocations, we\nretain the normal constexpr bounds check against MaxAllocationSize() on\nthe fast path. Only if that check fails do we check whether the\nallocation has AllocFlags::kAllowGigaAllocations and occurs in a\npartition configured with PartitionOptions::allow_giga_allocations,\nchecking against the higher MaxGigaAllocationSize() limit only then.\n\nTAG\u003dagy\nCONV\u003dde69a7fe-0685-4882-85dc-5f4d8c93a314\n\nBug: 40055619\nChange-Id: I05a4343748fecd72c37a50f4d281041c1e4d5590\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8402423\nCommit-Queue: Andreas Haas \u003cahaas@chromium.org\u003e\nReviewed-by: Justin Novosad \u003cjunov@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1704039}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9e1544f05431785d27f459b8ca6dabef1e2208f3\n" }, { "commit": "ef07e421fcfb2a0243a6e02f50764277eca205c1", "tree": "ae9fbe68840c7e5fd4034f9202fcf1c735e3b2e3", "parents": [ "a0f30e381c6e132215a0c8d809fd08ff4cdad244" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Sep 21 23:01:35 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Sep 21 23:08:11 2026" }, "message": "partition_alloc: Move PA_DEBUG_DATA_ON_STACK() to its own file\n\nPA_DEBUG_DATA_ON_STACK() lives in partition_alloc_check.h, which is\ntransitively included in 70% of all translation units. Since\nPA_DEBUG_DATA_ON_STACK() is only used within PartitionAlloc code, move\nit and related code into a new debug_data_on_stack.h, and only include\nthe new header where needed to reduce the compile size.\n\nChange-Id: Ie216efde43ca3ba21f55e8ea46f15bf36a0549ff\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8398143\nReviewed-by: Anton Bikineev \u003cbikineev@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1702152}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: fd40784064ab95c4376052bd38554d001c8f822e\n" }, { "commit": "a0f30e381c6e132215a0c8d809fd08ff4cdad244", "tree": "e2a9bf31c8ad57e000caff74cdb7b1e86d2b884f", "parents": [ "391865cb9a90a8bd7339adce2e1a1031eec0d0ab" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Fri Sep 18 16:21:58 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 18 16:27:42 2026" }, "message": "partition_alloc: Remove unused code from partition_alloc_constants.h\n\n- All users of enum class PoolHandleMask are gone.\n- Nobody calls MaxSuperPagesInPool() since they can just access\n `kMaxSuperPagesInPool` directly.\n\nChange-Id: I74c0f16484586d8ea70c1693d1dc71c594bb7d55\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8417503\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1700839}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6ad5d6f91d35a1e8e8a3e3d9b9c5ac67d8608b42\n" }, { "commit": "391865cb9a90a8bd7339adce2e1a1031eec0d0ab", "tree": "78862ba4995655118fe67497d73399cf3a8d0208", "parents": [ "3fe238c9a355c2f872f745e48c649b652afe4348" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Fri Sep 18 06:16:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 18 06:20:39 2026" }, "message": "Checked Span: Smuggle requested size\n\nThis CL temporarily breaks `SpanTest.CheckedSpanCrashes` when\n`PA_BUILDFLAG(CHECKED_SPAN_HAS_METADATA_SUPPORT)` is set.\n\nWhen build support for using `InSlotMetadata` is enabled, Checked Span\nwill smuggle the caller\u0027s requested size into the last 4 bytes of the\nslot\u0027s usable space. This space is opaquely withheld from the \"external\"\n`GetUsableSize()`.\n\nNote that these changes are confined to PartitionAlloc\u0027s core; to get\nChecked Span to actually use them, we\u0027ll modify `bounds_checks.cc`.\n\nBug: 534387022\nChange-Id: I93171d1b967721acd3eca66a9b1eed60183a6fea\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8319729\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1700510}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: bb853d4472bec783c4e01febfb43318e22194219\n" }, { "commit": "3fe238c9a355c2f872f745e48c649b652afe4348", "tree": "3d9d451bfcfdd95666fd48df9dabfacf66c4c128", "parents": [ "d9c413368b7c05399462a9a4aeb0a91c1c042429" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Fri Sep 18 01:38:35 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 18 01:42:27 2026" }, "message": "Add arthursonzogni@chromium.org to PartitionAlloc OWNERS\n\nPropose arthursonzogni@chromium.org to help with code reviews in\nPartitionAlloc.\n\nBug: None\nChange-Id: Icfa4b7fec0a6ee4935c10fc43b16e756d59a0a2e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8421361\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1700381}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 45c3131af9cf9e669bd74d785ee6d9a0c2f0a09c\n" }, { "commit": "d9c413368b7c05399462a9a4aeb0a91c1c042429", "tree": "d264f0f871cf6ffc8fe3b8b0aec5f494e2c5a2ec", "parents": [ "19e7ac6b5e9c220684165cb27c2b6d39541a1873" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Wed Sep 16 14:25:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 16 14:32:43 2026" }, "message": "Make free a no-op during signal-driven shutdown on ChromeOS\n\nOn ChromeOS, exits triggered by signals bypass the standard shutdown\npath and can lead to shutdown hangs in PartitionAlloc. This change\ninvokes MakeFreeNoOp() in ExitHandler::ExitWhenPossibleOnUIThread on\nChromeOS to mitigate these hangs.\n\nAdditionally, InsertNoOpOnFreeAllocatorShimOnShutDown() is updated to be\nidempotent so that multiple invocations return early instead of failing\nan assertion. This is just in case there is some path from\nExitWhenPossibleOnUIThread to BrowserMainImpl::Shutdown, which I wasn\u0027t\nable to find.\n\nBug: 561483162\nChange-Id: If68422330b3a23cf19c6f4afad6ec1d437eaf741\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8409759\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1698917}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7ab2e5d16fd447fe1a2a6b060efdb3b3382aa501\n" }, { "commit": "19e7ac6b5e9c220684165cb27c2b6d39541a1873", "tree": "53d6c3a7927d7bb8917b6e993a6608f900ef41df", "parents": [ "f6c416cfa90ddf7dd582dc4c60e63c1d77ce2ebc" ], "author": { "name": "Matt Stark", "email": "msta@google.com", "time": "Wed Sep 16 05:11:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 16 05:19:17 2026" }, "message": "Allowlist any target which has a public header include a private header\n\nThis is part of the check_includes_strict lsc (https://docs.google.com/document/d/1zYUC_zuFrZozo9ogFHcf0Rzkiw9W7RVnaY-1fzfQ0AM/edit?usp\u003dsharing)\n\nThese are more complex situations that will require nontrivial changes.\n\nGenerated via:\ngn check out/linux-x64 --error-limit\u003d999999 \u003e /tmp/errors.txt\ngn edit \"set check_includes_strict:expr CHECK_INCLUDES_STRICT_PUBLIC_INCLUDES_PRIVATE\" $(gn refs out/linux-x64 --default-toolchain $(grep \"Public headers cannot include private headers of the same target\" /tmp/errors.txt | egrep -o \"//[^:]*\" | sort | uniq))\n\nBug: 556959580\nChange-Id: I903434ed32aad05fb3c27bc34fbd82f36a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8413978\nAuto-Submit: Matt Stark \u003cmsta@google.com\u003e\nCommit-Queue: Matt Stark \u003cmsta@google.com\u003e\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Matt Stark \u003cmsta@google.com\u003e\nReviewed-by: Junji Watanabe \u003cjwata@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698638}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 53fc0e5d3871e25e7e599a3fe66f46392c9b3a52\n" }, { "commit": "f6c416cfa90ddf7dd582dc4c60e63c1d77ce2ebc", "tree": "41f43c51946d71d6a148ac1ba53da70fbb0649bc", "parents": [ "fe164fa9be04918d0e090fad8e9ae2cb308fa1ac" ], "author": { "name": "Foromo Daniel Soromou", "email": "koretadaniel@chromium.org", "time": "Tue Sep 15 20:40:31 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 20:45:48 2026" }, "message": "Add orphan worker_thread_unittest.cc in it BUILD.gn\n\nThe CL https://crrev.com/c/4952876 renamed the file\nworker_thread_unittest.cc, and then renamed it back in the CL\nhttps://crrev.com/c/5783349 but without adding it back in it BUILD.gn\n\nBug: None\nChange-Id: I14209604afa16b5a885e8308205a68dd194e05c7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8371582\nReviewed-by: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCommit-Queue: Foromo Daniel Soromou \u003ckoretadaniel@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1698354}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f62b9b9d32cef09b6a03015438eac7bb0d0dd1a3\n" }, { "commit": "fe164fa9be04918d0e090fad8e9ae2cb308fa1ac", "tree": "0be212747b8dd03422bef31a07827aed509796ad", "parents": [ "068786910975b708c50d856874469092abcc774e" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Sep 15 18:43:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 19:02:07 2026" }, "message": "partition_alloc: Move PartitionRootLock() forward decl to its own header\n\nMove the forward declaration for PartitionRootLock() from\npartition_alloc_forward.h to a new partition_root_internal_forward.h.\nInclude it where needed. Then stop including partition_alloc_forward.h\nin headers where it is not needed.\n\nChange-Id: Ic0b6fae74eafc59a20dff03e3e4dd49978f4dba0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8405105\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1698266}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7ebd5ee0f570bc686fd7b86945e1469848763538\n" }, { "commit": "068786910975b708c50d856874469092abcc774e", "tree": "a49c0aadeef3eab00bf67975f95660df0628f67f", "parents": [ "1f6b7be2e356e04bbb108fa9edf727a80573db62" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Sep 15 18:39:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 18:47:30 2026" }, "message": "Remove superfluous includes for PA\u0027s component_export.h from headers\n\nPA headers that do not export do not need component_export.h.\n\nBug: 40318405\nChange-Id: I080085be9d4fe54975805dc7faac095c1296f4c3\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8400961\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698264}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c5b72e181cd6c345dd7831f96b36d9a055c6ea0f\n" }, { "commit": "1f6b7be2e356e04bbb108fa9edf727a80573db62", "tree": "fa26112c1fca8c3533e183b7444adc9b7d12b9ec", "parents": [ "dd0036d9775c7103ff36a0f9fc8bfe8740c45e0f" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Sep 15 17:56:41 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 18:01:51 2026" }, "message": "Spanification of base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr_unittest.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known. The original\npatch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with jetski-cli and at last manually refined\n\nOriginal patch: patch_11.txt\n\nBug: 501143531\nChange-Id: I96ab1b60214b1e67bb7bb8e2142e169b77250452\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8359808\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698240}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8c01429e711254733c42aaacce9e6c097e3c09d0\n" }, { "commit": "dd0036d9775c7103ff36a0f9fc8bfe8740c45e0f", "tree": "236acf6b93ac81e49e4086b9ad18b860c805ff71", "parents": [ "8e376eee0206c80c1f4bc52c1c4eb98c7fdb1240" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Sep 15 17:38:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 17:43:09 2026" }, "message": "Spanification of partition_alloc/pointers/raw_ptr_unittest.cc, etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known. The original\npatch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with jetski-cli and at last manually refined\n\nOriginal patch: patch_15.txt\n\nBug: 501143531\nChange-Id: Ibd6153f4d6a275e5b8c3b3fa5dae177f6a8f53b1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8360269\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698233}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 804c07d0a5fa54c7a69fe1e7a726f03cfa89d708\n" }, { "commit": "8e376eee0206c80c1f4bc52c1c4eb98c7fdb1240", "tree": "402be127ae78f464b62cde52cc659d405cf4ee99", "parents": [ "b20227957a154343c5b10d3f4c4bb1e8527f559b" ], "author": { "name": "Alex Mitra", "email": "alexmitra@chromium.org", "time": "Tue Sep 15 14:27:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 14:35:25 2026" }, "message": "Revert \"[PA] Consolidate PartitionAlloc TLS into a single structure.\"\n\nThis reverts commit 67b58121286da3189afe0e05570f4e0c70499cf8.\n\nReason for revert: Suspected cause of memory regression\n\nFailure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\nOriginal change\u0027s description:\n\u003e [PA] Consolidate PartitionAlloc TLS into a single structure.\n\u003e\n\u003e This CL renames partition_tls.h to tls.h and defines a single\n\u003e `PartitionTls` structure that holds all thread-unique objects used\n\u003e within PartitionAlloc. Specifically, it now holds the ThreadCache\n\u003e pointers and the disallow_allocations flag.\n\u003e\n\u003e This consolidation reduces TLS slot usage and minimizes code\n\u003e duplication. TLS creation remains non-allocating.\n\u003e\n\u003e To minimize overhead on allocation and deallocation hot paths:\n\u003e - Placed scalar flags at byte offset 0 of struct PartitionTls for\n\u003e D-cache locality.\n\u003e - Combined thread cache validity and bucket size checks into a single\n\u003e branch (bucket_index \u003c thread_cache-\u003eactive_bucket_count()) on hot\n\u003e paths, removing duplicate checks and redundant TLS lookups.\n\u003e\n\u003e TAG\u003dagy\n\u003e CONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\u003e\n\u003e Bug: 329027914\n\u003e Change-Id: If05f8f540281a135eba36aba872df424a4c208be\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8264055\n\u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e Reviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\n\u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1688851}\n\nBug: 329027914\nChange-Id: Ic0a1771902cd4159e4571c563989e13e15fa0235\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8412606\nReviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\nCommit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\nOwners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698073}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 438d489235fc95769492fdb88920a78acee41f65\n" }, { "commit": "b20227957a154343c5b10d3f4c4bb1e8527f559b", "tree": "3c2ad8a1655c99e2fe887273109ec41672ce2f21", "parents": [ "25a216913163b3a8a7c12980909ee0239064e78f" ], "author": { "name": "Alex Mitra", "email": "alexmitra@chromium.org", "time": "Tue Sep 15 14:27:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 14:34:15 2026" }, "message": "Revert \"[PA] Replace largest_active_bucket_index_ with active_bucket_count_\"\n\nThis reverts commit 75f790d6fca4e88282c5d68c8f0faa40c45022c7.\n\nReason for revert: Parent CL is suspected cause of memory regression\n\nFailure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\nOriginal change\u0027s description:\n\u003e [PA] Replace largest_active_bucket_index_ with active_bucket_count_\n\u003e\n\u003e This CL renames `largest_active_bucket_index_` to `active_bucket_count_`\n\u003e in `ThreadCache` and `ThreadCacheRegistry`, and optimizes hot-path\n\u003e validity and bucket bounds checks in PartitionAlloc (`bucket_index \u003c\n\u003e tcache-\u003eactive_bucket_count()`).\n\u003e\n\u003e This makes use of zero-initialized `ThreadCache` safer - it simply\n\u003e denotes there is no active bucket and routes every allocation to the\n\u003e global root instead.\n\u003e\n\u003e TAG\u003dagy\n\u003e CONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\u003e\n\u003e Change-Id: Ie599f94695b8f5d1662da26f5efd2ad9fa6b021a\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8254723\n\u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1690469}\n\nChange-Id: I399006f53b684b1575abf5ffe32eae791e4fa03f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8408627\nOwners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\nReviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1698072}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7722d5682e81c10e435d72e0b4a6ed1fc67853a9\n" }, { "commit": "25a216913163b3a8a7c12980909ee0239064e78f", "tree": "bb7db4d9e0c9f4c6fdcc534259267b4026268399", "parents": [ "0fb0e3e45aeab84781a0c515298b40363f2bf312" ], "author": { "name": "Alex Mitra", "email": "alexmitra@chromium.org", "time": "Tue Sep 15 14:25:53 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 14:33:11 2026" }, "message": "Revert \"[PA] Introduce PartitionTlsRegistry to track PartitionTls instances\"\n\nThis reverts commit 33ce22068bdb197fc227e9313a5d49432b30bd6b.\n\nReason for revert: Dependent on CL chain suspected to cause memory regression\n\nFailure Link: https://pinpoint-dot-chromeperf.appspot.com/job/157bfe49690000\n\nOriginal change\u0027s description:\n\u003e [PA] Introduce PartitionTlsRegistry to track PartitionTls instances\n\u003e\n\u003e With this, we can iterate through active `PartitionTls` members.\n\u003e\n\u003e Change-Id: Id7b0ed89c768cf70b351e00e6ab521377c78f372\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8366011\n\u003e Commit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\n\u003e Reviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1695581}\n\nChange-Id: I5e7d58532c3789beb8433234c157057ede2575e5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8413365\nOwners-Override: Anna Tsvirchkova \u003catsvirchkova@google.com\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nReviewed-by: Mateusz Zbikowski \u003czbikowski@google.com\u003e\nCommit-Queue: Alex Mitra \u003calexmitra@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1698070}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9467d08d9e085700a4e184f5ff22568291b718eb\n" }, { "commit": "0fb0e3e45aeab84781a0c515298b40363f2bf312", "tree": "a584889f216e30bf4bd4ceac065b78da7bcb294f", "parents": [ "59c8c4f88fe20470be030c106f361d719127d068" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Sep 15 06:07:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 15 06:11:25 2026" }, "message": "PA: `const SlotSpanMetadata*` to `...BucketSizeDetails()`\n\nGetting a `BucketSizeDetails` doesn\u0027t mutate the `SlotSpanMetadata`.\nMake it const.\n\nChange-Id: Id7888dc8d416228409c2017c0e1bd407204c7c8a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8397647\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1697847}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7d7f989b3b98f0b79352c2b99bb22eb45fc14801\n" }, { "commit": "59c8c4f88fe20470be030c106f361d719127d068", "tree": "df7784ed3e3039ee7f1b0914ed3f2ed74e1c2e4a", "parents": [ "14f58fb57beeaa751d8b917ca66d42cdeb107da3" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Fri Sep 11 18:47:51 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 11 18:56:09 2026" }, "message": "Spanification of partition_alloc_base/cpu.cc, etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 501143531\nChange-Id: I94df85634204591c7d552b6b8b64be6f9e402359\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833057\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1696480}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2c2d0e7e82122eabbf20f00f74e8e0d4187746bd\n" }, { "commit": "14f58fb57beeaa751d8b917ca66d42cdeb107da3", "tree": "6381dcb03432624159fd672795efa6ec097d15ac", "parents": [ "7a355f7f5176462be645b41bed68e25c7a59b0c2" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Fri Sep 11 17:50:51 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Sep 11 17:59:41 2026" }, "message": "Spanification of partition_alloc/pointers/raw_ptr_unittest.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 501143531\nChange-Id: Ib8a48320e8a6b7e3db0b02412bd708d94a85696f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834126\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1696422}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: febf09c5b8156af64e709eadf1580623e9b1e230\n" }, { "commit": "7a355f7f5176462be645b41bed68e25c7a59b0c2", "tree": "68da482c751d92c6d37db06157ad1a713befb459", "parents": [ "4c253845862d4d860f0650088cb7383f050b7a7c" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Thu Sep 10 20:01:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Sep 10 20:07:32 2026" }, "message": "Spanification of partition_alloc/partition_alloc_check.h\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 501143531\nChange-Id: I2621d6874d02a429aea43e09a52e31e6092cde5e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833832\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1695599}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f099401af5041072a9f42e88b25174d6e7d5b83d\n" } ], "next": "4c253845862d4d860f0650088cb7383f050b7a7c" }