Move data members specific to ElementRareData out of NodeRareData

[cdumez]

11ece51

Move data members specific to ElementRareData out of NodeRareData
https://bugs.webkit.org/show_bug.cgi?id=253461

Reviewed by Darin Adler.

Move data members specific to ElementRareData out of NodeRareData. Those were
put in NodeRareData for better packing but we can achieve the same packing by
reordering data members.

I have verified that sizeof(NodeRareData)=32 and sizeof(ElementRareDate)=232
before and after my change.

* Source/WebCore/dom/ElementRareData.cpp:
* Source/WebCore/dom/ElementRareData.h:
(WebCore::ElementRareData::useTypes const):
* Source/WebCore/dom/NodeRareData.cpp:
* Source/WebCore/dom/NodeRareData.h:
(WebCore::NodeRareData::isElementRareData const):
(WebCore::NodeRareData::useTypes const):
(WebCore::NodeRareData::isElementRareData): Deleted.

Canonical link: https://commits.webkit.org/261308@main

a40448e

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🛠 gtk
	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🧪 gtk-wk2
	✅ 🛠 tv	✅ 🧪 mac-wk2	✅ 🧪 api-gtk
	✅ 🛠 tv-sim	✅ 🧪 mac-AS-debug-wk2
	✅ 🛠 watch	🧪 mac-wk2-stress
✅ 🛠 🧪 merge	✅ 🛠 watch-sim

[webkit-early-warning-system]

EWS run on current version of this PR (hash a40448e)

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🛠 gtk
	✅ 🧪 api-ios	✅ 🧪 mac-wk1	✅ 🧪 gtk-wk2
	✅ 🛠 tv	✅ 🧪 mac-wk2	✅ 🧪 api-gtk
	✅ 🛠 tv-sim	✅ 🧪 mac-AS-debug-wk2
	✅ 🛠 watch	🧪 mac-wk2-stress
✅ 🛠 🧪 merge	✅ 🛠 watch-sim

[darinadler]

Why do we need this? Don't we already know if it's an Element because of a flag in Node?

[cdumez]

It's true that Node has a NodeFlag that indicates whether the Node is an Element or not. I think you're right that we could probably infer wether the the NodeRareData is an ElementRareData. I'll look into it.

[cdumez]

So we use this flag in NodeRareData's operator delete() to make sure we delete ElementRareData data members too, since we don't use virtual inheritance (likely as an optimization).

Node knows whether it is NodeRareData or an ElementRareData. However, NodeRareData doesn't have a reference to its Node and doesn't know if it is an ElementRareData without this flag.

One way I guess would be to have Node to manual memory management and explicitly cast to the subclass before calling delete. However, this would be more error prone.

[rniwa]

That's precisely why we have that boolean. The type information needs to be stored in the object whose type is determined by it. Otherwise, the type & type info can get out of sync and may lead to an exploitable type confusion bug.

[webkit-commit-queue]

Committed 261308@main (11ece51): https://commits.webkit.org/261308@main

Reviewed commits have been landed. Closing PR #11131 and removing active labels.