Skip to content

android: Clone replacements into LinearAlloc #410

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pandasauce wants to merge 2 commits into
base: main
Choose a base branch
from
Open

android: Clone replacements into LinearAlloc #410

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b77771a
android: Clone replacements into LinearAlloc
pandasauce Oct 6, 2026
fcdd718
android: cache LinearAlloc slots for ART method clones
pandasauce Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion lib/android.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ let MethodMangler = null;
let artController = null;
const inlineHooks = [];
const patchedClasses = new Map();
const linearAllocClones = new Map();
const artQuickInterceptors = [];
let thunkPage = null;
let thunkOffset = 0;
Expand Down Expand Up @@ -291,6 +292,9 @@ function _getApi () {
};
},

// userfaultfd GC for cloneArtMethod()
_ZN3art7Runtime22CreateCalleeSaveMethodEv: ['art::Runtime::CreateCalleeSaveMethod', 'pointer', ['pointer']],

_ZN3art3Dbg14SetJdwpAllowedEb: ['art::Dbg::SetJdwpAllowed', 'void', ['bool']],
_ZN3art3Dbg13ConfigureJdwpERKNS_4JDWP11JdwpOptionsE: ['art::Dbg::ConfigureJdwp', 'void', ['pointer']],
_ZN3art31InternalDebuggerControlCallback13StartDebuggerEv: ['art::InternalDebuggerControlCallback::StartDebugger', 'void', ['pointer']],
Expand Down Expand Up @@ -325,6 +329,9 @@ function _getApi () {
},
_ZN3art3Dbg15gDebuggerActiveE: function (address) {
this.isDebuggerActive = () => !!address.readU8();
},
_ZN3art15gUseUserfaultfdE: function (address) {
this.isUserfaultfdGcActive = !!address.readU8();
}
},
optionals: new Set([
Expand All @@ -343,6 +350,7 @@ function _getApi () {
'_ZN3art6mirror6Object5CloneEPNS_6ThreadE',
'_ZN3art6mirror6Object5CloneEPNS_6ThreadEm',
'_ZN3art6mirror6Object5CloneEPNS_6ThreadEj',
'_ZN3art7Runtime22CreateCalleeSaveMethodEv',
'_ZN3art22IndirectReferenceTable3AddEjPNS_6mirror6ObjectE',
'_ZN3art22IndirectReferenceTable3AddENS_15IRTSegmentStateENS_6ObjPtrINS_6mirror6ObjectEEE',
'_ZN3art2gc4Heap12VisitObjectsEPFvPNS_6mirror6ObjectEPvES5_',
Expand All @@ -363,6 +371,7 @@ function _getApi () {
'_ZN3art3Dbg13ConfigureJdwpERKNS_4JDWP11JdwpOptionsE',
'_ZN3art31InternalDebuggerControlCallback13StartDebuggerEv',
'_ZN3art3Dbg15gDebuggerActiveE',
'_ZN3art15gUseUserfaultfdE',
'_ZN3art15instrumentation15Instrumentation20EnableDeoptimizationEv',
'_ZN3art15instrumentation15Instrumentation20DeoptimizeEverythingEPKc',
'_ZN3art15instrumentation15Instrumentation20DeoptimizeEverythingEv',
Expand Down Expand Up @@ -3972,7 +3981,27 @@ function cloneArtMethod (method, vm) {
return api['art::mirror::Object::Clone'](method, thread);
}

return Memory.dup(method, getArtMethodSpec(vm).size);
const artMethodSize = getArtMethodSpec(vm).size;

if (api.isUserfaultfdGcActive) {
// The CMC GC only updates declaring_class_ of ArtMethods in LinearAlloc, so a clone elsewhere goes stale on
// compaction. CreateCalleeSaveMethod() is exported and allocates its ArtMethod in the runtime's LinearAlloc.
const key = method.toString();
let artMethodClone = linearAllocClones.get(key);
// LinearAlloc never frees, so each method keeps its clone; re-copying it would race with calls still in flight.
if (artMethodClone === undefined) {
vm.perform(env => {
withRunnableArtThread(vm, env, () => {
artMethodClone = api['art::Runtime::CreateCalleeSaveMethod'](api.artRuntime);
Memory.copy(artMethodClone, method, artMethodSize);
});
});
linearAllocClones.set(key, artMethodClone);
}
return artMethodClone;
}

return Memory.dup(method, artMethodSize);
}

export function deoptimizeMethod (vm, env, method) {
Expand Down
Loading