Attachment 342911 Details for Bug 186422 – Patch, not for landing

[patch] Patch, not for landing

bug-186422-20180617084919.patch (text/plain), 233.01 KB, created by Simon Fraser (smfr) on 2018-06-17 08:49:22 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Simon Fraser (smfr)

Created: 2018-06-17 08:49:22 PDT

Size: 233.01 KB

patch

obsolete

>Subversion Revision: 232900
>diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index cce80a0e8ab7519d2921fdf36a26a25667d02ee8..990b6ec6b53a875cbec750c4f8e042473ba36918 100644
>--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -469,6 +469,8 @@
> 		0FA2C17C17D7CF84009D015F /* TestRunnerUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */; };
> 		0FA581BC150E953000B9A2D9 /* DFGNodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */; };
>+		0FA6F38D20CC2C9600A03DCD /* GCSegmentedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F38C20CC2C9500A03DCD /* GCSegmentedArray.cpp */; };
>+		0FA6F39720CCB7A600A03DCD /* AssemblerBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F39620CCB7A600A03DCD /* AssemblerBuffer.cpp */; };
> 		0FA762051DB9242900B7A2FD /* CollectionScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA762011DB9242300B7A2FD /* CollectionScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FA762071DB9243300B7A2FD /* MutatorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA762031DB9242300B7A2FD /* MutatorState.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		0FA7620B1DB959F900B7A2FD /* AllocatingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */; };
>@@ -2584,6 +2586,8 @@
> 		0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNodeFlags.cpp; path = dfg/DFGNodeFlags.cpp; sourceTree = "<group>"; };
> 		0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeFlags.h; path = dfg/DFGNodeFlags.h; sourceTree = "<group>"; };
> 		0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeType.h; path = dfg/DFGNodeType.h; sourceTree = "<group>"; };
>+		0FA6F38C20CC2C9500A03DCD /* GCSegmentedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCSegmentedArray.cpp; sourceTree = "<group>"; };
>+		0FA6F39620CCB7A600A03DCD /* AssemblerBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AssemblerBuffer.cpp; sourceTree = "<group>"; };
> 		0FA762001DB9242300B7A2FD /* CollectionScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CollectionScope.cpp; sourceTree = "<group>"; };
> 		0FA762011DB9242300B7A2FD /* CollectionScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionScope.h; sourceTree = "<group>"; };
> 		0FA762021DB9242300B7A2FD /* MutatorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutatorState.cpp; sourceTree = "<group>"; };
>@@ -5679,6 +5683,7 @@
> 				2AABCDE618EF294200002096 /* GCLogging.h */,
> 				0F97152E1EB28BE900A1645D /* GCRequest.cpp */,
> 				0F97152F1EB28BE900A1645D /* GCRequest.h */,
>+				0FA6F38C20CC2C9500A03DCD /* GCSegmentedArray.cpp */,
> 				2A343F7418A1748B0039B085 /* GCSegmentedArray.h */,
> 				2A343F7718A1749D0039B085 /* GCSegmentedArrayInlines.h */,
> 				0F86A26E1D6F7B3100CB0C92 /* GCTypeMap.h */,
>@@ -7491,6 +7496,7 @@
> 				86D3B2BF10156BDE002865E7 /* ARMAssembler.cpp */,
> 				86D3B2C010156BDE002865E7 /* ARMAssembler.h */,
> 				86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */,
>+				0FA6F39620CCB7A600A03DCD /* AssemblerBuffer.cpp */,
> 				9688CB130ED12B4E001D649F /* AssemblerBuffer.h */,
> 				86D3B2C110156BDE002865E7 /* AssemblerBufferWithConstantPool.h */,
> 				43C392AA1C3BEB0000241F53 /* AssemblerCommon.h */,
>@@ -10302,11 +10308,13 @@
> 				536B31871F71C5990037FC33 /* UnifiedSource103.cpp in Sources */,
> 				536B31731F71C5990037FC33 /* UnifiedSource104.cpp in Sources */,
> 				536B31781F71C5990037FC33 /* UnifiedSource105.cpp in Sources */,
>+				0FA6F38D20CC2C9600A03DCD /* GCSegmentedArray.cpp in Sources */,
> 				536B317F1F71C5990037FC33 /* UnifiedSource106.cpp in Sources */,
> 				536B317A1F71C5990037FC33 /* UnifiedSource107.cpp in Sources */,
> 				536B31271F71C5990037FC33 /* UnifiedSource108.cpp in Sources */,
> 				536B312C1F71C5990037FC33 /* UnifiedSource109.cpp in Sources */,
> 				536B31741F71C5990037FC33 /* UnifiedSource110.cpp in Sources */,
>+				0FA6F39720CCB7A600A03DCD /* AssemblerBuffer.cpp in Sources */,
> 				536B31771F71C5990037FC33 /* UnifiedSource111.cpp in Sources */,
> 				536B31801F71C5990037FC33 /* UnifiedSource112.cpp in Sources */,
> 				536B31791F71C5990037FC33 /* UnifiedSource113.cpp in Sources */,
>diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.cpp b/Source/JavaScriptCore/assembler/AssemblerBuffer.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..556e621a184c19915b952158a70ad50fa8e69d65
>--- /dev/null
>+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.cpp
>@@ -0,0 +1,43 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "AssemblerBuffer.h"
>+
>+#include <wtf/NeverDestroyed.h>
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+namespace JSC {
>+
>+WTF::DebugHeap& assemblerDataHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit AssemblerData");
>+    return heap;
>+}
>+
>+} // namespace JSC
>+
>+#endif
>diff --git a/Source/JavaScriptCore/assembler/AssemblerBuffer.h b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
>index 7340952d53c4f5d4f58855feac7511324e5ef9dd..0f4c066ccf4c64cad8b993ae58649d9ba8617bc8 100644
>--- a/Source/JavaScriptCore/assembler/AssemblerBuffer.h
>+++ b/Source/JavaScriptCore/assembler/AssemblerBuffer.h
>@@ -37,6 +37,10 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE WTF::DebugHeap& assemblerDataHeap();
>+#endif
>+
>     struct AssemblerLabel {
>         AssemblerLabel()
>             : m_offset(std::numeric_limits<uint32_t>::max())
>@@ -77,7 +81,12 @@ namespace JSC {
>                 m_buffer = m_inlineBuffer;
>             } else {
>                 m_capacity = initialCapacity;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                m_buffer = static_cast<char*>(assemblerDataHeap().malloc(m_capacity));
>+#else
>                 m_buffer = static_cast<char*>(fastMalloc(m_capacity));
>+#endif
>+
>             }
>         }
> 
>@@ -97,8 +106,13 @@ namespace JSC {
> 
>         AssemblerData& operator=(AssemblerData&& other)
>         {
>-            if (m_buffer && !isInlineBuffer())
>+            if (m_buffer && !isInlineBuffer()) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                assemblerDataHeap().free(m_buffer);
>+#else
>                 fastFree(m_buffer);
>+#endif
>+            }
> 
>             if (other.isInlineBuffer()) {
>                 ASSERT(other.m_capacity == InlineCapacity);
>@@ -115,8 +129,13 @@ namespace JSC {
> 
>         ~AssemblerData()
>         {
>-            if (m_buffer && !isInlineBuffer())
>+            if (m_buffer && !isInlineBuffer()) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                assemblerDataHeap().free(m_buffer);
>+#else
>                 fastFree(m_buffer);
>+#endif
>+            }
>         }
> 
>         char* buffer() const { return m_buffer; }
>@@ -127,10 +146,19 @@ namespace JSC {
>         {
>             m_capacity = m_capacity + m_capacity / 2 + extraCapacity;
>             if (isInlineBuffer()) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                m_buffer = static_cast<char*>(assemblerDataHeap().malloc(m_capacity));
>+#else
>                 m_buffer = static_cast<char*>(fastMalloc(m_capacity));
>+#endif
>                 memcpy(m_buffer, m_inlineBuffer, InlineCapacity);
>-            } else
>+            } else {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                m_buffer = static_cast<char*>(assemblerDataHeap().realloc(m_buffer, m_capacity));
>+#else
>                 m_buffer = static_cast<char*>(fastRealloc(m_buffer, m_capacity));
>+#endif
>+            }
>         }
> 
>     private:
>diff --git a/Source/JavaScriptCore/bytecode/AccessCase.cpp b/Source/JavaScriptCore/bytecode/AccessCase.cpp
>index f36c1fe248bdcaa31b967e19971464a250ac8b38..106dcfa894c8c864cb6ab473e190950dcb6effe2 100644
>--- a/Source/JavaScriptCore/bytecode/AccessCase.cpp
>+++ b/Source/JavaScriptCore/bytecode/AccessCase.cpp
>@@ -56,6 +56,14 @@ namespace AccessCaseInternal {
> static const bool verbose = false;
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& AccessCase::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> AccessCase::AccessCase(VM& vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure, const ObjectPropertyConditionSet& conditionSet, std::unique_ptr<PolyProtoAccessChain> prototypeAccessChain)
>     : m_type(type)
>     , m_offset(offset)
>diff --git a/Source/JavaScriptCore/bytecode/AccessCase.h b/Source/JavaScriptCore/bytecode/AccessCase.h
>index 21dc3f2d626f27d66cba65692508f7e8d280d949..ff2dbdef64b65012a12fdbb3c4964f8ec39e31df 100644
>--- a/Source/JavaScriptCore/bytecode/AccessCase.h
>+++ b/Source/JavaScriptCore/bytecode/AccessCase.h
>@@ -77,7 +77,11 @@ struct AccessGenerationState;
> // code. This allows us to only regenerate once we've accumulated (hopefully) more than one new
> // AccessCase.
> class AccessCase {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(AccessCase);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     enum AccessType : uint8_t {
>         Load,
>diff --git a/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp b/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp
>index a4397b5441f1c2acc6b62a6f0271a2292847e365..1373bc06b88812cf9259dfde969856494ce5b28e 100644
>--- a/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp
>+++ b/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp
>@@ -47,6 +47,14 @@ static bool isJumpTarget(OpcodeID opcodeID, const Vector<unsigned, 32>& jumpTarg
>     return std::binary_search(jumpTargets.begin(), jumpTargets.end(), bytecodeOffset);
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& BytecodeBasicBlock::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> template<typename Block, typename Instruction>
> void BytecodeBasicBlock::computeImpl(Block* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>& basicBlocks)
> {
>diff --git a/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h b/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h
>index fb81650ca1f6516e9b61bb0f782f2c23b66b8be9..88b9fcafc1d3426a813745753e28ac2186e2f11c 100644
>--- a/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h
>+++ b/Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h
>@@ -37,7 +37,11 @@ struct Instruction;
> struct UnlinkedInstruction;
> 
> class BytecodeBasicBlock {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(BytecodeBasicBlock);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     enum SpecialBlockType { EntryBlock, ExitBlock };
>     BytecodeBasicBlock(unsigned start, unsigned length);
>diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>index 98ef06f47a33611351c74cba411ac2f31b864a8f..c7ea25ebbacfd4adb796a710826642b679ba6cfa 100644
>--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>@@ -103,6 +103,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& CodeBlock::RareData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> const ClassInfo CodeBlock::s_info = {
>     "CodeBlock", nullptr, nullptr, nullptr,
>     CREATE_METHOD_TABLE(CodeBlock)
>diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
>index 0d4ed3af372ed46164d28916a836d385a2622a71..1a14d51b4747d5726b2d12a853fedb551916caa2 100644
>--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
>@@ -837,7 +837,11 @@ public:
>     NO_RETURN_DUE_TO_CRASH void endValidationDidFail();
> 
>     struct RareData {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(CodeBlock::RareData);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     public:
>         Vector<HandlerInfo> m_exceptionHandlers;
> 
>diff --git a/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp b/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
>index 585fcb5680312122e20419e3726bec9d5ec783c1..a6f7eb89e94b232129aef4fb4f64458d249cd21f 100644
>--- a/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
>+++ b/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
>@@ -208,6 +208,13 @@ void AccessGenerationState::emitExplicitExceptionHandler()
>     }
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& PolymorphicAccess::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
> 
> PolymorphicAccess::PolymorphicAccess() { }
> PolymorphicAccess::~PolymorphicAccess() { }
>diff --git a/Source/JavaScriptCore/bytecode/PolymorphicAccess.h b/Source/JavaScriptCore/bytecode/PolymorphicAccess.h
>index 30558551cbcab019f458f739d569ceee1c0462ae..ee983fb1ceab77e15689d148fcab45e93ef1cc9b 100644
>--- a/Source/JavaScriptCore/bytecode/PolymorphicAccess.h
>+++ b/Source/JavaScriptCore/bytecode/PolymorphicAccess.h
>@@ -129,7 +129,11 @@ private:
> 
> class PolymorphicAccess {
>     WTF_MAKE_NONCOPYABLE(PolymorphicAccess);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(PolymorphicAccess);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     PolymorphicAccess();
>     ~PolymorphicAccess();
>diff --git a/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.cpp b/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.cpp
>index 3bd44532cd131efd6678774287c0c9ef31b44a7d..a7f306bc5fdbda015f3da989cbadf1ad430925db 100644
>--- a/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.cpp
>+++ b/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.cpp
>@@ -34,6 +34,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StructureStubClearingWatchpoint::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint()
> {
>     for (auto current = WTFMove(m_next); current; current = WTFMove(current->m_next)) { }
>diff --git a/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h b/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h
>index 665c56a986f0f6c50a54e030a8497075b4ff6a94..b5bbbf4628674bf44825cb1f9804c15eec8ba3ae 100644
>--- a/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h
>+++ b/Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h
>@@ -41,7 +41,11 @@ class WatchpointsOnStructureStubInfo;
> 
> class StructureStubClearingWatchpoint : public Watchpoint {
>     WTF_MAKE_NONCOPYABLE(StructureStubClearingWatchpoint);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(StructureStubClearingWatchpoint);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     StructureStubClearingWatchpoint(
>         const ObjectPropertyCondition& key,
>diff --git a/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.cpp b/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.cpp
>index 48c816a149b1bf406075f03572eb95200ed7862d..6eeb6d3f95af98f5a24d93c21f79eb9041e601aa 100644
>--- a/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.cpp
>+++ b/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.cpp
>@@ -77,6 +77,14 @@ static void append32(unsigned char*& ptr, unsigned value)
>     *(ptr++) = (value >> 24) & 0xff;
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& UnlinkedInstructionStream::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> UnlinkedInstructionStream::UnlinkedInstructionStream(const Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>& instructions)
>     : m_instructionCount(instructions.size())
> {
>diff --git a/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.h b/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.h
>index 8c0bf5742dbfdd52bc6ea822c8b77efa5021886f..0397c718b99085bc6eb10ab9d0c911e5f7bb13e4 100644
>--- a/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.h
>+++ b/Source/JavaScriptCore/bytecode/UnlinkedInstructionStream.h
>@@ -33,7 +33,11 @@
> namespace JSC {
> 
> class UnlinkedInstructionStream {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(UnlinkedInstructionStream);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     explicit UnlinkedInstructionStream(const Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>&);
> 
>diff --git a/Source/JavaScriptCore/bytecode/ValueProfile.h b/Source/JavaScriptCore/bytecode/ValueProfile.h
>index c8143006fd8ac84754ac2c28b459d0404415409e..6e8834e0eac25fd7f04eac454d4199b8702901b6 100644
>--- a/Source/JavaScriptCore/bytecode/ValueProfile.h
>+++ b/Source/JavaScriptCore/bytecode/ValueProfile.h
>@@ -210,11 +210,18 @@ struct ValueProfileAndOperand {
> struct ValueProfileAndOperandBuffer {
>     ValueProfileAndOperandBuffer(unsigned size)
>         : m_size(size)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_buffer(VMDebugHeap())
>+#endif
>     {
>         // FIXME: ValueProfile has more stuff than we need. We could optimize these value profiles
>         // to be more space efficient.
>         // https://bugs.webkit.org/show_bug.cgi?id=175413
>-        m_buffer = MallocPtr<ValueProfileAndOperand>::malloc(m_size * sizeof(ValueProfileAndOperand));
>+        m_buffer = MallocPtr<ValueProfileAndOperand>::malloc(m_size * sizeof(ValueProfileAndOperand)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            , VMDebugHeap()
>+#endif
>+            );
>         for (unsigned i = 0; i < m_size; ++i)
>             new (&m_buffer.get()[i]) ValueProfileAndOperand();
>     }
>diff --git a/Source/JavaScriptCore/bytecode/Watchpoint.cpp b/Source/JavaScriptCore/bytecode/Watchpoint.cpp
>index 7ab385f585cc9031c46de5a9061cdfba8f204f89..d5862217880b077e34a64633d6f35bc9a0eea178 100644
>--- a/Source/JavaScriptCore/bytecode/Watchpoint.cpp
>+++ b/Source/JavaScriptCore/bytecode/Watchpoint.cpp
>@@ -32,6 +32,20 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& Watchpoint::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& WatchpointSet::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> void StringFireDetail::dump(PrintStream& out) const
> {
>     out.print(m_string);
>diff --git a/Source/JavaScriptCore/bytecode/Watchpoint.h b/Source/JavaScriptCore/bytecode/Watchpoint.h
>index 778fe16c3828ad224cbc1e3cdf0093d0a66f8788..f244d751b2a32d28b2b4bd8bc73411120bc4d393 100644
>--- a/Source/JavaScriptCore/bytecode/Watchpoint.h
>+++ b/Source/JavaScriptCore/bytecode/Watchpoint.h
>@@ -89,7 +89,9 @@ class WatchpointSet;
> 
> class Watchpoint : public BasicRawSentinelNode<Watchpoint> {
>     WTF_MAKE_NONCOPYABLE(Watchpoint);
>-    WTF_MAKE_FAST_ALLOCATED;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(Watchpoint);
>+#endif
> public:
>     Watchpoint() = default;
>     
>@@ -114,6 +116,9 @@ class DeferredWatchpointFire;
> class VM;
> 
> class WatchpointSet : public ThreadSafeRefCounted<WatchpointSet> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(WatchpointSet);
>+#endif
>     friend class LLIntOffsetsExtractor;
>     friend class DeferredWatchpointFire;
> public:
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>index eb7da976afb118bc086c842fd6833bc4b484550d..4934232f12a5cdf5fcbe962de579f48c8e6a1b81 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>@@ -67,6 +67,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& BytecodeGenerator::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> template<typename T>
> static inline void shrinkToFit(T& segmentedVector)
> {
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>index f57a47c324b76f29925f3acd376b238de415aafd..f08e6d017ef81735a3e3b983b5d48bd24fbe3d1f 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>@@ -353,7 +353,11 @@ namespace JSC {
>     };
> 
>     class BytecodeGenerator {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(BytecodeGenerator);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>         WTF_MAKE_NONCOPYABLE(BytecodeGenerator);
>     public:
>         typedef DeclarationStacks::FunctionStack FunctionStack;
>diff --git a/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp b/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp
>index 1ddc62e33573adc23e4befef548b2aca3ce201a8..06e80173f70de1f369c56dc000978e0986e6f4f4 100644
>--- a/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp
>@@ -32,6 +32,14 @@
> 
> namespace JSC { namespace DFG {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& BasicBlock::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> BasicBlock::BasicBlock(
>     unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals, float executionCount)
>     : bytecodeBegin(bytecodeBegin)
>diff --git a/Source/JavaScriptCore/dfg/DFGBasicBlock.h b/Source/JavaScriptCore/dfg/DFGBasicBlock.h
>index eb5fc9fd86bda3925fbe97bd4a70bb80781ba934..021552be3bad2c08f5da49d6ac4fcca93fc2c0ee 100644
>--- a/Source/JavaScriptCore/dfg/DFGBasicBlock.h
>+++ b/Source/JavaScriptCore/dfg/DFGBasicBlock.h
>@@ -45,6 +45,9 @@ typedef Vector<BasicBlock*, 2> PredecessorList;
> typedef Vector<Node*, 8> BlockNodeList;
> 
> struct BasicBlock : RefCounted<BasicBlock> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(BasicBlock);
>+#endif
>     BasicBlock(
>         unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals,
>         float executionCount);
>diff --git a/Source/JavaScriptCore/dfg/DFGNode.cpp b/Source/JavaScriptCore/dfg/DFGNode.cpp
>index 4314762e88c666504cc284f1f41596c584126a0b..36218bad426cd2838d1dabe7c5f38a3ca6c9928f 100644
>--- a/Source/JavaScriptCore/dfg/DFGNode.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGNode.cpp
>@@ -36,6 +36,14 @@ namespace JSC { namespace DFG {
> 
> const char Node::HashSetTemplateInstantiationString[] = "::JSC::DFG::Node*";
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& Node::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> bool MultiPutByOffsetData::writesStructures() const
> {
>     for (unsigned i = variants.size(); i--;) {
>diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
>index eee5e773be4b2f6ccade245be9ec7f3453af969a..620ae14c4e01a7e9d8ebf014100e87ba988d25d7 100644
>--- a/Source/JavaScriptCore/dfg/DFGNode.h
>+++ b/Source/JavaScriptCore/dfg/DFGNode.h
>@@ -55,6 +55,7 @@
> #include "TypeLocation.h"
> #include "ValueProfile.h"
> #include <type_traits>
>+#include <wtf/FastMalloc.h>
> #include <wtf/ListDump.h>
> #include <wtf/LoggingHashSet.h>
> 
>@@ -271,7 +272,11 @@ enum class BucketOwnerType : uint32_t {
> //
> // Node represents a single operation in the data flow graph.
> struct Node {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(DFG::Node);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static const char HashSetTemplateInstantiationString[];
>     
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index b04bde2f0712b5badf15208e4278e74ad30c9600..59468d95235219baa6bc8250d1d6c0f21c913060 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -70,6 +70,14 @@
> 
> namespace JSC { namespace DFG {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SpeculativeJIT::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> SpeculativeJIT::SpeculativeJIT(JITCompiler& jit)
>     : m_compileOkay(true)
>     , m_jit(jit)
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index ae7fe8b92981d49e42aec5b2eb12f3bb172c117f..19ff4436c60bc9b31c14a237900a2e45e87d99ed 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -69,8 +69,11 @@ enum GeneratedOperandType { GeneratedOperandTypeUnknown, GeneratedOperandInteger
> // to propagate type information (including information that has
> // only speculatively been asserted) through the dataflow.
> class SpeculativeJIT {
>-    WTF_MAKE_FAST_ALLOCATED;
>-
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(SpeculativeJIT);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     friend struct OSRExit;
> private:
>     typedef JITCompiler::TrustedImm32 TrustedImm32;
>diff --git a/Source/JavaScriptCore/heap/BlockDirectory.cpp b/Source/JavaScriptCore/heap/BlockDirectory.cpp
>index f5f2b3eb4d3aa31e0b4898576ca5f21870f4f1e4..0e649e1fb059dc955e55d43133f719a193385c39 100644
>--- a/Source/JavaScriptCore/heap/BlockDirectory.cpp
>+++ b/Source/JavaScriptCore/heap/BlockDirectory.cpp
>@@ -37,6 +37,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& BlockDirectory::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> BlockDirectory::BlockDirectory(Heap* heap, size_t cellSize)
>     : m_cellSize(static_cast<unsigned>(cellSize))
>     , m_heap(heap)
>diff --git a/Source/JavaScriptCore/heap/BlockDirectory.h b/Source/JavaScriptCore/heap/BlockDirectory.h
>index a12b433cef34d2f2dc685f2a6bac2720b393c1cc..23a8b390bb0ea8684a2bf0e78fc62a6ed492bff2 100644
>--- a/Source/JavaScriptCore/heap/BlockDirectory.h
>+++ b/Source/JavaScriptCore/heap/BlockDirectory.h
>@@ -73,8 +73,12 @@ class LLIntOffsetsExtractor;
> 
> class BlockDirectory {
>     WTF_MAKE_NONCOPYABLE(BlockDirectory);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(BlockDirectory);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>-    
>+#endif
>+
>     friend class LLIntOffsetsExtractor;
> 
> public:
>diff --git a/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.cpp b/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.cpp
>index 45f6bb751b129ec069509292b8d5e559b4574296..62520872c29c23787d6bc638dddc31c3815c7da7 100644
>--- a/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.cpp
>+++ b/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.cpp
>@@ -32,6 +32,9 @@
> namespace JSC {
> 
> FastMallocAlignedMemoryAllocator::FastMallocAlignedMemoryAllocator()
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    : m_heap("WebKit FastMallocAlignedMemoryAllocator")
>+#endif
> {
> }
> 
>@@ -41,12 +44,22 @@ FastMallocAlignedMemoryAllocator::~FastMallocAlignedMemoryAllocator()
> 
> void* FastMallocAlignedMemoryAllocator::tryAllocateAlignedMemory(size_t alignment, size_t size)
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    return m_heap.memalign(alignment, size, true);
>+#else
>     return tryFastAlignedMalloc(alignment, size);
>+#endif
>+
> }
> 
> void FastMallocAlignedMemoryAllocator::freeAlignedMemory(void* basePtr)
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    return m_heap.free(basePtr);
>+#else
>     fastAlignedFree(basePtr);
>+#endif
>+
> }
> 
> void FastMallocAlignedMemoryAllocator::dump(PrintStream& out) const
>diff --git a/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.h b/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.h
>index bdd57b708343c7e86674eef164a152192a36dd4b..7bc3dc4a5ffabf8ce82e0206356fbec8b1424a21 100644
>--- a/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.h
>+++ b/Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.h
>@@ -27,6 +27,10 @@
> 
> #include "AlignedMemoryAllocator.h"
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> namespace JSC {
> 
> class FastMallocAlignedMemoryAllocator : public AlignedMemoryAllocator {
>@@ -38,6 +42,10 @@ public:
>     void freeAlignedMemory(void*) override;
>     
>     void dump(PrintStream&) const override;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+private:
>+    WTF::DebugHeap m_heap;
>+#endif
> };
> 
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/heap/GCSegmentedArray.cpp b/Source/JavaScriptCore/heap/GCSegmentedArray.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..3b8d9fcf658fadf0e3d249130667296b8b53350a
>--- /dev/null
>+++ b/Source/JavaScriptCore/heap/GCSegmentedArray.cpp
>@@ -0,0 +1,40 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+ * THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "GCSegmentedArray.h"
>+
>+#include <wtf/NeverDestroyed.h>
>+
>+namespace JSC {
>+
>+WTF::DebugHeap& segmentedArrayHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit GCSegmentedArray");
>+    return heap;
>+}
>+
>+} // namespace JSC
>+
>diff --git a/Source/JavaScriptCore/heap/GCSegmentedArray.h b/Source/JavaScriptCore/heap/GCSegmentedArray.h
>index 359e83e1b35ed136d94e5bbf5a621cab987bd007..8cb145b49672925a6b89db53b71c5b62695a57c3 100644
>--- a/Source/JavaScriptCore/heap/GCSegmentedArray.h
>+++ b/Source/JavaScriptCore/heap/GCSegmentedArray.h
>@@ -27,9 +27,18 @@
> 
> #include <wtf/DoublyLinkedList.h>
> #include <wtf/Forward.h>
>+#include <wtf/Noncopyable.h>
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+extern WTF::DebugHeap& segmentedArrayHeap();
>+#endif
>+
> template <typename T>
> class GCArraySegment : public DoublyLinkedListNode<GCArraySegment<T>> {
>     friend class WTF::DoublyLinkedListNode<GCArraySegment<T>>;
>diff --git a/Source/JavaScriptCore/heap/GCSegmentedArrayInlines.h b/Source/JavaScriptCore/heap/GCSegmentedArrayInlines.h
>index b4638f928e6ab089e4147d3e36c43b717b61e7f6..5c8296c3adca896a1522a12b814d9ee8c6d920a8 100644
>--- a/Source/JavaScriptCore/heap/GCSegmentedArrayInlines.h
>+++ b/Source/JavaScriptCore/heap/GCSegmentedArrayInlines.h
>@@ -126,14 +126,24 @@ void GCSegmentedArray<T>::fillVector(Vector<T>& vector)
> template <typename T>
> inline GCArraySegment<T>* GCArraySegment<T>::create()
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    return new (NotNull, segmentedArrayHeap().malloc(blockSize)) GCArraySegment<T>();
>+#else
>     return new (NotNull, fastMalloc(blockSize)) GCArraySegment<T>();
>+#endif
>+
> }
> 
> template <typename T>
> inline void GCArraySegment<T>::destroy(GCArraySegment* segment)
> {
>     segment->~GCArraySegment();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    segmentedArrayHeap().free(segment);
>+#else
>     fastFree(segment);
>+#endif
>+
> }
> 
> template <typename T>
>diff --git a/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp b/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp
>index abddece9533d8aa771e1d9f8ecefdaaf13caa6c8..8291f5b45947b467e7091c0ee0b3ef6f8965cc5a 100644
>--- a/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp
>+++ b/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.cpp
>@@ -26,10 +26,23 @@
> #include "config.h"
> #include "IsoAlignedMemoryAllocator.h"
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit IsoAlignedMemoryAllocator");
>+    return heap;
>+}
>+#endif
>+
> IsoAlignedMemoryAllocator::IsoAlignedMemoryAllocator()
> {
>+
> }
> 
> IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator()
>@@ -38,7 +51,12 @@ IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator()
>         void* block = m_blocks[i];
>         if (!m_committed[i])
>             WTF::fastCommitAlignedMemory(block, MarkedBlock::blockSize);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        debugHeap().free(block);
>+#else
>         fastAlignedFree(block);
>+#endif
>+
>     }
> }
> 
>@@ -59,7 +77,11 @@ void* IsoAlignedMemoryAllocator::tryAllocateAlignedMemory(size_t alignment, size
>         return result;
>     }
>     
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* result = debugHeap().memalign(MarkedBlock::blockSize, MarkedBlock::blockSize, true);
>+#else
>     void* result = tryFastAlignedMalloc(MarkedBlock::blockSize, MarkedBlock::blockSize);
>+#endif
>     if (!result)
>         return nullptr;
>     unsigned index = m_blocks.size();
>diff --git a/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h b/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h
>index 09073b946f080d39a6f7128a49a2e7674dae5cf1..eb8549741e916b867ae8427697ab8b51089a9276 100644
>--- a/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h
>+++ b/Source/JavaScriptCore/heap/IsoAlignedMemoryAllocator.h
>@@ -27,6 +27,7 @@
> 
> #include "AlignedMemoryAllocator.h"
> 
>+
> namespace JSC {
> 
> class IsoAlignedMemoryAllocator : public AlignedMemoryAllocator {
>diff --git a/Source/JavaScriptCore/heap/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
>index c42534447eefa872c6ee5df2950896c406d24baf..0e508dfd78f4a7615ad64133ae421e51628e3c4b 100644
>--- a/Source/JavaScriptCore/heap/MarkedBlock.cpp
>+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
>@@ -44,6 +44,20 @@ const size_t MarkedBlock::blockSize;
> static const bool computeBalance = false;
> static size_t balance;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& MarkedBlock::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& MarkedBlock::Handle::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> MarkedBlock::Handle* MarkedBlock::tryCreate(Heap& heap, AlignedMemoryAllocator* alignedMemoryAllocator)
> {
>     if (computeBalance) {
>diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
>index 7d14eecfd8d7d1788374f0afefe8a334f643d809..639d8123e9f928c400ec693d5b059cb7fc8912a2 100644
>--- a/Source/JavaScriptCore/heap/MarkedBlock.h
>+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
>@@ -55,6 +55,9 @@ typedef uint32_t HeapVersion;
> 
> class MarkedBlock {
>     WTF_MAKE_NONCOPYABLE(MarkedBlock);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(MarkedBlock);
>+#endif
>     friend class LLIntOffsetsExtractor;
>     friend struct VerifyMarked;
> 
>@@ -95,7 +98,11 @@ public:
>         
>     class Handle {
>         WTF_MAKE_NONCOPYABLE(Handle);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(MarkedBlock::Handle);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>         friend class LLIntOffsetsExtractor;
>         friend class MarkedBlock;
>         friend struct VerifyMarked;
>diff --git a/Source/JavaScriptCore/heap/WeakBlock.cpp b/Source/JavaScriptCore/heap/WeakBlock.cpp
>index f328f96c451a5153b89d5b3c4ae424880675f0c3..f5a3bd722297dbee743dded626c92d679f9594d4 100644
>--- a/Source/JavaScriptCore/heap/WeakBlock.cpp
>+++ b/Source/JavaScriptCore/heap/WeakBlock.cpp
>@@ -34,16 +34,33 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit JSC WeakBlock");
>+    return heap;
>+}
>+#endif
>+
> WeakBlock* WeakBlock::create(Heap& heap, CellContainer container)
> {
>     heap.didAllocateBlock(WeakBlock::blockSize);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    return new (NotNull, debugHeap().malloc(blockSize)) WeakBlock(container);
>+#else
>     return new (NotNull, fastMalloc(blockSize)) WeakBlock(container);
>+#endif
>+
> }
> 
> void WeakBlock::destroy(Heap& heap, WeakBlock* block)
> {
>     block->~WeakBlock();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    debugHeap().free(block);
>+#else
>     fastFree(block);
>+#endif
>     heap.didFreeBlock(WeakBlock::blockSize);
> }
> 
>diff --git a/Source/JavaScriptCore/jit/JITCode.cpp b/Source/JavaScriptCore/jit/JITCode.cpp
>index bc281802dc22d287f0a4d73370ee08236ccf327a..e25982141fa15cba07f79fc6cefeb0389f509f91 100644
>--- a/Source/JavaScriptCore/jit/JITCode.cpp
>+++ b/Source/JavaScriptCore/jit/JITCode.cpp
>@@ -32,6 +32,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& DirectJITCode::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> JITCode::JITCode(JITType jitType)
>     : m_jitType(jitType)
> {
>diff --git a/Source/JavaScriptCore/jit/JITCode.h b/Source/JavaScriptCore/jit/JITCode.h
>index 66c5845d0df9d00074ffd9bf904be284cb76e72d..3149e252409e44370f13887bce772d5a4cad42e3 100644
>--- a/Source/JavaScriptCore/jit/JITCode.h
>+++ b/Source/JavaScriptCore/jit/JITCode.h
>@@ -221,6 +221,9 @@ protected:
> };
> 
> class DirectJITCode : public JITCodeWithCodeRef {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(DirectJITCode);
>+#endif
> public:
>     DirectJITCode(JITType);
>     DirectJITCode(CodeRef<JSEntryPtrTag>, CodePtr<JSEntryPtrTag> withArityCheck, JITType);
>diff --git a/Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp b/Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp
>index dd5b5b32f37ad0ddba3c73ba58a5076d3e299448..323370aacf987d0a9a434302e5120af7fbfc3c69 100644
>--- a/Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp
>+++ b/Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp
>@@ -31,7 +31,15 @@
> #include <wtf/ListDump.h>
> 
> namespace JSC {
>-    
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& RegisterAtOffsetList::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> RegisterAtOffsetList::RegisterAtOffsetList() { }
> 
> RegisterAtOffsetList::RegisterAtOffsetList(RegisterSet registerSet, OffsetBaseType offsetBaseType)
>diff --git a/Source/JavaScriptCore/jit/RegisterAtOffsetList.h b/Source/JavaScriptCore/jit/RegisterAtOffsetList.h
>index e0b2541ab8dc923ff71ed488764506075c3b9e3c..c27114435181dd7e25ac1d41ca8f924ead0e3ac6 100644
>--- a/Source/JavaScriptCore/jit/RegisterAtOffsetList.h
>+++ b/Source/JavaScriptCore/jit/RegisterAtOffsetList.h
>@@ -33,7 +33,11 @@
> namespace JSC {
> 
> class RegisterAtOffsetList {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(RegisterAtOffsetList);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     enum OffsetBaseType { FramePointerBased, ZeroBased };
> 
>diff --git a/Source/JavaScriptCore/parser/Nodes.cpp b/Source/JavaScriptCore/parser/Nodes.cpp
>index 4bb05f3fe32dafe384020f7440424f6fe8154d3b..8a8b1cc07bc888a8f2d616018e371d118a3b24e9 100644
>--- a/Source/JavaScriptCore/parser/Nodes.cpp
>+++ b/Source/JavaScriptCore/parser/Nodes.cpp
>@@ -35,6 +35,15 @@ using namespace WTF;
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& ParserArenaRoot::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+#endif
>+
> // ------------------------------ StatementNode --------------------------------
> 
> void StatementNode::setLoc(unsigned firstLine, unsigned lastLine, int startOffset, int lineStartOffset)
>diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
>index 4365637c882155b0ccca99c2fc2e5587740fc783..52f4582d93ef570bf9a4b8956df5fb2b3c96f6ac 100644
>--- a/Source/JavaScriptCore/parser/Nodes.h
>+++ b/Source/JavaScriptCore/parser/Nodes.h
>@@ -129,7 +129,11 @@ namespace JSC {
>         typedef int __thisIsHereToForceASemicolonAfterThisMacro
> 
>     class ParserArenaRoot {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(ParserArenaRoot);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     protected:
>         ParserArenaRoot(ParserArena&);
> 
>diff --git a/Source/JavaScriptCore/parser/ParserArena.cpp b/Source/JavaScriptCore/parser/ParserArena.cpp
>index a276887708c409644db81bcced8ae71b5c04e9a8..30ee024813ed97d3f65c9b81c11b36277bec3d1f 100644
>--- a/Source/JavaScriptCore/parser/ParserArena.cpp
>+++ b/Source/JavaScriptCore/parser/ParserArena.cpp
>@@ -31,6 +31,20 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& IdentifierArena::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit JSC ParserArena");
>+    return heap;
>+}
>+#endif
>+
> ParserArena::ParserArena()
>     : m_freeableMemory(0)
>     , m_freeablePoolEnd(0)
>@@ -49,12 +63,22 @@ inline void ParserArena::deallocateObjects()
>     for (size_t i = 0; i < size; ++i)
>         m_deletableObjects[i]->~ParserArenaDeletable();
> 
>-    if (m_freeablePoolEnd)
>+    if (m_freeablePoolEnd) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        debugHeap().free(freeablePool());
>+#else
>         fastFree(freeablePool());
>+#endif
>+    }
> 
>     size = m_freeablePools.size();
>-    for (size_t i = 0; i < size; ++i)
>+    for (size_t i = 0; i < size; ++i) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        debugHeap().free(m_freeablePools[i]);
>+#else
>         fastFree(m_freeablePools[i]);
>+#endif
>+    }
> }
> 
> ParserArena::~ParserArena()
>@@ -67,7 +91,11 @@ void ParserArena::allocateFreeablePool()
>     if (m_freeablePoolEnd)
>         m_freeablePools.append(freeablePool());
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    char* pool = static_cast<char*>(debugHeap().malloc(freeablePoolSize));
>+#else
>     char* pool = static_cast<char*>(fastMalloc(freeablePoolSize));
>+#endif
>     m_freeableMemory = pool;
>     m_freeablePoolEnd = pool + freeablePoolSize;
>     ASSERT(freeablePool() == pool);
>diff --git a/Source/JavaScriptCore/parser/ParserArena.h b/Source/JavaScriptCore/parser/ParserArena.h
>index 85b48559717675f8e5ac9f22fdc5b76d1a7e4b44..030c0d941007cf724c8efbe576fd60c87aee447e 100644
>--- a/Source/JavaScriptCore/parser/ParserArena.h
>+++ b/Source/JavaScriptCore/parser/ParserArena.h
>@@ -36,7 +36,11 @@ namespace JSC {
>     class ParserArenaDeletable;
> 
>     class IdentifierArena {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(IdentifierArena);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     public:
>         IdentifierArena()
>         {
>diff --git a/Source/JavaScriptCore/parser/SourceProvider.cpp b/Source/JavaScriptCore/parser/SourceProvider.cpp
>index 9a13eb238ff80824ea27fb72f7fb634399522d11..a8a0efe0106a767476d441ccad98526a64aef9c0 100644
>--- a/Source/JavaScriptCore/parser/SourceProvider.cpp
>+++ b/Source/JavaScriptCore/parser/SourceProvider.cpp
>@@ -31,6 +31,14 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StringSourceProvider::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> SourceProvider::SourceProvider(const SourceOrigin& sourceOrigin, const String& url, const TextPosition& startPosition, SourceProviderSourceType sourceType)
>     : m_sourceOrigin(sourceOrigin)
>     , m_url(url)
>diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
>index 0d0c2fc84cd05a58a31212a369af75a581a0122e..f49d18e110a9faf1218c685b0a29333c133b7938 100644
>--- a/Source/JavaScriptCore/parser/SourceProvider.h
>+++ b/Source/JavaScriptCore/parser/SourceProvider.h
>@@ -91,6 +91,9 @@ namespace JSC {
>     };
> 
>     class StringSourceProvider : public SourceProvider {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StringSourceProvider);
>+#endif
>     public:
>         static Ref<StringSourceProvider> create(const String& source, const SourceOrigin& sourceOrigin, const String& url, const TextPosition& startPosition = TextPosition(), SourceProviderSourceType sourceType = SourceProviderSourceType::Program)
>         {
>diff --git a/Source/JavaScriptCore/parser/SourceProviderCache.cpp b/Source/JavaScriptCore/parser/SourceProviderCache.cpp
>index ccc67272c81b4153a6e67dd4018e2d276830d2c3..cf7d7286586498dae845493f1af34e8f54d20a24 100644
>--- a/Source/JavaScriptCore/parser/SourceProviderCache.cpp
>+++ b/Source/JavaScriptCore/parser/SourceProviderCache.cpp
>@@ -30,6 +30,20 @@
> 
> namespace JSC {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SourceProviderCache::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& SourceProviderCacheItem::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> SourceProviderCache::~SourceProviderCache()
> {
>     clear();
>diff --git a/Source/JavaScriptCore/parser/SourceProviderCache.h b/Source/JavaScriptCore/parser/SourceProviderCache.h
>index 05a851f9ae5bfeea201ec8ddb82c194a7980db9e..da3d27d322101967a919c33d4e597686929b6b29 100644
>--- a/Source/JavaScriptCore/parser/SourceProviderCache.h
>+++ b/Source/JavaScriptCore/parser/SourceProviderCache.h
>@@ -32,7 +32,11 @@
> namespace JSC {
> 
> class SourceProviderCache : public RefCounted<SourceProviderCache> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(SourceProviderCache);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     SourceProviderCache() { }
>     JS_EXPORT_PRIVATE ~SourceProviderCache();
>diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
>index d0644d2df17195ad7e24b5cb5c3725ac821660f4..28d1824e64ae17eab1d55c565a9864a0ec8f6116 100644
>--- a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
>+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
>@@ -60,7 +60,11 @@ struct SourceProviderCacheItemCreationParameters {
> #endif
> 
> class SourceProviderCacheItem {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(SourceProviderCacheItem);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static std::unique_ptr<SourceProviderCacheItem> create(const SourceProviderCacheItemCreationParameters&);
>     ~SourceProviderCacheItem();
>@@ -116,7 +120,11 @@ inline std::unique_ptr<SourceProviderCacheItem> SourceProviderCacheItem::create(
> {
>     size_t variableCount = parameters.usedVariables.size();
>     size_t objectSize = sizeof(SourceProviderCacheItem) + sizeof(UniquedStringImpl*) * variableCount;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* slot = SourceProviderCacheItem::debugHeap("WebKit SourceProviderCacheItem").malloc(objectSize);
>+#else
>     void* slot = fastMalloc(objectSize);
>+#endif
>     return std::unique_ptr<SourceProviderCacheItem>(new (slot) SourceProviderCacheItem(parameters));
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>index f7d1f73ba52e396e0982cb09b3f7c7fa4d875e7a..47aed65be10a6b5475baeb699f89e1f12a9f4f48 100644
>--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>@@ -203,6 +203,8 @@ public:
>     static const unsigned EmptyEntryIndex = 0;
> 
> private:
>+    JS_EXPORT_PRIVATE static WTF::DebugHeap& debugHeap();
>+
>     PropertyTable(VM&, unsigned initialCapacity);
>     PropertyTable(VM&, const PropertyTable&);
>     PropertyTable(VM&, unsigned initialCapacity, const PropertyTable&);
>@@ -505,14 +507,24 @@ inline void PropertyTable::rehash(unsigned newCapacity)
>     m_indexMask = m_indexSize - 1;
>     m_keyCount = 0;
>     m_deletedCount = 0;
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    m_index = static_cast<unsigned*>(debugHeap().calloc(1, dataSize()));
>+#else
>     m_index = static_cast<unsigned*>(fastZeroedMalloc(dataSize()));
>+#endif
> 
>     for (; iter != end; ++iter) {
>         ASSERT(canInsert());
>         reinsert(*iter);
>     }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    debugHeap().free(oldEntryIndices);
>+#else
>     fastFree(oldEntryIndices);
>+#endif
>+
> }
> 
> inline unsigned PropertyTable::tableCapacity() const { return m_indexSize >> 1; }
>diff --git a/Source/JavaScriptCore/runtime/PropertyTable.cpp b/Source/JavaScriptCore/runtime/PropertyTable.cpp
>index 59ec41c49ae82f47f6986806dd6143944a42b5d6..5cd0eb8b09f4ae13807a6ff5651571e5667989ef 100644
>--- a/Source/JavaScriptCore/runtime/PropertyTable.cpp
>+++ b/Source/JavaScriptCore/runtime/PropertyTable.cpp
>@@ -32,6 +32,14 @@ namespace JSC {
> 
> const ClassInfo PropertyTable::s_info = { "PropertyTable", nullptr, nullptr, nullptr, CREATE_METHOD_TABLE(PropertyTable) };
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& PropertyTable::debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit JSC PropertyTable");
>+    return heap;
>+}
>+#endif
>+
> PropertyTable* PropertyTable::create(VM& vm, unsigned initialCapacity)
> {
>     PropertyTable* table = new (NotNull, allocateCell<PropertyTable>(vm.heap)) PropertyTable(vm, initialCapacity);
>@@ -57,7 +65,11 @@ PropertyTable::PropertyTable(VM& vm, unsigned initialCapacity)
>     : JSCell(vm, vm.propertyTableStructure.get())
>     , m_indexSize(sizeForCapacity(initialCapacity))
>     , m_indexMask(m_indexSize - 1)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    , m_index(static_cast<unsigned*>(debugHeap().calloc(1, dataSize())))
>+#else
>     , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
>+#endif
>     , m_keyCount(0)
>     , m_deletedCount(0)
> {
>@@ -68,7 +80,11 @@ PropertyTable::PropertyTable(VM& vm, const PropertyTable& other)
>     : JSCell(vm, vm.propertyTableStructure.get())
>     , m_indexSize(other.m_indexSize)
>     , m_indexMask(other.m_indexMask)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    , m_index(static_cast<unsigned*>(debugHeap().malloc(dataSize())))
>+#else
>     , m_index(static_cast<unsigned*>(fastMalloc(dataSize())))
>+#endif
>     , m_keyCount(other.m_keyCount)
>     , m_deletedCount(other.m_deletedCount)
> {
>@@ -90,7 +106,11 @@ PropertyTable::PropertyTable(VM& vm, unsigned initialCapacity, const PropertyTab
>     : JSCell(vm, vm.propertyTableStructure.get())
>     , m_indexSize(sizeForCapacity(initialCapacity))
>     , m_indexMask(m_indexSize - 1)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    , m_index(static_cast<unsigned*>(debugHeap().calloc(1, dataSize())))
>+#else
>     , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
>+#endif
>     , m_keyCount(0)
>     , m_deletedCount(0)
> {
>@@ -121,7 +141,12 @@ PropertyTable::~PropertyTable()
>     for (iterator iter = begin(); iter != end; ++iter)
>         iter->key->deref();
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    debugHeap().free(m_index);
>+#else
>     fastFree(m_index);
>+#endif
>+
> }
> 
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/SymbolTable.cpp b/Source/JavaScriptCore/runtime/SymbolTable.cpp
>index ced975fb3e210537f707ff3031b7222a2124deb1..9c0738135b9adaaabb2fcb5f679fb24632d65310 100644
>--- a/Source/JavaScriptCore/runtime/SymbolTable.cpp
>+++ b/Source/JavaScriptCore/runtime/SymbolTable.cpp
>@@ -39,6 +39,14 @@ namespace JSC {
> 
> const ClassInfo SymbolTable::s_info = { "SymbolTable", nullptr, nullptr, nullptr, CREATE_METHOD_TABLE(SymbolTable) };
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SymbolTableEntry::FatEntry::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> SymbolTableEntry& SymbolTableEntry::copySlow(const SymbolTableEntry& other)
> {
>     ASSERT(other.isFat());
>diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
>index 342af2ee040bd3667717eda37a2d9b41882106cf..92628e7557d96ffb85efabb21dd4537d619a8c65 100644
>--- a/Source/JavaScriptCore/runtime/SymbolTable.h
>+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
>@@ -330,7 +330,11 @@ private:
>     static const intptr_t FlagBits = 6;
>     
>     class FatEntry {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(SymbolTableEntry::FatEntry);
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     public:
>         FatEntry(intptr_t bits)
>             : m_bits(bits & ~SlimFlag)
>diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
>index 9eb3f0d059bf37f6020b0eb1b8851b3c1f0edff6..8f71b2551d543486c9acfb8e6ca3aa0f90af6126 100644
>--- a/Source/JavaScriptCore/runtime/VM.cpp
>+++ b/Source/JavaScriptCore/runtime/VM.cpp
>@@ -243,6 +243,14 @@ bool VM::isInMiniMode()
>     return !canUseJIT() || Options::forceMiniVMMode();
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+DebugHeap& VMDebugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit VM");
>+    return heap;
>+}
>+#endif
>+
> VM::VM(VMType vmType, HeapType heapType)
>     : m_apiLock(adoptRef(new JSLock(this)))
> #if USE(CF)
>@@ -353,6 +361,9 @@ VM::VM(VMType vmType, HeapType heapType)
>     , m_typeProfilerEnabledCount(0)
>     , m_primitiveGigacageEnabled(IsWatched)
>     , m_controlFlowProfilerEnabledCount(0)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    , m_exceptionFuzzBuffer(VMDebugHeap())
>+#endif
>     , m_shadowChicken(std::make_unique<ShadowChicken>())
> {
>     interpreter = new Interpreter(*this);
>@@ -580,8 +591,13 @@ VM::~VM()
> #endif
> 
> #if ENABLE(DFG_JIT)
>-    for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
>+    for (unsigned i = 0; i < m_scratchBuffers.size(); ++i) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        VMDebugHeap().free(m_scratchBuffers[i]);
>+#else
>         fastFree(m_scratchBuffers[i]);
>+#endif
>+    }
> #endif
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
>index 586ffa3b6a3751aeccf5efbfdb9d156ee78b39a4..513da41b5d6ff9c169797d6bec09961c47d1a397 100644
>--- a/Source/JavaScriptCore/runtime/VM.h
>+++ b/Source/JavaScriptCore/runtime/VM.h
>@@ -216,6 +216,10 @@ private:
> 
> class ConservativeRoots;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& VMDebugHeap();
>+#endif
>+
> #if COMPILER(MSVC)
> #pragma warning(push)
> #pragma warning(disable: 4200) // Disable "zero-sized array in struct/union" warning
>@@ -228,8 +232,11 @@ struct ScratchBuffer {
> 
>     static ScratchBuffer* create(size_t size)
>     {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        ScratchBuffer* result = new (VMDebugHeap().malloc(ScratchBuffer::allocationSize(size))) ScratchBuffer;
>+#else
>         ScratchBuffer* result = new (fastMalloc(ScratchBuffer::allocationSize(size))) ScratchBuffer;
>-
>+#endif
>         return result;
>     }
> 
>@@ -679,8 +686,13 @@ public:
>     EncodedJSValue* exceptionFuzzingBuffer(size_t size)
>     {
>         ASSERT(Options::useExceptionFuzz());
>-        if (!m_exceptionFuzzBuffer)
>+        if (!m_exceptionFuzzBuffer) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            m_exceptionFuzzBuffer = MallocPtr<EncodedJSValue>::malloc(size, VMDebugHeap());
>+#else
>             m_exceptionFuzzBuffer = MallocPtr<EncodedJSValue>::malloc(size);
>+#endif
>+        }
>         return m_exceptionFuzzBuffer.get();
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/WeakMapImpl.h b/Source/JavaScriptCore/runtime/WeakMapImpl.h
>index 088bac5fcf616901efd35791575c7c462dda3116..3386b976399dddc30fa7de1b27d9a91060d7c42c 100644
>--- a/Source/JavaScriptCore/runtime/WeakMapImpl.h
>+++ b/Source/JavaScriptCore/runtime/WeakMapImpl.h
>@@ -180,7 +180,11 @@ public:
>     static MallocPtr<WeakMapBuffer, JSValueMalloc> create(uint32_t capacity)
>     {
>         size_t allocationSize = WeakMapBuffer::allocationSize(capacity);
>-        auto buffer = MallocPtr<WeakMapBuffer, JSValueMalloc>::malloc(allocationSize);
>+        auto buffer = MallocPtr<WeakMapBuffer, JSValueMalloc>::malloc(allocationSize
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            , VMDebugHeap()
>+#endif
>+            );
>         buffer->reset(capacity);
>         return buffer;
>     }
>@@ -207,6 +211,9 @@ public:
> 
>     WeakMapImpl(VM& vm, Structure* structure)
>         : Base(vm, structure)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_buffer(VMDebugHeap())
>+#endif
>     {
>     }
> 
>diff --git a/Source/JavaScriptCore/wasm/WasmInstance.cpp b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>index dcbaa357e63a2beb9594f635a6805495c6306983..5b9c775d9277da882599cd65d84182a57e0e19cd 100644
>--- a/Source/JavaScriptCore/wasm/WasmInstance.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>@@ -44,7 +44,11 @@ size_t globalMemoryByteSize(Module& module)
> Instance::Instance(Context* context, Ref<Module>&& module, EntryFrame** pointerToTopEntryFrame, void** pointerToActualStackLimit, StoreTopCallFrameCallback&& storeTopCallFrame)
>     : m_context(context)
>     , m_module(WTFMove(module))
>-    , m_globals(MallocPtr<uint64_t>::malloc(globalMemoryByteSize(m_module.get())))
>+    , m_globals(MallocPtr<uint64_t>::malloc(globalMemoryByteSize(m_module.get())
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , VMDebugHeap()
>+#endif
>+        ))
>     , m_pointerToTopEntryFrame(pointerToTopEntryFrame)
>     , m_pointerToActualStackLimit(pointerToActualStackLimit)
>     , m_storeTopCallFrame(WTFMove(storeTopCallFrame))
>diff --git a/Source/JavaScriptCore/wasm/WasmTable.cpp b/Source/JavaScriptCore/wasm/WasmTable.cpp
>index 04ac0652559a6d938f09b06aee201f912e9e4c68..745632180bd9b31db1efc331b0b002661c70a1c5 100644
>--- a/Source/JavaScriptCore/wasm/WasmTable.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmTable.cpp
>@@ -59,6 +59,10 @@ Table::~Table()
> }
> 
> Table::Table(uint32_t initial, std::optional<uint32_t> maximum)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    : m_importableFunctions(VMDebugHeap())
>+    , m_instances(VMDebugHeap())
>+#endif
> {
>     setLength(initial);
>     m_maximum = maximum;
>@@ -66,9 +70,17 @@ Table::Table(uint32_t initial, std::optional<uint32_t> maximum)
> 
>     // FIXME: It might be worth trying to pre-allocate maximum here. The spec recommends doing so.
>     // But for now, we're not doing that.
>-    m_importableFunctions = MallocPtr<WasmToWasmImportableFunction>::malloc((sizeof(WasmToWasmImportableFunction) * Checked<size_t>(allocatedLength(m_length))).unsafeGet());
>+    m_importableFunctions = MallocPtr<WasmToWasmImportableFunction>::malloc((sizeof(WasmToWasmImportableFunction) * Checked<size_t>(allocatedLength(m_length))).unsafeGet()
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , VMDebugHeap()
>+#endif
>+        );
>     // FIXME this over-allocates and could be smarter about not committing all of that memory https://bugs.webkit.org/show_bug.cgi?id=181425
>-    m_instances = MallocPtr<Instance*>::malloc((sizeof(Instance*) * Checked<size_t>(allocatedLength(m_length))).unsafeGet());
>+    m_instances = MallocPtr<Instance*>::malloc((sizeof(Instance*) * Checked<size_t>(allocatedLength(m_length))).unsafeGet()
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , VMDebugHeap()
>+#endif
>+    );
>     for (uint32_t i = 0; i < allocatedLength(m_length); ++i) {
>         new (&m_importableFunctions.get()[i]) WasmToWasmImportableFunction();
>         ASSERT(m_importableFunctions.get()[i].signatureIndex == Wasm::Signature::invalidIndex); // We rely on this in compiled code.
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp
>index a5033d50f481307201583322d114eabec821bde6..15536053394a692831453da434ef3a72794b144d 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp
>@@ -59,11 +59,18 @@ Structure* JSWebAssemblyTable::createStructure(VM& vm, JSGlobalObject* globalObj
> JSWebAssemblyTable::JSWebAssemblyTable(VM& vm, Structure* structure, Ref<Wasm::Table>&& table)
>     : Base(vm, structure)
>     , m_table(WTFMove(table))
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    , m_jsFunctions(VMDebugHeap())
>+#endif
> {
>     // FIXME: It might be worth trying to pre-allocate maximum here. The spec recommends doing so.
>     // But for now, we're not doing that.
>     // FIXME this over-allocates and could be smarter about not committing all of that memory https://bugs.webkit.org/show_bug.cgi?id=181425
>-    m_jsFunctions = MallocPtr<PoisonedBarrier<JSObject>>::malloc((sizeof(PoisonedBarrier<JSObject>) * Checked<size_t>(allocatedLength())).unsafeGet());
>+    m_jsFunctions = MallocPtr<PoisonedBarrier<JSObject>>::malloc((sizeof(PoisonedBarrier<JSObject>) * Checked<size_t>(allocatedLength())).unsafeGet()
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , VMDebugHeap()
>+#endif
>+        );
>     for (uint32_t i = 0; i < allocatedLength(); ++i)
>         new(&m_jsFunctions.get()[i]) PoisonedBarrier<JSObject>();
> }
>diff --git a/Source/WTF/WTF.xcodeproj/project.pbxproj b/Source/WTF/WTF.xcodeproj/project.pbxproj
>index ef1b33b7fe0782f1d87405993f6f4106b1066e20..e7883ed52d75d8cc3873105f5e8e90bd298c4c5f 100644
>--- a/Source/WTF/WTF.xcodeproj/project.pbxproj
>+++ b/Source/WTF/WTF.xcodeproj/project.pbxproj
>@@ -36,11 +36,19 @@
> 		0F824A681B7443A0002E345D /* ParkingLot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F824A641B7443A0002E345D /* ParkingLot.cpp */; };
> 		0F8E85DB1FD485B000691889 /* CountingLock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8E85DA1FD485B000691889 /* CountingLock.cpp */; };
> 		0F8F2B92172E0103007DBDA5 /* CompilationThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B8F172E00F0007DBDA5 /* CompilationThread.cpp */; };
>+		0F95B63320CB4B7700479635 /* DebugHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F95B63220CB4B7700479635 /* DebugHeap.cpp */; };
>+		0F95B63520CB53C100479635 /* Vector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F95B63420CB53C100479635 /* Vector.cpp */; };
>+		0F95B63720CB5EFD00479635 /* StringBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F95B63620CB5EFD00479635 /* StringBuffer.cpp */; };
> 		0F9D3360165DBA73005AD387 /* FilePrintStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D335B165DBA73005AD387 /* FilePrintStream.cpp */; };
> 		0F9D3362165DBA73005AD387 /* PrintStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D335D165DBA73005AD387 /* PrintStream.cpp */; };
>+		0FA6F38F20CC580F00A03DCD /* SegmentedVector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F38E20CC580E00A03DCD /* SegmentedVector.cpp */; };
>+		0FA6F39120CC61EB00A03DCD /* RefCountedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F39020CC61EB00A03DCD /* RefCountedArray.cpp */; };
>+		0FA6F39320CC73A300A03DCD /* SmallPtrSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F39220CC73A200A03DCD /* SmallPtrSet.cpp */; };
>+		0FA6F39520CCACE900A03DCD /* UniqueArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA6F39420CCACE900A03DCD /* UniqueArray.cpp */; };
> 		0FDDBFA71666DFA300C55FEF /* StringPrintStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDDBFA51666DFA300C55FEF /* StringPrintStream.cpp */; };
> 		0FE1646A1B6FFC9600400E7C /* Lock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE164681B6FFC9600400E7C /* Lock.cpp */; };
> 		0FE4479C1B7AAA03009498EB /* WordLock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE4479A1B7AAA03009498EB /* WordLock.cpp */; };
>+		0FEBA64220CF37100074941C /* Bag.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEBA64120CF37100074941C /* Bag.cpp */; };
> 		0FEC3C5E1F368A9700F59B6C /* ReadWriteLock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC3C5C1F368A9700F59B6C /* ReadWriteLock.cpp */; };
> 		0FFF19DC1BB334EB00886D91 /* ParallelHelperPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFF19DA1BB334EB00886D91 /* ParallelHelperPool.cpp */; };
> 		14022F4118F5C3FC007FF0EB /* libbmalloc.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 14022F4018F5C3FC007FF0EB /* libbmalloc.a */; };
>@@ -232,12 +240,20 @@
> 		0F8F2B9B172F2594007DBDA5 /* ConversionMode.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ConversionMode.h; sourceTree = "<group>"; };
> 		0F93274A1C17F4B700CF6564 /* Box.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Box.h; sourceTree = "<group>"; };
> 		0F9495831C571CC900413A48 /* OrderMaker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OrderMaker.h; sourceTree = "<group>"; };
>+		0F95B63120CB4B7700479635 /* DebugHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebugHeap.h; sourceTree = "<group>"; };
>+		0F95B63220CB4B7700479635 /* DebugHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebugHeap.cpp; sourceTree = "<group>"; };
>+		0F95B63420CB53C100479635 /* Vector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Vector.cpp; sourceTree = "<group>"; };
>+		0F95B63620CB5EFD00479635 /* StringBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringBuffer.cpp; sourceTree = "<group>"; };
> 		0F9D335B165DBA73005AD387 /* FilePrintStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FilePrintStream.cpp; sourceTree = "<group>"; };
> 		0F9D335C165DBA73005AD387 /* FilePrintStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FilePrintStream.h; sourceTree = "<group>"; };
> 		0F9D335D165DBA73005AD387 /* PrintStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrintStream.cpp; sourceTree = "<group>"; };
> 		0F9D335E165DBA73005AD387 /* PrintStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrintStream.h; sourceTree = "<group>"; };
> 		0F9DAA041FD1C37B0079C5B2 /* StackShot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackShot.h; sourceTree = "<group>"; };
> 		0F9DAA051FD1C37B0079C5B2 /* StackShotProfiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackShotProfiler.h; sourceTree = "<group>"; };
>+		0FA6F38E20CC580E00A03DCD /* SegmentedVector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SegmentedVector.cpp; sourceTree = "<group>"; };
>+		0FA6F39020CC61EB00A03DCD /* RefCountedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RefCountedArray.cpp; sourceTree = "<group>"; };
>+		0FA6F39220CC73A200A03DCD /* SmallPtrSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmallPtrSet.cpp; sourceTree = "<group>"; };
>+		0FA6F39420CCACE900A03DCD /* UniqueArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UniqueArray.cpp; sourceTree = "<group>"; };
> 		0FB14E18180FA218009B6B4D /* Bag.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Bag.h; sourceTree = "<group>"; };
> 		0FB14E1A1810E1DA009B6B4D /* BagToHashMap.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = BagToHashMap.h; sourceTree = "<group>"; };
> 		0FB317C31C488001007E395A /* SystemTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SystemTracing.h; sourceTree = "<group>"; };
>@@ -257,6 +273,7 @@
> 		0FE4479B1B7AAA03009498EB /* WordLock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WordLock.h; sourceTree = "<group>"; };
> 		0FEB3DCE1BB5D684009D7AAD /* SharedTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SharedTask.h; sourceTree = "<group>"; };
> 		0FEB3DD01BB7366B009D7AAD /* ParallelVectorIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParallelVectorIterator.h; sourceTree = "<group>"; };
>+		0FEBA64120CF37100074941C /* Bag.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Bag.cpp; sourceTree = "<group>"; };
> 		0FEC3C4F1F323C6800F59B6C /* CagedPtr.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = CagedPtr.h; sourceTree = "<group>"; };
> 		0FEC3C5C1F368A9700F59B6C /* ReadWriteLock.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = ReadWriteLock.cpp; sourceTree = "<group>"; };
> 		0FEC3C5D1F368A9700F59B6C /* ReadWriteLock.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ReadWriteLock.h; sourceTree = "<group>"; };
>@@ -811,6 +828,7 @@
> 				0F43D8EF1DB5ADDC00108FB6 /* AutomaticThread.cpp */,
> 				0F43D8F01DB5ADDC00108FB6 /* AutomaticThread.h */,
> 				DCEE22041CEB9869000C2396 /* BackwardsGraph.h */,
>+				0FEBA64120CF37100074941C /* Bag.cpp */,
> 				0FB14E18180FA218009B6B4D /* Bag.h */,
> 				0FB14E1A1810E1DA009B6B4D /* BagToHashMap.h */,
> 				A8A4725F151A825A004123FF /* Bitmap.h */,
>@@ -863,6 +881,8 @@
> 				A8A47278151A825A004123FF /* DataLog.h */,
> 				A8A47279151A825A004123FF /* DateMath.cpp */,
> 				A8A4727A151A825A004123FF /* DateMath.h */,
>+				0F95B63220CB4B7700479635 /* DebugHeap.cpp */,
>+				0F95B63120CB4B7700479635 /* DebugHeap.h */,
> 				996B17841EBA441C007E10EB /* DebugUtilities.h */,
> 				A8A4727B151A825A004123FF /* DecimalNumber.cpp */,
> 				A8A4727C151A825A004123FF /* DecimalNumber.h */,
>@@ -1035,6 +1055,7 @@
> 				A8A472FE151A825B004123FF /* RedBlackTree.h */,
> 				26299B6D17A9E5B800ADEBE5 /* Ref.h */,
> 				A8A472FF151A825B004123FF /* RefCounted.h */,
>+				0FA6F39020CC61EB00A03DCD /* RefCountedArray.cpp */,
> 				A8A47300151A825B004123FF /* RefCountedArray.h */,
> 				A8A47301151A825B004123FF /* RefCountedLeakCounter.cpp */,
> 				A8A47302151A825B004123FF /* RefCountedLeakCounter.h */,
>@@ -1053,6 +1074,7 @@
> 				0FEC84B01BDACD390080FF74 /* ScopedLambda.h */,
> 				0F66B2841DC97BAB004A1D3F /* Seconds.cpp */,
> 				0F66B2851DC97BAB004A1D3F /* Seconds.h */,
>+				0FA6F38E20CC580E00A03DCD /* SegmentedVector.cpp */,
> 				A8A47306151A825B004123FF /* SegmentedVector.h */,
> 				A8A47307151A825B004123FF /* SentinelLinkedList.h */,
> 				A8A4731A151A825B004123FF /* SetForScope.h */,
>@@ -1066,6 +1088,7 @@
> 				A748744F17A0BDAE00FA04CB /* SixCharacterHash.cpp */,
> 				A748745017A0BDAE00FA04CB /* SixCharacterHash.h */,
> 				A8A4730C151A825B004123FF /* SizeLimits.cpp */,
>+				0FA6F39220CC73A200A03DCD /* SmallPtrSet.cpp */,
> 				7936D6A91C99F8AE000D1AED /* SmallPtrSet.h */,
> 				A30D412D1F0DE13F00B71954 /* SoftLinking.h */,
> 				A8A4730D151A825B004123FF /* Spectrum.h */,
>@@ -1111,6 +1134,7 @@
> 				149EF16216BBFE0D000A4331 /* TriState.h */,
> 				83FBA93119DF459700F30ADB /* TypeCasts.h */,
> 				A8A4735C151A825B004123FF /* UnionFind.h */,
>+				0FA6F39420CCACE900A03DCD /* UniqueArray.cpp */,
> 				E300E521203D645F00DA79BE /* UniqueArray.h */,
> 				5C7C88D31D0A3A0A009D2F6D /* UniqueRef.h */,
> 				CD7600FF1F90A3CA00026E26 /* UnsafePointer.h */,
>@@ -1119,6 +1143,7 @@
> 				A8A4736F151A825B004123FF /* ValueCheck.h */,
> 				7CD0D5A71D55322A000CC9E1 /* Variant.h */,
> 				A8A47370151A825B004123FF /* Vector.h */,
>+				0F95B63420CB53C100479635 /* Vector.cpp */,
> 				A8A47371151A825B004123FF /* VectorTraits.h */,
> 				A8A47372151A825B004123FF /* VMTags.h */,
> 				0F66B2881DC97BAB004A1D3F /* WallTime.cpp */,
>@@ -1202,6 +1227,7 @@
> 				C2BCFC541F621F3F00C9222C /* LineEnding.h */,
> 				14E785E71DFB330100209BD1 /* OrdinalNumber.h */,
> 				A8A47323151A825B004123FF /* StringBuffer.h */,
>+				0F95B63620CB5EFD00479635 /* StringBuffer.cpp */,
> 				A8A47324151A825B004123FF /* StringBuilder.cpp */,
> 				A8A47325151A825B004123FF /* StringBuilder.h */,
> 				E38D6E261F5522E300A75CC4 /* StringBuilderJSON.cpp */,
>@@ -1444,10 +1470,12 @@
> 			files = (
> 				A8A47386151A825B004123FF /* Assertions.cpp in Sources */,
> 				A8A47435151A825B004123FF /* AtomicString.cpp in Sources */,
>+				0FA6F39520CCACE900A03DCD /* UniqueArray.cpp in Sources */,
> 				70ECA60D1B02426800449739 /* AtomicStringImpl.cpp in Sources */,
> 				A5BA15FA182435A600A82E69 /* AtomicStringImplCF.cpp in Sources */,
> 				9BC70F05176C379D00101DEC /* AtomicStringTable.cpp in Sources */,
> 				1469419D16EAB10A0024E146 /* AutodrainedPool.cpp in Sources */,
>+				0F95B63720CB5EFD00479635 /* StringBuffer.cpp in Sources */,
> 				0F43D8F11DB5ADDC00108FB6 /* AutomaticThread.cpp in Sources */,
> 				8134013815B092FD001FF0B8 /* Base64.cpp in Sources */,
> 				A8A473A8151A825B004123FF /* bignum-dtoa.cc in Sources */,
>@@ -1509,6 +1537,7 @@
> 				A8A473F4151A825B004123FF /* NumberOfCores.cpp in Sources */,
> 				A8A473F7151A825B004123FF /* OSAllocatorPosix.cpp in Sources */,
> 				A8A473F9151A825B004123FF /* OSRandomSource.cpp in Sources */,
>+				0FA6F38F20CC580F00A03DCD /* SegmentedVector.cpp in Sources */,
> 				A8A47402151A825B004123FF /* PageBlock.cpp in Sources */,
> 				0FFF19DC1BB334EB00886D91 /* ParallelHelperPool.cpp in Sources */,
> 				0F824A681B7443A0002E345D /* ParkingLot.cpp in Sources */,
>@@ -1519,6 +1548,7 @@
> 				0F9D3362165DBA73005AD387 /* PrintStream.cpp in Sources */,
> 				7AF023B52061E17000A8EFD6 /* ProcessPrivilege.cpp in Sources */,
> 				143F611F1565F0F900DB514A /* RAMSize.cpp in Sources */,
>+				0F95B63320CB4B7700479635 /* DebugHeap.cpp in Sources */,
> 				A3B725EC987446AD93F1A440 /* RandomDevice.cpp in Sources */,
> 				A8A47414151A825B004123FF /* RandomNumber.cpp in Sources */,
> 				0FEC3C5E1F368A9700F59B6C /* ReadWriteLock.cpp in Sources */,
>@@ -1526,6 +1556,7 @@
> 				2CDED0F318115C85004DBA70 /* RunLoop.cpp in Sources */,
> 				2CDED0EF18115C38004DBA70 /* RunLoopCF.cpp in Sources */,
> 				1469419316EAAF6D0024E146 /* RunLoopTimerCF.cpp in Sources */,
>+				0FA6F39120CC61EB00A03DCD /* RefCountedArray.cpp in Sources */,
> 				1469419916EAB0410024E146 /* SchedulePairCF.cpp in Sources */,
> 				1469419716EAAFF80024E146 /* SchedulePairMac.mm in Sources */,
> 				0F66B28E1DC97BAB004A1D3F /* Seconds.cpp in Sources */,
>@@ -1534,6 +1565,7 @@
> 				A748745217A0BDAE00FA04CB /* SixCharacterHash.cpp in Sources */,
> 				A8A47425151A825B004123FF /* SizeLimits.cpp in Sources */,
> 				A8A47427151A825B004123FF /* StackBounds.cpp in Sources */,
>+				0FA6F39320CC73A300A03DCD /* SmallPtrSet.cpp in Sources */,
> 				FEDACD3D1630F83F00C69634 /* StackStats.cpp in Sources */,
> 				3337DB9CE743410FAF076E17 /* StackTrace.cpp in Sources */,
> 				A8A4743C151A825B004123FF /* StringBuilder.cpp in Sources */,
>@@ -1554,10 +1586,12 @@
> 				1C181C961D30800A00F5FA16 /* TextBreakIteratorInternalICUMac.mm in Sources */,
> 				A3E4DD931F3A803400DED0B4 /* TextStream.cpp in Sources */,
> 				E311FB171F0A568B003C08DE /* ThreadGroup.cpp in Sources */,
>+				0F95B63520CB53C100479635 /* Vector.cpp in Sources */,
> 				A8A4744A151A825B004123FF /* Threading.cpp in Sources */,
> 				A8A4744E151A825B004123FF /* ThreadingPthreads.cpp in Sources */,
> 				5311BD5C1EA822F900525281 /* ThreadMessage.cpp in Sources */,
> 				0F66B2901DC97BAB004A1D3F /* TimeWithDynamicClockType.cpp in Sources */,
>+				0FEBA64220CF37100074941C /* Bag.cpp in Sources */,
> 				0F7075F51FBF53CD00489AF0 /* TimingScope.cpp in Sources */,
> 				1C181C8F1D307AB800F5FA16 /* UTextProvider.cpp in Sources */,
> 				1C181C911D307AB800F5FA16 /* UTextProviderLatin1.cpp in Sources */,
>diff --git a/Source/WTF/wtf/Bag.cpp b/Source/WTF/wtf/Bag.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..fe7d7312c4205ab8333074bade6372c97ae34088
>--- /dev/null
>+++ b/Source/WTF/wtf/Bag.cpp
>@@ -0,0 +1,46 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+ * THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "Bag.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include "NeverDestroyed.h"
>+#endif
>+
>+namespace WTF {
>+namespace Private {
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& bagNodeDebugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit BagNode");
>+    return heap;
>+}
>+#endif
>+
>+} // namespace Private
>+} // namespace WTF
>+
>diff --git a/Source/WTF/wtf/Bag.h b/Source/WTF/wtf/Bag.h
>index f66eed38d18cba59fb4b76f02ccf1c23e4571f46..408acb2e60208345f80a096cb47666be3cb2ac5b 100644
>--- a/Source/WTF/wtf/Bag.h
>+++ b/Source/WTF/wtf/Bag.h
>@@ -34,9 +34,35 @@ namespace WTF {
> 
> namespace Private {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+extern WTF::DebugHeap& bagNodeDebugHeap();
>+#endif
>+
> template<typename T>
> class BagNode {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+public:
>+    void* operator new(size_t size)
>+    {
>+        return bagNodeDebugHeap().malloc(size);
>+    }
>+
>+    void operator delete(void* p)
>+    {
>+        bagNodeDebugHeap().free(p);
>+    }
>+
>+    void* operator new(size_t, void* p) { return p; }
>+    void* operator new[](size_t, void* p) { return p; }
>+
>+    void* operator new(size_t, NotNullTag, void* location)
>+    {
>+        ASSERT(location);
>+        return location;
>+    }
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     template<typename... Args>
>     BagNode(Args&&... args)
>diff --git a/Source/WTF/wtf/DebugHeap.cpp b/Source/WTF/wtf/DebugHeap.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..9e5bac5fea05fdfcdb85099c5cd46ee22684e45c
>--- /dev/null
>+++ b/Source/WTF/wtf/DebugHeap.cpp
>@@ -0,0 +1,81 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "DebugHeap.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#include <cstdlib>
>+#include <thread>
>+
>+namespace WTF {
>+
>+DebugHeap::DebugHeap(const char* heapName)
>+    : m_zone(malloc_create_zone(0, 0))
>+{
>+    malloc_set_zone_name(m_zone, heapName);
>+}
>+
>+void* DebugHeap::malloc(size_t size)
>+{
>+    void* result = malloc_zone_malloc(m_zone, size);
>+    if (!result)
>+        CRASH();
>+    return result;
>+}
>+
>+void* DebugHeap::calloc(size_t numElements, size_t elementSize)
>+{
>+    void* result = malloc_zone_calloc(m_zone, numElements, elementSize);
>+    if (!result)
>+        CRASH();
>+    return result;
>+}
>+
>+void* DebugHeap::memalign(size_t alignment, size_t size, bool crashOnFailure)
>+{
>+    void* result = malloc_zone_memalign(m_zone, alignment, size);
>+    if (!result && crashOnFailure)
>+        CRASH();
>+    return result;
>+}
>+
>+void* DebugHeap::realloc(void* object, size_t size)
>+{
>+    void* result = malloc_zone_realloc(m_zone, object, size);
>+    if (!result)
>+        CRASH();
>+    return result;
>+}
>+
>+void DebugHeap::free(void* object)
>+{
>+    malloc_zone_free(m_zone, object);
>+}
>+
>+#endif // ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+} // namespace WTF
>diff --git a/Source/WTF/wtf/DebugHeap.h b/Source/WTF/wtf/DebugHeap.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..3f61ae1eb1ea6d93902fa15bb8c9bb889f8adc3c
>--- /dev/null
>+++ b/Source/WTF/wtf/DebugHeap.h
>@@ -0,0 +1,57 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef WTF_DebugHeap_h
>+#define WTF_DebugHeap_h
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#if OS(DARWIN)
>+#include <malloc/malloc.h>
>+#endif
>+
>+namespace WTF {
>+
>+class DebugHeap {
>+public:
>+    WTF_EXPORT_PRIVATE DebugHeap(const char* heapName);
>+    
>+    WTF_EXPORT_PRIVATE void* malloc(size_t);
>+    WTF_EXPORT_PRIVATE void* calloc(size_t numElements, size_t elementSize);
>+    WTF_EXPORT_PRIVATE void* memalign(size_t alignment, size_t, bool crashOnFailure);
>+    WTF_EXPORT_PRIVATE void* realloc(void*, size_t);
>+    WTF_EXPORT_PRIVATE void free(void*);
>+    
>+private:
>+#if OS(DARWIN)
>+    malloc_zone_t* m_zone;
>+#endif
>+};
>+
>+} // namespace WTF
>+
>+#endif // ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#endif // WTF_DebugHeap_h
>diff --git a/Source/WTF/wtf/FastMalloc.cpp b/Source/WTF/wtf/FastMalloc.cpp
>index 74d1b5654d21ce8e12d31f0a214e0397bf74d6fd..64daf085f451d81f57b257db4d51e3ad7b43541e 100644
>--- a/Source/WTF/wtf/FastMalloc.cpp
>+++ b/Source/WTF/wtf/FastMalloc.cpp
>@@ -43,6 +43,20 @@
> #include <malloc/malloc.h>
> #endif
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include "Atomics.h"
>+#include "HashMap.h"
>+#include "Lock.h"
>+#include "NeverDestroyed.h"
>+#include "SetForScope.h"
>+#include "StackShot.h"
>+
>+#if PLATFORM(COCOA)
>+#include <notify.h>
>+#endif
>+
>+#endif
>+
> namespace WTF {
> 
> #if !defined(NDEBUG)
>@@ -260,6 +274,174 @@ void fastEnableMiniMode() { }
> 
> namespace WTF {
> 
>+#define TRACK_MALLOCS 0
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+
>+static std::atomic<unsigned> avoidRecordingCount;
>+
>+class AvoidRecordingScope {
>+public:
>+    AvoidRecordingScope()
>+    {
>+        ++avoidRecordingCount;
>+    }
>+
>+    ~AvoidRecordingScope()
>+    {
>+        --avoidRecordingCount;
>+    }
>+};
>+
>+class MallocCallTracker
>+{
>+public:
>+    MallocCallTracker();
>+
>+    void recordMalloc(void*, size_t);
>+    void recordRealloc(void* oldAddress, void* newAddress, size_t);
>+    void recordFree(void*);
>+    
>+    void dumpStats();
>+
>+    static MallocCallTracker& singleton();
>+
>+private:
>+    struct MallocSiteData {
>+        StackShot stack;
>+        size_t size;
>+        
>+        MallocSiteData(size_t stackSize, size_t allocationSize)
>+            : stack(stackSize)
>+            , size(allocationSize)
>+        {
>+        }
>+    };
>+
>+    HashMap<void*, std::unique_ptr<MallocSiteData>> m_addressMallocSiteData;
>+    Lock m_mutex;
>+};
>+
>+MallocCallTracker& MallocCallTracker::singleton()
>+{
>+    AvoidRecordingScope avoidRecording;
>+    static NeverDestroyed<MallocCallTracker> tracker;
>+    return tracker;
>+}
>+
>+
>+MallocCallTracker::MallocCallTracker()
>+{
>+    int token;
>+    notify_register_dispatch("com.apple.WebKit.dumpUntrackedMallocs", &token, dispatch_get_main_queue(), ^(int) {
>+        MallocCallTracker::singleton().dumpStats();
>+    });
>+}
>+
>+void MallocCallTracker::recordMalloc(void* address, size_t allocationSize)
>+{
>+    AvoidRecordingScope avoidRecording;
>+
>+    const size_t stackSize = 10;
>+    auto siteData = std::make_unique<MallocSiteData>(stackSize, allocationSize);
>+
>+    LockHolder lockHolder(m_mutex);
>+    auto addResult = m_addressMallocSiteData.add(address, WTFMove(siteData));
>+//    if (!addResult.isNewEntry)
>+//        WTFLogAlways("recordMalloc saw address %p for the second time", address);
>+    UNUSED_PARAM(addResult);
>+}
>+
>+void MallocCallTracker::recordRealloc(void* oldAddress, void* newAddress, size_t newSize)
>+{
>+    AvoidRecordingScope avoidRecording;
>+
>+    LockHolder lockHolder(m_mutex);
>+
>+    auto it = m_addressMallocSiteData.find(oldAddress);
>+    if (it == m_addressMallocSiteData.end()) {
>+        ASSERT_NOT_REACHED();
>+        return;
>+    }
>+    
>+    it->value->size = newSize;
>+    auto addResult = m_addressMallocSiteData.add(newAddress, WTFMove(it->value));
>+    ASSERT(addResult.isNewEntry);
>+    
>+    m_addressMallocSiteData.remove(it);
>+}
>+
>+void MallocCallTracker::recordFree(void* address)
>+{
>+    AvoidRecordingScope avoidRecording;
>+
>+    LockHolder lockHolder(m_mutex);
>+    bool removed = m_addressMallocSiteData.remove(address);
>+    UNUSED_PARAM(removed);
>+//    if (!removed)
>+//        WTFLogAlways("recordFree got address %p for which there is no entry", address);
>+}
>+
>+void MallocCallTracker::dumpStats()
>+{
>+    AvoidRecordingScope avoidRecording;
>+
>+    {
>+        LockHolder lockHolder(m_mutex);
>+
>+        // Build a hash of stack to address vector
>+        struct MallocSiteTotals {
>+            Vector<MallocSiteData*> siteData;
>+            size_t count { 0 };
>+            size_t totalSize { 0 };
>+        };
>+
>+        size_t totalUntrackedSize = 0;
>+        size_t totalUntrackedCount = 0;
>+
>+        HashMap<unsigned, std::unique_ptr<MallocSiteTotals>> callSiteToMallocData;
>+        for (const auto& it : m_addressMallocSiteData) {
>+            auto result = callSiteToMallocData.ensure(it.value->stack.hash(), [] () {
>+                return std::make_unique<MallocSiteTotals>();
>+            });
>+            auto& siteTotal = result.iterator->value;
>+            siteTotal->siteData.append(it.value.get());
>+            ++siteTotal->count;
>+            siteTotal->totalSize += it.value->size;
>+            totalUntrackedSize += it.value->size;
>+            ++totalUntrackedCount;
>+        }
>+        
>+        Vector<unsigned> stackHashes;
>+        auto stackKeys = callSiteToMallocData.keys();
>+        for (auto key : stackKeys)
>+            stackHashes.append(key);
>+        
>+        // Sort by reverse total size.
>+        std::sort(stackHashes.begin(), stackHashes.end(), [&] (unsigned a, unsigned b) {
>+            const auto& aSiteTotals = callSiteToMallocData.get(a);
>+            const auto& bSiteTotals = callSiteToMallocData.get(b);
>+
>+            return aSiteTotals->totalSize > bSiteTotals->totalSize;
>+        });
>+
>+        WTFLogAlways("Total untracked bytes: %lu (%lu allocations)\n", totalUntrackedSize, totalUntrackedCount);
>+
>+        const size_t numStacksToDump = 100;
>+        for (size_t i = 0; i < std::min(numStacksToDump, stackHashes.size()); ++i) {
>+            const auto& mallocDataForStack = callSiteToMallocData.get(stackHashes[i]);
>+
>+            WTFLogAlways("Total allocation size: %lu (%lu allocations)\n", mallocDataForStack->totalSize, mallocDataForStack->count);
>+            const size_t framesToSkip = 6;
>+            WTFPrintBacktrace(mallocDataForStack->siteData[0]->stack.array() + framesToSkip, mallocDataForStack->siteData[0]->stack.size() - framesToSkip);
>+            WTFLogAlways("\n");
>+        }
>+    }
>+}
>+
>+#endif
>+
>+
> bool isFastMallocEnabled()
> {
>     return bmalloc::api::isEnabled();
>@@ -267,8 +449,19 @@ bool isFastMallocEnabled()
> 
> void* fastMalloc(size_t size)
> {
>+//    if (size > 255) {
>+//        WTFLogAlways("fastMalloc %lu\n", size);
>+//        WTFReportBacktrace();
>+//        WTFLogAlways("\n");
>+//    }
>+
>     ASSERT_IS_WITHIN_LIMIT(size);
>-    return bmalloc::api::malloc(size);
>+    void* result = bmalloc::api::malloc(size);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+    if (!avoidRecordingCount)
>+        MallocCallTracker::singleton().recordMalloc(result, size);
>+#endif
>+    return result;
> }
> 
> void* fastCalloc(size_t numElements, size_t elementSize)
>@@ -285,12 +478,21 @@ void* fastCalloc(size_t numElements, size_t elementSize)
> void* fastRealloc(void* object, size_t size)
> {
>     ASSERT_IS_WITHIN_LIMIT(size);
>-    return bmalloc::api::realloc(object, size);
>+    void* result = bmalloc::api::realloc(object, size);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+    if (!avoidRecordingCount)
>+        MallocCallTracker::singleton().recordRealloc(object, result, size);
>+#endif
>+    return result;
> }
> 
> void fastFree(void* object)
> {
>     bmalloc::api::free(object);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+    if (!avoidRecordingCount)
>+        MallocCallTracker::singleton().recordFree(object);
>+#endif
> }
> 
> size_t fastMallocSize(const void*)
>@@ -309,13 +511,23 @@ size_t fastMallocGoodSize(size_t size)
> void* fastAlignedMalloc(size_t alignment, size_t size) 
> {
>     ASSERT_IS_WITHIN_LIMIT(size);
>-    return bmalloc::api::memalign(alignment, size);
>+    void* result = bmalloc::api::memalign(alignment, size);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+    if (!avoidRecordingCount)
>+        MallocCallTracker::singleton().recordMalloc(result, size);
>+#endif
>+    return result;
> }
> 
> void* tryFastAlignedMalloc(size_t alignment, size_t size) 
> {
>     FAIL_IF_EXCEEDS_LIMIT(size);
>-    return bmalloc::api::tryMemalign(alignment, size);
>+    void* result = bmalloc::api::tryMemalign(alignment, size);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN) && TRACK_MALLOCS
>+    if (!avoidRecordingCount)
>+        MallocCallTracker::singleton().recordMalloc(result, size);
>+#endif
>+    return result;
> }
> 
> void fastAlignedFree(void* p) 
>diff --git a/Source/WTF/wtf/FastMalloc.h b/Source/WTF/wtf/FastMalloc.h
>index 9d7d7ffa6cd7e13eea8255b280c4ad0892c343fc..8723d2d7598c33b5523690abdb16750a38c56f0f 100644
>--- a/Source/WTF/wtf/FastMalloc.h
>+++ b/Source/WTF/wtf/FastMalloc.h
>@@ -25,6 +25,10 @@
> #include <stdlib.h>
> #include <wtf/StdLibExtras.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> namespace WTF {
> 
> #if !defined(NDEBUG)
>@@ -299,4 +303,53 @@ typedef int __thisIsHereToForceASemicolonAfterThisMacro
>     WTF_MAKE_FAST_ALLOCATED_IMPL \
> typedef int __thisIsHereToForceASemicolonAfterThisMacro
> 
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#define WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP_IMPL(classname) \
>+    void* operator new(size_t, void* p) { return p; } \
>+    void* operator new[](size_t, void* p) { return p; } \
>+    \
>+    void* operator new(size_t size) \
>+    { \
>+        return debugHeap("WebKit "#classname).malloc(size); \
>+    } \
>+    \
>+    void operator delete(void* p) \
>+    { \
>+        debugHeap("WebKit "#classname).free(p); \
>+    } \
>+    \
>+    void* operator new[](size_t size) \
>+    { \
>+        return debugHeap("WebKit "#classname).malloc(size); \
>+    } \
>+    \
>+    void operator delete[](void* p) \
>+    { \
>+        debugHeap("WebKit "#classname).free(p); \
>+    } \
>+    void* operator new(size_t, NotNullTag, void* location) \
>+    { \
>+        ASSERT(location); \
>+        return location; \
>+    } \
>+
>+#define WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(classname) \
>+public: \
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP_IMPL(classname) \
>+private: \
>+    WTF_EXPORT static WTF::DebugHeap& debugHeap(const char*); \
>+typedef int __thisIsHereToForceASemicolonAfterThisMacro
>+
>+#define WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(className) \
>+private: \
>+    WTF_EXPORT static WTF::DebugHeap& debugHeap(const char*); \
>+public: \
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP_IMPL(className) \
>+typedef int __thisIsHereToForceASemicolonAfterThisMacro
>+
>+#endif // ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+
> #endif /* WTF_FastMalloc_h */
>diff --git a/Source/WTF/wtf/HashTable.cpp b/Source/WTF/wtf/HashTable.cpp
>index 0eb6036c863fb113fec891256e5075944114abe1..58c5374de64c74caf1d3cc1a0bf12bf9c9f6d9b4 100644
>--- a/Source/WTF/wtf/HashTable.cpp
>+++ b/Source/WTF/wtf/HashTable.cpp
>@@ -21,10 +21,19 @@
> #include "HashTable.h"
> 
> #include "DataLog.h"
>+#include "NeverDestroyed.h"
> #include <mutex>
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+DebugHeap& hashTableHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit HashTable");
>+    return heap;
>+}
>+#endif
>+
> #if DUMP_HASHTABLE_STATS
> 
> std::atomic<unsigned> HashTableStats::numAccesses;
>diff --git a/Source/WTF/wtf/HashTable.h b/Source/WTF/wtf/HashTable.h
>index e6a950fd400936cc4bff3d864a247852eadb35de..dd06bfcfd3580a8f01e6a79f2fd77d0fca7e8379 100644
>--- a/Source/WTF/wtf/HashTable.h
>+++ b/Source/WTF/wtf/HashTable.h
>@@ -42,8 +42,16 @@
> #include <wtf/DataLog.h>
> #endif
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE DebugHeap& hashTableHeap();
>+#endif
>+
> // Enables internal WTF consistency checks that are invoked automatically. Non-WTF callers can call checkTableConsistency() even if internal checks are disabled.
> #define CHECK_HASHTABLE_CONSISTENCY 0
> 
>@@ -1142,9 +1150,19 @@ namespace WTF {
>     {
>         // would use a template member function with explicit specializations here, but
>         // gcc doesn't appear to support that
>-        if (Traits::emptyValueIsZero)
>+        if (Traits::emptyValueIsZero) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            return static_cast<ValueType*>(hashTableHeap().calloc(size, sizeof(ValueType)));
>+#else
>             return static_cast<ValueType*>(fastZeroedMalloc(size * sizeof(ValueType)));
>+#endif
>+        }
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        ValueType* result = static_cast<ValueType*>(hashTableHeap().malloc(size * sizeof(ValueType)));
>+#else
>         ValueType* result = static_cast<ValueType*>(fastMalloc(size * sizeof(ValueType)));
>+#endif
>         for (unsigned i = 0; i < size; i++)
>             initializeBucket(result[i]);
>         return result;
>@@ -1157,7 +1175,11 @@ namespace WTF {
>             if (!isDeletedBucket(table[i]))
>                 table[i].~ValueType();
>         }
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        hashTableHeap().free(table);
>+#else
>         fastFree(table);
>+#endif
>     }
> 
>     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
>@@ -1219,7 +1241,11 @@ namespace WTF {
> 
>         m_deletedCount = 0;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        hashTableHeap().free(oldTable);
>+#else
>         fastFree(oldTable);
>+#endif
> 
>         internalCheckTableConsistency();
>         return newEntry;
>diff --git a/Source/WTF/wtf/MallocPtr.h b/Source/WTF/wtf/MallocPtr.h
>index 66f10aa9bd5bba09ac561136ad35bf5e84e48fca..3f0df7773c1d1cdf1d8eba39b8ac6c290ce504b6 100644
>--- a/Source/WTF/wtf/MallocPtr.h
>+++ b/Source/WTF/wtf/MallocPtr.h
>@@ -28,6 +28,10 @@
> 
> #include <wtf/FastMalloc.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> // MallocPtr is a smart pointer class that calls fastFree in its destructor.
> // It is intended to be used for pointers where the C++ lifetime semantics
> // (calling constructors and destructors) is not desired. 
>@@ -36,24 +40,46 @@ namespace WTF {
> 
> template<typename T, typename Malloc = FastMalloc> class MallocPtr {
> public:
>-    MallocPtr()
>+    MallocPtr(
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        DebugHeap& heap
>+#endif
>+    )
>         : m_ptr(nullptr)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_heap(heap)
>+#endif
>     {
>     }
> 
>-    MallocPtr(std::nullptr_t)
>+    MallocPtr(std::nullptr_t
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap& heap
>+#endif
>+        )
>         : m_ptr(nullptr)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_heap(heap)
>+#endif
>     {
>     }
> 
>     MallocPtr(MallocPtr&& other)
>         : m_ptr(other.leakPtr())
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_heap(other.m_heap)
>+#endif
>     {
>     }
> 
>     ~MallocPtr()
>     {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_heap.free(m_ptr);
>+#else
>         Malloc::free(m_ptr);
>+#endif
>+
>     }
> 
>     T* get() const
>@@ -98,39 +124,91 @@ public:
>     void swap(MallocPtr& other)
>     {
>         std::swap(m_ptr, other.m_ptr);
>+        std::swap(m_heap, other.m_heap);
>     }
> 
>-    template<typename U> friend MallocPtr<U> adoptMallocPtr(U*);
>+    template<typename U> friend MallocPtr<U> adoptMallocPtr(U*
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap&
>+#endif
>+        );
> 
>-    static MallocPtr malloc(size_t size)
>+    static MallocPtr malloc(size_t size
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap& heap
>+#endif
>+        )
>     {
>-        return MallocPtr { static_cast<T*>(Malloc::malloc(size)) };
>+        return MallocPtr {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            static_cast<T*>(heap.malloc(size)), heap
>+#else
>+            static_cast<T*>(Malloc::malloc(size))
>+#endif
>+        };
>     }
> 
>-    static MallocPtr tryMalloc(size_t size)
>+    static MallocPtr tryMalloc(size_t size
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap& heap
>+#endif
>+        )
>     {
>-        return MallocPtr { static_cast<T*>(Malloc::tryMalloc(size)) };
>+        return MallocPtr {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            static_cast<T*>(heap.malloc(size)), heap
>+#else
>+            static_cast<T*>(Malloc::tryMalloc(size))
>+#endif
>+        };
>     }
> 
>     void realloc(size_t newSize)
>     {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_ptr = static_cast<T*>(m_heap.realloc(m_ptr, newSize));
>+#else
>         m_ptr = static_cast<T*>(Malloc::realloc(m_ptr, newSize));
>+#endif
>+
>     }
> 
> private:
>-    explicit MallocPtr(T* ptr)
>+    explicit MallocPtr(T* ptr
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap& heap
>+#endif
>+        )
>         : m_ptr(ptr)
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , m_heap(heap)
>+#endif
>     {
>     }
> 
>     T* m_ptr;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    DebugHeap& m_heap;
>+#endif
> };
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static_assert(sizeof(MallocPtr<int>) == 2 * sizeof(int*), "");
>+#else
> static_assert(sizeof(MallocPtr<int>) == sizeof(int*), "");
>+#endif
> 
>-template<typename U> MallocPtr<U> adoptMallocPtr(U* ptr)
>+template<typename U> MallocPtr<U> adoptMallocPtr(U* ptr
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , DebugHeap& heap
>+#endif
>+)
> {
>-    return MallocPtr<U>(ptr);
>+    return MallocPtr<U>(ptr
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , heap
>+#endif
>+        );
> }
> 
> } // namespace WTF
>diff --git a/Source/WTF/wtf/MetaAllocator.cpp b/Source/WTF/wtf/MetaAllocator.cpp
>index b8e01c083d39c1e19fcd1c5b561908460d5a6195..d2253d7bb4c949264f407df2e960bd1806e03f64 100644
>--- a/Source/WTF/wtf/MetaAllocator.cpp
>+++ b/Source/WTF/wtf/MetaAllocator.cpp
>@@ -33,8 +33,26 @@
> #include <wtf/FastMalloc.h>
> #include <wtf/ProcessID.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/NeverDestroyed.h>
>+#endif
>+
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& MetaAllocatorHandle::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+static WTF::DebugHeap& metaAllocatorFreeSpaceDebugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit MetaAllocatorFreeSpace");
>+    return heap;
>+}
>+#endif
>+
> MetaAllocator::~MetaAllocator()
> {
>     for (FreeSpaceNode* node = m_freeSpaceSizeMap.first(); node;) {
>@@ -444,7 +462,11 @@ MetaAllocator::FreeSpaceNode* MetaAllocator::allocFreeSpaceNode()
> #ifndef NDEBUG
>     m_mallocBalance++;
> #endif
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    return new (NotNull, metaAllocatorFreeSpaceDebugHeap().malloc(sizeof(FreeSpaceNode))) FreeSpaceNode();
>+#else
>     return new (NotNull, fastMalloc(sizeof(FreeSpaceNode))) FreeSpaceNode();
>+#endif
> }
> 
> void MetaAllocator::freeFreeSpaceNode(FreeSpaceNode* node)
>@@ -452,7 +474,12 @@ void MetaAllocator::freeFreeSpaceNode(FreeSpaceNode* node)
> #ifndef NDEBUG
>     m_mallocBalance--;
> #endif
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    metaAllocatorFreeSpaceDebugHeap().free(node);
>+#else
>     fastFree(node);
>+#endif
>+
> }
> 
> #if ENABLE(META_ALLOCATOR_PROFILE)
>diff --git a/Source/WTF/wtf/MetaAllocatorHandle.h b/Source/WTF/wtf/MetaAllocatorHandle.h
>index 81ad71cbb380fd65fa6f2ccc34eee159ad274038..bb5e34edc96b83d69b816516a50c5d961bc3fac5 100644
>--- a/Source/WTF/wtf/MetaAllocatorHandle.h
>+++ b/Source/WTF/wtf/MetaAllocatorHandle.h
>@@ -40,6 +40,9 @@ class MetaAllocator;
> class PrintStream;
> 
> class MetaAllocatorHandle : public ThreadSafeRefCounted<MetaAllocatorHandle>, public RedBlackTree<MetaAllocatorHandle, void*>::Node {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(MetaAllocatorHandle);
>+#endif
> private:
>     MetaAllocatorHandle(MetaAllocator*, void* start, size_t sizeInBytes, void* ownerUID);
> 
>diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
>index 02817717daeb7098577fc65c35e3df20a522ff60..0468c45d66ba8de512b314f292bc98fb4fd436c4 100644
>--- a/Source/WTF/wtf/Platform.h
>+++ b/Source/WTF/wtf/Platform.h
>@@ -1111,6 +1111,11 @@
> #endif
> #endif
> 
>+#if !defined(ENABLE_MALLOC_HEAP_BREAKDOWN) && !defined(NDEBUG)
>+/* Enable this to put each ISOHeap and other allocation categories into their own malloc heaps, so that tools like vmmap can show how big each heap is. */
>+#define ENABLE_MALLOC_HEAP_BREAKDOWN 1
>+#endif
>+
> #if PLATFORM(IOS) || PLATFORM(MAC)
> #define USE_COREMEDIA 1
> #define USE_VIDEOTOOLBOX 1
>diff --git a/Source/WTF/wtf/RefCountedArray.cpp b/Source/WTF/wtf/RefCountedArray.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..9672ce1832ea0c586e2d5085f3d6780905402f70
>--- /dev/null
>+++ b/Source/WTF/wtf/RefCountedArray.cpp
>@@ -0,0 +1,42 @@
>+/*
>+ * Copyright (C) 2011-2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "RefCountedArray.h"
>+#include <wtf/NeverDestroyed.h>
>+
>+namespace WTF {
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+DebugHeap& refCountedArrayHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit RefCountedArray");
>+    return heap;
>+}
>+
>+#endif
>+
>+} // namespace WTF
>diff --git a/Source/WTF/wtf/RefCountedArray.h b/Source/WTF/wtf/RefCountedArray.h
>index 3f68363bc5b7491f4e7499816e82b4097ab9129f..e36caa8cfe0e1594f6d51ca4b1c3a2d7269b3cef 100644
>--- a/Source/WTF/wtf/RefCountedArray.h
>+++ b/Source/WTF/wtf/RefCountedArray.h
>@@ -44,6 +44,10 @@
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE WTF::DebugHeap& refCountedArrayHeap();
>+#endif
>+
> template<typename T, typename PtrTraits = DumbPtrTraits<T>>
> class RefCountedArray {
>     enum CommonCopyConstructorTag { CommonCopyConstructor };
>@@ -68,7 +72,11 @@ public:
>             return;
>         }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        T* data = (static_cast<Header*>(refCountedArrayHeap().malloc(Header::size() + sizeof(T) * size)))->payload();
>+#else
>         T* data = (static_cast<Header*>(fastMalloc(Header::size() + sizeof(T) * size)))->payload();
>+#endif
>         m_data = data;
>         Header::fromPayload(data)->refCount = 1;
>         Header::fromPayload(data)->length = size;
>@@ -95,7 +103,11 @@ public:
>             return;
>         }
>         
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        T* data = (static_cast<Header*>(refCountedArrayHeap().malloc(Header::size() + sizeof(T) * other.size())))->payload();
>+#else
>         T* data = (static_cast<Header*>(fastMalloc(Header::size() + sizeof(T) * other.size())))->payload();
>+#endif
>         m_data = data;
>         Header::fromPayload(data)->refCount = 1;
>         Header::fromPayload(data)->length = other.size();
>@@ -117,7 +129,12 @@ public:
>         if (--Header::fromPayload(oldData)->refCount)
>             return *this;
>         VectorTypeOperations<T>::destruct(oldData, oldData + Header::fromPayload(oldData)->length);
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        refCountedArrayHeap().free(Header::fromPayload(oldData));
>+#else
>         fastFree(Header::fromPayload(oldData));
>+#endif
>         return *this;
>     }
> 
>@@ -131,7 +148,13 @@ public:
>         if (--Header::fromPayload(data)->refCount)
>             return;
>         VectorTypeOperations<T>::destruct(begin(), end());
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        refCountedArrayHeap().free(Header::fromPayload(data));
>+#else
>         fastFree(Header::fromPayload(data));
>+#endif
>+
>     }
>     
>     unsigned refCount() const
>diff --git a/Source/WTF/wtf/SegmentedVector.cpp b/Source/WTF/wtf/SegmentedVector.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..b8d2488407040341f5fb1a94c88618bc5d7769c7
>--- /dev/null
>+++ b/Source/WTF/wtf/SegmentedVector.cpp
>@@ -0,0 +1,47 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ *
>+ * 1.  Redistributions of source code must retain the above copyright
>+ *     notice, this list of conditions and the following disclaimer.
>+ * 2.  Redistributions in binary form must reproduce the above copyright
>+ *     notice, this list of conditions and the following disclaimer in the
>+ *     documentation and/or other materials provided with the distribution.
>+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
>+ *     its contributors may be used to endorse or promote products derived
>+ *     from this software without specific prior written permission.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
>+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
>+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
>+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
>+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
>+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
>+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
>+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+
>+#include "config.h"
>+#include "SegmentedVector.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#include "NeverDestroyed.h"
>+
>+namespace WTF {
>+
>+DebugHeap& segmentedVectorHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit SegmentedVector");
>+    return heap;
>+}
>+
>+} // namespace WTF
>+
>+#endif // ENABLE(MALLOC_HEAP_BREAKDOWN)
>diff --git a/Source/WTF/wtf/SegmentedVector.h b/Source/WTF/wtf/SegmentedVector.h
>index 3e3fe0072f517e023972aabbb00052fe57b4bd33..237aff94eb91cfa385a9d56e58a621dc548fe2fa 100644
>--- a/Source/WTF/wtf/SegmentedVector.h
>+++ b/Source/WTF/wtf/SegmentedVector.h
>@@ -34,6 +34,8 @@
> 
> namespace WTF {
> 
>+    DebugHeap& segmentedVectorHeap();
>+
>     // An iterator for SegmentedVector. It supports only the pre ++ operator
>     template <typename T, size_t SegmentSize = 8> class SegmentedVector;
>     template <typename T, size_t SegmentSize = 8> class SegmentedVectorIterator {
>@@ -226,8 +228,13 @@ namespace WTF {
>         {
>             for (size_t i = 0; i < m_size; ++i)
>                 at(i).~T();
>-            for (size_t i = 0; i < m_segments.size(); ++i)
>+            for (size_t i = 0; i < m_segments.size(); ++i) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                segmentedVectorHeap().free(m_segments[i]);
>+#else
>                 fastFree(m_segments[i]);
>+#endif
>+            }
>         }
> 
>         bool segmentExistsFor(size_t index)
>@@ -263,7 +270,11 @@ namespace WTF {
> 
>         void allocateSegment()
>         {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            m_segments.append(static_cast<Segment*>(segmentedVectorHeap().malloc(sizeof(T) * SegmentSize)));
>+#else
>             m_segments.append(static_cast<Segment*>(fastMalloc(sizeof(T) * SegmentSize)));
>+#endif
>         }
> 
>         size_t m_size { 0 };
>diff --git a/Source/WTF/wtf/SmallPtrSet.cpp b/Source/WTF/wtf/SmallPtrSet.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..3c57b6e3377300cba675eb2e97f3295ccebd4b4f
>--- /dev/null
>+++ b/Source/WTF/wtf/SmallPtrSet.cpp
>@@ -0,0 +1,43 @@
>+/*
>+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "SmallPtrSet.h"
>+
>+#include "NeverDestroyed.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+namespace WTF {
>+
>+DebugHeap& smallPtrSetHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit smallPtrSetHeap");
>+    return heap;
>+}
>+
>+} // namespace WTF
>+
>+#endif
>diff --git a/Source/WTF/wtf/SmallPtrSet.h b/Source/WTF/wtf/SmallPtrSet.h
>index da36c8da4d8ae74a15e39d1272a2ae1e4883fa3e..977020713aef76e1dc516fc0a4c9f90c44b6fa84 100644
>--- a/Source/WTF/wtf/SmallPtrSet.h
>+++ b/Source/WTF/wtf/SmallPtrSet.h
>@@ -33,6 +33,10 @@
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE DebugHeap& smallPtrSetHeap();
>+#endif
>+
> template<typename PtrType, unsigned SmallArraySize = 8>
> class SmallPtrSet {
>     WTF_MAKE_NONCOPYABLE(SmallPtrSet);
>@@ -71,8 +75,13 @@ public:
> 
>     ~SmallPtrSet()
>     {
>-        if (!isSmall())
>+        if (!isSmall()) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            smallPtrSetHeap().free(m_buffer);
>+#else
>             fastFree(m_buffer);
>+#endif
>+        }
>     }
> 
>     inline void add(PtrType ptr)
>@@ -208,7 +217,11 @@ private:
>         bool wasSmall = isSmall();
>         void** oldBuffer = wasSmall ? m_smallStorage : m_buffer;
>         unsigned oldCapacity = m_capacity;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_buffer = static_cast<void**>(smallPtrSetHeap().malloc(allocationSize));
>+#else
>         m_buffer = static_cast<void**>(fastMalloc(allocationSize));
>+#endif
>         memset(m_buffer, -1, allocationSize);
>         m_capacity = size;
> 
>@@ -219,8 +232,13 @@ private:
>             }
>         }
> 
>-        if (!wasSmall)
>+        if (!wasSmall) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            smallPtrSetHeap().free(oldBuffer);
>+#else
>             fastFree(oldBuffer);
>+#endif
>+        }
>     }
> 
> 
>diff --git a/Source/WTF/wtf/UniqueArray.cpp b/Source/WTF/wtf/UniqueArray.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..b131b7c776553ff9a755a262a005a0faf9261463
>--- /dev/null
>+++ b/Source/WTF/wtf/UniqueArray.cpp
>@@ -0,0 +1,45 @@
>+/*
>+ *  Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ *  This library is free software; you can redistribute it and/or
>+ *  modify it under the terms of the GNU Library General Public
>+ *  License as published by the Free Software Foundation; either
>+ *  version 2 of the License, or (at your option) any later version.
>+ *
>+ *  This library is distributed in the hope that it will be useful,
>+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
>+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>+ *  Library General Public License for more details.
>+ *
>+ *  You should have received a copy of the GNU Library General Public License
>+ *  along with this library; see the file COPYING.LIB.  If not, write to
>+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
>+ *  Boston, MA 02110-1301, USA.
>+ *
>+ */
>+
>+#include "config.h"
>+#include "UniqueArray.h"
>+#include "NeverDestroyed.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+namespace WTF {
>+
>+DebugHeap& uniqueArrayHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit UniqueArray");
>+    return heap;
>+}
>+
>+DebugHeap& uniqueArrayElementHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit UniqueArrayElement");
>+    return heap;
>+}
>+
>+} // namespace WTF
>+
>+#endif
>+
>+
>diff --git a/Source/WTF/wtf/UniqueArray.h b/Source/WTF/wtf/UniqueArray.h
>index a2b85853529311db46298535d3262c211a10426c..e4d511aa3d684dcec963507d3d391a572544a9a0 100644
>--- a/Source/WTF/wtf/UniqueArray.h
>+++ b/Source/WTF/wtf/UniqueArray.h
>@@ -31,11 +31,46 @@
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE DebugHeap& uniqueArrayHeap();
>+WTF_EXPORT_PRIVATE DebugHeap& uniqueArrayElementHeap();
>+#endif
>+
> template<bool isTriviallyDestructible, typename T> struct UniqueArrayMaker;
> 
>+template<typename T>
>+struct UniqueArrayFree {
>+    static_assert(std::is_trivially_destructible<T>::value, "");
>+
>+    void operator()(T* pointer) const
>+    {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        uniqueArrayHeap().free(const_cast<typename std::remove_cv<T>::type*>(pointer));
>+#else
>+        fastFree(const_cast<typename std::remove_cv<T>::type*>(pointer));
>+#endif
>+    }
>+};
>+
>+template<typename T>
>+struct UniqueArrayFree<T[]> {
>+    static_assert(std::is_trivially_destructible<T>::value, "");
>+
>+    void operator()(T* pointer) const
>+    {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        uniqueArrayHeap().free(const_cast<typename std::remove_cv<T>::type*>(pointer));
>+#else
>+        fastFree(const_cast<typename std::remove_cv<T>::type*>(pointer));
>+#endif
>+
>+    }
>+};
>+
>+
> template<typename T>
> struct UniqueArrayMaker<true, T> {
>-    using ResultType = typename std::unique_ptr<T[], FastFree<T[]>>;
>+    using ResultType = typename std::unique_ptr<T[], UniqueArrayFree<T[]>>;
> 
>     static ResultType make(size_t size)
>     {
>@@ -49,7 +84,11 @@ struct UniqueArrayMaker<true, T> {
>         // Do not use placement new like `new (storage) T[size]()`. `new T[size]()` requires
>         // larger storage than the `sizeof(T) * size` storage since it want to store `size`
>         // to somewhere.
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        T* storage = static_cast<T*>(uniqueArrayHeap().malloc((Checked<size_t>(sizeof(T)) * size).unsafeGet()));
>+#else
>         T* storage = static_cast<T*>(fastMalloc((Checked<size_t>(sizeof(T)) * size).unsafeGet()));
>+#endif
>         VectorTypeOperations<T>::initialize(storage, storage + size);
>         return ResultType(storage);
>     }
>@@ -62,7 +101,38 @@ struct UniqueArrayMaker<false, T> {
>     // UniqueArrayElement has new [] and delete [] operators for FastMalloc. We allocate UniqueArrayElement[] and cast
>     // it to T[]. When deleting, the custom deleter casts T[] to UniqueArrayElement[] and deletes it.
>     class UniqueArrayElement {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+public:
>+    void* operator new(size_t, void* p) { return p; }
>+    void* operator new[](size_t, void* p) { return p; }
>+    void* operator new(size_t size)
>+    {
>+        return uniqueArrayElementHeap().malloc(size);
>+    }
>+
>+    void operator delete(void* p)
>+    {
>+        uniqueArrayElementHeap().free(p);
>+    }
>+
>+    void* operator new[](size_t size)
>+    {
>+        return uniqueArrayElementHeap().malloc(size);
>+    }
>+
>+    void operator delete[](void* p)
>+    {
>+        uniqueArrayElementHeap().free(p);
>+    }
>+
>+    void* operator new(size_t, NotNullTag, void* location)
>+    {
>+        ASSERT(location);
>+        return location;
>+    }
>+#else
>         WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     public:
>         struct Deleter {
>             void operator()(T* pointer)
>diff --git a/Source/WTF/wtf/Vector.cpp b/Source/WTF/wtf/Vector.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..c269cff27a421927b62165c2c620555943b8ef9b
>--- /dev/null
>+++ b/Source/WTF/wtf/Vector.cpp
>@@ -0,0 +1,38 @@
>+/*
>+ *  Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ *  This library is free software; you can redistribute it and/or
>+ *  modify it under the terms of the GNU Library General Public
>+ *  License as published by the Free Software Foundation; either
>+ *  version 2 of the License, or (at your option) any later version.
>+ *
>+ *  This library is distributed in the hope that it will be useful,
>+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
>+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>+ *  Library General Public License for more details.
>+ *
>+ *  You should have received a copy of the GNU Library General Public License
>+ *  along with this library; see the file COPYING.LIB.  If not, write to
>+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
>+ *  Boston, MA 02110-1301, USA.
>+ *
>+ */
>+
>+#include "config.h"
>+#include "Vector.h"
>+#include "NeverDestroyed.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+namespace WTF {
>+
>+DebugHeap& vectorHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit Vector");
>+    return heap;
>+}
>+
>+} // namespace WTF
>+
>+#endif
>+
>diff --git a/Source/WTF/wtf/Vector.h b/Source/WTF/wtf/Vector.h
>index 66e3be2ae688b0fd5e348c074a5c3f54f890a384..342f14c777388a3b2fb96ccace3992447008faf0 100644
>--- a/Source/WTF/wtf/Vector.h
>+++ b/Source/WTF/wtf/Vector.h
>@@ -37,12 +37,20 @@
> #include <wtf/ValueCheck.h>
> #include <wtf/VectorTraits.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> #if ASAN_ENABLED
> extern "C" void __sanitizer_annotate_contiguous_container(const void* begin, const void* end, const void* old_mid, const void* new_mid);
> #endif
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE DebugHeap& vectorHeap();
>+#endif
>+
> template <bool needsDestruction, typename T>
> struct VectorDestructor;
> 
>@@ -287,7 +295,11 @@ public:
>             CRASH();
>         size_t sizeToAllocate = newCapacity * sizeof(T);
>         m_capacity = sizeToAllocate / sizeof(T);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_buffer = static_cast<T*>(vectorHeap().malloc(sizeToAllocate));
>+#else
>         m_buffer = static_cast<T*>(fastMalloc(sizeToAllocate));
>+#endif
>     }
> 
>     bool tryAllocateBuffer(size_t newCapacity)
>@@ -298,11 +310,21 @@ public:
> 
>         size_t sizeToAllocate = newCapacity * sizeof(T);
>         T* newBuffer;
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        if ((newBuffer = static_cast<T*>(vectorHeap().malloc(sizeToAllocate)))) {
>+            m_capacity = sizeToAllocate / sizeof(T);
>+            m_buffer = newBuffer;
>+            return true;
>+        }
>+#else
>         if (tryFastMalloc(sizeToAllocate).getValue(newBuffer)) {
>             m_capacity = sizeToAllocate / sizeof(T);
>             m_buffer = newBuffer;
>             return true;
>         }
>+#endif
>+
>         return false;
>     }
> 
>@@ -318,7 +340,12 @@ public:
>             CRASH();
>         size_t sizeToAllocate = newCapacity * sizeof(T);
>         m_capacity = sizeToAllocate / sizeof(T);
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_buffer = static_cast<T*>(vectorHeap().realloc(m_buffer, sizeToAllocate));
>+#else
>         m_buffer = static_cast<T*>(fastRealloc(m_buffer, sizeToAllocate));
>+#endif
>     }
> 
>     void deallocateBuffer(T* bufferToDeallocate)
>@@ -331,7 +358,12 @@ public:
>             m_capacity = 0;
>         }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        vectorHeap().free(bufferToDeallocate);
>+#else
>         fastFree(bufferToDeallocate);
>+#endif
>+
>     }
> 
>     T* buffer() { return m_buffer; }
>@@ -344,7 +376,11 @@ public:
>         T* buffer = m_buffer;
>         m_buffer = 0;
>         m_capacity = 0;
>-        return adoptMallocPtr(buffer);
>+        return adoptMallocPtr(buffer
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            , vectorHeap()
>+#endif
>+        );
>     }
> 
> protected:
>@@ -544,7 +580,7 @@ public:
>     MallocPtr<T> releaseBuffer()
>     {
>         if (buffer() == inlineBuffer())
>-            return nullptr;
>+            return { vectorHeap() };
>         return Base::releaseBuffer();
>     }
> 
>@@ -1548,7 +1584,11 @@ inline MallocPtr<T> Vector<T, inlineCapacity, OverflowHandler, minCapacity>::rel
>         // that means it was using the inline buffer. In that case,
>         // we create a brand new buffer so the caller always gets one.
>         size_t bytes = m_size * sizeof(T);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        buffer = adoptMallocPtr(static_cast<T*>(vectorHeap().malloc(bytes)), vectorHeap());
>+#else
>         buffer = adoptMallocPtr(static_cast<T*>(fastMalloc(bytes)));
>+#endif
>         memcpy(buffer.get(), data(), bytes);
>     }
>     m_size = 0;
>diff --git a/Source/WTF/wtf/text/CString.cpp b/Source/WTF/wtf/text/CString.cpp
>index 07ae161eb7e1c46e389c6df5dfc175a59ae5dfea..91eaa495aebb3dc336373fb5084478e55ef2ff40 100644
>--- a/Source/WTF/wtf/text/CString.cpp
>+++ b/Source/WTF/wtf/text/CString.cpp
>@@ -30,15 +30,31 @@
> #include <string.h>
> #include <wtf/text/StringHasher.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/NeverDestroyed.h>
>+#endif
>+
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+DebugHeap& CStringBufferHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit CStringBuffer");
>+    return heap;
>+}
>+#endif
>+
> Ref<CStringBuffer> CStringBuffer::createUninitialized(size_t length)
> {
>     RELEASE_ASSERT(length < (std::numeric_limits<unsigned>::max() - sizeof(CStringBuffer)));
> 
>     // The +1 is for the terminating null character.
>     size_t size = sizeof(CStringBuffer) + length + 1;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    CStringBuffer* stringBuffer = static_cast<CStringBuffer*>(CStringBufferHeap().malloc(size));
>+#else
>     CStringBuffer* stringBuffer = static_cast<CStringBuffer*>(fastMalloc(size));
>+#endif
>     return adoptRef(*new (NotNull, stringBuffer) CStringBuffer(length));
> }
> 
>diff --git a/Source/WTF/wtf/text/CString.h b/Source/WTF/wtf/text/CString.h
>index 34793a4d6ac645802629d8a48d4aacfa8e00dd5b..17750da13833f41eb3660786fa3dd051bdcf1609 100644
>--- a/Source/WTF/wtf/text/CString.h
>+++ b/Source/WTF/wtf/text/CString.h
>@@ -33,6 +33,10 @@
> 
> namespace WTF {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF_EXPORT_PRIVATE DebugHeap& CStringBufferHeap();
>+#endif
>+
> // CStringBuffer is the ref-counted storage class for the characters in a CString.
> // The data is implicitly allocated 1 character longer than length(), as it is zero-terminated.
> class CStringBuffer : public RefCounted<CStringBuffer> {
>@@ -40,6 +44,13 @@ public:
>     const char* data() { return mutableData(); }
>     size_t length() const { return m_length; }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void operator delete(void* p)
>+    {
>+        CStringBufferHeap().free(p);
>+    }
>+#endif
>+
> private:
>     friend class CString;
> 
>diff --git a/Source/WTF/wtf/text/StringBuffer.cpp b/Source/WTF/wtf/text/StringBuffer.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..908533de8fe4dcf2e8d8552b0197bfd05c89c468
>--- /dev/null
>+++ b/Source/WTF/wtf/text/StringBuffer.cpp
>@@ -0,0 +1,46 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ *
>+ * 1.  Redistributions of source code must retain the above copyright
>+ *     notice, this list of conditions and the following disclaimer. 
>+ * 2.  Redistributions in binary form must reproduce the above copyright
>+ *     notice, this list of conditions and the following disclaimer in the
>+ *     documentation and/or other materials provided with the distribution. 
>+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of its
>+ *     contributors may be used to endorse or promote products derived
>+ *     from this software without specific prior written permission. 
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
>+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
>+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
>+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
>+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
>+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
>+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
>+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "StringBuffer.h"
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+
>+#include "NeverDestroyed.h"
>+
>+namespace WTF {
>+
>+DebugHeap& stringBufferHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit StringBuffer");
>+    return heap;
>+}
>+
>+} // namespace WTF
>+
>+#endif
>diff --git a/Source/WTF/wtf/text/StringBuffer.h b/Source/WTF/wtf/text/StringBuffer.h
>index f293d333dbe3e45e637a1486733d0a2fd8c08c0c..70886023917198e8603c2fba90c79f2da65b8c81 100644
>--- a/Source/WTF/wtf/text/StringBuffer.h
>+++ b/Source/WTF/wtf/text/StringBuffer.h
>@@ -30,24 +30,40 @@
> #define StringBuffer_h
> 
> #include <wtf/Assertions.h>
>+#include <wtf/DebugHeap.h>
>+#include <wtf/MallocPtr.h>
>+#include <wtf/Noncopyable.h>
> #include <limits>
> #include <unicode/utypes.h>
> 
> namespace WTF {
> 
>+WTF_EXPORT_PRIVATE DebugHeap& stringBufferHeap();
>+
> template <typename CharType>
> class StringBuffer {
>     WTF_MAKE_NONCOPYABLE(StringBuffer);
> public:
>     explicit StringBuffer(unsigned length)
>         : m_length(length)
>-        , m_data(m_length ? static_cast<CharType*>(fastMalloc((Checked<size_t>(m_length) * sizeof(CharType)).unsafeGet())) : nullptr)
>+        , m_data(m_length ? static_cast<CharType*>(
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            stringBufferHeap().malloc((Checked<size_t>(m_length) * sizeof(CharType)).unsafeGet())
>+#else
>+            fastMalloc((Checked<size_t>(m_length) * sizeof(CharType)).unsafeGet())
>+#endif
>+            ) : nullptr)
>     {
>     }
> 
>     ~StringBuffer()
>     {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        stringBufferHeap().free(m_data);
>+#else
>         fastFree(m_data);
>+#endif
>+
>     }
> 
>     void shrink(unsigned newLength)
>@@ -61,7 +77,12 @@ public:
>         if (newLength > m_length) {
>             if (newLength > std::numeric_limits<unsigned>::max() / sizeof(UChar))
>                 CRASH();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            m_data = static_cast<UChar*>(stringBufferHeap().realloc(m_data, newLength * sizeof(UChar)));
>+#else
>             m_data = static_cast<UChar*>(fastRealloc(m_data, newLength * sizeof(UChar)));
>+#endif
>+
>         }
>         m_length = newLength;
>     }
>@@ -75,7 +96,11 @@ public:
>     {
>         CharType* data = m_data;
>         m_data = 0;
>-        return adoptMallocPtr(data);
>+        return adoptMallocPtr(data
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            , stringBufferHeap()
>+#endif
>+        );
>     }
> 
> private:
>diff --git a/Source/WTF/wtf/text/StringImpl.cpp b/Source/WTF/wtf/text/StringImpl.cpp
>index d50c3a3f44075218512f432c778d6d411976c2da..15b55a69563ef017aeeb4352544c7a5ed1ea648d 100644
>--- a/Source/WTF/wtf/text/StringImpl.cpp
>+++ b/Source/WTF/wtf/text/StringImpl.cpp
>@@ -101,6 +101,14 @@ void StringStats::printStats()
> }
> #endif
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StringImpl::stringImplHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit StringImpl");
>+    return heap;
>+}
>+#endif
>+
> StringImpl::StaticStringImpl StringImpl::s_atomicEmptyString("", StringImpl::StringAtomic);
> 
> StringImpl::~StringImpl()
>@@ -129,7 +137,11 @@ StringImpl::~StringImpl()
>     if (ownership == BufferOwned) {
>         // We use m_data8, but since it is a union with m_data16 this works either way.
>         ASSERT(m_data8);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        stringImplHeap().free(const_cast<LChar*>(m_data8));
>+#else
>         fastFree(const_cast<LChar*>(m_data8));
>+#endif
>         return;
>     }
> 
>@@ -141,7 +153,12 @@ StringImpl::~StringImpl()
> void StringImpl::destroy(StringImpl* stringImpl)
> {
>     stringImpl->~StringImpl();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    stringImplHeap().free(stringImpl);
>+#else
>     fastFree(stringImpl);
>+#endif
>+
> }
> 
> Ref<StringImpl> StringImpl::createFromLiteral(const char* characters, unsigned length)
>@@ -188,8 +205,11 @@ template<typename CharacterType> inline Ref<StringImpl> StringImpl::createUninit
>     // heap allocation from this call.
>     if (length > ((std::numeric_limits<unsigned>::max() - sizeof(StringImpl)) / sizeof(CharacterType)))
>         CRASH();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    StringImpl* string = static_cast<StringImpl*>(stringImplHeap().malloc(allocationSize<CharacterType>(length)));
>+#else
>     StringImpl* string = static_cast<StringImpl*>(fastMalloc(allocationSize<CharacterType>(length)));
>-
>+#endif
>     data = string->tailPointer<CharacterType>();
>     return constructInternal<CharacterType>(*string, length);
> }
>@@ -219,7 +239,11 @@ template<typename CharacterType> inline Ref<StringImpl> StringImpl::reallocateIn
>         CRASH();
> 
>     originalString->~StringImpl();
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    auto* string = static_cast<StringImpl*>(stringImplHeap().realloc(&originalString.leakRef(), allocationSize<CharacterType>(length)));
>+#else
>     auto* string = static_cast<StringImpl*>(fastRealloc(&originalString.leakRef(), allocationSize<CharacterType>(length)));
>+#endif
> 
>     data = string->tailPointer<CharacterType>();
>     return constructInternal<CharacterType>(*string, length);
>diff --git a/Source/WTF/wtf/text/StringImpl.h b/Source/WTF/wtf/text/StringImpl.h
>index 2aa0c918753b06446f0fb08ac22b71121adfbabb..7a8b02694733fb2b42f4b2e420cf7f321a340057 100644
>--- a/Source/WTF/wtf/text/StringImpl.h
>+++ b/Source/WTF/wtf/text/StringImpl.h
>@@ -37,6 +37,10 @@
> #include <wtf/text/StringHasher.h>
> #include <wtf/text/UTF8ConversionError.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> #if USE(CF)
> typedef const struct __CFString * CFStringRef;
> #endif
>@@ -158,7 +162,29 @@ protected:
> // Right now we use a mix of both, which makes code more confusing and has no benefit.
> 
> class StringImpl : private StringImplShape {
>-    WTF_MAKE_NONCOPYABLE(StringImpl); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(StringImpl);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* operator new(size_t size)
>+    {
>+        return stringImplHeap().malloc(size);
>+    }
>+
>+    void operator delete(void* p)
>+    {
>+        stringImplHeap().free(p);
>+    }
>+
>+    void* operator new(size_t, void* p) { return p; }
>+    void* operator new[](size_t, void* p) { return p; }
>+
>+    void* operator new(size_t, NotNullTag, void* location)
>+    {
>+        ASSERT(location);
>+        return location;
>+    }
>+#else
>+    WTF_MAKE_FAST_ALLOCATED;
>+#endif
> 
>     friend class AtomicStringImpl;
>     friend class JSC::LLInt::Data;
>@@ -181,6 +207,11 @@ public:
> 
>     // The bottom 6 bits in the hash are flags.
>     static constexpr const unsigned s_flagCount = 6;
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_EXPORT_PRIVATE static WTF::DebugHeap& stringImplHeap();
>+#endif
>+
> private:
>     static constexpr const unsigned s_flagMask = (1u << s_flagCount) - 1;
>     static_assert(s_flagCount <= StringHasher::flagCount, "StringHasher reserves enough bits for StringImpl flags");
>@@ -847,6 +878,19 @@ inline StringImpl::StringImpl(unsigned length)
>     STRING_STATS_ADD_16BIT_STRING(m_length);
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+inline StringImpl::StringImpl(MallocPtr<LChar> characters, unsigned length)
>+    : StringImplShape(s_refCountIncrement, length, static_cast<const LChar*>(nullptr), s_hashFlag8BitBuffer | StringNormal | BufferOwned)
>+{
>+    m_data8 = static_cast<const LChar*>(stringImplHeap().malloc(length));
>+    memcpy((void*)m_data8, characters.get(), length);
>+    
>+    ASSERT(m_data8);
>+    ASSERT(m_length);
>+
>+    STRING_STATS_ADD_8BIT_STRING(m_length);
>+}
>+#else
> inline StringImpl::StringImpl(MallocPtr<LChar> characters, unsigned length)
>     : StringImplShape(s_refCountIncrement, length, characters.leakPtr(), s_hashFlag8BitBuffer | StringNormal | BufferOwned)
> {
>@@ -855,6 +899,7 @@ inline StringImpl::StringImpl(MallocPtr<LChar> characters, unsigned length)
> 
>     STRING_STATS_ADD_8BIT_STRING(m_length);
> }
>+#endif
> 
> inline StringImpl::StringImpl(const UChar* characters, unsigned length, ConstructWithoutCopyingTag)
>     : StringImplShape(s_refCountIncrement, length, characters, StringNormal | BufferInternal)
>@@ -874,6 +919,19 @@ inline StringImpl::StringImpl(const LChar* characters, unsigned length, Construc
>     STRING_STATS_ADD_8BIT_STRING(m_length);
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+inline StringImpl::StringImpl(MallocPtr<UChar> characters, unsigned length)
>+    : StringImplShape(s_refCountIncrement, length, static_cast<const UChar*>(nullptr), StringNormal | BufferOwned)
>+{
>+    m_data16 = static_cast<const UChar*>(stringImplHeap().malloc(length * sizeof(UChar)));
>+    memcpy((void*)m_data16, characters.get(), length * sizeof(UChar));
>+
>+    ASSERT(m_data16);
>+    ASSERT(m_length);
>+
>+    STRING_STATS_ADD_16BIT_STRING(m_length);
>+}
>+#else
> inline StringImpl::StringImpl(MallocPtr<UChar> characters, unsigned length)
>     : StringImplShape(s_refCountIncrement, length, characters.leakPtr(), StringNormal | BufferOwned)
> {
>@@ -882,6 +940,7 @@ inline StringImpl::StringImpl(MallocPtr<UChar> characters, unsigned length)
> 
>     STRING_STATS_ADD_16BIT_STRING(m_length);
> }
>+#endif
> 
> inline StringImpl::StringImpl(const LChar* characters, unsigned length, Ref<StringImpl>&& base)
>     : StringImplShape(s_refCountIncrement, length, characters, s_hashFlag8BitBuffer | StringNormal | BufferSubstring)
>@@ -924,7 +983,11 @@ ALWAYS_INLINE Ref<StringImpl> StringImpl::createSubstringSharingImpl(StringImpl&
>     auto* ownerRep = ((rep.bufferOwnership() == BufferSubstring) ? rep.substringBuffer() : &rep);
> 
>     // We allocate a buffer that contains both the StringImpl struct as well as the pointer to the owner string.
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    auto* stringImpl = static_cast<StringImpl*>(stringImplHeap().malloc(allocationSize<StringImpl*>(1)));
>+#else
>     auto* stringImpl = static_cast<StringImpl*>(fastMalloc(allocationSize<StringImpl*>(1)));
>+#endif
>     if (rep.is8Bit())
>         return adoptRef(*new (NotNull, stringImpl) StringImpl(rep.m_data8 + offset, length, *ownerRep));
>     return adoptRef(*new (NotNull, stringImpl) StringImpl(rep.m_data16 + offset, length, *ownerRep));
>@@ -950,10 +1013,15 @@ template<typename CharacterType> ALWAYS_INLINE RefPtr<StringImpl> StringImpl::tr
>         return nullptr;
>     }
>     StringImpl* result;
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    result = (StringImpl*)stringImplHeap().malloc(allocationSize<CharacterType>(length));
>+#else
>     if (!tryFastMalloc(allocationSize<CharacterType>(length)).getValue(result)) {
>         output = nullptr;
>         return nullptr;
>     }
>+#endif
>     output = result->tailPointer<CharacterType>();
> 
>     return constructInternal<CharacterType>(*result, length);
>@@ -966,7 +1034,17 @@ inline Ref<StringImpl> StringImpl::adopt(Vector<CharacterType, inlineCapacity, O
>         ASSERT(vector.data());
>         if (size > std::numeric_limits<unsigned>::max())
>             CRASH();
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        // We have to copy between malloc zones.
>+        auto vectorBuffer = vector.releaseBuffer();
>+        auto stringImplBuffer = MallocPtr<CharacterType>::malloc(size, stringImplHeap());
>+        memcpy(stringImplBuffer.get(), vectorBuffer.get(), size);
>+        return adoptRef(*new StringImpl(WTFMove(stringImplBuffer), size));
>+#else
>         return adoptRef(*new StringImpl(vector.releaseBuffer(), size));
>+#endif
>+
>     }
>     return *empty();
> }
>diff --git a/Source/WTF/wtf/text/cf/StringImplCF.cpp b/Source/WTF/wtf/text/cf/StringImplCF.cpp
>index 53f498383fac89cd004131cfbc06242561789cf9..6da6e76bfdeb7d58051b85ad414d61ffeb3e8d78 100644
>--- a/Source/WTF/wtf/text/cf/StringImplCF.cpp
>+++ b/Source/WTF/wtf/text/cf/StringImplCF.cpp
>@@ -24,7 +24,9 @@
> #if USE(CF)
> 
> #include <CoreFoundation/CoreFoundation.h>
>+#include <wtf/DebugHeap.h>
> #include <wtf/MainThread.h>
>+#include <wtf/NeverDestroyed.h>
> #include <wtf/RetainPtr.h>
> #include <wtf/Threading.h>
> 
>@@ -32,6 +34,14 @@ namespace WTF {
> 
> namespace StringWrapperCFAllocator {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& stringWrapperCFAllocatorDebugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit stringWrapperCFAllocatorDebugHeap");
>+    return heap;
>+}
>+#endif
>+
>     static StringImpl* currentString;
> 
>     static const void* retain(const void* info)
>@@ -60,7 +70,11 @@ namespace StringWrapperCFAllocator {
>                 underlyingString->ref(); // Balanced by call to deref in deallocate below.
>             }
>         }
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        StringImpl** header = static_cast<StringImpl**>(stringWrapperCFAllocatorDebugHeap().malloc(sizeof(StringImpl*) + size));
>+#else
>         StringImpl** header = static_cast<StringImpl**>(fastMalloc(sizeof(StringImpl*) + size));
>+#endif
>         *header = underlyingString;
>         return header + 1;
>     }
>@@ -70,7 +84,11 @@ namespace StringWrapperCFAllocator {
>         size_t newAllocationSize = sizeof(StringImpl*) + newSize;
>         StringImpl** header = static_cast<StringImpl**>(pointer) - 1;
>         ASSERT(!*header);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        header = static_cast<StringImpl**>(stringWrapperCFAllocatorDebugHeap().realloc(header, newAllocationSize));
>+#else
>         header = static_cast<StringImpl**>(fastRealloc(header, newAllocationSize));
>+#endif
>         return header + 1;
>     }
> 
>@@ -78,12 +96,21 @@ namespace StringWrapperCFAllocator {
>     {
>         StringImpl** header = static_cast<StringImpl**>(pointer) - 1;
>         StringImpl* underlyingString = *header;
>-        if (!underlyingString)
>+        if (!underlyingString) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            stringWrapperCFAllocatorDebugHeap().free(header);
>+#else
>             fastFree(header);
>+#endif
>+        }
>         else {
>             if (isMainThread()) {
>                 underlyingString->deref(); // Balanced by call to ref in allocate above.
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                stringWrapperCFAllocatorDebugHeap().free(header);
>+#else
>                 fastFree(header);
>+#endif
>                 return;
>             }
> 
>@@ -91,7 +118,12 @@ namespace StringWrapperCFAllocator {
>                 StringImpl* underlyingString = *header;
>                 ASSERT(underlyingString);
>                 underlyingString->deref(); // Balanced by call to ref in allocate above.
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+                stringWrapperCFAllocatorDebugHeap().free(header);
>+#else
>                 fastFree(header);
>+#endif
>+
>             });
>         }
>     }
>diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
>index 7388e0cfa5c1e84e77909dab8aa864972c8cd757..03b87b339b51d60d5c951cc32a10cc79517f286d 100644
>--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
>+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
>@@ -95,6 +95,14 @@
> namespace WebCore {
> using namespace JSC;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SerializedScriptValue::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> static const unsigned maximumFilterRecursion = 40000;
> 
> enum class SerializationReturnCode {
>diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
>index 2352904d1745b2d5f8f59513eead4f6f25933e5f..291e092997d18a01e37d77d5007df3414b09adbf 100644
>--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
>+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
>@@ -62,6 +62,9 @@ using WasmModuleArray = Vector<RefPtr<JSC::Wasm::Module>>;
> #endif
> 
> class SerializedScriptValue : public ThreadSafeRefCounted<SerializedScriptValue> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(SerializedScriptValue);
>+#endif
> public:
>     WEBCORE_EXPORT static RefPtr<SerializedScriptValue> create(JSC::ExecState&, JSC::JSValue, SerializationErrorMode = SerializationErrorMode::Throwing);
> 
>diff --git a/Source/WebCore/css/CSSFontFace.cpp b/Source/WebCore/css/CSSFontFace.cpp
>index f7d775ffbba76b80ceee71deec5cf4b67e2ff31c..7f76a368be171d72ea83b86c203594745273c2f1 100644
>--- a/Source/WebCore/css/CSSFontFace.cpp
>+++ b/Source/WebCore/css/CSSFontFace.cpp
>@@ -48,6 +48,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& CSSFontFace::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> template<typename T> void iterateClients(HashSet<CSSFontFace::Client*>& clients, T callback)
> {
>     Vector<Ref<CSSFontFace::Client>> clientsCopy;
>diff --git a/Source/WebCore/css/CSSFontFace.h b/Source/WebCore/css/CSSFontFace.h
>index 346a7b861a7ae39ff05ee6e3e0530cafbcf66087..e40869d781fd95bd3e26153642f74f75a12f3f3f 100644
>--- a/Source/WebCore/css/CSSFontFace.h
>+++ b/Source/WebCore/css/CSSFontFace.h
>@@ -55,6 +55,9 @@ class FontFace;
> enum class ExternalResourceDownloadPolicy;
> 
> class CSSFontFace final : public RefCounted<CSSFontFace> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(CSSFontFace);
>+#endif
> public:
>     static Ref<CSSFontFace> create(CSSFontSelector* fontSelector, StyleRuleFontFace* cssConnection = nullptr, FontFace* wrapper = nullptr, bool isLocalFallback = false)
>     {
>diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
>index 906b3b071b960c07b373433b3859b450590137ce..c7dd5690d8326d4d6909fb5ecd7aa57f7507e102 100644
>--- a/Source/WebCore/css/CSSSelector.cpp
>+++ b/Source/WebCore/css/CSSSelector.cpp
>@@ -48,6 +48,14 @@ struct SameSizeAsCSSSelector {
> static_assert(CSSSelector::RelationType::Subselector == 0, "Subselector must be 0 for consumeCombinator.");
> static_assert(sizeof(CSSSelector) == sizeof(SameSizeAsCSSSelector), "CSSSelector should remain small.");
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& CSSSelector::RareData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> CSSSelector::CSSSelector(const QualifiedName& tagQName, bool tagIsForNamespaceRule)
>     : m_relation(DescendantSpace)
>     , m_match(Tag)
>diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
>index 03e9f16d884d7a2b5e21e2c7ee7628bd7b47ba5e..3f1147d1503f6e216ca1159574a5a379be8534f1 100644
>--- a/Source/WebCore/css/CSSSelector.h
>+++ b/Source/WebCore/css/CSSSelector.h
>@@ -343,6 +343,9 @@ namespace WebCore {
>         CSSSelector& operator=(const CSSSelector&);
> 
>         struct RareData : public RefCounted<RareData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(CSSSelector::RareData);
>+#endif
>             static Ref<RareData> create(AtomicString&& value) { return adoptRef(*new RareData(WTFMove(value))); }
>             ~RareData();
> 
>diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
>index 4fc69838c71081136e02fa2395ccea9681b9f4a5..0cf6dcdaa9c08baacb1702cf9749167c0af45b07 100644
>--- a/Source/WebCore/css/CSSSelectorList.cpp
>+++ b/Source/WebCore/css/CSSSelectorList.cpp
>@@ -32,12 +32,24 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& CSSSelectorArrayHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit CSSSelectorList array");
>+    return heap;
>+}
>+#endif
>+
> CSSSelectorList::CSSSelectorList(const CSSSelectorList& other)
> {
>     unsigned otherComponentCount = other.componentCount();
>     ASSERT_WITH_SECURITY_IMPLICATION(otherComponentCount);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    m_selectorArray = reinterpret_cast<CSSSelector*>(CSSSelectorArrayHeap().malloc(sizeof(CSSSelector) * otherComponentCount));
>+#else
>     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * otherComponentCount));
>+#endif
>     for (unsigned i = 0; i < otherComponentCount; ++i)
>         new (NotNull, &m_selectorArray[i]) CSSSelector(other.m_selectorArray[i]);
> }
>@@ -59,7 +71,13 @@ void CSSSelectorList::adoptSelectorVector(Vector<std::unique_ptr<CSSParserSelect
>             ++flattenedSize;
>     }
>     ASSERT(flattenedSize);
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    m_selectorArray = reinterpret_cast<CSSSelector*>(CSSSelectorArrayHeap().malloc(sizeof(CSSSelector) * flattenedSize));
>+#else
>     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * flattenedSize));
>+#endif
>+
>     size_t arrayIndex = 0;
>     for (size_t i = 0; i < selectorVector.size(); ++i) {
>         CSSParserSelector* current = selectorVector[i].get();
>@@ -131,7 +149,12 @@ void CSSSelectorList::deleteSelectors()
>         isLastSelector = s->isLastInSelectorList();
>         s->~CSSSelector();
>     }
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    CSSSelectorArrayHeap().free(selectorArray);
>+#else
>     fastFree(selectorArray);
>+#endif
>+
> }
> 
> String CSSSelectorList::selectorsText() const
>diff --git a/Source/WebCore/css/CSSValue.cpp b/Source/WebCore/css/CSSValue.cpp
>index d8284450413ec19e34e30972ca3e58352e357172..9f9968986d6dc935bbcf81e9cc0eb2214220fb02 100644
>--- a/Source/WebCore/css/CSSValue.cpp
>+++ b/Source/WebCore/css/CSSValue.cpp
>@@ -84,6 +84,14 @@ bool CSSValue::isImplicitInitialValue() const
>     return m_classType == InitialClass && downcast<CSSInitialValue>(*this).isImplicit();
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& CSSValue::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> CSSValue::Type CSSValue::cssValueType() const
> {
>     if (isInheritedValue())
>diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
>index d44b0750bfae02d9c7aa9e05a9db8cab1dd95b36..fe70c7a957c8aa7b3ab3da3f64fcbd73d58d890c 100644
>--- a/Source/WebCore/css/CSSValue.h
>+++ b/Source/WebCore/css/CSSValue.h
>@@ -38,6 +38,9 @@ class StyleSheetContents;
> enum CSSPropertyID : uint16_t;
> 
> class CSSValue : public RefCounted<CSSValue> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(CSSValue);
>+#endif
> public:
>     enum Type {
>         CSS_INHERIT = 0,
>diff --git a/Source/WebCore/css/ElementRuleCollector.cpp b/Source/WebCore/css/ElementRuleCollector.cpp
>index 77b9bed246e69cb9a501a6a36565b7ba32c021fd..5e686c8358f5af9efab21b3df866af48f037b293 100644
>--- a/Source/WebCore/css/ElementRuleCollector.cpp
>+++ b/Source/WebCore/css/ElementRuleCollector.cpp
>@@ -225,7 +225,7 @@ void ElementRuleCollector::matchHostPseudoClassRules(bool includeEmptyRules, Sty
> 
>     auto& shadowAuthorStyle = m_element.shadowRoot()->styleScope().resolver().ruleSets().authorStyle();
>     auto& shadowHostRules = shadowAuthorStyle.hostPseudoClassRules();
>-    if (shadowHostRules.isEmpty())
>+    if (shadowHostRules.data.isEmpty())
>         return;
> 
>     SetForScope<bool> change(m_isMatchingHostPseudoClass, true);
>@@ -292,9 +292,9 @@ std::unique_ptr<RuleSet::RuleDataVector> ElementRuleCollector::collectSlottedPse
>         return { };
> 
>     auto ruleDataVector = std::make_unique<RuleSet::RuleDataVector>();
>-    ruleDataVector->reserveInitialCapacity(m_matchedRules.size());
>+    ruleDataVector->data.reserveInitialCapacity(m_matchedRules.size());
>     for (auto& matchedRule : m_matchedRules)
>-        ruleDataVector->uncheckedAppend(*matchedRule.ruleData);
>+        ruleDataVector->data.uncheckedAppend(*matchedRule.ruleData);
> 
>     return ruleDataVector;
> }
>@@ -455,8 +455,8 @@ void ElementRuleCollector::collectMatchingRulesForList(const RuleSet::RuleDataVe
>     if (!rules)
>         return;
> 
>-    for (unsigned i = 0, size = rules->size(); i < size; ++i) {
>-        const RuleData& ruleData = rules->data()[i];
>+    for (unsigned i = 0, size = rules->data.size(); i < size; ++i) {
>+        const RuleData& ruleData = rules->data.data()[i];
> 
>         if (!ruleData.canMatchPseudoElement() && m_pseudoStyleRequest.pseudoId != PseudoId::None)
>             continue;
>diff --git a/Source/WebCore/css/RuleSet.cpp b/Source/WebCore/css/RuleSet.cpp
>index f4b5bff3c2bdd825775d4c763fdccf070218db24..b1f377c551965557881619f0ca20521c2dc7ba7a 100644
>--- a/Source/WebCore/css/RuleSet.cpp
>+++ b/Source/WebCore/css/RuleSet.cpp
>@@ -52,6 +52,20 @@ namespace WebCore {
> 
> using namespace HTMLNames;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& RuleSet::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& RuleSet::RuleDataVector::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> // -----------------------------------------------------------------
> 
> static inline MatchBasedOnRuleHash computeMatchBasedOnRuleHash(const CSSSelector& selector)
>@@ -175,13 +189,13 @@ void RuleSet::addToRuleSet(const AtomicString& key, AtomRuleMap& map, const Rule
>     auto& rules = map.add(key, nullptr).iterator->value;
>     if (!rules)
>         rules = std::make_unique<RuleDataVector>();
>-    rules->append(ruleData);
>+    rules->data.append(ruleData);
> }
> 
> static unsigned rulesCountForName(const RuleSet::AtomRuleMap& map, const AtomicString& name)
> {
>     if (const auto* rules = map.get(name))
>-        return rules->size();
>+        return rules->data.size();
>     return 0;
> }
> 
>@@ -295,7 +309,7 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, unsigned selector
> 
> #if ENABLE(VIDEO_TRACK)
>     if (cuePseudoElementSelector) {
>-        m_cuePseudoRules.append(ruleData);
>+        m_cuePseudoRules.data.append(ruleData);
>         return;
>     }
> #endif
>@@ -303,7 +317,7 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, unsigned selector
>     if (slottedPseudoElementSelector) {
>         // ::slotted pseudo elements work accross shadow boundary making filtering difficult.
>         ruleData.disableSelectorFiltering();
>-        m_slottedPseudoElementRules.append(ruleData);
>+        m_slottedPseudoElementRules.data.append(ruleData);
>         return;
>     }
> 
>@@ -318,7 +332,7 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, unsigned selector
>         m_hasHostPseudoClassRulesMatchingInShadowTree = isHostSelectorMatchingInShadowTree(*ruleData.selector());
> 
>     if (hostPseudoClassSelector) {
>-        m_hostPseudoClassRules.append(ruleData);
>+        m_hostPseudoClassRules.data.append(ruleData);
>         return;
>     }
> 
>@@ -333,12 +347,12 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, unsigned selector
>     }
> 
>     if (linkSelector) {
>-        m_linkPseudoClassRules.append(ruleData);
>+        m_linkPseudoClassRules.data.append(ruleData);
>         return;
>     }
> 
>     if (focusSelector) {
>-        m_focusPseudoClassRules.append(ruleData);
>+        m_focusPseudoClassRules.data.append(ruleData);
>         return;
>     }
> 
>@@ -349,7 +363,7 @@ void RuleSet::addRule(StyleRule* rule, unsigned selectorIndex, unsigned selector
>     }
> 
>     // If we didn't find a specialized map to stick it in, file under universal rules.
>-    m_universalRules.append(ruleData);
>+    m_universalRules.data.append(ruleData);
> }
> 
> void RuleSet::addPageRule(StyleRulePage* rule)
>@@ -412,7 +426,7 @@ bool RuleSet::hasShadowPseudoElementRules() const
>     if (!m_shadowPseudoElementRules.isEmpty())
>         return true;
> #if ENABLE(VIDEO_TRACK)
>-    if (!m_cuePseudoRules.isEmpty())
>+    if (!m_cuePseudoRules.data.isEmpty())
>         return true;
> #endif
>     return false;
>@@ -421,7 +435,7 @@ bool RuleSet::hasShadowPseudoElementRules() const
> static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
> {
>     for (auto& vector : map.values())
>-        vector->shrinkToFit();
>+        vector->data.shrinkToFit();
> }
> 
> void RuleSet::shrinkToFit()
>@@ -431,14 +445,14 @@ void RuleSet::shrinkToFit()
>     shrinkMapVectorsToFit(m_tagLocalNameRules);
>     shrinkMapVectorsToFit(m_tagLowercaseLocalNameRules);
>     shrinkMapVectorsToFit(m_shadowPseudoElementRules);
>-    m_linkPseudoClassRules.shrinkToFit();
>+    m_linkPseudoClassRules.data.shrinkToFit();
> #if ENABLE(VIDEO_TRACK)
>-    m_cuePseudoRules.shrinkToFit();
>+    m_cuePseudoRules.data.shrinkToFit();
> #endif
>-    m_hostPseudoClassRules.shrinkToFit();
>-    m_slottedPseudoElementRules.shrinkToFit();
>-    m_focusPseudoClassRules.shrinkToFit();
>-    m_universalRules.shrinkToFit();
>+    m_hostPseudoClassRules.data.shrinkToFit();
>+    m_slottedPseudoElementRules.data.shrinkToFit();
>+    m_focusPseudoClassRules.data.shrinkToFit();
>+    m_universalRules.data.shrinkToFit();
>     m_pageRules.shrinkToFit();
>     m_features.shrinkToFit();
> }
>diff --git a/Source/WebCore/css/RuleSet.h b/Source/WebCore/css/RuleSet.h
>index ba5dc60fe34c6b7678246734d322ac2f7a02f57f..937f68845ae0aa12f22fee283dfa4aeaff149706 100644
>--- a/Source/WebCore/css/RuleSet.h
>+++ b/Source/WebCore/css/RuleSet.h
>@@ -101,7 +101,12 @@ struct SameSizeAsRuleData {
> COMPILE_ASSERT(sizeof(RuleData) == sizeof(SameSizeAsRuleData), RuleData_should_stay_small);
> 
> class RuleSet {
>-    WTF_MAKE_NONCOPYABLE(RuleSet); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(RuleSet);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(RuleSet);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     struct RuleSetSelectorPair {
>         RuleSetSelectorPair(const CSSSelector* selector, std::unique_ptr<RuleSet> ruleSet) : selector(selector), ruleSet(WTFMove(ruleSet)) { }
>@@ -114,7 +119,12 @@ public:
>     RuleSet();
>     ~RuleSet();
> 
>-    typedef Vector<RuleData, 1> RuleDataVector;
>+    struct RuleDataVector {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(RuleSet::RuleDataVector);
>+#endif
>+        Vector<RuleData, 1> data;
>+    };
>     typedef HashMap<AtomicString, std::unique_ptr<RuleDataVector>> AtomRuleMap;
> 
>     void addRulesFromSheet(StyleSheetContents&, const MediaQueryEvaluator&, StyleResolver* = 0);
>diff --git a/Source/WebCore/css/StyleProperties.cpp b/Source/WebCore/css/StyleProperties.cpp
>index 30dbeb42b6b5a67a06fa9c65e0fdfc6deccf9086..b594c2304ef4daffe687d7e6907f866892889976 100644
>--- a/Source/WebCore/css/StyleProperties.cpp
>+++ b/Source/WebCore/css/StyleProperties.cpp
>@@ -47,6 +47,26 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleProperties::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& ImmutableStyleProperties::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& MutableStyleProperties::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> static size_t sizeForImmutableStylePropertiesWithPropertyCount(unsigned count)
> {
>     return sizeof(ImmutableStyleProperties) - sizeof(void*) + sizeof(CSSValue*) * count + sizeof(StylePropertyMetadata) * count;
>@@ -59,7 +79,11 @@ static bool isInitialOrInherit(const String& value)
> 
> Ref<ImmutableStyleProperties> ImmutableStyleProperties::create(const CSSProperty* properties, unsigned count, CSSParserMode cssParserMode)
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* slot = ImmutableStyleProperties::debugHeap("WebKit ImmutableStyleProperties").malloc(sizeForImmutableStylePropertiesWithPropertyCount(count));
>+#else
>     void* slot = WTF::fastMalloc(sizeForImmutableStylePropertiesWithPropertyCount(count));
>+#endif
>     return adoptRef(*new (NotNull, slot) ImmutableStyleProperties(properties, count, cssParserMode));
> }
> 
>diff --git a/Source/WebCore/css/StyleProperties.h b/Source/WebCore/css/StyleProperties.h
>index 2661ec1121108a635065dc6a250145d6d5649a39..cbe553039e8009d07a27dca745a40b52d04d210a 100644
>--- a/Source/WebCore/css/StyleProperties.h
>+++ b/Source/WebCore/css/StyleProperties.h
>@@ -76,6 +76,9 @@ protected:
> };
> 
> class StyleProperties : public StylePropertiesBase {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleProperties);
>+#endif
>     friend class PropertyReference;
> public:
>     class PropertyReference {
>@@ -177,6 +180,9 @@ private:
> };
> 
> class ImmutableStyleProperties final : public StyleProperties {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(ImmutableStyleProperties);
>+#endif
> public:
>     WEBCORE_EXPORT ~ImmutableStyleProperties();
>     static Ref<ImmutableStyleProperties> create(const CSSProperty* properties, unsigned count, CSSParserMode);
>@@ -207,6 +213,9 @@ inline const StylePropertyMetadata* ImmutableStyleProperties::metadataArray() co
> }
> 
> class MutableStyleProperties final : public StyleProperties {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(MutableStyleProperties);
>+#endif
> public:
>     WEBCORE_EXPORT static Ref<MutableStyleProperties> create(CSSParserMode = HTMLQuirksMode);
>     static Ref<MutableStyleProperties> create(const CSSProperty* properties, unsigned count);
>@@ -349,3 +358,4 @@ SPECIALIZE_TYPE_TRAITS_END()
> SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::DeferredStyleProperties)
>     static bool isType(const WebCore::StylePropertiesBase& set) { return set.type() == WebCore::DeferredPropertiesType; }
> SPECIALIZE_TYPE_TRAITS_END()
>+
>diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
>index ad59facf12d359ccde96996e369997b323ac43a2..ee8146e8c24eea4fddd5d389ac02043f3b41b9f7 100644
>--- a/Source/WebCore/css/StyleResolver.cpp
>+++ b/Source/WebCore/css/StyleResolver.cpp
>@@ -125,6 +125,14 @@ static const CSSPropertyID firstLowPriorityProperty = static_cast<CSSPropertyID>
> 
> static void extractDirectionAndWritingMode(const RenderStyle&, const StyleResolver::MatchResult&, TextDirection&, WritingMode&);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleResolver::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> inline void StyleResolver::State::cacheBorderAndBackground()
> {
>     m_hasUAAppearance = m_style->hasAppearance();
>diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
>index 0f2f3fe7a9d09d7ff90deb1487a4e71b4a55cbe7..d05e350b729cb8b89a4c107b61580fc333faa5b7 100644
>--- a/Source/WebCore/css/StyleResolver.h
>+++ b/Source/WebCore/css/StyleResolver.h
>@@ -124,7 +124,12 @@ struct ElementStyle {
> 
> // This class selects a RenderStyle for a given element based on a collection of stylesheets.
> class StyleResolver {
>-    WTF_MAKE_NONCOPYABLE(StyleResolver); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(StyleResolver);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleResolver);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     StyleResolver(Document&);
>     ~StyleResolver();
>diff --git a/Source/WebCore/css/StyleRule.cpp b/Source/WebCore/css/StyleRule.cpp
>index 86a5c2bc67f4c93f8a2e83a8ce589800c3acc26a..fd41c05984879307bdb100116c7a4ae454614c4d 100644
>--- a/Source/WebCore/css/StyleRule.cpp
>+++ b/Source/WebCore/css/StyleRule.cpp
>@@ -131,6 +131,20 @@ Ref<StyleRuleBase> StyleRuleBase::copy() const
>     CRASH();
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleRule::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& StyleRuleBase::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> RefPtr<CSSRule> StyleRuleBase::createCSSOMWrapper(CSSStyleSheet* parentSheet, CSSRule* parentRule) const
> {
>     RefPtr<CSSRule> rule;
>diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
>index 2c1fedd12e4728a2a209807495cd93c67bd0243c..55f3c55746ec4b18837b5d6bc4175a6d0b761a02 100644
>--- a/Source/WebCore/css/StyleRule.h
>+++ b/Source/WebCore/css/StyleRule.h
>@@ -40,7 +40,11 @@ class StyleProperties;
> class StyleRuleKeyframes;
>     
> class StyleRuleBase : public WTF::RefCountedBase {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleRuleBase);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     enum Type {
>         Unknown, // Not used.
>@@ -116,7 +120,11 @@ private:
> };
> 
> class StyleRule final : public StyleRuleBase {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleRule);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<StyleRule> create(Ref<StylePropertiesBase>&& properties, bool hasDocumentSecurityOrigin)
>     {
>diff --git a/Source/WebCore/dom/DOMRect.h b/Source/WebCore/dom/DOMRect.h
>index ca439d1e1bdc52912fe61584cc38c46292ff9a79..d5d9ea33ab52bdee8481988d8f9d68f5af4aeaac 100644
>--- a/Source/WebCore/dom/DOMRect.h
>+++ b/Source/WebCore/dom/DOMRect.h
>@@ -34,7 +34,29 @@ namespace WebCore {
> class FloatQuad;
> 
> class DOMRect : public DOMRectReadOnly {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+public:
>+    void* operator new(size_t size)
>+    {
>+        return domRectDebugHeap().malloc(size);
>+    }
>+
>+    void operator delete(void* p)
>+    {
>+        domRectDebugHeap().free(p);
>+    }
>+
>+    void* operator new(size_t, void* p) { return p; }
>+    void* operator new[](size_t, void* p) { return p; }
>+
>+    void* operator new(size_t, NotNullTag, void* location)
>+    {
>+        ASSERT(location);
>+        return location;
>+    }
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<DOMRect> create() { return adoptRef(*new DOMRect()); }
>     static Ref<DOMRect> create(double x, double y, double width, double height) { return adoptRef(*new DOMRect(x, y, width, height)); }
>diff --git a/Source/WebCore/dom/DOMRectList.cpp b/Source/WebCore/dom/DOMRectList.cpp
>index 7c0a62c96ab089f2da64750de8e5cbb30c194f85..c28c35696b9b7e243034b7ea3a8f3468ac0bdd07 100644
>--- a/Source/WebCore/dom/DOMRectList.cpp
>+++ b/Source/WebCore/dom/DOMRectList.cpp
>@@ -30,6 +30,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& domRectDebugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit DOMRect");
>+    return heap;
>+}
>+#endif
>+
> DOMRectList::DOMRectList(const Vector<FloatQuad>& quads)
> {
>     m_items.reserveInitialCapacity(quads.size());
>diff --git a/Source/WebCore/dom/DOMRectReadOnly.h b/Source/WebCore/dom/DOMRectReadOnly.h
>index 2b2cc92c684ef95de2b4cf89fdeb15aca6fabbf3..539ed6ee8a751c320ad4b541d73cd329ad11a6b5 100644
>--- a/Source/WebCore/dom/DOMRectReadOnly.h
>+++ b/Source/WebCore/dom/DOMRectReadOnly.h
>@@ -33,8 +33,34 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WEBCORE_EXPORT WTF::DebugHeap& domRectDebugHeap();
>+#endif
>+
> class DOMRectReadOnly : public ScriptWrappable, public RefCounted<DOMRectReadOnly> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+public:
>+    void* operator new(size_t size)
>+    {
>+        return domRectDebugHeap().malloc(size);
>+    }
>+
>+    void operator delete(void* p)
>+    {
>+        domRectDebugHeap().free(p);
>+    }
>+
>+    void* operator new(size_t, void* p) { return p; }
>+    void* operator new[](size_t, void* p) { return p; }
>+
>+    void* operator new(size_t, NotNullTag, void* location)
>+    {
>+        ASSERT(location);
>+        return location;
>+    }
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<DOMRectReadOnly> create(double x, double y, double width, double height) { return adoptRef(*new DOMRectReadOnly(x, y, width, height)); }
>     static Ref<DOMRectReadOnly> fromRect(const DOMRectInit& init) { return create(init.x, init.y, init.width, init.height); }
>diff --git a/Source/WebCore/dom/ElementData.cpp b/Source/WebCore/dom/ElementData.cpp
>index 9515305584ba41e6af47aa3944f1918bdcd2df82..54232e1f6f9132814ba8831079deae1bd669e3b6 100644
>--- a/Source/WebCore/dom/ElementData.cpp
>+++ b/Source/WebCore/dom/ElementData.cpp
>@@ -33,6 +33,20 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& ShareableElementData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& ElementData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> void ElementData::destroy()
> {
>     if (is<UniqueElementData>(*this))
>@@ -65,7 +79,11 @@ static size_t sizeForShareableElementDataWithAttributeCount(unsigned count)
> 
> Ref<ShareableElementData> ShareableElementData::createWithAttributes(const Vector<Attribute>& attributes)
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* slot = ShareableElementData::debugHeap("WebKit ShareableElementData").malloc(sizeForShareableElementDataWithAttributeCount(attributes.size()));
>+#else
>     void* slot = WTF::fastMalloc(sizeForShareableElementDataWithAttributeCount(attributes.size()));
>+#endif
>     return adoptRef(*new (NotNull, slot) ShareableElementData(attributes));
> }
> 
>@@ -157,7 +175,11 @@ Ref<UniqueElementData> ElementData::makeUniqueCopy() const
> 
> Ref<ShareableElementData> UniqueElementData::makeShareableCopy() const
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    void* slot = ShareableElementData::debugHeap("WebKit ShareableElementData").malloc(sizeForShareableElementDataWithAttributeCount(m_attributeVector.size()));
>+#else
>     void* slot = WTF::fastMalloc(sizeForShareableElementDataWithAttributeCount(m_attributeVector.size()));
>+#endif
>     return adoptRef(*new (NotNull, slot) ShareableElementData(*this));
> }
> 
>diff --git a/Source/WebCore/dom/ElementData.h b/Source/WebCore/dom/ElementData.h
>index f6d1eafd736b2aa826beb2b7fe054ffc2d59b653..80d3dc729839d93bb080e4f5fee3d573175dc772 100644
>--- a/Source/WebCore/dom/ElementData.h
>+++ b/Source/WebCore/dom/ElementData.h
>@@ -76,7 +76,11 @@ private:
> };
> 
> class ElementData : public RefCounted<ElementData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(ElementData);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     // Override RefCounted's deref() to ensure operator delete is called on
>     // the appropriate subclass type.
>@@ -184,6 +188,12 @@ private:
> #endif
> 
> class ShareableElementData : public ElementData {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+public:
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP_IMPL(ShareableElementData);
>+public:
>+    WTF_EXPORT static WTF::DebugHeap& debugHeap(const char*);
>+#endif
> public:
>     static Ref<ShareableElementData> createWithAttributes(const Vector<Attribute>&);
> 
>diff --git a/Source/WebCore/dom/MessageEvent.cpp b/Source/WebCore/dom/MessageEvent.cpp
>index 36c082d4a13b56d39e827659540ae8fc0a6f699d..639c0a388e4178051fab92c5c458ff2498dc776c 100644
>--- a/Source/WebCore/dom/MessageEvent.cpp
>+++ b/Source/WebCore/dom/MessageEvent.cpp
>@@ -36,6 +36,14 @@ namespace WebCore {
> 
> using namespace JSC;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& MessageEvent::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> MessageEvent::MessageEvent() = default;
> 
> inline MessageEvent::MessageEvent(const AtomicString& type, Init&& initializer, IsTrusted isTrusted)
>diff --git a/Source/WebCore/dom/MessageEvent.h b/Source/WebCore/dom/MessageEvent.h
>index 33092787d14ae6573ea1b9d1fd9a7d0eee0f402b..4f6b7d9e6df9cc8d0bfd383c2a1ff441eb10f126 100644
>--- a/Source/WebCore/dom/MessageEvent.h
>+++ b/Source/WebCore/dom/MessageEvent.h
>@@ -46,6 +46,9 @@ using MessageEventSource = Variant<RefPtr<WindowProxy>, RefPtr<MessagePort>>;
> #endif
> 
> class MessageEvent final : public Event {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(MessageEvent);
>+#endif
> public:
>     static Ref<MessageEvent> create(Vector<RefPtr<MessagePort>>&&, Ref<SerializedScriptValue>&&, const String& origin = { }, const String& lastEventId = { }, std::optional<MessageEventSource>&& source = std::nullopt);
>     static Ref<MessageEvent> create(const AtomicString& type, Ref<SerializedScriptValue>&&, const String& origin, const String& lastEventId);
>diff --git a/Source/WebCore/dom/NodeRareData.cpp b/Source/WebCore/dom/NodeRareData.cpp
>index 821db174e01188f25bd368081aa2b77132a885e4..8b33679f7c43708a3844e27f467a448570680ac4 100644
>--- a/Source/WebCore/dom/NodeRareData.cpp
>+++ b/Source/WebCore/dom/NodeRareData.cpp
>@@ -40,4 +40,20 @@ struct SameSizeAsNodeRareData {
> 
> COMPILE_ASSERT(sizeof(NodeRareData) == sizeof(SameSizeAsNodeRareData), NodeRareDataShouldStaySmall);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& NodeListsNodeData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& NodeRareData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
>index 3be876c8d8d0f3e3162336ec90e5f365995d7c48..64c750770bd31858b71b94198b5b054a2d75fba5 100644
>--- a/Source/WebCore/dom/NodeRareData.h
>+++ b/Source/WebCore/dom/NodeRareData.h
>@@ -45,7 +45,12 @@ template <> struct NodeListTypeIdentifier<RadioNodeList> { static int value() {
> template <> struct NodeListTypeIdentifier<LabelsNodeList> { static int value() { return 2; } };
> 
> class NodeListsNodeData {
>-    WTF_MAKE_NONCOPYABLE(NodeListsNodeData); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(NodeListsNodeData);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(NodeListsNodeData);
>+#else
>+    WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     NodeListsNodeData()
>         : m_childNodeList(nullptr)
>@@ -248,7 +253,12 @@ public:
> };
> 
> class NodeRareData : public NodeRareDataBase {
>-    WTF_MAKE_NONCOPYABLE(NodeRareData); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(NodeRareData);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(NodeRareData);
>+#else
>+    WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     NodeRareData(RenderObject* renderer)
>         : NodeRareDataBase(renderer)
>diff --git a/Source/WebCore/dom/QualifiedName.cpp b/Source/WebCore/dom/QualifiedName.cpp
>index 986292ff951cb4ffac1ada6a5798601682b5cd3e..13c843d44e1ad7bab52da4686ee069bca3d57d95 100644
>--- a/Source/WebCore/dom/QualifiedName.cpp
>+++ b/Source/WebCore/dom/QualifiedName.cpp
>@@ -26,6 +26,20 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& QualifiedName::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+
>+WTF::DebugHeap& QualifiedName::QualifiedNameImpl::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
>     : m_impl(threadGlobalData().qualifiedNameCache().getOrCreate(QualifiedNameComponents { p.impl(), l.impl(), n.isEmpty() ? nullptr : n.impl() }))
> {
>diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
>index 8b762e5e89f78d24f17e8f8049106d27b1985d7e..659935e08980e64b9827134c4632e7d1a5c22aa6 100644
>--- a/Source/WebCore/dom/QualifiedName.h
>+++ b/Source/WebCore/dom/QualifiedName.h
>@@ -33,9 +33,18 @@ struct QualifiedNameComponents {
> };
> 
> class QualifiedName {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(QualifiedName);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(QualifiedName::QualifiedNameImpl);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     public:
>         static Ref<QualifiedNameImpl> create(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
>         {
>diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
>index dcf49e9031cf37deb391b85e6d1ba976bfd6aa16..f630e0608d8ea39b8a3f6d9bef4b6efdd94060a1 100644
>--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
>+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
>@@ -45,6 +45,14 @@ namespace WebCore {
> 
> using namespace HTMLNames;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& HTMLDocumentParser::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> HTMLDocumentParser::HTMLDocumentParser(HTMLDocument& document)
>     : ScriptableDocumentParser(document)
>     , m_options(document)
>diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
>index 9a79d44c4fb85eeac1225b52dd0de57d56367e5e..0cb9efc8a0991497117292b834138b9765994b96 100644
>--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
>+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
>@@ -48,7 +48,11 @@ class HTMLResourcePreloader;
> class PumpSession;
> 
> class HTMLDocumentParser : public ScriptableDocumentParser, private HTMLScriptRunnerHost, private PendingScriptClient {
>-    WTF_MAKE_FAST_ALLOCATED;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(HTMLDocumentParser);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<HTMLDocumentParser> create(HTMLDocument&);
>     virtual ~HTMLDocumentParser();
>diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
>index 47a369e10ccc1a764577b0162a1ac7b611b01b5f..8bb049a05518c0ce93c713e0136e7aa3907b2371 100644
>--- a/Source/WebCore/loader/DocumentLoader.cpp
>+++ b/Source/WebCore/loader/DocumentLoader.cpp
>@@ -140,6 +140,14 @@ static bool areAllLoadersPageCacheAcceptable(const ResourceLoaderMap& loaders)
>     return true;
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& DocumentLoader::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> DocumentLoader::DocumentLoader(const ResourceRequest& request, const SubstituteData& substituteData)
>     : FrameDestructionObserver(nullptr)
>     , m_cachedResourceLoader(CachedResourceLoader::create(this))
>diff --git a/Source/WebCore/loader/DocumentLoader.h b/Source/WebCore/loader/DocumentLoader.h
>index 9f9a8221ad8a3fd2f9be3cc502d5a6ec858e39e6..14f1c98879566ee7451a14e5295c8327d79edb32 100644
>--- a/Source/WebCore/loader/DocumentLoader.h
>+++ b/Source/WebCore/loader/DocumentLoader.h
>@@ -114,7 +114,11 @@ class DocumentLoader
>     , public FrameDestructionObserver
>     , public ContentSecurityPolicyClient
>     , private CachedRawResourceClient {
>-    WTF_MAKE_FAST_ALLOCATED;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(DocumentLoader);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     friend class ContentFilter;
> public:
>     static Ref<DocumentLoader> create(const ResourceRequest& request, const SubstituteData& data)
>diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
>index 230d6f9ce9ceb7114c35898ccf2921c92cfc11b5..e6c97700f4492ce706943383a6aab54753ba43e4 100644
>--- a/Source/WebCore/loader/ResourceLoader.cpp
>+++ b/Source/WebCore/loader/ResourceLoader.cpp
>@@ -62,6 +62,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& ResourceLoader::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> ResourceLoader::ResourceLoader(Frame& frame, ResourceLoaderOptions options)
>     : m_frame { &frame }
>     , m_documentLoader { frame.loader().activeDocumentLoader() }
>diff --git a/Source/WebCore/loader/ResourceLoader.h b/Source/WebCore/loader/ResourceLoader.h
>index e4d2ab28b127251541c22e0f7c080f7d3fee2d90..6f07f1a86a1f338918db88d4eef4c30285ca1198 100644
>--- a/Source/WebCore/loader/ResourceLoader.h
>+++ b/Source/WebCore/loader/ResourceLoader.h
>@@ -55,6 +55,9 @@ class PreviewLoader;
> class URL;
> 
> class ResourceLoader : public RefCounted<ResourceLoader>, protected ResourceHandleClient {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(ResourceLoader);
>+#endif
> public:
>     virtual ~ResourceLoader() = 0;
> 
>diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
>index aa54541d534ec1a2cb58ad000a33cdba34d6064e..252b797c7a6304a66585df9b7714b52361b15469 100644
>--- a/Source/WebCore/loader/cache/CachedResource.cpp
>+++ b/Source/WebCore/loader/cache/CachedResource.cpp
>@@ -65,6 +65,14 @@
> namespace WebCore {
> using namespace WTF;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& CachedResource::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> ResourceLoadPriority CachedResource::defaultPriorityForResourceType(Type type)
> {
>     switch (type) {
>diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
>index f3290f51c722917a7ce4090173587639c9527270..4f0791559cd7c0bb296d9daa4c58aeee59c9b9e9 100644
>--- a/Source/WebCore/loader/cache/CachedResource.h
>+++ b/Source/WebCore/loader/cache/CachedResource.h
>@@ -56,7 +56,12 @@ class TextResourceDecoder;
> // from CachedResourceClient, to get the function calls in case the requested data has arrived.
> // This class also does the actual communication with the loader to obtain the resource from the network.
> class CachedResource {
>-    WTF_MAKE_NONCOPYABLE(CachedResource); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(CachedResource);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(CachedResource);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
>     friend class MemoryCache;
> 
> public:
>diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
>index e80df81311561d9dfcc753dc27cf4c481e8a938b..03f4d745140f18c29e84e0f9dc0f1fff8d4c34e3 100644
>--- a/Source/WebCore/page/FrameView.cpp
>+++ b/Source/WebCore/page/FrameView.cpp
>@@ -4138,7 +4138,7 @@ void FrameView::paintContents(GraphicsContext& context, const IntRect& dirtyRect
>     if (!layoutContext().inPaintableState())
>         return;
> 
>-    ASSERT(!needsLayout());
>+//    ASSERT(!needsLayout());
>     if (needsLayout())
>         return;
> 
>diff --git a/Source/WebCore/page/PerformanceEntry.cpp b/Source/WebCore/page/PerformanceEntry.cpp
>index 7fc81ab1be9f8d68395ddb16cc0a27680a20a42a..8767de808c2e7b57eebd62bf447c4f3ff870d392 100644
>--- a/Source/WebCore/page/PerformanceEntry.cpp
>+++ b/Source/WebCore/page/PerformanceEntry.cpp
>@@ -35,6 +35,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& PerformanceEntry::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> PerformanceEntry::PerformanceEntry(Type type, const String& name, const String& entryType, double startTime, double finishTime)
>     : m_name(name)
>     , m_entryType(entryType)
>diff --git a/Source/WebCore/page/PerformanceEntry.h b/Source/WebCore/page/PerformanceEntry.h
>index 918aa18f591d6b43077872c0ce73d3f3c45e93d2..46e06e5ba6dd32ade45418087713e2fe5a15c260 100644
>--- a/Source/WebCore/page/PerformanceEntry.h
>+++ b/Source/WebCore/page/PerformanceEntry.h
>@@ -39,6 +39,9 @@
> namespace WebCore {
> 
> class PerformanceEntry : public RefCounted<PerformanceEntry> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(PerformanceEntry);
>+#endif
> public:
>     virtual ~PerformanceEntry();
> 
>diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
>index 2cdae74e29fed09e169e31cab2d56db76ea30d80..383e0fc642868a8ddf0a5141f636251e7c3fdcad 100644
>--- a/Source/WebCore/platform/graphics/Font.cpp
>+++ b/Source/WebCore/platform/graphics/Font.cpp
>@@ -55,6 +55,14 @@ unsigned GlyphPage::s_count = 0;
> const float smallCapsFontSizeMultiplier = 0.7f;
> const float emphasisMarkFontSizeMultiplier = 0.5f;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& Font::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> Font::Font(const FontPlatformData& platformData, Origin origin, Interstitial interstitial, Visibility visibility, OrientationFallback orientationFallback)
>     : m_maxCharWidth(-1)
>     , m_avgCharWidth(-1)
>diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
>index 73cdf2a852b7ad8382a70d47c6575df1be9994b0..aafbd7e85d4ba30d2c0444ac364fa8b8551220ba 100644
>--- a/Source/WebCore/platform/graphics/Font.h
>+++ b/Source/WebCore/platform/graphics/Font.h
>@@ -67,6 +67,9 @@ enum FontVariant { AutoVariant, NormalVariant, SmallCapsVariant, EmphasisMarkVar
> enum Pitch { UnknownPitch, FixedPitch, VariablePitch };
> 
> class Font : public RefCounted<Font> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(Font);
>+#endif
> public:
>     // Used to create platform fonts.
>     enum class Origin {
>diff --git a/Source/WebCore/platform/graphics/FontCascadeFonts.cpp b/Source/WebCore/platform/graphics/FontCascadeFonts.cpp
>index 5dccc19445c4f0e9da3b7eccc4ef6383c11f615f..4648157f17311e6d75f89a7cea5ce1b0a2cf5dd2 100644
>--- a/Source/WebCore/platform/graphics/FontCascadeFonts.cpp
>+++ b/Source/WebCore/platform/graphics/FontCascadeFonts.cpp
>@@ -96,6 +96,14 @@ void FontCascadeFonts::GlyphPageCacheEntry::setSingleFontPage(RefPtr<GlyphPage>&
>     m_singleFont = page;
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& FontCascadeFonts::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> FontCascadeFonts::FontCascadeFonts(RefPtr<FontSelector>&& fontSelector)
>     : m_cachedPrimaryFont(nullptr)
>     , m_fontSelector(fontSelector)
>diff --git a/Source/WebCore/platform/graphics/FontCascadeFonts.h b/Source/WebCore/platform/graphics/FontCascadeFonts.h
>index 70f7c56104256ae197c4d5000ed820cfaf98d5e7..39575556821c46e362728672870a238e710d637e 100644
>--- a/Source/WebCore/platform/graphics/FontCascadeFonts.h
>+++ b/Source/WebCore/platform/graphics/FontCascadeFonts.h
>@@ -44,6 +44,9 @@ class MixedFontGlyphPage;
> 
> class FontCascadeFonts : public RefCounted<FontCascadeFonts> {
>     WTF_MAKE_NONCOPYABLE(FontCascadeFonts);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(FontCascadeFonts);
>+#endif
> public:
>     static Ref<FontCascadeFonts> create(RefPtr<FontSelector>&& fontSelector) { return adoptRef(*new FontCascadeFonts(WTFMove(fontSelector))); }
>     static Ref<FontCascadeFonts> createForPlatformFont(const FontPlatformData& platformData) { return adoptRef(*new FontCascadeFonts(platformData)); }
>diff --git a/Source/WebCore/platform/graphics/Region.cpp b/Source/WebCore/platform/graphics/Region.cpp
>index ce555b72195b430552fb7b21c27bc350f4ead7e9..917af8745b6a44df380800fe245fcf72408ec3f5 100644
>--- a/Source/WebCore/platform/graphics/Region.cpp
>+++ b/Source/WebCore/platform/graphics/Region.cpp
>@@ -36,6 +36,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& Region::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> Region::Region()
> {
> }
>diff --git a/Source/WebCore/platform/graphics/Region.h b/Source/WebCore/platform/graphics/Region.h
>index d72ec4b2694681ed21c4bf8a416f4c32d21a704a..8de547844b8d85fd698b4f6e8bda0ea7264d0351 100644
>--- a/Source/WebCore/platform/graphics/Region.h
>+++ b/Source/WebCore/platform/graphics/Region.h
>@@ -32,7 +32,11 @@
> namespace WebCore {
> 
> class Region {
>-    WTF_MAKE_FAST_ALLOCATED;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(Region);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> 
> public:
>     WEBCORE_EXPORT Region();
>diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm
>index 1898dcb4807dc3d4decb4c03debe4edf86712b9f..d11f1007b046e719b291465dc28fe33dbb59f977 100644
>--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm
>+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm
>@@ -43,7 +43,13 @@ namespace WebCore {
> 
> static inline void releaseUint8Vector(void *array, const void*)
> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    // Is this really vector backing memory?
>+    WTF::vectorHeap().free(array);
>+#else
>     adoptMallocPtr(static_cast<uint8_t*>(array));
>+#endif
>+
> }
> 
> RefPtr<MediaSampleAVFObjC> MediaSampleAVFObjC::createImageSample(Vector<uint8_t>&& array, unsigned long width, unsigned long height)
>diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
>index 47d671bfb85a467190f37579f8c4bdcf38e574d3..0e4618a15f064228be74b40f34004956ea0161c5 100644
>--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
>+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
>@@ -55,11 +55,23 @@
> #include <pal/spi/cocoa/IOSurfaceSPI.h>
> #endif
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> // CA uses ARGB32 for textures and ARGB32 -> ARGB32 resampling is optimized.
> #define USE_ARGB32 PLATFORM(IOS)
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit ImageBuffer");
>+    return heap;
>+}
>+#endif
>+
> static FloatSize scaleSizeToUserSpace(const FloatSize& logicalSize, const IntSize& backingStoreSize, const IntSize& internalSize)
> {
>     float xMagnification = static_cast<float>(backingStoreSize.width()) / internalSize.width();
>@@ -166,8 +178,16 @@ ImageBuffer::ImageBuffer(const FloatSize& size, float resolutionScale, CGColorSp
>     }
> 
>     if (!accelerateRendering) {
>+
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        m_data.data = debugHeap().calloc(m_data.backingStoreSize.height(), m_data.bytesPerRow.unsafeGet());
>+        if (!m_data.data)
>+            return;
>+#else
>         if (!tryFastCalloc(m_data.backingStoreSize.height(), m_data.bytesPerRow.unsafeGet()).getValue(m_data.data))
>             return;
>+#endif
>+
>         ASSERT(!(reinterpret_cast<intptr_t>(m_data.data) & 3));
> 
> #if USE_ARGB32
>@@ -177,7 +197,11 @@ ImageBuffer::ImageBuffer(const FloatSize& size, float resolutionScale, CGColorSp
> #endif
>         cgContext = adoptCF(CGBitmapContextCreate(m_data.data, m_data.backingStoreSize.width(), m_data.backingStoreSize.height(), 8, m_data.bytesPerRow.unsafeGet(), m_data.colorSpace, m_data.bitmapInfo));
>         const auto releaseImageData = [] (void*, const void* data, size_t) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            debugHeap().free(const_cast<void*>(data));
>+#else
>             fastFree(const_cast<void*>(data));
>+#endif
>         };
>         // Create a live image that wraps the data.
>         m_data.dataProvider = adoptCF(CGDataProviderCreateWithData(0, m_data.data, numBytes.unsafeGet(), releaseImageData));
>diff --git a/Source/WebCore/platform/network/ResourceHandle.cpp b/Source/WebCore/platform/network/ResourceHandle.cpp
>index 491434d8fa53f190e5453eb9f394e407dd6c13bf..015617d6c519b54c113be65c37210ffc9811d5fd 100644
>--- a/Source/WebCore/platform/network/ResourceHandle.cpp
>+++ b/Source/WebCore/platform/network/ResourceHandle.cpp
>@@ -43,6 +43,14 @@ namespace WebCore {
> 
> static bool shouldForceContentSniffing;
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& ResourceHandleInternal::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> typedef HashMap<AtomicString, ResourceHandle::BuiltinConstructor> BuiltinResourceHandleConstructorMap;
> static BuiltinResourceHandleConstructorMap& builtinResourceHandleConstructorMap()
> {
>diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
>index c66601a15f08c1b53ea63be685a9252d7f59c931..e14d892c813331fc55c54b4d3c448a96eed0b928 100644
>--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
>+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
>@@ -57,7 +57,12 @@ typedef const struct __CFURLStorageSession* CFURLStorageSessionRef;
> namespace WebCore {
> 
> class ResourceHandleInternal {
>-    WTF_MAKE_NONCOPYABLE(ResourceHandleInternal); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(ResourceHandleInternal);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(ResourceHandleInternal);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     ResourceHandleInternal(ResourceHandle* loader, NetworkingContext* context, const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading, bool shouldContentSniff, bool shouldContentEncodingSniff)
>         : m_context(context)
>diff --git a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
>index c185a894930a7291565bd93022b5689534518d86..c735de90034ef5e18900dd6b9eacc338fadacbaf 100644
>--- a/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
>+++ b/Source/WebCore/platform/network/cf/FormDataStreamCFNet.cpp
>@@ -99,6 +99,14 @@ struct FormCreationContext {
>     unsigned long long streamLength;
> };
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit FormStreamFields");
>+    return heap;
>+}
>+#endif
>+
> struct FormStreamFields {
>     RefPtr<FormData> formData;
>     SchedulePairHashSet scheduledRunLoopPairs;
>@@ -110,6 +118,13 @@ struct FormStreamFields {
>     unsigned long long streamLength;
>     unsigned long long bytesSent;
>     Lock streamIsBeingOpenedOrClosedLock;
>+    
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    FormStreamFields()
>+        : currentData(debugHeap())
>+    {
>+    }
>+#endif
> };
> 
> static void closeCurrentStream(FormStreamFields* form)
>@@ -124,7 +139,7 @@ static void closeCurrentStream(FormStreamFields* form)
>         form->currentStreamRangeLength = BlobDataItem::toEndOfFile;
>     }
> 
>-    form->currentData = nullptr;
>+    form->currentData = { debugHeap() };
> }
> 
> // Return false if we cannot advance the stream. Currently the only possible failure is that the underlying file has been removed or changed since File.slice.
>diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
>index e107e44b7673b7bf5856895413e00da2a508dd88..04087b5652daa2998219a846b6acd9e455a02060 100644
>--- a/Source/WebCore/rendering/RenderLayer.cpp
>+++ b/Source/WebCore/rendering/RenderLayer.cpp
>@@ -267,6 +267,14 @@ void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
> #endif
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& RenderLayer::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> RenderLayer::RenderLayer(RenderLayerModelObject& rendererLayerModelObject)
>     : m_isRenderViewLayer(rendererLayerModelObject.isRenderView())
>     , m_forcedStackingContext(rendererLayerModelObject.isMedia())
>diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
>index d7fd0a8c6a6295f012f807e5416f15a76fc1d69d..05cee21bac8bbd779d073f3e1d2efe6b8ae22e2b 100644
>--- a/Source/WebCore/rendering/RenderLayer.h
>+++ b/Source/WebCore/rendering/RenderLayer.h
>@@ -123,7 +123,11 @@ enum class RequestState {
> };
> 
> class RenderLayer final : public ScrollableArea {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(RenderLayer);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     friend class RenderReplica;
> 
>diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
>index ccb2d06148fa199a1a867d5992f51c572efaca19..566a47bb87ef104baf863ce003f96b2c90e457ab 100644
>--- a/Source/WebCore/rendering/RenderTable.cpp
>+++ b/Source/WebCore/rendering/RenderTable.cpp
>@@ -58,6 +58,14 @@ using namespace HTMLNames;
> 
> WTF_MAKE_ISO_ALLOCATED_IMPL(RenderTable);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& TableLayout::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> RenderTable::RenderTable(Element& element, RenderStyle&& style)
>     : RenderBlock(element, WTFMove(style), 0)
>     , m_currentBorder(nullptr)
>diff --git a/Source/WebCore/rendering/TableLayout.h b/Source/WebCore/rendering/TableLayout.h
>index 939e5dee2e99719531b9b3246c58333844ce49db..a3a712a005564c216b9f567f93f00c282f772d62 100644
>--- a/Source/WebCore/rendering/TableLayout.h
>+++ b/Source/WebCore/rendering/TableLayout.h
>@@ -29,7 +29,12 @@ namespace WebCore {
> class RenderTable;
> 
> class TableLayout {
>-    WTF_MAKE_NONCOPYABLE(TableLayout); WTF_MAKE_FAST_ALLOCATED;
>+    WTF_MAKE_NONCOPYABLE(TableLayout);
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleInheritedData);
>+#else
>+    WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     explicit TableLayout(RenderTable* table)
>         : m_table(table)
>diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
>index 779b0f4b710697c58a082cf7744e6d51ceba3731..ecbc72deb0b3aff14c07c277f23e32e41218d21e 100644
>--- a/Source/WebCore/rendering/style/RenderStyle.cpp
>+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
>@@ -83,6 +83,14 @@ struct SameSizeAsRenderStyle {
> 
> static_assert(sizeof(RenderStyle) == sizeof(SameSizeAsRenderStyle), "RenderStyle should stay small");
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& RenderStyle::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> RenderStyle& RenderStyle::defaultStyle()
> {
>     static NeverDestroyed<RenderStyle> style { CreateDefaultStyle };
>diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
>index 18ee86aec68ab6d0d4731354324172f90576d7de..57205bf0759e8f4971ca9e693f01140819b454c9 100644
>--- a/Source/WebCore/rendering/style/RenderStyle.h
>+++ b/Source/WebCore/rendering/style/RenderStyle.h
>@@ -125,7 +125,11 @@ using PseudoStyleCache = Vector<std::unique_ptr<RenderStyle>, 4>;
> template<typename T, typename U> inline bool compareEqual(const T& t, const U& u) { return t == static_cast<const T&>(u); }
> 
> class RenderStyle {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(RenderStyle);
>+#else
>     WTF_MAKE_FAST_ALLOCATED;
>+#endif
> 
> private:
>     enum CloneTag { Clone };
>diff --git a/Source/WebCore/rendering/style/SVGRenderStyle.cpp b/Source/WebCore/rendering/style/SVGRenderStyle.cpp
>index cd9f364b286271b17e651f71a3b25af38f556970..7fcdf27175489c879e0c7ef4b3f06a12445b59d2 100644
>--- a/Source/WebCore/rendering/style/SVGRenderStyle.cpp
>+++ b/Source/WebCore/rendering/style/SVGRenderStyle.cpp
>@@ -43,6 +43,14 @@ static const SVGRenderStyle& defaultSVGStyle()
>     return *style.get();
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SVGRenderStyle::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> Ref<SVGRenderStyle> SVGRenderStyle::createDefaultStyle()
> {
>     return adoptRef(*new SVGRenderStyle(CreateDefault));
>diff --git a/Source/WebCore/rendering/style/SVGRenderStyle.h b/Source/WebCore/rendering/style/SVGRenderStyle.h
>index 4244ca601448f1b10a8f1fcbf9170234d3a0179b..d0c8c357a0e896adc96526ba49b9ac6b4787a025 100644
>--- a/Source/WebCore/rendering/style/SVGRenderStyle.h
>+++ b/Source/WebCore/rendering/style/SVGRenderStyle.h
>@@ -31,6 +31,11 @@
> namespace WebCore {
> 
> class SVGRenderStyle : public RefCounted<SVGRenderStyle> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(SVGRenderStyle);
>+#else
>+    WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<SVGRenderStyle> createDefaultStyle();
>     static Ref<SVGRenderStyle> create() { return adoptRef(*new SVGRenderStyle); }
>diff --git a/Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp
>index 9c206c046b05317608f37a33c327007358e71a62..9081ceee99eb3670121b6bb661bac68fd25978ce 100644
>--- a/Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp
>+++ b/Source/WebCore/rendering/style/SVGRenderStyleDefs.cpp
>@@ -35,6 +35,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleFillData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleFillData::StyleFillData()
>     : opacity(SVGRenderStyle::initialFillOpacity())
>     , paintType(SVGRenderStyle::initialFillPaintType())
>diff --git a/Source/WebCore/rendering/style/SVGRenderStyleDefs.h b/Source/WebCore/rendering/style/SVGRenderStyleDefs.h
>index d74de781042670ccdeaa37963f41991410794df7..da93a33a8c94e50649990104d7431435d8e1c6c0 100644
>--- a/Source/WebCore/rendering/style/SVGRenderStyleDefs.h
>+++ b/Source/WebCore/rendering/style/SVGRenderStyleDefs.h
>@@ -137,6 +137,9 @@ enum class MaskType {
> 
> // Inherited/Non-Inherited Style Datastructures
> class StyleFillData : public RefCounted<StyleFillData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleFillData);
>+#endif
> public:
>     static Ref<StyleFillData> create() { return adoptRef(*new StyleFillData); }
>     Ref<StyleFillData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleBoxData.cpp b/Source/WebCore/rendering/style/StyleBoxData.cpp
>index a8b35e136fb08b31caec094e788d7ce645102421..bcc1478cd423462791ba38d3d9beeeebbd227fc9 100644
>--- a/Source/WebCore/rendering/style/StyleBoxData.cpp
>+++ b/Source/WebCore/rendering/style/StyleBoxData.cpp
>@@ -35,6 +35,14 @@ struct SameSizeAsStyleBoxData : public RefCounted<SameSizeAsStyleBoxData> {
> 
> COMPILE_ASSERT(sizeof(StyleBoxData) == sizeof(SameSizeAsStyleBoxData), StyleBoxData_should_not_grow);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleBoxData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleBoxData::StyleBoxData()
>     : m_minWidth(RenderStyle::initialMinSize())
>     , m_maxWidth(RenderStyle::initialMaxSize())
>diff --git a/Source/WebCore/rendering/style/StyleBoxData.h b/Source/WebCore/rendering/style/StyleBoxData.h
>index 89170374b34b084146d06398f65d059cd4d82cfd..bbcfac1dcefb3a665da5525036b9417ce89160d2 100644
>--- a/Source/WebCore/rendering/style/StyleBoxData.h
>+++ b/Source/WebCore/rendering/style/StyleBoxData.h
>@@ -32,6 +32,9 @@
> namespace WebCore {
> 
> class StyleBoxData : public RefCounted<StyleBoxData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleBoxData);
>+#endif
> public:
>     static Ref<StyleBoxData> create() { return adoptRef(*new StyleBoxData); }
>     Ref<StyleBoxData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleInheritedData.cpp b/Source/WebCore/rendering/style/StyleInheritedData.cpp
>index a5e357ee93123f12d7426f07300675a121fab557..cf7dcf9565d7130bc908d2041c9ba2448e689e6f 100644
>--- a/Source/WebCore/rendering/style/StyleInheritedData.cpp
>+++ b/Source/WebCore/rendering/style/StyleInheritedData.cpp
>@@ -26,6 +26,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleInheritedData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleInheritedData::StyleInheritedData()
>     : horizontalBorderSpacing(RenderStyle::initialHorizontalBorderSpacing())
>     , verticalBorderSpacing(RenderStyle::initialVerticalBorderSpacing())
>diff --git a/Source/WebCore/rendering/style/StyleInheritedData.h b/Source/WebCore/rendering/style/StyleInheritedData.h
>index d6555835ac8e0930506055dfc8b19a2889280166..80c47d5e5b6e2cc9c322e9fc1e91cfec5b2de4cf 100644
>--- a/Source/WebCore/rendering/style/StyleInheritedData.h
>+++ b/Source/WebCore/rendering/style/StyleInheritedData.h
>@@ -31,6 +31,9 @@
> namespace WebCore {
> 
> class StyleInheritedData : public RefCounted<StyleInheritedData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleInheritedData);
>+#endif
> public:
>     static Ref<StyleInheritedData> create() { return adoptRef(*new StyleInheritedData); }
>     Ref<StyleInheritedData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
>index 5a847c83431b4390c5ef5ca0c5967b94ee693ab0..bec381dae7c10954f9065a81ccee945f19a2fc35 100644
>--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
>+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
>@@ -70,6 +70,14 @@ struct GreaterThanOrSameSizeAsStyleRareInheritedData : public RefCounted<Greater
> 
> COMPILE_ASSERT(sizeof(StyleRareInheritedData) <= sizeof(GreaterThanOrSameSizeAsStyleRareInheritedData), StyleRareInheritedData_should_bit_pack);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleRareInheritedData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleRareInheritedData::StyleRareInheritedData()
>     : listStyleImage(RenderStyle::initialListStyleImage())
>     , textStrokeWidth(RenderStyle::initialTextStrokeWidth())
>diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
>index dda53e3d670b8db4881fdebf24e3da0b91277e63..3a662dab8072bf466d8dc7379d9fc4d7de9ee797 100644
>--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
>+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
>@@ -47,6 +47,9 @@ class StyleImage;
> // By grouping them together, we save space, and only allocate this object when someone
> // actually uses one of these properties.
> class StyleRareInheritedData : public RefCounted<StyleRareInheritedData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleRareInheritedData);
>+#endif
> public:
>     static Ref<StyleRareInheritedData> create() { return adoptRef(*new StyleRareInheritedData); }
>     Ref<StyleRareInheritedData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
>index aa37b66abbd9e4f9400341f32e524598d4d22f1e..40db60eccb1bfc6e13299a76db0078736157aef5 100644
>--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
>+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
>@@ -36,6 +36,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleRareNonInheritedData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleRareNonInheritedData::StyleRareNonInheritedData()
>     : opacity(RenderStyle::initialOpacity())
>     , aspectRatioDenominator(RenderStyle::initialAspectRatioDenominator())
>diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
>index 12363af3556668a162c5ed089bf0624b29a0c8ac..a9836f686b37ce756dc9f7e57c06b2c10a61edcd 100644
>--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
>+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
>@@ -74,6 +74,9 @@ enum PageSizeType {
> // By grouping them together, we save space, and only allocate this object when someone
> // actually uses one of these properties.
> class StyleRareNonInheritedData : public RefCounted<StyleRareNonInheritedData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleRareNonInheritedData);
>+#endif
> public:
>     static Ref<StyleRareNonInheritedData> create() { return adoptRef(*new StyleRareNonInheritedData); }
>     Ref<StyleRareNonInheritedData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleSurroundData.cpp b/Source/WebCore/rendering/style/StyleSurroundData.cpp
>index 5c9bbdbecd4696806742608334012bc4af2af053..85da28d77927927ee64f7b4564fdf40423d8ce76 100644
>--- a/Source/WebCore/rendering/style/StyleSurroundData.cpp
>+++ b/Source/WebCore/rendering/style/StyleSurroundData.cpp
>@@ -24,6 +24,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleSurroundData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleSurroundData::StyleSurroundData()
>     : margin(Fixed)
>     , padding(Fixed)
>diff --git a/Source/WebCore/rendering/style/StyleSurroundData.h b/Source/WebCore/rendering/style/StyleSurroundData.h
>index 1f618a04486446d7b0a0f8c0736aa77a02b69ab9..24188ebbca2e27b12c857abcf7de0a8a5ea7d494 100644
>--- a/Source/WebCore/rendering/style/StyleSurroundData.h
>+++ b/Source/WebCore/rendering/style/StyleSurroundData.h
>@@ -32,6 +32,9 @@
> namespace WebCore {
> 
> class StyleSurroundData : public RefCounted<StyleSurroundData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleSurroundData);
>+#endif
> public:
>     static Ref<StyleSurroundData> create() { return adoptRef(*new StyleSurroundData); }
>     Ref<StyleSurroundData> copy() const;
>diff --git a/Source/WebCore/rendering/style/StyleTransformData.cpp b/Source/WebCore/rendering/style/StyleTransformData.cpp
>index eba3222d4740d9e3c319bda8c8049d45586f6040..79b31fdc4511a92652dc55853e600bb6e0dfc5f0 100644
>--- a/Source/WebCore/rendering/style/StyleTransformData.cpp
>+++ b/Source/WebCore/rendering/style/StyleTransformData.cpp
>@@ -26,6 +26,14 @@
> 
> namespace WebCore {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& StyleTransformData::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> StyleTransformData::StyleTransformData()
>     : operations(RenderStyle::initialTransform())
>     , x(RenderStyle::initialTransformOriginX())
>diff --git a/Source/WebCore/rendering/style/StyleTransformData.h b/Source/WebCore/rendering/style/StyleTransformData.h
>index a36c9fad6b4a5309fafae087ba3f0fc600270850..3e02583bfd2415fb048ada0f3a1abbcb637c0455 100644
>--- a/Source/WebCore/rendering/style/StyleTransformData.h
>+++ b/Source/WebCore/rendering/style/StyleTransformData.h
>@@ -33,6 +33,9 @@
> namespace WebCore {
> 
> class StyleTransformData : public RefCounted<StyleTransformData> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(StyleTransformData);
>+#endif
> public:
>     static Ref<StyleTransformData> create() { return adoptRef(*new StyleTransformData); }
>     Ref<StyleTransformData> copy() const;
>diff --git a/Source/WebCore/style/StyleInvalidationFunctions.h b/Source/WebCore/style/StyleInvalidationFunctions.h
>index 02ffd4064cfc5ab1759303c30054dff1a9cf8b82..b0a4001a78757e8dc2f2004b101451a3eba9510b 100644
>--- a/Source/WebCore/style/StyleInvalidationFunctions.h
>+++ b/Source/WebCore/style/StyleInvalidationFunctions.h
>@@ -42,7 +42,7 @@ inline void traverseRuleFeaturesInShadowTree(Element& element, TraverseFunction&
>     auto& shadowRuleSets = element.shadowRoot()->styleScope().resolver().ruleSets();
>     auto& authorStyle = shadowRuleSets.authorStyle();
>     bool hasHostPseudoClassRulesMatchingInShadowTree = authorStyle.hasHostPseudoClassRulesMatchingInShadowTree();
>-    if (authorStyle.hostPseudoClassRules().isEmpty() && !hasHostPseudoClassRulesMatchingInShadowTree)
>+    if (authorStyle.hostPseudoClassRules().data.isEmpty() && !hasHostPseudoClassRulesMatchingInShadowTree)
>         return;
>     function(shadowRuleSets.features(), hasHostPseudoClassRulesMatchingInShadowTree);
> }
>@@ -53,7 +53,7 @@ inline void traverseRuleFeaturesForSlotted(Element& element, TraverseFunction&&
>     auto assignedShadowRoots = assignedShadowRootsIfSlotted(element);
>     for (auto& assignedShadowRoot : assignedShadowRoots) {
>         auto& ruleSets = assignedShadowRoot->styleScope().resolver().ruleSets();
>-        if (ruleSets.authorStyle().slottedPseudoElementRules().isEmpty())
>+        if (ruleSets.authorStyle().slottedPseudoElementRules().data.isEmpty())
>             continue;
>         function(ruleSets.features(), false);
>     }
>@@ -67,7 +67,7 @@ inline void traverseRuleFeatures(Element& element, TraverseFunction&& function)
>     auto mayAffectShadowTree = [&] {
>         if (element.shadowRoot() && ruleSets.authorStyle().hasShadowPseudoElementRules())
>             return true;
>-        if (is<HTMLSlotElement>(element) && !ruleSets.authorStyle().slottedPseudoElementRules().isEmpty())
>+        if (is<HTMLSlotElement>(element) && !ruleSets.authorStyle().slottedPseudoElementRules().data.isEmpty())
>             return true;
>         return false;
>     };
>diff --git a/Source/WebCore/style/StyleInvalidator.cpp b/Source/WebCore/style/StyleInvalidator.cpp
>index dae11cb2f6289918453a12809ae43b8124b6b12b..29f866fce37e7bf13eb8d818819d4405e79a6a44 100644
>--- a/Source/WebCore/style/StyleInvalidator.cpp
>+++ b/Source/WebCore/style/StyleInvalidator.cpp
>@@ -106,7 +106,7 @@ Invalidator::CheckDescendants Invalidator::invalidateIfNeeded(Element& element,
>             element.invalidateStyleForSubtreeInternal();
>     }
> 
>-    bool shouldCheckForSlots = !m_ruleSet.slottedPseudoElementRules().isEmpty() && !m_didInvalidateHostChildren;
>+    bool shouldCheckForSlots = !m_ruleSet.slottedPseudoElementRules().data.isEmpty() && !m_didInvalidateHostChildren;
>     if (shouldCheckForSlots && is<HTMLSlotElement>(element)) {
>         auto* containingShadowRoot = element.containingShadowRoot();
>         if (containingShadowRoot && containingShadowRoot->host()) {
>@@ -192,7 +192,7 @@ void Invalidator::invalidateStyle(ShadowRoot& shadowRoot)
> {
>     ASSERT(!m_dirtiesAllStyle);
> 
>-    if (!m_ruleSet.hostPseudoClassRules().isEmpty() && shadowRoot.host())
>+    if (!m_ruleSet.hostPseudoClassRules().data.isEmpty() && shadowRoot.host())
>         shadowRoot.host()->invalidateStyleInternal();
> 
>     for (auto& child : childrenOfType<Element>(shadowRoot)) {
>diff --git a/Source/WebCore/style/StyleScope.cpp b/Source/WebCore/style/StyleScope.cpp
>index f22fd8332a24daa609fb5a51a93c96899ef6556e..77ddb6a00b2d9dedd51ae9b6dc9ff8e9e51f536b 100644
>--- a/Source/WebCore/style/StyleScope.cpp
>+++ b/Source/WebCore/style/StyleScope.cpp
>@@ -457,10 +457,10 @@ static void filterEnabledNonemptyCSSStyleSheets(Vector<RefPtr<CSSStyleSheet>>& r
> static void invalidateHostAndSlottedStyleIfNeeded(ShadowRoot& shadowRoot, StyleResolver& resolver)
> {
>     auto& host = *shadowRoot.host();
>-    if (!resolver.ruleSets().authorStyle().hostPseudoClassRules().isEmpty())
>+    if (!resolver.ruleSets().authorStyle().hostPseudoClassRules().data.isEmpty())
>         host.invalidateStyle();
> 
>-    if (!resolver.ruleSets().authorStyle().slottedPseudoElementRules().isEmpty()) {
>+    if (!resolver.ruleSets().authorStyle().slottedPseudoElementRules().data.isEmpty()) {
>         for (auto& shadowChild : childrenOfType<Element>(host))
>             shadowChild.invalidateStyle();
>     }
>diff --git a/Source/WebCore/style/StyleSharingResolver.cpp b/Source/WebCore/style/StyleSharingResolver.cpp
>index 5ae54d77d4251036dcbeb6c36e19909055943e74..9a1d3c66e59b06ceab7f821d0253d3ce65164de2 100644
>--- a/Source/WebCore/style/StyleSharingResolver.cpp
>+++ b/Source/WebCore/style/StyleSharingResolver.cpp
>@@ -98,7 +98,7 @@ std::unique_ptr<RenderStyle> SharingResolver::resolve(const Element& searchEleme
>         return nullptr;
>     if (elementHasDirectionAuto(element))
>         return nullptr;
>-    if (element.shadowRoot() && !element.shadowRoot()->styleScope().resolver().ruleSets().authorStyle().hostPseudoClassRules().isEmpty())
>+    if (element.shadowRoot() && !element.shadowRoot()->styleScope().resolver().ruleSets().authorStyle().hostPseudoClassRules().data.isEmpty())
>         return nullptr;
> 
>     Context context {
>@@ -288,7 +288,7 @@ bool SharingResolver::canShareStyleWithElement(const Context& context, const Sty
>     if (candidateElement.matchesDefaultPseudoClass() != element.matchesDefaultPseudoClass())
>         return false;
> 
>-    if (candidateElement.shadowRoot() && !candidateElement.shadowRoot()->styleScope().resolver().ruleSets().authorStyle().hostPseudoClassRules().isEmpty())
>+    if (candidateElement.shadowRoot() && !candidateElement.shadowRoot()->styleScope().resolver().ruleSets().authorStyle().hostPseudoClassRules().data.isEmpty())
>         return false;
> 
> #if ENABLE(FULLSCREEN_API)
>diff --git a/Source/WebCore/style/StyleTreeResolver.cpp b/Source/WebCore/style/StyleTreeResolver.cpp
>index 49e4d45edfee546f52aff5e309ff594d0bc52de9..0bd06760850888063701982766e7cc287435961f 100644
>--- a/Source/WebCore/style/StyleTreeResolver.cpp
>+++ b/Source/WebCore/style/StyleTreeResolver.cpp
>@@ -56,6 +56,14 @@ namespace WebCore {
> 
> namespace Style {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& TreeResolver::Scope::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> TreeResolver::TreeResolver(Document& document)
>     : m_document(document)
> {
>diff --git a/Source/WebCore/style/StyleTreeResolver.h b/Source/WebCore/style/StyleTreeResolver.h
>index 88af96fe35c452e4a14628675272e97e4e13bab3..b6e643f124aaaa17ce5921e74405812d23681c68 100644
>--- a/Source/WebCore/style/StyleTreeResolver.h
>+++ b/Source/WebCore/style/StyleTreeResolver.h
>@@ -62,6 +62,9 @@ private:
>     ElementUpdate resolvePseudoStyle(Element&, const ElementUpdate&, PseudoId);
> 
>     struct Scope : RefCounted<Scope> {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED_FROM_DEBUG_HEAP(TreeResolver::Scope);
>+#endif
>         StyleResolver& styleResolver;
>         SelectorFilter selectorFilter;
>         SharingResolver sharingResolver;
>diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.cpp b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
>index 56a46a6e837e003ac4e9ab78f167b954715e111f..f2525a967f9e65639ae8955c5244019edfb87c7f 100644
>--- a/Source/WebCore/svg/animation/SMILTimeContainer.cpp
>+++ b/Source/WebCore/svg/animation/SMILTimeContainer.cpp
>@@ -37,6 +37,14 @@ namespace WebCore {
> static const Seconds SMILAnimationFrameDelay { 1_s / 60. };
> static const Seconds SMILAnimationFrameThrottledDelay { 1_s / 30. };
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& SMILTimeContainer::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> SMILTimeContainer::SMILTimeContainer(SVGSVGElement& owner)
>     : m_timer(*this, &SMILTimeContainer::timerFired)
>     , m_ownerSVGElement(owner)
>diff --git a/Source/WebCore/svg/animation/SMILTimeContainer.h b/Source/WebCore/svg/animation/SMILTimeContainer.h
>index d8fc4f805ad99c618df3bb58baf9ba46c82c9ae1..f9014c619eabb61c562af74a05b4ab1a46c27903 100644
>--- a/Source/WebCore/svg/animation/SMILTimeContainer.h
>+++ b/Source/WebCore/svg/animation/SMILTimeContainer.h
>@@ -40,6 +40,9 @@ class SVGSMILElement;
> class SVGSVGElement;
> 
> class SMILTimeContainer final : public RefCounted<SMILTimeContainer>  {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(SMILTimeContainer);
>+#endif
> public:
>     static Ref<SMILTimeContainer> create(SVGSVGElement& owner) { return adoptRef(*new SMILTimeContainer(owner)); }
>     ~SMILTimeContainer();
>diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
>index 53c0f23ce9254fc862d9df945e210e806f8da20c..9094c4a5852e24461cce6d51bb7b658a2bc63533 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.cpp
>+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
>@@ -102,6 +102,14 @@ static void logConsoleError(ScriptExecutionContext* context, const String& messa
>     context->addConsoleMessage(MessageSource::JS, MessageLevel::Error, message);
> }
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+WTF::DebugHeap& XMLHttpRequest::debugHeap(const char* heapName)
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap(heapName);
>+    return heap;
>+}
>+#endif
>+
> Ref<XMLHttpRequest> XMLHttpRequest::create(ScriptExecutionContext& context)
> {
>     auto xmlHttpRequest = adoptRef(*new XMLHttpRequest(context));
>diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
>index e32d01335cab370600bf06b622e379e267d6fce2..69c75fce27eb09add466c8535064325484365856 100644
>--- a/Source/WebCore/xml/XMLHttpRequest.h
>+++ b/Source/WebCore/xml/XMLHttpRequest.h
>@@ -50,7 +50,11 @@ class XMLHttpRequestUpload;
> struct OwnedString;
> 
> class XMLHttpRequest final : public RefCounted<XMLHttpRequest>, public XMLHttpRequestEventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
>-    WTF_MAKE_FAST_ALLOCATED;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        WTF_MAKE_FAST_ALLOCATED_FROM_DEBUG_HEAP(XMLHttpRequest);
>+#else
>+        WTF_MAKE_FAST_ALLOCATED;
>+#endif
> public:
>     static Ref<XMLHttpRequest> create(ScriptExecutionContext&);
>     WEBCORE_EXPORT ~XMLHttpRequest();
>diff --git a/Source/WebKit/Shared/ShareableBitmap.cpp b/Source/WebKit/Shared/ShareableBitmap.cpp
>index 4fcf4d34f696fbc4e7c8ce5c922623f59ff1b50b..492be8b0ed4ebe24463daeb97d7de29f35aacba7 100644
>--- a/Source/WebKit/Shared/ShareableBitmap.cpp
>+++ b/Source/WebKit/Shared/ShareableBitmap.cpp
>@@ -30,10 +30,22 @@
> #include "WebCoreArgumentCoders.h"
> #include <WebCore/GraphicsContext.h>
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+#include <wtf/DebugHeap.h>
>+#endif
>+
> using namespace WebCore;
> 
> namespace WebKit {
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit ShareableBitmap");
>+    return heap;
>+}
>+#endif
>+
> ShareableBitmap::Handle::Handle()
> {
> }
>@@ -89,8 +101,14 @@ RefPtr<ShareableBitmap> ShareableBitmap::create(const IntSize& size, Configurati
>         return nullptr;
> 
>     void* data = 0;
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+    data = debugHeap().malloc(numBytes.unsafeGet());
>+    if (!data)
>+        return nullptr;
>+#else
>     if (!tryFastMalloc(numBytes.unsafeGet()).getValue(data))
>         return nullptr;
>+#endif
> 
>     return adoptRef(new ShareableBitmap(size, configuration, data));
> }
>@@ -161,8 +179,13 @@ ShareableBitmap::ShareableBitmap(const IntSize& size, Configuration configuratio
> 
> ShareableBitmap::~ShareableBitmap()
> {
>-    if (!isBackedBySharedMemory())
>+    if (!isBackedBySharedMemory()) {
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        debugHeap().free(m_data);
>+#else
>         fastFree(m_data);
>+#endif
>+    }
> }
> 
> void* ShareableBitmap::data() const
>diff --git a/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp b/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>index 17f66b71779c0549cf68ae28165818a729d663fe..0d300b5909f392e4f75f8a61ac3596624c551806 100644
>--- a/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>+++ b/Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp
>@@ -68,12 +68,24 @@ static const uint32_t maximumSessionStateDataSize = std::numeric_limits<uint32_t
> 
> template<typename T> void isValidEnum(T);
> 
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+static WTF::DebugHeap& debugHeap()
>+{
>+    static NeverDestroyed<WTF::DebugHeap> heap = WTF::DebugHeap("WebKit HistoryEntryDataEncoder");
>+    return heap;
>+}
>+#endif
>+
> class HistoryEntryDataEncoder {
> public:
>     HistoryEntryDataEncoder()
>         : m_bufferSize(0)
>         , m_bufferCapacity(512)
>-        , m_buffer(MallocPtr<uint8_t>::malloc(m_bufferCapacity))
>+        , m_buffer(MallocPtr<uint8_t>::malloc(m_bufferCapacity
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+            , debugHeap()
>+#endif
>+            ))
>         , m_bufferPointer(m_buffer.get())
>     {
>         // Keep format compatibility by encoding an unused uint64_t here.
>@@ -503,7 +515,11 @@ RefPtr<API::Data> encodeLegacySessionState(const SessionState& sessionState)
>     CFIndex length = CFDataGetLength(data.get());
> 
>     size_t bufferSize = length + sizeof(uint32_t);
>-    auto buffer = MallocPtr<uint8_t>::malloc(bufferSize);
>+    auto buffer = MallocPtr<uint8_t>::malloc(bufferSize
>+#if ENABLE(MALLOC_HEAP_BREAKDOWN)
>+        , debugHeap()
>+#endif
>+        );
> 
>     // Put the session state version number at the start of the buffer
>     buffer.get()[0] = (sessionStateDataVersion & 0xff000000) >> 24;
>diff --git a/Source/bmalloc/bmalloc/BPlatform.h b/Source/bmalloc/bmalloc/BPlatform.h
>index 39516ac0d3511583f16f10285edff8c8d57e4d23..f62d56052309e77cc7c154082f297931b686cf63 100644
>--- a/Source/bmalloc/bmalloc/BPlatform.h
>+++ b/Source/bmalloc/bmalloc/BPlatform.h
>@@ -233,3 +233,6 @@
> 
> /* This is used for debugging when hacking on how bmalloc calculates its physical footprint. */
> #define ENABLE_PHYSICAL_PAGE_MAP 0
>+
>+/* Enable this to put each ISOHeap and other allocation categories into their own malloc heaps, so that tools like vmmap can show how big each heap is. */
>+#define BENABLE_MALLOC_HEAP_BREAKDOWN 1
>diff --git a/Source/bmalloc/bmalloc/DebugHeap.cpp b/Source/bmalloc/bmalloc/DebugHeap.cpp
>index f0a37e86bc75e73fc46b3941eae8015e2319af93..fd1bda192421c25535187f68196adffa05529941 100644
>--- a/Source/bmalloc/bmalloc/DebugHeap.cpp
>+++ b/Source/bmalloc/bmalloc/DebugHeap.cpp
>@@ -43,8 +43,17 @@ DebugHeap::DebugHeap(std::lock_guard<Mutex>&)
>     malloc_set_zone_name(m_zone, "WebKit Using System Malloc");
> }
> 
>+void DebugHeap::setZoneName(const char* name)
>+{
>+    malloc_set_zone_name(m_zone, name);
>+}
>+
> void* DebugHeap::malloc(size_t size)
> {
>+    if (m_logMallocs && size > 1024) {
>+        fprintf(stderr, "DebugHeap::malloc %lu\n", size);
>+    }
>+
>     void* result = malloc_zone_malloc(m_zone, size);
>     if (!result)
>         BCRASH();
>@@ -53,6 +62,10 @@ void* DebugHeap::malloc(size_t size)
> 
> void* DebugHeap::memalign(size_t alignment, size_t size, bool crashOnFailure)
> {
>+    if (m_logMallocs && size > 1024) {
>+        fprintf(stderr, "DebugHeap::memalign %lu\n", size);
>+    }
>+
>     void* result = malloc_zone_memalign(m_zone, alignment, size);
>     if (!result && crashOnFailure)
>         BCRASH();
>@@ -61,6 +74,10 @@ void* DebugHeap::memalign(size_t alignment, size_t size, bool crashOnFailure)
> 
> void* DebugHeap::realloc(void* object, size_t size)
> {
>+    if (m_logMallocs && size > 1024) {
>+        fprintf(stderr, "DebugHeap::realloc %lu\n", size);
>+    }
>+
>     void* result = malloc_zone_realloc(m_zone, object, size);
>     if (!result)
>         BCRASH();
>@@ -117,6 +134,10 @@ void DebugHeap::free(void* object)
> 
> void* DebugHeap::memalignLarge(size_t alignment, size_t size)
> {
>+    if (size > 1024) {
>+        fprintf(stderr, "DebugHeap::memalignLarge %lu\n", size);
>+    }
>+
>     alignment = roundUpToMultipleOf(m_pageSize, alignment);
>     size = roundUpToMultipleOf(m_pageSize, size);
>     void* result = tryVMAllocate(alignment, size);
>diff --git a/Source/bmalloc/bmalloc/DebugHeap.h b/Source/bmalloc/bmalloc/DebugHeap.h
>index 314b9c3d92d06cc0fc908947eccbecc912972d3b..9b4dace182898290c845a88749ab24b14ebe7b9b 100644
>--- a/Source/bmalloc/bmalloc/DebugHeap.h
>+++ b/Source/bmalloc/bmalloc/DebugHeap.h
>@@ -34,11 +34,14 @@
> #endif
> 
> namespace bmalloc {
>-    
>+
> class DebugHeap {
> public:
>     DebugHeap(std::lock_guard<Mutex>&);
>     
>+    void setZoneName(const char*);
>+    void setLogMallocs(bool f) { m_logMallocs = f; }
>+
>     void* malloc(size_t);
>     void* memalign(size_t alignment, size_t, bool crashOnFailure);
>     void* realloc(void*, size_t);
>@@ -56,6 +59,7 @@ private:
>     size_t m_pageSize;
>     std::mutex m_lock;
>     std::unordered_map<void*, size_t> m_sizeMap;
>+    bool m_logMallocs { true };
> };
> 
> } // namespace bmalloc
>diff --git a/Source/bmalloc/bmalloc/Heap.cpp b/Source/bmalloc/bmalloc/Heap.cpp
>index 53b3e369193f1f5499a3acea47bc571792b30a0e..953019933953eac950f04ac503481e4129df53a7 100644
>--- a/Source/bmalloc/bmalloc/Heap.cpp
>+++ b/Source/bmalloc/bmalloc/Heap.cpp
>@@ -43,6 +43,34 @@
> 
> namespace bmalloc {
> 
>+class PrimaryDebugHeap : public DebugHeap
>+{
>+public:
>+    PrimaryDebugHeap(std::lock_guard<Mutex>& mutex)
>+        : DebugHeap(mutex)
>+    {
>+    }
>+};
>+
>+class PrimitiveGigacageDebugHeap : public DebugHeap
>+{
>+public:
>+    PrimitiveGigacageDebugHeap(std::lock_guard<Mutex>& mutex)
>+        : DebugHeap(mutex)
>+    {
>+    }
>+};
>+
>+class JSValueGigacageDebugHeap : public DebugHeap
>+{
>+public:
>+    JSValueGigacageDebugHeap(std::lock_guard<Mutex>& mutex)
>+        : DebugHeap(mutex)
>+    {
>+    }
>+};
>+
>+
> Heap::Heap(HeapKind kind, std::lock_guard<Mutex>&)
>     : m_kind(kind)
>     , m_vmPageSizePhysical(vmPageSizePhysical())
>@@ -54,9 +82,30 @@ Heap::Heap(HeapKind kind, std::lock_guard<Mutex>&)
>     initializeLineMetadata();
>     initializePageMetadata();
>     
>-    if (PerProcess<Environment>::get()->isDebugHeapEnabled())
>+    if (PerProcess<Environment>::get()->isDebugHeapEnabled()) {
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+        switch (kind) {
>+        case HeapKind::Primary: {
>+            m_debugHeap = PerProcess<PrimaryDebugHeap>::get();
>+            m_debugHeap->setZoneName("WebKit Heap Primary");
>+            m_debugHeap->setLogMallocs(false);
>+            break;
>+        }
>+        case HeapKind::PrimitiveGigacage:
>+            m_debugHeap = PerProcess<PrimitiveGigacageDebugHeap>::get();
>+            m_debugHeap->setZoneName("WebKit Primitive Gigacage");
>+            m_debugHeap->setLogMallocs(false);
>+            break;
>+        case HeapKind::JSValueGigacage:
>+            m_debugHeap = PerProcess<JSValueGigacageDebugHeap>::get();
>+            m_debugHeap->setZoneName("WebKit JSValue Gigacage");
>+            m_debugHeap->setLogMallocs(false);
>+            break;
>+        }
>+#else
>         m_debugHeap = PerProcess<DebugHeap>::get();
>-    else {
>+#endif
>+    } else {
>         Gigacage::ensureGigacage();
> #if GIGACAGE_ENABLED
>         if (usingGigacage()) {
>diff --git a/Source/bmalloc/bmalloc/IsoHeap.h b/Source/bmalloc/bmalloc/IsoHeap.h
>index 0cd3764806b75cb24cc76e4889bbc0c4dffc046e..426026271ad6b89d06cbe7be89edda1136135933 100644
>--- a/Source/bmalloc/bmalloc/IsoHeap.h
>+++ b/Source/bmalloc/bmalloc/IsoHeap.h
>@@ -28,6 +28,10 @@
> #include "IsoConfig.h"
> #include "Mutex.h"
> 
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+#include <malloc/malloc.h>
>+#endif
>+
> namespace bmalloc {
> 
> template<typename Config> class IsoHeapImpl;
>@@ -44,6 +48,8 @@ template<typename Type>
> struct IsoHeap {
>     typedef IsoConfig<sizeof(Type)> Config;
>     
>+    IsoHeap(const char*);
>+
>     void* allocate();
>     void* tryAllocate();
>     void deallocate(void* p);
>@@ -64,6 +70,11 @@ struct IsoHeap {
>     unsigned m_allocatorOffsetPlusOne;
>     unsigned m_deallocatorOffsetPlusOne;
>     IsoHeapImpl<Config>* m_impl;
>+
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+    const char* m_heapClass;
>+    malloc_zone_t* m_zone;
>+#endif
> };
> 
> // Use this together with MAKE_BISO_MALLOCED_IMPL.
>diff --git a/Source/bmalloc/bmalloc/IsoHeapInlines.h b/Source/bmalloc/bmalloc/IsoHeapInlines.h
>index 35f90f5ef74bb15fcab831f0d7ebe67ae873a1fb..02c3bbc56de08f2f05bf1a061b780912a3a79a16 100644
>--- a/Source/bmalloc/bmalloc/IsoHeapInlines.h
>+++ b/Source/bmalloc/bmalloc/IsoHeapInlines.h
>@@ -43,6 +43,12 @@
> 
> namespace bmalloc { namespace api {
> 
>+template<typename Type>
>+IsoHeap<Type>::IsoHeap(const char* heapClass)
>+    : m_heapClass(heapClass)
>+{
>+}
>+
> template<typename Type>
> void* IsoHeap<Type>::allocate()
> {
>@@ -89,7 +95,7 @@ auto IsoHeap<Type>::impl() -> IsoHeapImpl<Config>&
> public: \
>     static ::bmalloc::api::IsoHeap<isoType>& bisoHeap() \
>     { \
>-        static ::bmalloc::api::IsoHeap<isoType> heap; \
>+        static ::bmalloc::api::IsoHeap<isoType> heap("WebKit_"#isoType); \
>         return heap; \
>     } \
>     \
>@@ -115,7 +121,7 @@ typedef int __makeBisoMallocedInlineMacroSemicolonifier
> #define MAKE_BISO_MALLOCED_IMPL(isoType) \
> ::bmalloc::api::IsoHeap<isoType>& isoType::bisoHeap() \
> { \
>-    static ::bmalloc::api::IsoHeap<isoType> heap; \
>+    static ::bmalloc::api::IsoHeap<isoType> heap("WebKit "#isoType); \
>     return heap; \
> } \
> \
>diff --git a/Source/bmalloc/bmalloc/IsoTLS.cpp b/Source/bmalloc/bmalloc/IsoTLS.cpp
>index aca5bf0c9a84bf16b8740fe8c4f4b574d406b18b..4a8f4ae90be9e7753cbc9119582c40e8a0964182 100644
>--- a/Source/bmalloc/bmalloc/IsoTLS.cpp
>+++ b/Source/bmalloc/bmalloc/IsoTLS.cpp
>@@ -178,6 +178,7 @@ bool IsoTLS::isUsingDebugHeap()
> 
> auto IsoTLS::debugMalloc(size_t size) -> DebugMallocResult
> {
>+    // FIXME for heap tracking.
>     DebugMallocResult result;
>     if ((result.usingDebugHeap = isUsingDebugHeap()))
>         result.ptr = PerProcess<DebugHeap>::get()->malloc(size);
>@@ -186,6 +187,7 @@ auto IsoTLS::debugMalloc(size_t size) -> DebugMallocResult
> 
> bool IsoTLS::debugFree(void* p)
> {
>+    // FIXME for heap tracking.
>     if (isUsingDebugHeap()) {
>         PerProcess<DebugHeap>::get()->free(p);
>         return true;
>diff --git a/Source/bmalloc/bmalloc/IsoTLSInlines.h b/Source/bmalloc/bmalloc/IsoTLSInlines.h
>index 20f6afeacd9d9ae97af0bf0c6dc518551c7eea09..ecd6d355b0d5e164baf4e007e1531185deaad6b3 100644
>--- a/Source/bmalloc/bmalloc/IsoTLSInlines.h
>+++ b/Source/bmalloc/bmalloc/IsoTLSInlines.h
>@@ -25,6 +25,7 @@
> 
> #pragma once
> 
>+#include "IsoConfig.h"
> #include "IsoHeapImpl.h"
> #include "IsoTLS.h"
> #include "bmalloc.h"
>@@ -93,7 +94,12 @@ BNO_INLINE void* IsoTLS::allocateSlow(api::IsoHeap<Type>& handle, bool abortOnFa
>         }
>         break;
>     }
>-    
>+
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+    ensureHeap(handle);
>+    return malloc_zone_malloc(handle.m_zone, Config::objectSize);
>+#endif
>+
>     auto debugMallocResult = debugMalloc(Config::objectSize);
>     if (debugMallocResult.usingDebugHeap)
>         return debugMallocResult.ptr;
>@@ -137,7 +143,12 @@ BNO_INLINE void IsoTLS::deallocateSlow(api::IsoHeap<Type>& handle, void* p)
>         }
>         break;
>     }
>-    
>+
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+    malloc_zone_free(handle.m_zone, p);
>+    return;
>+#endif
>+
>     if (debugFree(p))
>         return;
>     
>@@ -179,6 +190,11 @@ void IsoTLS::ensureHeap(api::IsoHeap<Type>& handle)
>             handle.setAllocatorOffset(heap->allocatorOffset());
>             handle.setDeallocatorOffset(heap->deallocatorOffset());
>             handle.m_impl = heap;
>+
>+#if BENABLE_MALLOC_HEAP_BREAKDOWN
>+            handle.m_zone = malloc_create_zone(0, 0);
>+            malloc_set_zone_name(handle.m_zone, handle.m_heapClass);
>+#endif
>         }
>     }
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 186422: 342237 | 342911 | 342912 | 352402 | 369931 | 369938 | 369939 | 369940 | 369941 | 370089 | 370092 | 370901 | 370923 | 370927 | 370930 | 370998 | 371234 | 371238 | 386485 | 386486 | 386487 | 386488 | 386497 | 386503 | 386506 | 386507 | 386508 | 386550 | 386632