Having an iframe as a descendent node shouldn't require ElementRareData

rniwa · rniwa · commit d493cd280f85 · 2020-09-09T03:32:10.000Z
https://bugs.webkit.org/show_bug.cgi?id=216264 Reviewed by Darin Adler. Store the number of connected frames in the descendent nodes directly in Node using CompactUniquePtrTuple in the same space as where we store the NodeRareData pointer. This avoids creating ElementRareData on every ancestor element and shadow host / document of an iframe. Also moved TabIndexState there to simply NodeFlags, and created CustomElementState to replace the existing flags in NodeFlags to match the latest terminology used in the specification: https://dom.spec.whatwg.org/#concept-element-custom-element-state CustomElementState has four states: "uncustomized" (default; builtin elements), "undefined" (i.e. element has a valid custom element but it hasn't been defined or upgraded yet), "custom" (a valid custom element instance), and "failed" (upgrading has resulted in an error). Before this patch, "uncustomized" meant that neither IsCustomElement nor IsEditingTextOrUndefinedCustomElementFlag is set, "undefined" had IsCustomElement and IsEditingTextOrUndefinedCustomElementFlag set, and "custom" had IsCustomElement set but IsEditingTextOrUndefinedCustomElementFlag unset whereas "failed" had the opposite. No new tests since there should be no observable behavioral change. * cssjit/SelectorCompiler.cpp: (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild): Mask out the bits stored in the pointer in the 64-bit architecture. In the 32-bit architecture, the pointer is the first component without any extra bits stored in it. * dom/Element.cpp: (WebCore::Node::setTabIndexState): Moved from Node.h. Updated to use the newly introduced bitfields. (WebCore::Node::setCustomElementState): Added. (WebCore::Element::setIsDefinedCustomElement): Now updates CustomElementState in the newly added bitfields. (WebCore::Element::setIsFailedCustomElementWithoutClearingReactionQueue): Ditto. (WebCore::Element::setIsCustomElementUpgradeCandidate): Ditto. * dom/ElementRareData.cpp: * dom/ElementRareData.h: (WebCore::ElementRareData): Moved m_unusualTabIndex and m_childIndex to NodeRareData for better packing. * dom/Node.cpp: (WebCore::Node::materializeRareData): (WebCore::Node::clearRareData): (WebCore::Node::connectedSubframeCount const): Moved to the header file. (WebCore::Node::incrementConnectedSubframeCount): Now updates the newly added bitfields. (WebCore::Node::decrementConnectedSubframeCount): Ditto. * dom/Node.h: (WebCore::Node::isUndefinedCustomElement const): Now uses CustomElementState in the newly added bitfields. (WebCore::Node::isCustomElementUpgradeCandidate const): Ditto. (WebCore::Node::isDefinedCustomElement const): Ditto. (WebCore::Node::isFailedCustomElement const): Ditto. (WebCore::Node::isEditingText const): (WebCore::Node::connectedSubframeCount const): Moved here from cpp file. (WebCore::Node::rareDataMemoryOffset): (WebCore::Node::rareDataPointerMask): Added. (WebCore::Node::CustomElementState): Added. (WebCore::Node::RareDataBitFields): Added. (WebCore::Node::rareDataBitfields const): Added. (WebCore::Node::setRareDataBitfields): Added. (WebCore::Node::tabIndexState const): Updated to use rareDataBitfields. (WebCore::Node::setTabIndexState): Moved to Element.cpp. (WebCore::Node::customElementState const): Added. (WebCore::Node::hasRareData const): (WebCore::Node::rareData const): * dom/NodeRareData.cpp: * dom/NodeRareData.h: (WebCore::NodeRareData::UseType): Removed ConnectedFrameCount. (WebCore::NodeRareData::NodeRareData): (WebCore::NodeRareData::useTypes const): (WebCore::NodeRareData::connectedSubframeCount const): Deleted. (WebCore::NodeRareData::incrementConnectedSubframeCount): Deleted. (WebCore::NodeRareData::decrementConnectedSubframeCount): Deleted. (WebCore::NodeRareData): Moved m_unusualTabIndex and m_childIndex here for better packing in 64-bit architecture. Canonical link: https://commits.webkit.org/229133@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@266769 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,74 @@
+2020-09-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Having an iframe as a descendent node shouldn't require ElementRareData
+        https://bugs.webkit.org/show_bug.cgi?id=216264
+
+        Reviewed by Darin Adler.
+
+        Store the number of connected frames in the descendent nodes directly in Node using CompactUniquePtrTuple
+        in the same space as where we store the NodeRareData pointer. This avoids creating ElementRareData on every
+        ancestor element and shadow host / document of an iframe.
+
+        Also moved TabIndexState there to simply NodeFlags, and created CustomElementState to replace the existing
+        flags in NodeFlags to match the latest terminology used in the specification:
+        https://dom.spec.whatwg.org/#concept-element-custom-element-state
+
+        CustomElementState has four states: "uncustomized" (default; builtin elements), "undefined" (i.e. element has
+        a valid custom element but it hasn't been defined or upgraded yet), "custom" (a valid custom element instance),
+        and "failed" (upgrading has resulted in an error). Before this patch, "uncustomized" meant that neither
+        IsCustomElement nor IsEditingTextOrUndefinedCustomElementFlag is set, "undefined" had IsCustomElement
+        and IsEditingTextOrUndefinedCustomElementFlag set, and "custom" had IsCustomElement set but
+        IsEditingTextOrUndefinedCustomElementFlag unset whereas "failed" had the opposite.
+
+        No new tests since there should be no observable behavioral change.
+
+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild): Mask out the bits stored in
+        the pointer in the 64-bit architecture. In the 32-bit architecture, the pointer is the first component
+        without any extra bits stored in it.
+        * dom/Element.cpp:
+        (WebCore::Node::setTabIndexState): Moved from Node.h. Updated to use the newly introduced bitfields.
+        (WebCore::Node::setCustomElementState): Added.
+        (WebCore::Element::setIsDefinedCustomElement): Now updates CustomElementState in the newly added bitfields.
+        (WebCore::Element::setIsFailedCustomElementWithoutClearingReactionQueue): Ditto.
+        (WebCore::Element::setIsCustomElementUpgradeCandidate): Ditto.
+        * dom/ElementRareData.cpp:
+        * dom/ElementRareData.h:
+        (WebCore::ElementRareData): Moved m_unusualTabIndex and m_childIndex to NodeRareData for better packing.
+        * dom/Node.cpp:
+        (WebCore::Node::materializeRareData):
+        (WebCore::Node::clearRareData):
+        (WebCore::Node::connectedSubframeCount const): Moved to the header file.
+        (WebCore::Node::incrementConnectedSubframeCount): Now updates the newly added bitfields.
+        (WebCore::Node::decrementConnectedSubframeCount): Ditto.
+        * dom/Node.h:
+        (WebCore::Node::isUndefinedCustomElement const): Now uses CustomElementState in the newly added bitfields.
+        (WebCore::Node::isCustomElementUpgradeCandidate const): Ditto.
+        (WebCore::Node::isDefinedCustomElement const): Ditto.
+        (WebCore::Node::isFailedCustomElement const): Ditto.
+        (WebCore::Node::isEditingText const):
+        (WebCore::Node::connectedSubframeCount const): Moved here from cpp file.
+        (WebCore::Node::rareDataMemoryOffset):
+        (WebCore::Node::rareDataPointerMask): Added.
+        (WebCore::Node::CustomElementState): Added.
+        (WebCore::Node::RareDataBitFields): Added.
+        (WebCore::Node::rareDataBitfields const): Added.
+        (WebCore::Node::setRareDataBitfields): Added.
+        (WebCore::Node::tabIndexState const): Updated to use rareDataBitfields.
+        (WebCore::Node::setTabIndexState): Moved to Element.cpp.
+        (WebCore::Node::customElementState const): Added.
+        (WebCore::Node::hasRareData const):
+        (WebCore::Node::rareData const):
+        * dom/NodeRareData.cpp:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::UseType): Removed ConnectedFrameCount.
+        (WebCore::NodeRareData::NodeRareData):
+        (WebCore::NodeRareData::useTypes const):
+        (WebCore::NodeRareData::connectedSubframeCount const): Deleted.
+        (WebCore::NodeRareData::incrementConnectedSubframeCount): Deleted.
+        (WebCore::NodeRareData::decrementConnectedSubframeCount): Deleted.
+        (WebCore::NodeRareData): Moved m_unusualTabIndex and m_childIndex here for better packing in 64-bit architecture.
+
 2020-09-08  Tim Horton  <timothy_horton@apple.com>
 
         WebCore UnifiedSource81 builds for upwards of 10 minutes
diff --git a/Source/WebCore/cssjit/SelectorCompiler.cpp b/Source/WebCore/cssjit/SelectorCompiler.cpp
@@ -3582,6 +3582,10 @@ void SelectorCodeGenerator::generateElementIsNthChild(Assembler::JumpList& failu
         LocalRegister elementRareData(m_registerAllocator);
         m_assembler.loadPtr(Assembler::Address(previousSibling, Node::rareDataMemoryOffset()), elementRareData);
 
+        LocalRegister rareDataPointerMask(m_registerAllocator);
+        m_assembler.move(Assembler::TrustedImmPtr(Node::rareDataPointerMask()), rareDataPointerMask);
+        m_assembler.andPtr(rareDataPointerMask, elementRareData);
+
         noCachedChildIndexCases.append(m_assembler.branchTestPtr(Assembler::Zero, elementRareData));
         {
             LocalRegister cachedChildIndex(m_registerAllocator);
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
@@ -241,6 +241,13 @@ inline ElementRareData& Element::ensureElementRareData()
     return static_cast<ElementRareData&>(ensureRareData());
 }
 
+inline void Node::setTabIndexState(TabIndexState state)
+{
+    auto bitfields = rareDataBitfields();
+    bitfields.tabIndexState = static_cast<uint16_t>(state);
+    setRareDataBitfields(bitfields);
+}
+
 void Element::setTabIndexExplicitly(Optional<int> tabIndex)
 {
     if (!tabIndex) {
@@ -2422,10 +2429,16 @@ ShadowRoot& Element::ensureUserAgentShadowRoot()
     return shadow;
 }
 
+inline void Node::setCustomElementState(CustomElementState state)
+{
+    auto bitfields = rareDataBitfields();
+    bitfields.customElementState = static_cast<uint16_t>(state);
+    setRareDataBitfields(bitfields);
+}
+
 void Element::setIsDefinedCustomElement(JSCustomElementInterface& elementInterface)
 {
-    clearFlag(IsEditingTextOrUndefinedCustomElementFlag);
-    setFlag(IsCustomElement);
+    setCustomElementState(CustomElementState::Custom);
     auto& data = ensureElementRareData();
     if (!data.customElementReactionQueue())
         data.setCustomElementReactionQueue(makeUnique<CustomElementReactionQueue>(elementInterface));
@@ -2442,8 +2455,8 @@ void Element::setIsFailedCustomElement()
 void Element::setIsFailedCustomElementWithoutClearingReactionQueue()
 {
     ASSERT(isUndefinedCustomElement());
-    ASSERT(getFlag(IsEditingTextOrUndefinedCustomElementFlag));
-    clearFlag(IsCustomElement);
+    ASSERT(customElementState() == CustomElementState::Undefined);
+    setCustomElementState(CustomElementState::Failed);
     InspectorInstrumentation::didChangeCustomElementState(*this);
 }
 
@@ -2459,9 +2472,8 @@ void Element::clearReactionQueueFromFailedCustomElement()
 
 void Element::setIsCustomElementUpgradeCandidate()
 {
-    ASSERT(!getFlag(IsCustomElement));
-    setFlag(IsCustomElement);
-    setFlag(IsEditingTextOrUndefinedCustomElementFlag);
+    ASSERT(customElementState() == CustomElementState::Uncustomized);
+    setCustomElementState(CustomElementState::Undefined);
     InspectorInstrumentation::didChangeCustomElementState(*this);
 }
 
diff --git a/Source/WebCore/dom/ElementRareData.cpp b/Source/WebCore/dom/ElementRareData.cpp
@@ -34,8 +34,6 @@
 namespace WebCore {
 
 struct SameSizeAsElementRareData : NodeRareData {
-    int tabIndex;
-    unsigned short childIndex;
     LayoutSize sizeForResizing;
     IntPoint savedLayerScrollPosition;
     void* pointers[11];
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
@@ -158,9 +158,6 @@ class ElementRareData : public NodeRareData {
 #endif
 
 private:
-    int m_unusualTabIndex { 0 };
-    unsigned short m_childIndex { 0 };
-
     LayoutSize m_minimumSizeForResizing;
     IntPoint m_savedLayerScrollPosition;
     std::unique_ptr<RenderStyle> m_computedStyle;
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
@@ -413,9 +413,9 @@ void Node::willBeDeletedFrom(Document& document)
 void Node::materializeRareData()
 {
     if (is<Element>(*this))
-        m_rareData = std::unique_ptr<NodeRareData, NodeRareDataDeleter>(new ElementRareData);
+        m_rareDataWithBitfields.setPointer(std::unique_ptr<NodeRareData, NodeRareDataDeleter>(new ElementRareData));
     else
-        m_rareData = std::unique_ptr<NodeRareData, NodeRareDataDeleter>(new NodeRareData);
+        m_rareDataWithBitfields.setPointer(std::unique_ptr<NodeRareData, NodeRareDataDeleter>(new NodeRareData));
 }
 
 inline void Node::NodeRareDataDeleter::operator()(NodeRareData* rareData) const
@@ -431,7 +431,7 @@ void Node::clearRareData()
     ASSERT(hasRareData());
     ASSERT(!transientMutationObserverRegistry() || transientMutationObserverRegistry()->isEmpty());
 
-    m_rareData = nullptr;
+    m_rareDataWithBitfields.setPointer(nullptr);
 }
 
 bool Node::isNode() const
@@ -2573,23 +2573,24 @@ void Node::removedLastRef()
     delete this;
 }
 
-unsigned Node::connectedSubframeCount() const
-{
-    return hasRareData() ? rareData()->connectedSubframeCount() : 0;
-}
-
 void Node::incrementConnectedSubframeCount(unsigned amount)
 {
+    static_assert(RareDataBitFields { Page::maxNumberOfFrames, 0, 0 }.connectedSubframeCount == Page::maxNumberOfFrames, "connectedSubframeCount must fit Page::maxNumberOfFrames");
+
     ASSERT(isContainerNode());
-    ensureRareData().incrementConnectedSubframeCount(amount);
+    auto bitfields = rareDataBitfields();
+    bitfields.connectedSubframeCount += amount;
+    RELEASE_ASSERT(bitfields.connectedSubframeCount == rareDataBitfields().connectedSubframeCount + amount);
+    setRareDataBitfields(bitfields);
 }
 
 void Node::decrementConnectedSubframeCount(unsigned amount)
 {
-    ASSERT(rareData());
-    if (!hasRareData())
-        return; // Defend against type confusion when the above assertion fails. See webkit.org/b/200300.
-    rareData()->decrementConnectedSubframeCount(amount);
+    ASSERT(isContainerNode());
+    auto bitfields = rareDataBitfields();
+    RELEASE_ASSERT(amount <= bitfields.connectedSubframeCount);
+    bitfields.connectedSubframeCount -= amount;
+    setRareDataBitfields(bitfields);
 }
 
 void Node::updateAncestorConnectedSubframeCountForRemoval() const
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
@@ -32,6 +32,7 @@
 #include "StyleValidity.h"
 #include "TreeScope.h"
 #include <wtf/CompactPointerTuple.h>
+#include <wtf/CompactUniquePtrTuple.h>
 #include <wtf/Forward.h>
 #include <wtf/IsoMalloc.h>
 #include <wtf/ListHashSet.h>
@@ -229,10 +230,10 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
     HTMLSlotElement* assignedSlot() const;
     HTMLSlotElement* assignedSlotForBindings() const;
 
-    bool isUndefinedCustomElement() const { return isElementNode() && getFlag(IsEditingTextOrUndefinedCustomElementFlag); }
-    bool isCustomElementUpgradeCandidate() const { return getFlag(IsCustomElement) && getFlag(IsEditingTextOrUndefinedCustomElementFlag); }
-    bool isDefinedCustomElement() const { return getFlag(IsCustomElement) && !getFlag(IsEditingTextOrUndefinedCustomElementFlag); }
-    bool isFailedCustomElement() const { return isElementNode() && !getFlag(IsCustomElement) && getFlag(IsEditingTextOrUndefinedCustomElementFlag); }
+    bool isUndefinedCustomElement() const { return customElementState() == CustomElementState::Undefined || customElementState() == CustomElementState::Failed; }
+    bool isCustomElementUpgradeCandidate() const { return customElementState() == CustomElementState::Undefined; }
+    bool isDefinedCustomElement() const { return customElementState() == CustomElementState::Custom; }
+    bool isFailedCustomElement() const { return customElementState() == CustomElementState::Failed; }
 
     // Returns null, a child of ShadowRoot, or a legacy shadow root.
     Node* nonBoundaryShadowTreeRootNode();
@@ -296,7 +297,7 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
     Style::Validity styleValidity() const { return styleBitfields().styleValidity(); }
     bool styleResolutionShouldRecompositeLayer() const { return hasStyleFlag(NodeStyleFlag::StyleResolutionShouldRecompositeLayer); }
     bool childNeedsStyleRecalc() const { return hasStyleFlag(NodeStyleFlag::DescendantNeedsStyleResolution); }
-    bool isEditingText() const { return getFlag(IsTextFlag) && getFlag(IsEditingTextOrUndefinedCustomElementFlag); }
+    bool isEditingText() const { return getFlag(IsTextFlag) && getFlag(IsEditingText); }
 
     void setChildNeedsStyleRecalc() { setStyleFlag(NodeStyleFlag::DescendantNeedsStyleResolution); }
     void clearChildNeedsStyleRecalc();
@@ -491,15 +492,20 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
     void unregisterTransientMutationObserver(MutationObserverRegistration&);
     void notifyMutationObserversNodeWillDetach();
 
-    unsigned connectedSubframeCount() const;
+    unsigned connectedSubframeCount() const { return rareDataBitfields().connectedSubframeCount; }
     void incrementConnectedSubframeCount(unsigned amount = 1);
     void decrementConnectedSubframeCount(unsigned amount = 1);
     void updateAncestorConnectedSubframeCountForRemoval() const;
     void updateAncestorConnectedSubframeCountForInsertion() const;
 
 #if ENABLE(JIT)
     static ptrdiff_t nodeFlagsMemoryOffset() { return OBJECT_OFFSETOF(Node, m_nodeFlags); }
-    static ptrdiff_t rareDataMemoryOffset() { return OBJECT_OFFSETOF(Node, m_rareData); }
+    static ptrdiff_t rareDataMemoryOffset() { return OBJECT_OFFSETOF(Node, m_rareDataWithBitfields); }
+#if CPU(ADDRESS64)
+    static uint64_t rareDataPointerMask() { return CompactPointerTuple<NodeRareData*, uint16_t>::pointerMask; }
+#else
+    static uint32_t rareDataPointerMask() { return -1; }
+#endif
     static int32_t flagIsText() { return IsTextFlag; }
     static int32_t flagIsContainer() { return IsContainerFlag; }
     static int32_t flagIsElement() { return IsElementFlag; }
@@ -526,12 +532,12 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
         HasEventTargetDataFlag = 1 << 11,
         // UnusedFlag = 1 << 12,
         // UnusedFlag = 1 << 13,
+        // UnusedFlag = 1 << 14,
 
         // These bits are used by derived classes, pulled up here so they can
         // be stored in the same memory word as the Node bits above.
-        IsEditingTextOrUndefinedCustomElementFlag = 1 << 14, // Text and Element
-        IsCustomElement = 1 << 15, // Element
-        HasFocusWithin = 1 << 16,
+        IsEditingText = 1 << 15, // Text
+        HasFocusWithin = 1 << 16, // Element
         IsLinkFlag = 1 << 17,
         IsUserActionElement = 1 << 18,
         IsParsingChildrenFinishedFlag = 1 << 19,
@@ -547,28 +553,44 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
         ContainsFullScreenElementFlag = 1 << 26,
 #endif
 
-        // Bits 27-29 are free.
-        // Bits 30-31: TabIndexState
+        // Bits 27-31 are free.
 
         DefaultNodeFlags = IsParsingChildrenFinishedFlag
     };
 
-    static constexpr unsigned s_tabIndexStateBitOffset = 30;
-    static constexpr uint32_t s_tabIndexStateBitMask = 3U << s_tabIndexStateBitOffset;
     enum class TabIndexState : uint8_t {
         NotSet = 0,
         Zero = 1,
         NegativeOne = 2,
         InRareData = 3,
     };
 
+    enum class CustomElementState : uint8_t {
+        Uncustomized = 0,
+        Undefined = 1,
+        Custom = 2,
+        Failed = 3,
+    };
+
+    struct RareDataBitFields {
+        uint16_t connectedSubframeCount : 10;
+        uint16_t tabIndexState : 2;
+        uint16_t customElementState : 2;
+    };
+
     bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; }
     void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 
     void setFlag(NodeFlags mask) const { m_nodeFlags |= mask; } 
     void clearFlag(NodeFlags mask) const { m_nodeFlags &= ~mask; }
 
-    TabIndexState tabIndexState() const { return static_cast<TabIndexState>((m_nodeFlags & s_tabIndexStateBitMask) >> s_tabIndexStateBitOffset); }
-    void setTabIndexState(TabIndexState state) { m_nodeFlags = (m_nodeFlags & ~s_tabIndexStateBitMask) | (static_cast<uint32_t>(state) << s_tabIndexStateBitOffset); }
+    RareDataBitFields rareDataBitfields() const { return bitwise_cast<RareDataBitFields>(m_rareDataWithBitfields.type()); }
+    void setRareDataBitfields(RareDataBitFields bitfields) { m_rareDataWithBitfields.setType(bitwise_cast<uint16_t>(bitfields)); }
+
+    TabIndexState tabIndexState() const { return static_cast<TabIndexState>(rareDataBitfields().tabIndexState); }
+    void setTabIndexState(TabIndexState);
+
+    CustomElementState customElementState() const { return static_cast<CustomElementState>(rareDataBitfields().customElementState); }
+    void setCustomElementState(CustomElementState);
 
     bool isParsingChildrenFinished() const { return getFlag(IsParsingChildrenFinishedFlag); }
     void setIsParsingChildrenFinished() { setFlag(IsParsingChildrenFinishedFlag); }
@@ -586,7 +608,7 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
         CreateSVGElement = CreateElement | IsSVGFlag | HasCustomStyleResolveCallbacksFlag,
         CreateMathMLElement = CreateElement | IsMathMLFlag,
         CreateDocument = CreateContainer | IsDocumentNodeFlag | IsConnectedFlag,
-        CreateEditingText = CreateText | IsEditingTextOrUndefinedCustomElementFlag,
+        CreateEditingText = CreateText | IsEditingText,
     };
     Node(Document&, ConstructionType);
 
@@ -648,8 +670,8 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
 
     virtual void addSubresourceAttributeURLs(ListHashSet<URL>&) const { }
 
-    bool hasRareData() const { return !!m_rareData; }
-    NodeRareData* rareData() const { return m_rareData.get(); }
+    bool hasRareData() const { return !!m_rareDataWithBitfields.pointer(); }
+    NodeRareData* rareData() const { return m_rareDataWithBitfields.pointer(); }
     NodeRareData& ensureRareData();
     void clearRareData();
 
@@ -705,7 +727,7 @@ class Node : public CanMakeWeakPtr<Node>, public EventTarget {
     Node* m_previous { nullptr };
     Node* m_next { nullptr };
     CompactPointerTuple<RenderObject*, uint16_t> m_rendererWithStyleFlags;
-    std::unique_ptr<NodeRareData, NodeRareDataDeleter> m_rareData;
+    CompactUniquePtrTuple<NodeRareData, uint16_t, NodeRareDataDeleter> m_rareDataWithBitfields;
 };
 
 bool connectedInSameTreeScope(const Node*, const Node*);
diff --git a/Source/WebCore/dom/NodeRareData.cpp b/Source/WebCore/dom/NodeRareData.cpp
@@ -36,7 +36,8 @@
 namespace WebCore {
 
 struct SameSizeAsNodeRareData {
-    unsigned m_frameCountAndIsElementRareDataFlag;
+    uint32_t m_tabIndex;
+    uint32_t m_childIndexAndIsElementRareDataFlag;
     void* m_pointer[2];
 };
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
