Title: [236514] trunk
- Revision
- 236514
- Author
- [email protected]
- Date
- 2018-09-26 11:57:32 -0700 (Wed, 26 Sep 2018)
Log Message
We should zero unused property storage when rebalancing array storage.
https://bugs.webkit.org/show_bug.cgi?id=188151
Reviewed by Michael Saboff.
JSTests:
* stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
Source/_javascript_Core:
In unshiftCountSlowCase we sometimes will move property storage to the right even when net adding elements.
This can happen because we "balance" the pre/post-capacity in that code so we need to zero the unused
property storage.
* runtime/JSArray.cpp:
(JSC::JSArray::unshiftCountSlowCase):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (236513 => 236514)
--- trunk/JSTests/ChangeLog 2018-09-26 18:45:23 UTC (rev 236513)
+++ trunk/JSTests/ChangeLog 2018-09-26 18:57:32 UTC (rev 236514)
@@ -1,3 +1,12 @@
+2018-09-26 Keith Miller <[email protected]>
+
+ We should zero unused property storage when rebalancing array storage.
+ https://bugs.webkit.org/show_bug.cgi?id=188151
+
+ Reviewed by Michael Saboff.
+
+ * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
+
2018-09-20 Yusuke Suzuki <[email protected]>
[JSC] Optimize Array#lastIndexOf
Added: trunk/JSTests/stress/splice-should-zero-property-storage-when-rebalancing.js (0 => 236514)
--- trunk/JSTests/stress/splice-should-zero-property-storage-when-rebalancing.js (rev 0)
+++ trunk/JSTests/stress/splice-should-zero-property-storage-when-rebalancing.js 2018-09-26 18:57:32 UTC (rev 236514)
@@ -0,0 +1,8 @@
+var arr = [4, 5, 6];
+arr.push(10);
+arr.pop();
+Object.defineProperty(arr, "foo", { });
+
+arr.shift();
+arr.splice(0, 0, 101, 102);
+Object.defineProperty(arr, "bar", { });
Modified: trunk/Source/_javascript_Core/ChangeLog (236513 => 236514)
--- trunk/Source/_javascript_Core/ChangeLog 2018-09-26 18:45:23 UTC (rev 236513)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-09-26 18:57:32 UTC (rev 236514)
@@ -1,3 +1,17 @@
+2018-09-26 Keith Miller <[email protected]>
+
+ We should zero unused property storage when rebalancing array storage.
+ https://bugs.webkit.org/show_bug.cgi?id=188151
+
+ Reviewed by Michael Saboff.
+
+ In unshiftCountSlowCase we sometimes will move property storage to the right even when net adding elements.
+ This can happen because we "balance" the pre/post-capacity in that code so we need to zero the unused
+ property storage.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::unshiftCountSlowCase):
+
2018-09-26 Yusuke Suzuki <[email protected]>
Unreviewed, add scope verification handling
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (236513 => 236514)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2018-09-26 18:45:23 UTC (rev 236513)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2018-09-26 18:57:32 UTC (rev 236514)
@@ -424,13 +424,14 @@
memmove(newButterfly->arrayStorage()->m_vector + count, storage->m_vector, sizeof(JSValue) * usedVectorLength);
memmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
+ // We don't need to zero the pre-capacity for the concurrent GC because it is not available to use as property storage.
+ memset(newButterfly->base(0, propertyCapacity), 0, (propertyCapacity - propertySize) * sizeof(JSValue));
+
if (allocatedNewStorage) {
// We will set the vectorLength to newVectorLength. We populated requiredVectorLength
// (usedVectorLength + count), which is less. Clear the difference.
for (unsigned i = requiredVectorLength; i < newVectorLength; ++i)
newButterfly->arrayStorage()->m_vector[i].clear();
- // We don't need to zero the pre-capacity because it is not available to use as property storage.
- memset(newButterfly->base(0, propertyCapacity), 0, (propertyCapacity - propertySize) * sizeof(JSValue));
}
} else if ((newAllocBase != butterfly->base(structure)) || (preCapacity != storage->m_indexBias)) {
memmove(newButterfly->propertyStorage() - propertyCapacity, butterfly->propertyStorage() - propertyCapacity, sizeof(JSValue) * propertyCapacity + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
