Title: [136388] releases/WebKitGTK/webkit-1.10/Source/_javascript_Core
- Revision
- 136388
- Author
- [email protected]
- Date
- 2012-12-03 05:30:33 -0800 (Mon, 03 Dec 2012)
Log Message
Merge 129577 - We shouldn't use the optimized versions of shift/unshift if the user is doing crazy things to the array
https://bugs.webkit.org/show_bug.cgi?id=97603
<rdar://problem/12370864>
Reviewed by Gavin Barraclough.
You changed the length behind our backs? No optimizations for you then!
* runtime/ArrayPrototype.cpp:
(JSC::shift):
(JSC::unshift):
* runtime/JSArray.cpp:
(JSC::JSArray::shiftCount):
Conflicts:
Source/_javascript_Core/runtime/JSArray.cpp
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/ChangeLog (136387 => 136388)
--- releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/ChangeLog 2012-12-03 13:23:59 UTC (rev 136387)
+++ releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/ChangeLog 2012-12-03 13:30:33 UTC (rev 136388)
@@ -1,3 +1,19 @@
+2012-09-25 Filip Pizlo <[email protected]>
+
+ We shouldn't use the optimized versions of shift/unshift if the user is doing crazy things to the array
+ https://bugs.webkit.org/show_bug.cgi?id=97603
+ <rdar://problem/12370864>
+
+ Reviewed by Gavin Barraclough.
+
+ You changed the length behind our backs? No optimizations for you then!
+
+ * runtime/ArrayPrototype.cpp:
+ (JSC::shift):
+ (JSC::unshift):
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::shiftCount):
+
2012-08-26 Filip Pizlo <[email protected]>
Array type checks and storage accesses should be uniformly represented and available to CSE
Modified: releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/ArrayPrototype.cpp (136387 => 136388)
--- releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2012-12-03 13:23:59 UTC (rev 136387)
+++ releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2012-12-03 13:30:33 UTC (rev 136388)
@@ -190,8 +190,11 @@
ASSERT(header <= length);
ASSERT(currentCount <= (length - header));
- if (!header && isJSArray(thisObj) && asArray(thisObj)->shiftCount(exec, count))
- return;
+ if (!header && isJSArray(thisObj)) {
+ JSArray* array = asArray(thisObj);
+ if (array->length() == length && asArray(thisObj)->shiftCount(exec, count))
+ return;
+ }
for (unsigned k = header; k < length - currentCount; ++k) {
unsigned from = k + currentCount;
@@ -230,8 +233,11 @@
return;
}
- if (!header && isJSArray(thisObj) && asArray(thisObj)->unshiftCount(exec, count))
- return;
+ if (!header && isJSArray(thisObj)) {
+ JSArray* array = asArray(thisObj);
+ if (array->length() == length && asArray(thisObj)->unshiftCount(exec, count))
+ return;
+ }
for (unsigned k = length - currentCount; k > header; --k) {
unsigned from = k + currentCount - 1;
Modified: releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/JSArray.cpp (136387 => 136388)
--- releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/JSArray.cpp 2012-12-03 13:23:59 UTC (rev 136387)
+++ releases/WebKitGTK/webkit-1.10/Source/_javascript_Core/runtime/JSArray.cpp 2012-12-03 13:30:33 UTC (rev 136388)
@@ -1308,6 +1308,7 @@
ArrayStorage* storage = m_storage;
unsigned oldLength = storage->m_length;
+ ASSERT(count <= oldLength);
// If the array contains holes or is otherwise in an abnormal state,
// use the generic algorithm in ArrayPrototype.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
