Changeset 2846 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Nov 23, 2002, 11:49:26 PM (23 years ago)

Author:

mjs

Message:

• completed Darin's mostly-fix for 3037795 - Resource use increases when accessing very high index value in array

The two missing pieces were handling sparse properties when
shrinking the array, and when sorting. Thse are now both taken
care of.

• kjs/array_instance.h:
• kjs/array_object.cpp: (ArrayInstanceImp::put): (ArrayInstanceImp::deleteProperty): (ArrayInstanceImp::resizeStorage): (ArrayInstanceImp::setLength): (ArrayInstanceImp::sort): (ArrayInstanceImp::pushUndefinedObjectsToEnd):
• kjs/identifier.h:
• kjs/object.h:
• kjs/property_map.cpp:
• kjs/property_map.h:
• kjs/reference_list.cpp: (ReferenceList::append): (ReferenceList::length):
• kjs/reference_list.h:
• kjs/ustring.cpp: (UString::toUInt32):
• kjs/ustring.h:

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (10 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -105 +105 @@
 {
   if (propertyName == lengthPropertyName) {
-    setLength(value.toUInt32(exec));
+    setLength(value.toUInt32(exec), exec);
     return;
   }
@@ -113 +113 @@
   if (ok) {
     if (length <= index)
-      setLength(index + 1);
+      setLength(index + 1, exec);
     if (index < storageLength) {
       storage[index] = value.imp();
@@ -126 +126 @@
 {
   if (length <= index)
-    setLength(index + 1);
+    setLength(index + 1, exec);
   if (index < storageLength) {
     storage[index] = value.imp();
@@ -172 +172 @@
   
   bool ok;
-  unsigned index = propertyName.toULong(&ok);
+  uint32_t index = propertyName.toUInt32(&ok);
   if (ok) {
     if (index >= length)
@@ -197 +197 @@
 }
 
-void ArrayInstanceImp::setLength(unsigned newLength)
-{
-  if (newLength <= sparseArrayCutoff || newLength == length + 1) {
+void ArrayInstanceImp::resizeStorage(unsigned newLength)
+{
     if (newLength < storageLength) {
       memset(storage + newLength, 0, sizeof(ValueImp *) * (storageLength - newLength));
@@ -210 +209 @@
     }
     storageLength = newLength;
-  }
-  
-  // FIXME: Need to remove items from the property map when making a sparse
-  // list shorter.
+}
+
+void ArrayInstanceImp::setLength(unsigned newLength, ExecState *exec)
+{
+  if (newLength <= MAX(sparseArrayCutoff,storageLength) || newLength == length + 1) {
+    resizeStorage(newLength);
+  }
+
+  if (newLength < length) {
+    ReferenceList sparseProperties;
+    
+    _prop.addSparseArrayPropertiesToReferenceList(sparseProperties, Object(this));
+    
+    ReferenceListIterator it = sparseProperties.begin();
+    while (it != sparseProperties.end()) {
+      Reference ref = it++;
+      bool ok;
+      if (ref.getPropertyName(exec).toULong(&ok) > newLength) {
+        ref.deleteValue(exec);
+      }
+    }
+  }
   
   length = newLength;
@@ -239 +256 @@
 void ArrayInstanceImp::sort(ExecState *exec)
 {
-    int lengthNotIncludingUndefined = pushUndefinedObjectsToEnd();
+    int lengthNotIncludingUndefined = pushUndefinedObjectsToEnd(exec);
     
     execForCompareByStringForQSort = exec;
@@ -277 +294 @@
 void ArrayInstanceImp::sort(ExecState *exec, Object &compareFunction)
 {
-    int lengthNotIncludingUndefined = pushUndefinedObjectsToEnd();
+    int lengthNotIncludingUndefined = pushUndefinedObjectsToEnd(exec);
     
     CompareWithCompareFunctionArguments args(exec, compareFunction.imp());
@@ -285 +302 @@
 }
 
-unsigned ArrayInstanceImp::pushUndefinedObjectsToEnd()
+unsigned ArrayInstanceImp::pushUndefinedObjectsToEnd(ExecState *exec)
 {
     ValueImp *undefined = UndefinedImp::staticUndefined;
@@ -300 +317 @@
     }
     
-    // FIXME: Get sparse items down here.
-    
-    if (o != storageLength)
+    ReferenceList sparseProperties;
+    _prop.addSparseArrayPropertiesToReferenceList(sparseProperties, Object(this));
+    unsigned newLength = o + sparseProperties.length();
+
+    if (newLength > storageLength) {
+      resizeStorage(newLength);
+    } 
+
+    ReferenceListIterator it = sparseProperties.begin();
+    while (it != sparseProperties.end()) {
+      Reference ref = it++;
+      storage[o] = ref.getValue(exec).imp();
+      ObjectImp::deleteProperty(exec, ref.getPropertyName(exec));
+      o++;
+    }
+    
+    if (newLength != storageLength)
         memset(storage + o, 0, sizeof(ValueImp *) * (storageLength - o));