Changeset 2846 in webkit for trunk/JavaScriptCore/kjs/property_map.cpp

Timestamp:

Nov 23, 2002, 11:49:26 PM (23 years ago)

Author:

mjs

Message:

• completed Darin's mostly-fix for 3037795 - Resource use increases when accessing very high index value in array

The two missing pieces were handling sparse properties when
shrinking the array, and when sorting. Thse are now both taken
care of.

• kjs/array_instance.h:
• kjs/array_object.cpp: (ArrayInstanceImp::put): (ArrayInstanceImp::deleteProperty): (ArrayInstanceImp::resizeStorage): (ArrayInstanceImp::setLength): (ArrayInstanceImp::sort): (ArrayInstanceImp::pushUndefinedObjectsToEnd):
• kjs/identifier.h:
• kjs/object.h:
• kjs/property_map.cpp:
• kjs/property_map.h:
• kjs/reference_list.cpp: (ReferenceList::append): (ReferenceList::length):
• kjs/reference_list.h:
• kjs/ustring.cpp: (UString::toUInt32):
• kjs/ustring.h:

File:

• trunk/JavaScriptCore/kjs/property_map.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/property_map.cpp

@@ -370 +370 @@
 }
 
+void PropertyMap::addSparseArrayPropertiesToReferenceList(ReferenceList &list, const Object &base) const
+{
+#if USE_SINGLE_ENTRY
+    UString::Rep *key = _singleEntry.key;
+    if (key) {
+      UString k(key);
+      bool fitsInUInt32;
+      k.toUInt32(&fitsInUInt32);
+      if (fitsInUInt32) {
+        list.append(Reference(base, Identifier(key)));
+      }
+    }
+#endif
+    if (!_table) {
+      return;
+    }
+
+    for (int i = 0; i != _table->size; ++i) {
+      UString::Rep *key = _table->entries[i].key;
+      if (key) {
+        UString k(key);
+        bool fitsInUInt32;
+        k.toUInt32(&fitsInUInt32);
+        if (fitsInUInt32) {
+          list.append(Reference(base, Identifier(key)));
+        }
+      }
+    }
+}
+
 void PropertyMap::save(SavedProperties &p) const
 {