Changeset 3478 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Jan 28, 2003, 12:50:56 PM (22 years ago)

Author:

darin

Message:

Reviewed by Maciej.

• fixed 3144918 -- Can't drill down multiple levels of categories when selling on ebay if first item in list is chosen

The bug was caused by having array values in the property map past the storageLength cutoff
in an array object; those values would not be seen when you do a get.

• kjs/array_object.cpp: (ArrayInstanceImp::put): Implement a new rule for resizing the storage that is independent of the length. The old rule would sometimes make the storage very big if you added two elements in a row that both had large, but consecutive indexes. This eliminates any cases where we make sparse entries in the property map below the sparse array cutoff. (ArrayInstanceImp::resizeStorage): Don't ever make storage size bigger than the cutoff unless the caller specifically requests it. (ArrayInstanceImp::setLength): Change this so it only makes the storage smaller, never larger. We will actually enlarge the storage when putting elements in.

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (6 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -113 +113 @@
   unsigned index = propertyName.toULong(&ok);
   if (ok) {
-    if (length <= index)
-      setLength(index + 1, exec);
-    if (index < storageLength) {
-      storage[index] = value.imp();
-      return;
-    }
+    put(exec, index, value, attr);
+    return;
   }
   
@@ -126 +122 @@
 void ArrayInstanceImp::put(ExecState *exec, unsigned index, const Value &value, int attr)
 {
-  if (length <= index)
-    setLength(index + 1, exec);
+  if (index < sparseArrayCutoff && index >= storageLength) {
+    resizeStorage(index + 1);
+  }
+
+  if (index >= length) {
+    length = index + 1;
+  }
+
   if (index < storageLength) {
     storage[index] = value.imp();
@@ -133 +135 @@
   }
   
+  assert(index >= sparseArrayCutoff);
   ObjectImp::put(exec, Identifier::from(index), value, attr);
 }
@@ -214 +217 @@
 }
 
-
 void ArrayInstanceImp::resizeStorage(unsigned newLength)
 {
@@ -221 +223 @@
     }
     if (newLength > capacity) {
-      unsigned newCapacity = (newLength * 3 + 1) / 2;
+      unsigned newCapacity;
+      if (newLength > sparseArrayCutoff) {
+        newCapacity = newLength;
+      } else {
+        newCapacity = (newLength * 3 + 1) / 2;
+        if (newCapacity > sparseArrayCutoff) {
+          newCapacity = sparseArrayCutoff;
+        }
+      }
       storage = (ValueImp **)realloc(storage, newCapacity * sizeof (ValueImp *));
       memset(storage + capacity, 0, sizeof(ValueImp *) * (newCapacity - capacity));
@@ -231 +241 @@
 void ArrayInstanceImp::setLength(unsigned newLength, ExecState *exec)
 {
-  if (newLength <= MAX(sparseArrayCutoff,storageLength) || newLength == length + 1) {
+  if (newLength <= storageLength) {
     resizeStorage(newLength);
   }