Changeset 53025 in webkit for trunk/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Jan 8, 2010, 5:02:38 PM (15 years ago)

Author:

[email protected]

Message:

2010-01-08 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

Memory use grows grows possibly unbounded in this JavaScript Array test case
​https://bugs.webkit.org/show_bug.cgi?id=31675

This fixes one observed bug in this test case, which is that
arrays don't report extra cost for the sparse value maps.

SunSpider reports a small speedup.

• runtime/JSArray.cpp: (JSC::JSArray::putSlowCase): Report extra memory cost for the sparse value map.
• runtime/JSArray.h:

File:

• trunk/JavaScriptCore/runtime/JSArray.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -330 +330 @@
 
         // We miss some cases where we could compact the storage, such as a large array that is being filled from the end
-        // (which will only be compacted as we reach indices that are less than cutoff) - but this makes the check much faster.
+        // (which will only be compacted as we reach indices that are less than MIN_SPARSE_ARRAY_INDEX) - but this makes the check much faster.
         if ((i > MAX_STORAGE_VECTOR_INDEX) || !isDenseEnoughForVector(i + 1, storage->m_numValuesInVector + 1)) {
             if (!map) {
@@ -336 +336 @@
                 storage->m_sparseValueMap = map;
             }
-            map->set(i, value);
+
+            pair<SparseArrayValueMap::iterator, bool> result = map->add(i, value);
+            if (!result.second) { // pre-existing entry
+                result.first->second = value;
+                return;
+            }
+
+            size_t capacity = map->capacity();
+            if (capacity != storage->reportedMapCapacity) {
+                Heap::heap(this)->reportExtraMemoryCost((capacity - storage->reportedMapCapacity) * (sizeof(unsigned) + sizeof(JSValue)));
+                storage->reportedMapCapacity = capacity;
+            }
             return;
         }