Changeset 64588 in webkit for trunk/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Aug 3, 2010, 2:29:32 PM (15 years ago)

Author:

[email protected]

Message:

Change to keep returned pointer from malloc family functions to
quiet memory leak detect. The pointer is saved in the new m_allocBase
member of the ArrayStorage structure. This fixes the issue found in
​https://bugs.webkit.org/show_bug.cgi?id=43229.

Patch by Michael Saboff <​[email protected]> on 2010-08-03
Reviewed by Gavin Barraclough.

As part of this change, we use m_allocBase when reallocating and
freeing the memory associated with ArrayStorage.

• runtime/JSArray.cpp:

(JSC::JSArray::JSArray):
(JSC::JSArray::~JSArray):
(JSC::JSArray::putSlowCase):
(JSC::JSArray::increaseVectorLength):
(JSC::JSArray::increaseVectorPrefixLength):

• runtime/JSArray.h:

File:

• trunk/JavaScriptCore/runtime/JSArray.cpp (modified) (10 diffs)

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -133 +133 @@
 
     ArrayStorage* storage = static_cast<ArrayStorage*>(fastZeroedMalloc(storageSize(initialCapacity)));
+    storage->m_allocBase = storage;
     m_indexBias = 0;
     setArrayStorage(storage);
@@ -138 +139 @@
 
     checkConsistency();
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(0));
 }
 
@@ -150 +153 @@
     
     ArrayStorage* storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    storage->m_allocBase = storage;
     storage->m_length = initialLength;
     m_indexBias = 0;
@@ -177 +181 @@
     checkConsistency();
     
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(initialCapacity));
 }
 
@@ -186 +190 @@
 
     ArrayStorage* storage = static_cast<ArrayStorage*>(fastMalloc(storageSize(initialCapacity)));
+    storage->m_allocBase = storage;
     m_indexBias = 0;
     storage->m_length = initialCapacity;
@@ -216 +221 @@
     ArrayStorage* storage = arrayStorage();
     delete storage->m_sparseValueMap;
-    char* realStorage = reinterpret_cast<char*>(storage) - (m_indexBias * sizeof(JSValue));
-    fastFree(realStorage);
+    fastFree(storage->m_allocBase);
 }
 
@@ -417 +421 @@
     }
 
-    int baseBias = m_indexBias * sizeof(JSValue);
-    char* baseStorage = reinterpret_cast<char*>(storage - baseBias);
+    void* baseStorage = storage->m_allocBase;
     
     if (!tryFastRealloc(baseStorage, storageSize(newVectorLength + m_indexBias)).getValue(baseStorage)) {
@@ -425 +428 @@
     }
 
-    storage = reinterpret_cast<ArrayStorage*>(baseStorage + baseBias);
+    storage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(baseStorage) + m_indexBias * sizeof(JSValue));
+    storage->m_allocBase = baseStorage;
     setArrayStorage(storage);
     
@@ -568 +572 @@
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = getNewVectorLength(newLength);
-    int baseBias = m_indexBias * sizeof(JSValue);
-    char* baseStorage = reinterpret_cast<char*>(storage) - baseBias;
+    void* baseStorage = storage->m_allocBase;
 
     if (!tryFastRealloc(baseStorage, storageSize(newVectorLength + m_indexBias)).getValue(baseStorage))
         return false;
-    
-    storage = reinterpret_cast<ArrayStorage*>(baseStorage + baseBias);
+
+    storage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(baseStorage) + m_indexBias * sizeof(JSValue));
+    storage->m_allocBase = baseStorage;
     setArrayStorage(storage);
 
@@ -600 +604 @@
     ASSERT(newLength <= MAX_STORAGE_VECTOR_INDEX);
     unsigned newVectorLength = getNewVectorLength(newLength);
-    char* baseStorage = reinterpret_cast<char*>(storage) - (m_indexBias * sizeof(JSValue));
-    
-    char* newBaseStorage = reinterpret_cast<char*>(fastMalloc(storageSize(newVectorLength + m_indexBias)));
+
+    void* newBaseStorage = fastMalloc(storageSize(newVectorLength + m_indexBias));
     if (!newBaseStorage)
         return false;
     
     m_indexBias += newVectorLength - newLength;
-    int newStorageOffset = m_indexBias * sizeof(JSValue);
-    
-    newStorage = reinterpret_cast<ArrayStorage*>(newBaseStorage + newStorageOffset);
-    
+    
+    newStorage = reinterpret_cast<ArrayStorage*>(static_cast<char*>(newBaseStorage) + m_indexBias * sizeof(JSValue));
+
     memcpy(newStorage, storage, storageSize(0));
     memcpy(&newStorage->m_vector[newLength - m_vectorLength], &storage->m_vector[0], storage->m_length * sizeof(JSValue));
     
+    newStorage->m_allocBase = newBaseStorage;
     m_vectorLength = newLength;
     
-    fastFree(baseStorage);
+    fastFree(storage->m_allocBase);
 
     setArrayStorage(newStorage);