Attachment 361132 Details for Bug 193912 – Patch

[patch] Patch

bug-193912-20190205020427.patch (text/plain), 4.47 KB, created by Guillaume Emont on 2019-02-04 17:04:28 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Guillaume Emont

Created: 2019-02-04 17:04:28 PST

Size: 4.47 KB

patch

obsolete

>Subversion Revision: 240582
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 848e889ac20541dcc52507926021e50433e5b8bf..d8ed900f02de7850b82e43c7856d6f2958205503 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,20 @@
>+2019-02-04  Guillaume Emont  <guijemont@igalia.com>
>+
>+        [JSC] Repeat string created from Array.prototype.join() take too much memory
>+        https://bugs.webkit.org/show_bug.cgi?id=193912
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added a fast case in Array.prototype.join when the array is
>+        uninitialized.
>+
>+        * runtime/ArrayPrototype.cpp:
>+        (JSC::canUseFastJoin):
>+        (JSC::fastJoin):
>+        * runtime/JSStringInlines.h:
>+        (JSC::repeatCharacter): moved from StringPrototype.cpp
>+        * runtime/StringPrototype.cpp:
>+
> 2018-12-15  Darin Adler  <darin@apple.com>
> 
>         Replace many uses of String::format with more type-safe alternatives
>diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>index c37389aa857f89ce217d773f73d663ba2ea1728b..4707dc820f7f05a910fa04f21fbaf7118901c1c6 100644
>--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>@@ -390,6 +390,7 @@ inline bool canUseFastJoin(const JSObject* thisObject)
>     case ALL_CONTIGUOUS_INDEXING_TYPES:
>     case ALL_INT32_INDEXING_TYPES:
>     case ALL_DOUBLE_INDEXING_TYPES:
>+    case ALL_UNDECIDED_INDEXING_TYPES:
>         return true;
>     default:
>         break;
>@@ -503,6 +504,22 @@ inline JSValue fastJoin(ExecState& state, JSObject* thisObject, StringView separ
>         }
>         RELEASE_AND_RETURN(scope, joiner.join(state));
>     }
>+    case ALL_UNDECIDED_INDEXING_TYPES: {
>+        switch (separator.length()) {
>+        case 0:
>+            RELEASE_AND_RETURN(scope, jsEmptyString(&state));
>+        case 1: {
>+            if (length <= 1)
>+                RELEASE_AND_RETURN(scope, jsEmptyString(&state));
>+            if (holesMustForwardToPrototype(vm, thisObject))
>+                goto generalCase;
>+            if (separator.is8Bit())
>+                RELEASE_AND_RETURN(scope, repeatCharacter(state, separator.characters8()[0], length - 1));
>+            else
>+                RELEASE_AND_RETURN(scope, repeatCharacter(state, separator.characters16()[0], length - 1));
>+        }
>+        }
>+    }
>     }
> 
> generalCase:
>diff --git a/Source/JavaScriptCore/runtime/JSStringInlines.h b/Source/JavaScriptCore/runtime/JSStringInlines.h
>index 19d4756e0c1a9bcee73bb8a5b0cae6e03373074c..a27cf50670f18054876891e359700c6775b1bb1e 100644
>--- a/Source/JavaScriptCore/runtime/JSStringInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSStringInlines.h
>@@ -54,4 +54,22 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, StringType&& string, Stri
>     return jsNontrivialString(exec, WTFMove(result));
> }
> 
>+template <typename CharacterType>
>+inline JSString* repeatCharacter(ExecState& exec, CharacterType character, unsigned repeatCount)
>+{
>+    VM& vm = exec.vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    CharacterType* buffer = nullptr;
>+    auto impl = StringImpl::tryCreateUninitialized(repeatCount, buffer);
>+    if (!impl) {
>+        throwOutOfMemoryError(&exec, scope);
>+        return nullptr;
>+    }
>+
>+    std::fill_n(buffer, repeatCount, character);
>+
>+    RELEASE_AND_RETURN(scope, jsString(&exec, WTFMove(impl)));
>+}
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
>index 240ba5ef549a623c4d4fd256d09bc0ccc102c85c..eb51e41c230c951d0183cee21b76c6f5a97b0ca3 100644
>--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
>+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
>@@ -832,24 +832,6 @@ static inline bool checkObjectCoercible(JSValue thisValue)
>     return true;
> }
> 
>-template <typename CharacterType>
>-static inline JSString* repeatCharacter(ExecState& exec, CharacterType character, unsigned repeatCount)
>-{
>-    VM& vm = exec.vm();
>-    auto scope = DECLARE_THROW_SCOPE(vm);
>-
>-    CharacterType* buffer = nullptr;
>-    auto impl = StringImpl::tryCreateUninitialized(repeatCount, buffer);
>-    if (!impl) {
>-        throwOutOfMemoryError(&exec, scope);
>-        return nullptr;
>-    }
>-
>-    std::fill_n(buffer, repeatCount, character);
>-
>-    RELEASE_AND_RETURN(scope, jsString(&exec, WTFMove(impl)));
>-}
>-
> EncodedJSValue JSC_HOST_CALL stringProtoFuncRepeatCharacter(ExecState* exec)
> {
>     VM& vm = exec->vm();

Actions: View | Formatted Diff | Diff

Attachments on bug 193912: 360761 | 361132 | 361157 | 361213 | 361705 | 362913