Changeset 236514 in webkit

Timestamp:

Sep 26, 2018, 11:57:32 AM (8 years ago)

Author:

keith_miller@apple.com

Message:

We should zero unused property storage when rebalancing array storage.
​https://bugs.webkit.org/show_bug.cgi?id=188151

Reviewed by Michael Saboff.

JSTests:

• stress/splice-should-zero-property-storage-when-rebalancing.js: Added.

Source/JavaScriptCore:

In unshiftCountSlowCase we sometimes will move property storage to the right even when net adding elements.
This can happen because we "balance" the pre/post-capacity in that code so we need to zero the unused
property storage.

• runtime/JSArray.cpp:

(JSC::JSArray::unshiftCountSlowCase):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/splice-should-zero-property-storage-when-rebalancing.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSArray.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-09-26  Keith Miller  <keith_miller@apple.com>
+
+        We should zero unused property storage when rebalancing array storage.
+        https://bugs.webkit.org/show_bug.cgi?id=188151
+
+        Reviewed by Michael Saboff.
+
+        * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
+
 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-09-26  Keith Miller  <keith_miller@apple.com>
+
+        We should zero unused property storage when rebalancing array storage.
+        https://bugs.webkit.org/show_bug.cgi?id=188151
+
+        Reviewed by Michael Saboff.
+
+        In unshiftCountSlowCase we sometimes will move property storage to the right even when net adding elements.
+        This can happen because we "balance" the pre/post-capacity in that code so we need to zero the unused
+        property storage.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+
 2018-09-26  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -425 +425 @@
         memmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
 
+        // We don't need to zero the pre-capacity for the concurrent GC because it is not available to use as property storage.
+        memset(newButterfly->base(0, propertyCapacity), 0, (propertyCapacity - propertySize) * sizeof(JSValue));
+
         if (allocatedNewStorage) {
             // We will set the vectorLength to newVectorLength. We populated requiredVectorLength
@@ -430 +433 @@
             for (unsigned i = requiredVectorLength; i < newVectorLength; ++i)
                 newButterfly->arrayStorage()->m_vector[i].clear();
-            // We don't need to zero the pre-capacity because it is not available to use as property storage.
-            memset(newButterfly->base(0, propertyCapacity), 0, (propertyCapacity - propertySize) * sizeof(JSValue));
         }
     } else if ((newAllocBase != butterfly->base(structure)) || (preCapacity != storage->m_indexBias)) {