Changeset 243576 in webkit

Timestamp:

Mar 27, 2019, 4:43:48 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r243069. rdar://problem/49308056

Structure::flattenDictionary() should clear unused property slots.
​https://bugs.webkit.org/show_bug.cgi?id=195871
<rdar://problem/48959497>

Reviewed by Michael Saboff.

JSTests:

• stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.

Source/JavaScriptCore:

It currently attempts to do this but fails because it's actually clearing up the
preCapacity region instead. The fix is simply to account for the preCapacity
when computing the start address of the property slots.

• runtime/Structure.cpp: (JSC::Structure::flattenDictionaryStructure):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243069 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/structure-flattenDictionary-should-clear-unused-property-slots.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/Structure.cpp (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-03-27  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r243069. rdar://problem/49308056
+
+    Structure::flattenDictionary() should clear unused property slots.
+    https://bugs.webkit.org/show_bug.cgi?id=195871
+    <rdar://problem/48959497>
+    
+    Reviewed by Michael Saboff.
+    
+    JSTests:
+    
+    * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    It currently attempts to do this but fails because it's actually clearing up the
+    preCapacity region instead.  The fix is simply to account for the preCapacity
+    when computing the start address of the property slots.
+    
+    * runtime/Structure.cpp:
+    (JSC::Structure::flattenDictionaryStructure):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243069 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-18  Mark Lam  <mark.lam@apple.com>
+
+            Structure::flattenDictionary() should clear unused property slots.
+            https://bugs.webkit.org/show_bug.cgi?id=195871
+            <rdar://problem/48959497>
+
+            Reviewed by Michael Saboff.
+
+            * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.
+
 2019-03-27  Alan Coon  <alancoon@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-27  Alan Coon  <alancoon@apple.com>
+
+        Cherry-pick r243069. rdar://problem/49308056
+
+    Structure::flattenDictionary() should clear unused property slots.
+    https://bugs.webkit.org/show_bug.cgi?id=195871
+    <rdar://problem/48959497>
+    
+    Reviewed by Michael Saboff.
+    
+    JSTests:
+    
+    * stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    It currently attempts to do this but fails because it's actually clearing up the
+    preCapacity region instead.  The fix is simply to account for the preCapacity
+    when computing the start address of the property slots.
+    
+    * runtime/Structure.cpp:
+    (JSC::Structure::flattenDictionaryStructure):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243069 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-18  Mark Lam  <mark.lam@apple.com>
+
+            Structure::flattenDictionary() should clear unused property slots.
+            https://bugs.webkit.org/show_bug.cgi?id=195871
+            <rdar://problem/48959497>
+
+            Reviewed by Michael Saboff.
+
+            It currently attempts to do this but fails because it's actually clearing up the
+            preCapacity region instead.  The fix is simply to account for the preCapacity
+            when computing the start address of the property slots.
+
+            * runtime/Structure.cpp:
+            (JSC::Structure::flattenDictionaryStructure):
+
 2019-03-27  Alan Coon  <alancoon@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/runtime/Structure.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2008, 2009, 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -778 +778 @@
 
         Butterfly* butterfly = object->butterfly();
-        memset(
-            butterfly->base(butterfly->indexingHeader()->preCapacity(this), beforeOutOfLineCapacity),
-            0,
-            (beforeOutOfLineCapacity - outOfLineSize()) * sizeof(EncodedJSValue));
+        size_t preCapacity = butterfly->indexingHeader()->preCapacity(this);
+        void* base = butterfly->base(preCapacity, beforeOutOfLineCapacity);
+        void* startOfPropertyStorageSlots = reinterpret_cast<EncodedJSValue*>(base) + preCapacity;
+        memset(startOfPropertyStorageSlots, 0, (beforeOutOfLineCapacity - outOfLineSize()) * sizeof(EncodedJSValue));
         checkOffsetConsistency();
     }