Changeset 91290 in webkit


Ignore:
Timestamp:
Jul 19, 2011 1:03:13 PM (13 years ago)
Author:
barraclough@apple.com
Message:

Source/JavaScriptCore: [JSC] WebKit allocates gigabytes of memory when doing repeated string concatenation
​https://bugs.webkit.org/show_bug.cgi?id=63918

Patch by Mark Hahnenberg <​mhahnenberg@apple.com> on 2011-07-19
Reviewed by Darin Adler.

When allocating JSStrings during concatenation, we needed to call the Heap's reportExtraMemoryCost
method due to additional string copying within several of the constructors when dealing with
UStrings. This has been added to the UString version of the appendStringInConstruct method
within the JSString class.

  • runtime/JSString.h:

(JSC::RopeBuilder::JSString):
(JSC::RopeBuilder::appendStringInConstruct):

LayoutTests: Chromium rebaselines r91269 and r91277.

Patch by Ryosuke Niwa <​rniwa@webkit.org> on 2011-07-19

  • platform/chromium-linux/svg/W3C-SVG-1.1-SE/styling-pres-02-f-expected.png: Added.
  • platform/chromium-mac/fast/table/align-right-within-left-aligned-div-expected.png: Added.
  • platform/chromium-mac/fast/table/align-right-within-left-aligned-div-expected.txt: Added.
  • platform/chromium-mac/svg/W3C-SVG-1.1-SE/styling-pres-02-f-expected.png: Added.
  • platform/chromium-win/svg/W3C-SVG-1.1-SE/styling-pres-02-f-expected.png: Added.
Location:
trunk
Files:
3 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r91287 r91290  
    2929        * fast/dynamic/hover-before-position-after-style-change-expected.txt: Added.
    3030        * fast/dynamic/hover-before-position-after-style-change.html: Added.
     31
     322011-07-19  Gavin Barraclough  <barraclough@apple.com>
     33
     34        https://bugs.webkit.org/show_bug.cgi?id=64679
     35        Fix bugs in Array.prototype this handling.
     36
     37        Reviewed by Oliver Hunt.
     38
     39        * fast/js/array-prototype-properties-expected.txt: Added.
     40        * fast/js/array-prototype-properties.html: Added.
     41        * fast/js/script-tests/array-prototype-properties.js: Added.
     42            - Added layout test for array prototype functions with undefined as this value.
     43        * ietestcenter/Javascript/15.4.4.14-5-28-expected.txt:
     44        * ietestcenter/Javascript/15.4.4.15-5-28-expected.txt:
     45            - These tests now pass.
    3146
    32472011-07-19  Gavin Barraclough  <barraclough@apple.com>

  • trunk/LayoutTests/ietestcenter/Javascript/15.4.4.14-5-28-expected.txt

    r62810 r91290  
    55
    66PASS ES5Harness.preconditionPassed is true
    7 FAIL ES5Harness.testPassed should be true. Was false.
     7PASS ES5Harness.testPassed is true
    88PASS successfullyParsed is true
    99

  • trunk/LayoutTests/ietestcenter/Javascript/15.4.4.15-5-28-expected.txt

    r62810 r91290  
    55
    66PASS ES5Harness.preconditionPassed is true
    7 FAIL ES5Harness.testPassed should be true. Was false.
     7PASS ES5Harness.testPassed is true
    88PASS successfullyParsed is true
    99

  • trunk/Source/JavaScriptCore/ChangeLog

    r91288 r91290  
    1414        (JSC::RopeBuilder::JSString):
    1515        (JSC::RopeBuilder::appendStringInConstruct):
     16
     172011-07-19  Gavin Barraclough  <barraclough@apple.com>
     18
     19        https://bugs.webkit.org/show_bug.cgi?id=64679
     20        Fix bugs in Array.prototype this handling.
     21
     22        Reviewed by Oliver Hunt.
     23
     24        * runtime/ArrayPrototype.cpp:
     25        (JSC::arrayProtoFuncJoin):
     26        (JSC::arrayProtoFuncConcat):
     27        (JSC::arrayProtoFuncPop):
     28        (JSC::arrayProtoFuncPush):
     29        (JSC::arrayProtoFuncReverse):
     30        (JSC::arrayProtoFuncShift):
     31        (JSC::arrayProtoFuncSlice):
     32        (JSC::arrayProtoFuncSort):
     33        (JSC::arrayProtoFuncSplice):
     34        (JSC::arrayProtoFuncUnShift):
     35        (JSC::arrayProtoFuncFilter):
     36        (JSC::arrayProtoFuncMap):
     37        (JSC::arrayProtoFuncEvery):
     38        (JSC::arrayProtoFuncForEach):
     39        (JSC::arrayProtoFuncSome):
     40        (JSC::arrayProtoFuncReduce):
     41        (JSC::arrayProtoFuncReduceRight):
     42        (JSC::arrayProtoFuncIndexOf):
     43        (JSC::arrayProtoFuncLastIndexOf):
     44            - These methods should throw if this value is undefined.
    1645
    17462011-07-19  Gavin Barraclough  <barraclough@apple.com>

  • trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

    r91194 r91290  
    268268EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
    269269{
    270     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     270    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    271271    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    272272    if (exec->hadException())
    … …  
    338338    JSArray* arr = constructEmptyArray(exec);
    339339    unsigned n = 0;
    340     JSValue curArg = thisValue.toThisObject(exec);
     340    JSValue curArg = thisValue.toObject(exec);
     341    if (exec->hadException())
     342        return JSValue::encode(jsUndefined());
    341343    size_t i = 0;
    342344    size_t argCount = exec->argumentCount();
    … …  
    370372        return JSValue::encode(asArray(thisValue)->pop());
    371373
    372     JSObject* thisObj = thisValue.toThisObject(exec);
     374    JSObject* thisObj = thisValue.toObject(exec);
    373375    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    374376    if (exec->hadException())
    … …  
    397399    }
    398400
    399     JSObject* thisObj = thisValue.toThisObject(exec);
     401    JSObject* thisObj = thisValue.toObject(exec);
    400402    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    401403    if (exec->hadException())
    … …  
    419421EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
    420422{
    421     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     423    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    422424    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    423425    if (exec->hadException())
    … …  
    445447EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
    446448{
    447     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     449    JSObject* thisObj = exec->hostThisValue().toObject(exec);
     450    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     451    if (exec->hadException())
     452        return JSValue::encode(jsUndefined());
     453
    448454    JSValue result;
    449 
    450     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    451     if (exec->hadException())
    452         return JSValue::encode(jsUndefined());
    453 
    454455    if (length == 0) {
    455456        putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length));
    … …  
    476477{
    477478    // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
    478     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     479    JSObject* thisObj = exec->hostThisValue().toObject(exec);
     480    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     481    if (exec->hadException())
     482        return JSValue::encode(jsUndefined());
    479483
    480484    // We return a new array
    481485    JSArray* resObj = constructEmptyArray(exec);
    482486    JSValue result = resObj;
    483 
    484     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    485     if (exec->hadException())
    486         return JSValue::encode(jsUndefined());
    487487
    488488    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
    … …  
    500500EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
    501501{
    502     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     502    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    503503    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    504504    if (!length || exec->hadException())
    … …  
    562562    // 15.4.4.12
    563563
    564     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     564    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    565565    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    566566    if (exec->hadException())
    … …  
    630630    // 15.4.4.13
    631631
    632     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     632    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    633633    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    634634    if (exec->hadException())
    … …  
    657657EncodedJSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec)
    658658{
    659     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     659    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    660660    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    661661    if (exec->hadException())
    … …  
    716716EncodedJSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec)
    717717{
    718     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     718    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    719719    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    720720    if (exec->hadException())
    … …  
    778778EncodedJSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec)
    779779{
    780     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     780    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    781781    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    782782    if (exec->hadException())
    … …  
    836836EncodedJSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec)
    837837{
    838     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     838    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    839839    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    840840    if (exec->hadException())
    … …  
    886886EncodedJSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec)
    887887{
    888     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     888    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    889889    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    890890    if (exec->hadException())
    … …  
    943943EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec)
    944944{
    945     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     945    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    946946    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    947947    if (exec->hadException())
    … …  
    10181018EncodedJSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec)
    10191019{
    1020     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     1020    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    10211021    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    10221022    if (exec->hadException())
    … …  
    10931093{
    10941094    // 15.4.4.14
    1095     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     1095    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    10961096    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    10971097    if (exec->hadException())
    … …  
    11141114{
    11151115    // 15.4.4.15
    1116     JSObject* thisObj = exec->hostThisValue().toThisObject(exec);
     1116    JSObject* thisObj = exec->hostThisValue().toObject(exec);
    11171117    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
    11181118    if (!length)
Note: See TracChangeset for help on using the changeset viewer.