Commit 5e4d2f12 authored by barraclough@apple.com's avatar barraclough@apple.com

unshift/pop fifo may consume excessive memory

https://bugs.webkit.org/show_bug.cgi?id=75588

Reviewed by Sam Weinig.

The Array object commonly store data in a vector, consisting of a portion that
is in use, a pre-capacity (m_indexBias) and a post-capacity (the delta between
m_length and m_vectorLength). Calls to pop with grow the post-capacity, and the
current algorithm for increasePrefixVectorLength (used by unshift) will never
stink the post-capacity, so a unshift/pop fifo may consume an inordinate amount
of memory, whilst having a relatively small active length.

* runtime/JSArray.cpp:
(JSC::storageSize):
    - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::SparseArrayValueMap::put):
    - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::JSArray::increaseVectorLength):
    - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::JSArray::unshiftCountSlowCase):
    - renamed from increaseVectorPrefixLength (this was a bad name, since it
      also moved the ArrayStorage header), rewritten.
(JSC::JSArray::shiftCount):
    - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned
(JSC::JSArray::unshiftCount):
    - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned,
      increaseVectorPrefixLength renamed to unshiftCountSlowCase
(JSC::JSArray::sortNumeric):
* runtime/JSArray.h:
    - Updated function declarations, m_indexBias should be unsigned.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104120 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 5a525ae8
2012-01-04 Gavin Barraclough <barraclough@apple.com>
unshift/pop fifo may consume excessive memory
https://bugs.webkit.org/show_bug.cgi?id=75588
Reviewed by Sam Weinig.
The Array object commonly store data in a vector, consisting of a portion that
is in use, a pre-capacity (m_indexBias) and a post-capacity (the delta between
m_length and m_vectorLength). Calls to pop with grow the post-capacity, and the
current algorithm for increasePrefixVectorLength (used by unshift) will never
stink the post-capacity, so a unshift/pop fifo may consume an inordinate amount
of memory, whilst having a relatively small active length.
* runtime/JSArray.cpp:
(JSC::storageSize):
- sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::SparseArrayValueMap::put):
- sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::JSArray::increaseVectorLength):
- sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
(JSC::JSArray::unshiftCountSlowCase):
- renamed from increaseVectorPrefixLength (this was a bad name, since it
also moved the ArrayStorage header), rewritten.
(JSC::JSArray::shiftCount):
- sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned
(JSC::JSArray::unshiftCount):
- sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned,
increaseVectorPrefixLength renamed to unshiftCountSlowCase
(JSC::JSArray::sortNumeric):
* runtime/JSArray.h:
- Updated function declarations, m_indexBias should be unsigned.
2012-01-04 Mark Rowe <mrowe@apple.com>
<http://webkit.org/b/75604> All instances of JSC::ArgumentsData appear to be leaked by JSC::Arguments
This diff is collapsed.
......@@ -153,8 +153,8 @@ namespace JSC {
void push(ExecState*, JSValue);
JSValue pop();
void shiftCount(ExecState*, int count);
void unshiftCount(ExecState*, int count);
void shiftCount(ExecState*, unsigned count);
void unshiftCount(ExecState*, unsigned count);
bool canGetIndex(unsigned i) { return i < m_vectorLength && m_storage->m_vector[i]; }
JSValue getIndex(unsigned i)
......@@ -250,7 +250,7 @@ namespace JSC {
unsigned getNewVectorLength(unsigned desiredLength);
bool increaseVectorLength(unsigned newLength);
bool increaseVectorPrefixLength(unsigned newLength);
bool unshiftCountSlowCase(unsigned count);
unsigned compactForSorting();
......@@ -258,7 +258,7 @@ namespace JSC {
void checkConsistency(ConsistencyCheckType = NormalConsistencyCheck);
unsigned m_vectorLength; // The valid length of m_vector
int m_indexBias; // The number of JSValue sized blocks before ArrayStorage.
unsigned m_indexBias; // The number of JSValue sized blocks before ArrayStorage.
ArrayStorage *m_storage;
};
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment