arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type...
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 26 Jul 2018 19:49:23 +0000 (19:49 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 26 Jul 2018 19:49:23 +0000 (19:49 +0000)
https://bugs.webkit.org/show_bug.cgi?id=188065
<rdar://problem/42515726>

Reviewed by Saam Barati.

JSTests:

* stress/regress-188065.js: Added.

Source/JavaScriptCore:

* runtime/ArrayPrototype.cpp:
(JSC::clearElement):
(JSC::copyElements):
(JSC::arrayProtoPrivateFuncConcatMemcpy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234269 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/regress-188065.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/ArrayPrototype.cpp

index 9453757..13ae6d4 100644 (file)
@@ -1,3 +1,13 @@
+2018-07-26  Mark Lam  <mark.lam@apple.com>
+
+        arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type array.
+        https://bugs.webkit.org/show_bug.cgi?id=188065
+        <rdar://problem/42515726>
+
+        Reviewed by Saam Barati.
+
+        * stress/regress-188065.js: Added.
+
 2018-07-25  Andy VanWagoner  <andy@vanwagoner.family>
 
         [INTL] Call Typed Array elements toLocaleString with locale and options
diff --git a/JSTests/stress/regress-188065.js b/JSTests/stress/regress-188065.js
new file mode 100644 (file)
index 0000000..eb38938
--- /dev/null
@@ -0,0 +1,8 @@
+function test() {
+    var arr = new Array(400);
+    arr.concat([1.1]);
+}
+noInline(test);
+
+for (var i = 0; i < 10000; i++)
+    test();
index 90dfc7e..904e3df 100644 (file)
@@ -1,3 +1,16 @@
+2018-07-26  Mark Lam  <mark.lam@apple.com>
+
+        arrayProtoPrivateFuncConcatMemcpy() should handle copying from an Undecided type array.
+        https://bugs.webkit.org/show_bug.cgi?id=188065
+        <rdar://problem/42515726>
+
+        Reviewed by Saam Barati.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::clearElement):
+        (JSC::copyElements):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+
 2018-07-26  Andy VanWagoner  <andy@vanwagoner.family>
 
         JSC: Intl API should ignore encoding when parsing BCP 47 language tag from ISO 15897 locale string (passed via LANG)
index cc06e65..764871c 100644 (file)
@@ -1292,6 +1292,29 @@ static EncodedJSValue concatAppendOne(ExecState* exec, VM& vm, JSArray* first, J
 
 }
 
+template<typename T>
+void clearElement(T& element)
+{
+    element.clear();
+}
+
+template<>
+void clearElement(double& element)
+{
+    element = PNaN;
+}
+
+template<typename T>
+ALWAYS_INLINE void copyElements(T* buffer, unsigned offset, void* source, unsigned sourceSize, IndexingType sourceType)
+{
+    if (sourceType != ArrayWithUndecided) {
+        memcpy(buffer + offset, source, sizeof(JSValue) * sourceSize);
+        return;
+    }
+
+    for (unsigned i = sourceSize; i--;)
+        clearElement<T>(buffer[i + offset]);
+};
 
 EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncConcatMemcpy(ExecState* exec)
 {
@@ -1367,26 +1390,16 @@ EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncConcatMemcpy(ExecState* exec)
         throwOutOfMemoryError(exec, scope);
         return encodedJSValue();
     }
-    
+
     if (type == ArrayWithDouble) {
         double* buffer = result->butterfly()->contiguousDouble().data();
-        memcpy(buffer, firstButterfly->contiguousDouble().data(), sizeof(JSValue) * firstArraySize);
-        memcpy(buffer + firstArraySize, secondButterfly->contiguousDouble().data(), sizeof(JSValue) * secondArraySize);
+        copyElements(buffer, 0, firstButterfly->contiguousDouble().data(), firstArraySize, firstType);
+        copyElements(buffer, firstArraySize, secondButterfly->contiguousDouble().data(), secondArraySize, secondType);
+
     } else if (type != ArrayWithUndecided) {
         WriteBarrier<Unknown>* buffer = result->butterfly()->contiguous().data();
-        
-        auto copy = [&] (unsigned offset, void* source, unsigned size, IndexingType type) {
-            if (type != ArrayWithUndecided) {
-                memcpy(buffer + offset, source, sizeof(JSValue) * size);
-                return;
-            }
-            
-            for (unsigned i = size; i--;)
-                buffer[i + offset].clear();
-        };
-        
-        copy(0, firstButterfly->contiguous().data(), firstArraySize, firstType);
-        copy(firstArraySize, secondButterfly->contiguous().data(), secondArraySize, secondType);
+        copyElements(buffer, 0, firstButterfly->contiguous().data(), firstArraySize, firstType);
+        copyElements(buffer, firstArraySize, secondButterfly->contiguous().data(), secondArraySize, secondType);
     }
 
     result->butterfly()->setPublicLength(resultSize);