Zero out CopiedBlocks on initialization

https://bugs.webkit.org/show_bug.cgi?id=79199

Reviewed by Filip Pizlo.

Made CopyBlocks zero their payloads during construction. This allows
JSArray to avoid having to manually clear its backing store upon allocation
and also alleviates any future pain with regard to the garbage collector trying
to mark what it thinks are values in what is actually uninitialized memory.

* heap/CopiedBlock.h:
(JSC::CopiedBlock::CopiedBlock):
* runtime/JSArray.cpp:
(JSC::JSArray::finishCreation):
(JSC::JSArray::tryFinishCreationUninitialized):
(JSC::JSArray::increaseVectorLength):
(JSC::JSArray::unshiftCountSlowCase):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108716 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index cb388cb..193b583 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,23 @@
+2012-02-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Zero out CopiedBlocks on initialization
+        https://bugs.webkit.org/show_bug.cgi?id=79199
+
+        Reviewed by Filip Pizlo.
+
+        Made CopyBlocks zero their payloads during construction. This allows 
+        JSArray to avoid having to manually clear its backing store upon allocation
+        and also alleviates any future pain with regard to the garbage collector trying 
+        to mark what it thinks are values in what is actually uninitialized memory.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+        (JSC::JSArray::tryFinishCreationUninitialized):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::unshiftCountSlowCase):
+
 2012-02-23  Oliver Hunt  <oliver@apple.com>
 
         Make Interpreter::getStackTrace be able to generate the line number for the top callframe if none is provided

diff --git a/Source/JavaScriptCore/heap/CopiedBlock.h b/Source/JavaScriptCore/heap/CopiedBlock.h
index 5183307..6308e95 100644 (file)
--- a/Source/JavaScriptCore/heap/CopiedBlock.h
+++ b/Source/JavaScriptCore/heap/CopiedBlock.h
@@ -27,6 +27,8 @@
 #define CopiedBlock_h
 
 #include "HeapBlock.h"
+#include "JSValue.h"
+#include "JSValueInlineMethods.h"
 
 namespace JSC {
 
@@ -41,6 +43,15 @@ public:
         , m_offset(m_payload)
         , m_isPinned(false)
     {
+        ASSERT(is8ByteAligned(static_cast<void*>(m_payload)));
+#if USE(JSVALUE64)
+        memset(static_cast<void*>(m_payload), 0, static_cast<size_t>((reinterpret_cast<char*>(this) + allocation.size()) - m_payload));
+#else
+        JSValue emptyValue;
+        JSValue* limit = reinterpret_cast<JSValue*>(reinterpret_cast<char*>(this) + allocation.size());
+        for (JSValue* currentValue = reinterpret_cast<JSValue*>(m_payload); currentValue < limit; currentValue++)
+            *currentValue = emptyValue;
+#endif
     }
 
 private:

diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index ab77986..71d5200 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -161,10 +161,6 @@ void JSArray::finishCreation(JSGlobalData& globalData, unsigned initialLength)
     m_storage->m_inCompactInitialization = false;
 #endif
 
-    WriteBarrier<Unknown>* vector = m_storage->m_vector;
-    for (size_t i = 0; i < initialVectorLength; ++i)
-        vector[i].clear();
-
     checkConsistency();
 }
 
@@ -194,10 +190,6 @@ JSArray* JSArray::tryFinishCreationUninitialized(JSGlobalData& globalData, unsig
     m_storage->m_inCompactInitialization = true;
 #endif
 
-    WriteBarrier<Unknown>* vector = m_storage->m_vector;
-    for (size_t i = initialLength; i < initialVectorLength; ++i)
-        vector[i].clear();
-
     return this;
 }
 
@@ -992,10 +984,6 @@ bool JSArray::increaseVectorLength(JSGlobalData& globalData, unsigned newLength)
         m_storage->m_allocBase = newStorage;
         ASSERT(m_storage->m_allocBase);
 
-        WriteBarrier<Unknown>* vector = storage->m_vector;
-        for (unsigned i = vectorLength; i < newVectorLength; ++i)
-            vector[i].clear();
-
         m_vectorLength = newVectorLength;
         
         return true;
@@ -1015,10 +1003,8 @@ bool JSArray::increaseVectorLength(JSGlobalData& globalData, unsigned newLength)
     m_indexBias = newIndexBias;
     m_storage = reinterpret_cast_ptr<ArrayStorage*>(reinterpret_cast<WriteBarrier<Unknown>*>(newAllocBase) + m_indexBias);
 
-    // Copy the ArrayStorage header & current contents of the vector, clear the new post-capacity.
+    // Copy the ArrayStorage header & current contents of the vector.
     memmove(m_storage, storage, storageSize(vectorLength));
-    for (unsigned i = vectorLength; i < m_vectorLength; ++i)
-        m_storage->m_vector[i].clear();
 
     // Free the old allocation, update m_allocBase.
     m_storage->m_allocBase = newAllocBase;
@@ -1101,13 +1087,6 @@ bool JSArray::unshiftCountSlowCase(JSGlobalData& globalData, unsigned count)
     if (newAllocBase != m_storage->m_allocBase) {
         // Free the old allocation, update m_allocBase.
         m_storage->m_allocBase = newAllocBase;
-
-        // We need to clear any entries in the vector beyond length. We only need to
-        // do this if this was a new allocation, because if we're using an existing
-        // allocation the post-capacity will already be cleared, and in an existing
-        // allocation we can only beshrinking the amount of post capacity.
-        for (unsigned i = requiredVectorLength; i < m_vectorLength; ++i)
-            m_storage->m_vector[i].clear();
     }
 
     return true;