From: yangguo@chromium.org <yangguo@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 11 Apr 2013 09:53:00 +0000 (+0000)
Subject: Fix JSON.stringify's slow path wrt sliced strings.
X-Git-Tag: upstream/4.7.83~14621
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=da5c11a44ad6c5e8643dd8df5678e8e3d8122a24;p=platform%2Fupstream%2Fv8.git

Fix JSON.stringify's slow path wrt sliced strings.

R=mvstanton@chromium.org
BUG=229923

Review URL: https://chromiumcodereview.appspot.com/14107004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index a154a4e..3bab324 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -295,29 +295,23 @@ MaybeObject* BasicJsonStringifier::StringifyString(Isolate* isolate,
     return stringifier.Stringify(object);
   }
 
-  object = FlattenGetString(object);
+  FlattenString(object);
   ASSERT(object->IsFlat());
-  if (object->IsOneByteRepresentation()) {
+  if (object->IsOneByteRepresentationUnderneath()) {
     Handle<String> result =
         isolate->factory()->NewRawOneByteString(worst_case_length);
     AssertNoAllocation no_alloc;
-    const uint8_t* start = object->IsSeqOneByteString()
-        ? SeqOneByteString::cast(*object)->GetChars()
-        : ExternalAsciiString::cast(*object)->GetChars();
     return StringifyString_<SeqOneByteString>(
         isolate,
-        Vector<const uint8_t>(start, object->length()),
+        object->GetFlatContent().ToOneByteVector(),
         result);
   } else {
     Handle<String> result =
         isolate->factory()->NewRawTwoByteString(worst_case_length);
     AssertNoAllocation no_alloc;
-    const uc16* start = object->IsSeqTwoByteString()
-        ? SeqTwoByteString::cast(*object)->GetChars()
-        : ExternalTwoByteString::cast(*object)->GetChars();
     return StringifyString_<SeqTwoByteString>(
         isolate,
-        Vector<const uc16>(start, object->length()),
+        object->GetFlatContent().ToUC16Vector(),
         result);
   }
 }
diff --git a/test/mjsunit/regress/regress-crbug-229923.js b/test/mjsunit/regress/regress-crbug-229923.js
new file mode 100644
index 0000000..95c0ded
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-229923.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-externalize-string
+
+var slice = "slow path of JSON.stringify for sliced string".substring(1);
+assertEquals('"' + slice + '"', JSON.stringify(slice, null, 0));
+
+var parent = "external string turned into two byte";
+var slice_of_external = parent.substring(1);
+try {
+  // Turn the string to a two-byte external string, so that the sliced
+  // string looks like one-byte, but its parent is actually two-byte.
+  externalizeString(parent, true);
+} catch (e) { }
+assertEquals('"' + slice_of_external + '"',
+             JSON.stringify(slice_of_external, null, 0));