Ensure reducing the length of an array doesn't make it go holey. (issue 11358011)

[verw...@chromium.org]

Reviewers: danno,

Message:
PTAL

Description:
Ensure reducing the length of an array doesn't make it go holey.

Also only transition and/or change anything to the backing store if we are
actually going to delete anything.


BUG=


Please review this at https://chromiumcodereview.appspot.com/11358011/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
M src/elements.cc
A + test/mjsunit/elements-length-no-holey.js
A + test/mjsunit/regress/regress-delete-empty-double.js


Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index
72ad5096ee6eb31430fec1ebe32b88229619234d..3d188291030ddc66ec5ffc8828d59376dd666c31
100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -770,11 +770,11 @@ class FastElementsAccessor
uint32_t length) {
uint32_t old_capacity = backing_store->length();
Object* old_length = array->length();
- bool same_size = old_length->IsSmi() &&
- static_cast<uint32_t>(Smi::cast(old_length)->value()) == length;
+ bool same_or_smaller_size = old_length->IsSmi() &&
+ static_cast<uint32_t>(Smi::cast(old_length)->value()) >= length;
ElementsKind kind = array->GetElementsKind();

- if (!same_size && IsFastElementsKind(kind) &&
+ if (!same_or_smaller_size && IsFastElementsKind(kind) &&
!IsFastHoleyElementsKind(kind)) {
kind = GetHoleyElementsKind(kind);
MaybeObject* maybe_obj = array->TransitionElementsKind(kind);
@@ -829,32 +829,39 @@ class FastElementsAccessor
ASSERT(obj->HasFastSmiOrObjectElements() ||
obj->HasFastDoubleElements() ||
obj->HasFastArgumentsElements());
- typename KindTraits::BackingStore* backing_store =
- KindTraits::BackingStore::cast(obj->elements());
Heap* heap = obj->GetHeap();
- if (backing_store->map() == heap->non_strict_arguments_elements_map())
{
+ Object* elements = obj->elements();
+ if (elements == heap->empty_fixed_array()) {
+ return heap->true_value();
+ }
+ typename KindTraits::BackingStore* backing_store =
+ KindTraits::BackingStore::cast(elements);
+ bool is_non_strict_arguments_elements_map =
+ backing_store->map() == heap->non_strict_arguments_elements_map();
+ if (is_non_strict_arguments_elements_map) {
backing_store =
KindTraits::BackingStore::cast(
FixedArray::cast(backing_store)->get(1));
- } else {
- ElementsKind kind = KindTraits::Kind;
- if (IsFastPackedElementsKind(kind)) {
- MaybeObject* transitioned =
- obj->TransitionElementsKind(GetHoleyElementsKind(kind));
- if (transitioned->IsFailure()) return transitioned;
- }
- if (IsFastSmiOrObjectElementsKind(KindTraits::Kind)) {
- Object* writable;
- MaybeObject* maybe = obj->EnsureWritableFastElements();
- if (!maybe->ToObject(&writable)) return maybe;
- backing_store = KindTraits::BackingStore::cast(writable);
- }
}
uint32_t length = static_cast<uint32_t>(
obj->IsJSArray()
? Smi::cast(JSArray::cast(obj)->length())->value()
: backing_store->length());
if (key < length) {
+ if (!is_non_strict_arguments_elements_map) {
+ ElementsKind kind = KindTraits::Kind;
+ if (IsFastPackedElementsKind(kind)) {
+ MaybeObject* transitioned =
+ obj->TransitionElementsKind(GetHoleyElementsKind(kind));
+ if (transitioned->IsFailure()) return transitioned;
+ }
+ if (IsFastSmiOrObjectElementsKind(KindTraits::Kind)) {
+ Object* writable;
+ MaybeObject* maybe = obj->EnsureWritableFastElements();
+ if (!maybe->ToObject(&writable)) return maybe;
+ backing_store = KindTraits::BackingStore::cast(writable);
+ }
+ }
backing_store->set_the_hole(key);
// If an old space backing store is larger than a certain size and
// has too few used values, normalize it.
Index: test/mjsunit/elements-length-no-holey.js
diff --git a/test/mjsunit/regress/regress-113924.js
b/test/mjsunit/elements-length-no-holey.js
similarity index 94%
copy from test/mjsunit/regress/regress-113924.js
copy to test/mjsunit/elements-length-no-holey.js
index
3ecdec48f219b9ea545702ebf3a396debe7a93f8..a753fd0651ab6fdefef6afa872aa67f54a9721db
100644
--- a/test/mjsunit/regress/regress-113924.js
+++ b/test/mjsunit/elements-length-no-holey.js
@@ -25,7 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-var count=12000;
-while(count--) {
- eval("var a = new Object(10); a[2] += 7;");
-}
+// Flags: --allow-natives-syntax
+
+a = [1,2,3];
+a.length = 1;
+assertFalse(%HasFastHoleyElements(a));
Index: test/mjsunit/regress/regress-delete-empty-double.js
diff --git a/test/mjsunit/regress/regress-2373.js
b/test/mjsunit/regress/regress-delete-empty-double.js
similarity index 95%
copy from test/mjsunit/regress/regress-2373.js
copy to test/mjsunit/regress/regress-delete-empty-double.js
index
16a87ece6f57aee42d77171e8087db412610b0a3..b91268fea67c84d45361a60bdc0aa119ecf044cf
100644
--- a/test/mjsunit/regress/regress-2373.js
+++ b/test/mjsunit/regress/regress-delete-empty-double.js
@@ -25,5 +25,6 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-var o = JSON.parse('{"a":2600753951}');
-assertEquals(2600753951, o.a);
+a = [1.1,2.2,3.3];
+a.length = 0;
+delete a[0];

[da...@chromium.org]

LGTM if you beef up the tests as indicated


https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/elements-length-no-holey.js
File test/mjsunit/elements-length-no-holey.js (right):

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/elements-length-no-holey.js#newcode32
test/mjsunit/elements-length-no-holey.js:32:
assertFalse(%HasFastHoleyElements(a));
assertTrue(%FastSmiElements(a));

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js
File test/mjsunit/regress/regress-delete-empty-double.js (right):

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js#newcode30
test/mjsunit/regress/regress-delete-empty-double.js:30: delete a[0];
assertTrue(%HasFastDoubleElements(a));
assertTrue(%HasFastHoleyElements(a));

https://chromiumcodereview.appspot.com/11358011/

[verw...@chromium.org]

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js
File test/mjsunit/regress/regress-delete-empty-double.js (right):

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js#newcode30
test/mjsunit/regress/regress-delete-empty-double.js:30: delete a[0];

Are you sure this should be holey? In my current implementation they
stay non-holey given that nothing was actually deleted.

On 2012/10/31 18:23:11, danno wrote:
> assertTrue(%HasFastDoubleElements(a));
> assertTrue(%HasFastHoleyElements(a));

https://chromiumcodereview.appspot.com/11358011/

[da...@chromium.org]

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js
File test/mjsunit/regress/regress-delete-empty-double.js (right):

https://chromiumcodereview.appspot.com/11358011/diff/1/test/mjsunit/regress/regress-delete-empty-double.js#newcode30
test/mjsunit/regress/regress-delete-empty-double.js:30: delete a[0];

You're right. How about a second case that verifies that deleting
element 0 of a 1-element array does make it holey?

[verw...@chromium.org]

Addressed comments.

https://chromiumcodereview.appspot.com/11358011/