corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[INFER] Fix incorrect uses of getDenseArrayCapacity in array_concat, CloneDensePrimitiveArray, and stubs::GetElem.

Browse Source
This commit is contained in:
Brian Hackett
2010-12-11 07:30:44 -08:00
parent 4dd6d8d8ea
commit faf154a7d7
3 changed files with 14 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
js/src/jsarray.cpp
View File

@@ -2538,15 +2538,9 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
JSObject *nobj;
jsuint length;
if (aobj->isDenseArray()) {
/*
* Clone aobj but pass the minimum of its length and capacity, to
* handle a = [1,2,3]; a.length = 10000 "dense" cases efficiently. In
* the normal case where length is <= capacity, nobj and aobj will have
* the same capacity.
*/
length = aobj->getArrayLength();
jsuint capacity = aobj->getDenseArrayCapacity();
nobj = js_NewArrayObject(cx, JS_MIN(length, capacity), aobj->getDenseArrayElements(), ntype);
jsuint initlen = aobj->getDenseArrayInitializedLength();
nobj = js_NewArrayObject(cx, initlen, aobj->getDenseArrayElements(), ntype);
if (!nobj)
return JS_FALSE;
nobj->setArrayLength(cx, length);
@@ -3599,20 +3593,13 @@ js_CloneDensePrimitiveArray(JSContext *cx, JSObject *obj, JSObject **clone)
}
jsuint length = obj->getArrayLength();
/*
* Must use the minimum of original array's length and capacity, to handle
* |a = [1,2,3]; a.length = 10000| "dense" cases efficiently. In the normal
* case where length is <= capacity, the clone and original array will have
* the same capacity.
*/
jsuint jsvalCount = JS_MIN(obj->getDenseArrayCapacity(), length);
jsuint initlen = obj->getDenseArrayInitializedLength();
js::AutoValueVector vector(cx);
if (!vector.reserve(jsvalCount))
if (!vector.reserve(initlen))
return JS_FALSE;
for (jsuint i = 0; i < jsvalCount; i++) {
for (jsuint i = 0; i < initlen; i++) {
const Value &val = obj->getDenseArrayElement(i);
if (val.isString()) {
@@ -3631,7 +3618,7 @@ js_CloneDensePrimitiveArray(JSContext *cx, JSObject *obj, JSObject **clone)
vector.append(val);
}
*clone = js_NewArrayObject(cx, jsvalCount, vector.begin(), obj->getTypeObject());
*clone = js_NewArrayObject(cx, initlen, vector.begin(), obj->getTypeObject());
if (!*clone)
return JS_FALSE;
(*clone)->setArrayLength(cx, length);