Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(203)

Unified Diff: src/elements.cc

Issue 1218663009: Delete from non-array end by trimming the backing store (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Rebase and fix Created 5 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 750b1174bf946ac63ba4657d7c7e0843e0b05091..e830d7c46500524ce32a8f0b213fc16214d5094d 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -1037,12 +1037,39 @@ class FastElementsAccessor
typedef typename KindTraits::BackingStore BackingStore;
+ static void DeleteAtEnd(Handle<JSObject> obj,
+ Handle<BackingStore> backing_store, uint32_t entry) {
+ uint32_t length = static_cast<uint32_t>(backing_store->length());
+ Heap* heap = obj->GetHeap();
+ for (; entry > 0; entry--) {
+ if (!backing_store->is_the_hole(entry - 1)) break;
+ }
+ if (entry == 0) {
+ FixedArray* empty = heap->empty_fixed_array();
+ if (obj->HasFastArgumentsElements()) {
+ FixedArray::cast(obj->elements())->set(1, empty);
+ } else {
+ obj->set_elements(empty);
+ }
+ return;
+ }
+
+ heap->RightTrimFixedArray<Heap::CONCURRENT_TO_SWEEPER>(*backing_store,
+ length - entry);
+ }
+
static void DeleteCommon(Handle<JSObject> obj, uint32_t entry,
Handle<FixedArrayBase> store) {
DCHECK(obj->HasFastSmiOrObjectElements() ||
obj->HasFastDoubleElements() ||
obj->HasFastArgumentsElements());
Handle<BackingStore> backing_store = Handle<BackingStore>::cast(store);
+ if (!obj->IsJSArray() &&
+ entry == static_cast<uint32_t>(store->length()) - 1) {
+ DeleteAtEnd(obj, backing_store, entry);
+ return;
+ }
+
backing_store->set_the_hole(entry);
// TODO(verwaest): Move this out of elements.cc.
@@ -1061,6 +1088,16 @@ class FastElementsAccessor
}
if ((entry > 0 && backing_store->is_the_hole(entry - 1)) ||
(entry + 1 < length && backing_store->is_the_hole(entry + 1))) {
+ if (!obj->IsJSArray()) {
+ uint32_t i;
+ for (i = entry + 1; i < length; i++) {
+ if (!backing_store->is_the_hole(i)) break;
+ }
+ if (i == length) {
+ DeleteAtEnd(obj, backing_store, entry);
+ return;
+ }
+ }
int num_used = 0;
for (int i = 0; i < backing_store->length(); ++i) {
if (!backing_store->is_the_hole(i)) ++num_used;
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698