[webkit-changes] [WebKit/WebKit] 9c5c2c: [JSC] JSRopeString::resolveToBuffer should have fa...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9c5c2c9fc89f8d977ead596d3066df729561df9c
      https://github.com/WebKit/WebKit/commit/9c5c2c9fc89f8d977ead596d3066df729561df9c
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-07-13 (Thu, 13 Jul 2023)

  Changed paths:
    A JSTests/stress/rope-resolve-recursive-non-ascii.js
    A JSTests/stress/rope-resolve-recursive.js
    A JSTests/stress/three-rope-non-ascii.js
    A JSTests/stress/three-rope.js
    A JSTests/stress/two-rope-non-ascii.js
    A JSTests/stress/two-rope.js
    M Source/JavaScriptCore/runtime/JSString.cpp
    M Source/JavaScriptCore/runtime/JSString.h
    M Source/JavaScriptCore/runtime/JSStringInlines.h

  Log Message:
  -----------
  [JSC] JSRopeString::resolveToBuffer should have fast path for two rope+non-rope case
https://bugs.webkit.org/show_bug.cgi?id=259176
rdar://112178098

Reviewed by Michael Saboff.

JSRopeString can have three fibers. But we observed two fibers case, where only one is a rope, very commonly.
This happens when you write code like this,

    var string = '';
    for (var i = 0; i < 1e6; ++i)
        string += char

Then, the resulted string becomes two fibers rope, only left hand side gets super deep.
We can handle this string, just recursively handle the left side (via tail-call), but just spreading the right side.

This patch changes JSRopeString::resolveToBuffer to handle this kind of patterns efficiently. We carefully crafted this
code so that the above pattern becomes repeated tail call to JSRopeString::resolveToBuffer. We also have sp checker so that
this code works perfectly well even if the compiler is not supporting tail-calls (at some level, we stop and use slow-but-works mode).

* Source/JavaScriptCore/runtime/JSString.cpp:
(JSC::JSRopeString::resolveRopeInternalNoSubstring const):
(JSC::JSRopeString::resolveRopeToAtomString const):
(JSC::JSRopeString::resolveRopeToExistingAtomString const):
(JSC::JSRopeString::resolveRopeWithFunction const):
* Source/JavaScriptCore/runtime/JSString.h:
* Source/JavaScriptCore/runtime/JSStringInlines.h:
(JSC::JSRopeString::resolveToBuffer):
(JSC::jsAtomString):

Canonical link: https://commits.webkit.org/266028@main