<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168255] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168255">168255</a></dd>
<dt>Author</dt> <dd>akling@apple.com</dd>
<dt>Date</dt> <dd>2014-05-04 23:10:03 -0700 (Sun, 04 May 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/168254">r168254</a>.

Very crashy on debug JSC tests.

Reverted changeset:

&quot;jsSubstring() should be lazy&quot;
https://bugs.webkit.org/show_bug.cgi?id=132556
http://trac.webkit.org/changeset/168254</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapMarkedBlockcpp">trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringcpp">trunk/Source/JavaScriptCore/runtime/JSString.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringh">trunk/Source/JavaScriptCore/runtime/JSString.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpMatchesArraycpp">trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressscripttestssubstringconcatweirdjs">trunk/LayoutTests/js/regress/script-tests/substring-concat-weird.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestssubstringconcatjs">trunk/LayoutTests/js/regress/script-tests/substring-concat.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestssubstringjs">trunk/LayoutTests/js/regress/script-tests/substring.js</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringconcatexpectedtxt">trunk/LayoutTests/js/regress/substring-concat-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringconcatweirdexpectedtxt">trunk/LayoutTests/js/regress/substring-concat-weird-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringconcatweirdhtml">trunk/LayoutTests/js/regress/substring-concat-weird.html</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringconcathtml">trunk/LayoutTests/js/regress/substring-concat.html</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringexpectedtxt">trunk/LayoutTests/js/regress/substring-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresssubstringhtml">trunk/LayoutTests/js/regress/substring.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/ChangeLog        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2014-05-04  Andreas Kling  &lt;akling@apple.com&gt;
+
+        Unreviewed, rolling out r168254.
+
+        Very crashy on debug JSC tests.
+
+        Reverted changeset:
+
+        &quot;jsSubstring() should be lazy&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=132556
+        http://trac.webkit.org/changeset/168254
+
</ins><span class="cx"> 2014-05-04  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         jsSubstring() should be lazy
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestssubstringconcatweirdjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/substring-concat-weird.js (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/substring-concat-weird.js        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/script-tests/substring-concat-weird.js        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,18 +0,0 @@
</span><del>-function foo() {
-    return a + b;
-}
-
-var array = Array(10007);
-
-var string = foo.toString();
-
-for (var i = 0; i &lt; 500000; ++i) {
-    array[i % array.length] = &quot;foo &quot; + string.substring(i % string.length, (i / string.length) % string.length) + &quot; bar&quot;;
-    array[i % array.length] = &quot;this &quot; + array[i % array.length] + &quot; that&quot;;
-}
-
-for (var i = 0; i &lt; array.length; ++i) {
-    var thing = array[i].substring(9, array[i].length - 9);
-    if (string.indexOf(thing) &lt; 0)
-        throw &quot;Error: bad substring: &quot; + thing;
-}
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestssubstringconcatjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/substring-concat.js (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/substring-concat.js        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/script-tests/substring-concat.js        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,17 +0,0 @@
</span><del>-function foo() {
-    return a + b;
-}
-
-var array = Array(10007);
-
-var string = foo.toString();
-
-for (var i = 0; i &lt; 700000; ++i) {
-    array[i % array.length] = &quot;foo &quot; + string.substring(i % string.length, (i / string.length) % string.length) + &quot; bar&quot;;
-}
-
-for (var i = 0; i &lt; array.length; ++i) {
-    var thing = array[i].substring(4, array[i].length - 4);
-    if (string.indexOf(thing) &lt; 0)
-        throw &quot;Error: bad substring: \&quot;&quot; + thing + &quot;\&quot;&quot;;
-}
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestssubstringjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/substring.js (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/substring.js        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/script-tests/substring.js        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,16 +0,0 @@
</span><del>-function foo() {
-    return a + b;
-}
-
-var array = Array(10007);
-
-var string = foo.toString();
-
-for (var i = 0; i &lt; 1000000; ++i) {
-    array[i % array.length] = string.substring(i % string.length, (i / string.length) % string.length);
-}
-
-for (var i = 0; i &lt; array.length; ++i) {
-    if (string.indexOf(array[i]) &lt; 0)
-        throw &quot;Error: bad substring: &quot; + array[i];
-}
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringconcatexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring-concat-expected.txt (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring-concat-expected.txt        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring-concat-expected.txt        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/substring-concat
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringconcatweirdexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring-concat-weird-expected.txt (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring-concat-weird-expected.txt        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring-concat-weird-expected.txt        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/substring-concat-weird
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringconcatweirdhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring-concat-weird.html (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring-concat-weird.html        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring-concat-weird.html        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/substring-concat-weird.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringconcathtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring-concat.html (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring-concat.html        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring-concat.html        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/substring-concat.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring-expected.txt (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring-expected.txt        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring-expected.txt        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/substring
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresssubstringhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/substring.html (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/substring.html        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/LayoutTests/js/regress/substring.html        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/substring.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2014-05-04  Andreas Kling  &lt;akling@apple.com&gt;
+
+        Unreviewed, rolling out r168254.
+
+        Very crashy on debug JSC tests.
+
+        Reverted changeset:
+
+        &quot;jsSubstring() should be lazy&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=132556
+        http://trac.webkit.org/changeset/168254
+
</ins><span class="cx"> 2014-05-04  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         jsSubstring() should be lazy
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapMarkedBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -70,8 +70,6 @@
</span><span class="cx">     ASSERT(blockState != Allocated &amp;&amp; blockState != FreeListed);
</span><span class="cx">     ASSERT(!(dtorType == MarkedBlock::None &amp;&amp; sweepMode == SweepOnly));
</span><span class="cx"> 
</span><del>-    SamplingRegion samplingRegion((dtorType != MarkedBlock::None &amp;&amp; blockState != New) ? &quot;Calling destructors&quot; : &quot;sweeping&quot;);
-    
</del><span class="cx">     // This produces a free list that is ordered in reverse through the block.
</span><span class="cx">     // This is fine, since the allocation code makes no assumptions about the
</span><span class="cx">     // order of the free list.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSStringcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.cpp (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.cpp        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/runtime/JSString.cpp        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -82,25 +82,14 @@
</span><span class="cx"> 
</span><span class="cx"> void JSRopeString::visitFibers(SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><del>-    if (isSubstring()) {
-        visitor.append(&amp;substringBase());
-        return;
-    }
-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i)
-        visitor.append(&amp;fiber(i));
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i)
+        visitor.append(&amp;m_fibers[i]);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSRopeString::resolveRope(ExecState* exec) const
</span><span class="cx"> {
</span><span class="cx">     ASSERT(isRope());
</span><del>-    
-    if (isSubstring()) {
-        ASSERT(!substringBase()-&gt;isRope());
-        m_value = substringBase()-&gt;m_value.substring(substringOffset(), m_length);
-        substringBase().clear();
-        return;
-    }
-    
</del><ins>+
</ins><span class="cx">     if (is8Bit()) {
</span><span class="cx">         LChar* buffer;
</span><span class="cx">         if (RefPtr&lt;StringImpl&gt; newImpl = StringImpl::tryCreateUninitialized(m_length, buffer)) {
</span><span class="lines">@@ -110,19 +99,19 @@
</span><span class="cx">             outOfMemory(exec);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        
-        for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i) {
-            if (fiber(i)-&gt;isRope())
</del><ins>+
+        for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i) {
+            if (m_fibers[i]-&gt;isRope())
</ins><span class="cx">                 return resolveRopeSlowCase8(buffer);
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         LChar* position = buffer;
</span><del>-        for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i) {
-            StringImpl* string = fiber(i)-&gt;m_value.impl();
</del><ins>+        for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i) {
+            StringImpl* string = m_fibers[i]-&gt;m_value.impl();
</ins><span class="cx">             unsigned length = string-&gt;length();
</span><span class="cx">             StringImpl::copyChars(position, string-&gt;characters8(), length);
</span><span class="cx">             position += length;
</span><del>-            fiber(i).clear();
</del><ins>+            m_fibers[i].clear();
</ins><span class="cx">         }
</span><span class="cx">         ASSERT((buffer + m_length) == position);
</span><span class="cx">         ASSERT(!isRope());
</span><span class="lines">@@ -139,21 +128,21 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i) {
-        if (fiber(i)-&gt;isRope())
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i) {
+        if (m_fibers[i]-&gt;isRope())
</ins><span class="cx">             return resolveRopeSlowCase(buffer);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     UChar* position = buffer;
</span><del>-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i) {
-        StringImpl* string = fiber(i)-&gt;m_value.impl();
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i) {
+        StringImpl* string = m_fibers[i]-&gt;m_value.impl();
</ins><span class="cx">         unsigned length = string-&gt;length();
</span><span class="cx">         if (string-&gt;is8Bit())
</span><span class="cx">             StringImpl::copyChars(position, string-&gt;characters8(), length);
</span><span class="cx">         else
</span><span class="cx">             StringImpl::copyChars(position, string-&gt;characters16(), length);
</span><span class="cx">         position += length;
</span><del>-        fiber(i).clear();
</del><ins>+        m_fibers[i].clear();
</ins><span class="cx">     }
</span><span class="cx">     ASSERT((buffer + m_length) == position);
</span><span class="cx">     ASSERT(!isRope());
</span><span class="lines">@@ -174,35 +163,27 @@
</span><span class="cx">     LChar* position = buffer + m_length; // We will be working backwards over the rope.
</span><span class="cx">     Vector&lt;JSString*, 32, UnsafeVectorOverflow&gt; workQueue; // Putting strings into a Vector is only OK because there are no GC points in this method.
</span><span class="cx">     
</span><del>-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i) {
-        workQueue.append(fiber(i).get());
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i) {
+        workQueue.append(m_fibers[i].get());
</ins><span class="cx">         // Clearing here works only because there are no GC points in this method.
</span><del>-        fiber(i).clear();
</del><ins>+        m_fibers[i].clear();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     while (!workQueue.isEmpty()) {
</span><span class="cx">         JSString* currentFiber = workQueue.last();
</span><span class="cx">         workQueue.removeLast();
</span><del>-        
-        const LChar* characters;
-        
</del><ins>+
</ins><span class="cx">         if (currentFiber-&gt;isRope()) {
</span><span class="cx">             JSRopeString* currentFiberAsRope = static_cast&lt;JSRopeString*&gt;(currentFiber);
</span><del>-            if (!currentFiberAsRope-&gt;isSubstring()) {
-                for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; currentFiberAsRope-&gt;fiber(i); ++i)
-                    workQueue.append(currentFiberAsRope-&gt;fiber(i).get());
-                continue;
-            }
-            ASSERT(!currentFiberAsRope-&gt;substringBase()-&gt;isRope());
-            characters =
-                currentFiberAsRope-&gt;substringBase()-&gt;m_value.characters8() +
-                currentFiberAsRope-&gt;substringOffset();
-        } else
-            characters = currentFiber-&gt;m_value.characters8();
</del><ins>+            for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; currentFiberAsRope-&gt;m_fibers[i]; ++i)
+                workQueue.append(currentFiberAsRope-&gt;m_fibers[i].get());
+            continue;
+        }
</ins><span class="cx"> 
</span><del>-        unsigned length = currentFiber-&gt;length();
</del><ins>+        StringImpl* string = static_cast&lt;StringImpl*&gt;(currentFiber-&gt;m_value.impl());
+        unsigned length = string-&gt;length();
</ins><span class="cx">         position -= length;
</span><del>-        StringImpl::copyChars(position, characters, length);
</del><ins>+        StringImpl::copyChars(position, string-&gt;characters8(), length);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ASSERT(buffer == position);
</span><span class="lines">@@ -214,8 +195,8 @@
</span><span class="cx">     UChar* position = buffer + m_length; // We will be working backwards over the rope.
</span><span class="cx">     Vector&lt;JSString*, 32, UnsafeVectorOverflow&gt; workQueue; // These strings are kept alive by the parent rope, so using a Vector is OK.
</span><span class="cx"> 
</span><del>-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i)
-        workQueue.append(fiber(i).get());
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i)
+        workQueue.append(m_fibers[i].get());
</ins><span class="cx"> 
</span><span class="cx">     while (!workQueue.isEmpty()) {
</span><span class="cx">         JSString* currentFiber = workQueue.last();
</span><span class="lines">@@ -223,21 +204,8 @@
</span><span class="cx"> 
</span><span class="cx">         if (currentFiber-&gt;isRope()) {
</span><span class="cx">             JSRopeString* currentFiberAsRope = static_cast&lt;JSRopeString*&gt;(currentFiber);
</span><del>-            if (currentFiberAsRope-&gt;isSubstring()) {
-                ASSERT(!currentFiberAsRope-&gt;substringBase()-&gt;isRope());
-                StringImpl* string = static_cast&lt;StringImpl*&gt;(
-                    currentFiberAsRope-&gt;substringBase()-&gt;m_value.impl());
-                unsigned offset = currentFiberAsRope-&gt;substringOffset();
-                unsigned length = currentFiberAsRope-&gt;length();
-                position -= length;
-                if (string-&gt;is8Bit())
-                    StringImpl::copyChars(position, string-&gt;characters8() + offset, length);
-                else
-                    StringImpl::copyChars(position, string-&gt;characters16() + offset, length);
-                continue;
-            }
-            for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; currentFiberAsRope-&gt;fiber(i); ++i)
-                workQueue.append(currentFiberAsRope-&gt;fiber(i).get());
</del><ins>+            for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; currentFiberAsRope-&gt;m_fibers[i]; ++i)
+                workQueue.append(currentFiberAsRope-&gt;m_fibers[i].get());
</ins><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -256,8 +224,8 @@
</span><span class="cx"> 
</span><span class="cx"> void JSRopeString::outOfMemory(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; fiber(i); ++i)
-        u[i].string.clear();
</del><ins>+    for (size_t i = 0; i &lt; s_maxInternalRopeLength &amp;&amp; m_fibers[i]; ++i)
+        m_fibers[i].clear();
</ins><span class="cx">     ASSERT(isRope());
</span><span class="cx">     ASSERT(m_value.isNull());
</span><span class="cx">     if (exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.h (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.h        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/runtime/JSString.h        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -270,9 +270,8 @@
</span><span class="cx">             Base::finishCreation(vm);
</span><span class="cx">             m_length = s1-&gt;length() + s2-&gt;length();
</span><span class="cx">             setIs8Bit(s1-&gt;is8Bit() &amp;&amp; s2-&gt;is8Bit());
</span><del>-            fiber(0).set(vm, this, s1);
-            fiber(1).set(vm, this, s2);
-            fiber(2).clear();
</del><ins>+            m_fibers[0].set(vm, this, s1);
+            m_fibers[1].set(vm, this, s2);
</ins><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         void finishCreation(VM&amp; vm, JSString* s1, JSString* s2, JSString* s3)
</span><span class="lines">@@ -280,35 +279,19 @@
</span><span class="cx">             Base::finishCreation(vm);
</span><span class="cx">             m_length = s1-&gt;length() + s2-&gt;length() + s3-&gt;length();
</span><span class="cx">             setIs8Bit(s1-&gt;is8Bit() &amp;&amp; s2-&gt;is8Bit() &amp;&amp;  s3-&gt;is8Bit());
</span><del>-            fiber(0).set(vm, this, s1);
-            fiber(1).set(vm, this, s2);
-            fiber(2).set(vm, this, s3);
</del><ins>+            m_fibers[0].set(vm, this, s1);
+            m_fibers[1].set(vm, this, s2);
+            m_fibers[2].set(vm, this, s3);
</ins><span class="cx">         }
</span><del>-        
-        void finishCreation(VM&amp; vm, JSString* base, unsigned offset, unsigned length)
-        {
-            Base::finishCreation(vm);
-            ASSERT(!base-&gt;isRope());
-            ASSERT(!sumOverflows&lt;int32_t&gt;(offset, length));
-            ASSERT(offset + length &lt;= base-&gt;length());
-            m_length = length;
-            setIs8Bit(base-&gt;is8Bit());
-            u[0].string.setWithoutWriteBarrier(substringSentinel());
-            substringBase().set(vm, this, base);
-            substringOffset() = offset;
-        }
</del><span class="cx"> 
</span><span class="cx">         void finishCreation(VM&amp; vm)
</span><span class="cx">         {
</span><span class="cx">             JSString::finishCreation(vm);
</span><del>-            fiber(0).clear();
-            fiber(1).clear();
-            fiber(2).clear();
</del><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         void append(VM&amp; vm, size_t index, JSString* jsString)
</span><span class="cx">         {
</span><del>-            fiber(index).set(vm, this, jsString);
</del><ins>+            m_fibers[index].set(vm, this, jsString);
</ins><span class="cx">             m_length += jsString-&gt;m_length;
</span><span class="cx">             RELEASE_ASSERT(static_cast&lt;int32_t&gt;(m_length) &gt;= 0);
</span><span class="cx">             setIs8Bit(is8Bit() &amp;&amp; jsString-&gt;is8Bit());
</span><span class="lines">@@ -334,17 +317,10 @@
</span><span class="cx">             newString-&gt;finishCreation(vm, s1, s2, s3);
</span><span class="cx">             return newString;
</span><span class="cx">         }
</span><del>-        
-        static JSString* create(VM&amp; vm, JSString* base, unsigned offset, unsigned length)
-        {
-            JSRopeString* newString = new (NotNull, allocateCell&lt;JSRopeString&gt;(vm.heap)) JSRopeString(vm);
-            newString-&gt;finishCreation(vm, base, offset, length);
-            return newString;
-        }
</del><span class="cx"> 
</span><span class="cx">         void visitFibers(SlotVisitor&amp;);
</span><span class="cx">             
</span><del>-        static ptrdiff_t offsetOfFibers() { return OBJECT_OFFSETOF(JSRopeString, u); }
</del><ins>+        static ptrdiff_t offsetOfFibers() { return OBJECT_OFFSETOF(JSRopeString, m_fibers); }
</ins><span class="cx"> 
</span><span class="cx">         static const unsigned s_maxInternalRopeLength = 3;
</span><span class="cx">             
</span><span class="lines">@@ -358,38 +334,8 @@
</span><span class="cx">         void outOfMemory(ExecState*) const;
</span><span class="cx">             
</span><span class="cx">         JS_EXPORT_PRIVATE JSString* getIndexSlowCase(ExecState*, unsigned);
</span><del>-        
-        WriteBarrierBase&lt;JSString&gt;&amp; fiber(unsigned i) const
-        {
-            ASSERT(!isSubstring());
-            ASSERT(i &lt; s_maxInternalRopeLength);
-            return u[i].string;
-        }
-        
-        WriteBarrierBase&lt;JSString&gt;&amp; substringBase() const
-        {
-            return u[1].string;
-        }
-        
-        unsigned&amp; substringOffset() const
-        {
-            return u[2].number;
-        }
-        
-        static JSString* substringSentinel()
-        {
-            return bitwise_cast&lt;JSString*&gt;(static_cast&lt;uintptr_t&gt;(1));
-        }
-        
-        bool isSubstring() const
-        {
-            return u[0].string.get() == substringSentinel();
-        }
</del><span class="cx"> 
</span><del>-        mutable union {
-            unsigned number;
-            WriteBarrierBase&lt;JSString&gt; string;
-        } u[s_maxInternalRopeLength];
</del><ins>+        mutable std::array&lt;WriteBarrier&lt;JSString&gt;, s_maxInternalRopeLength&gt; m_fibers;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="lines">@@ -475,11 +421,10 @@
</span><span class="cx">         ASSERT(offset &lt;= static_cast&lt;unsigned&gt;(s-&gt;length()));
</span><span class="cx">         ASSERT(length &lt;= static_cast&lt;unsigned&gt;(s-&gt;length()));
</span><span class="cx">         ASSERT(offset + length &lt;= static_cast&lt;unsigned&gt;(s-&gt;length()));
</span><del>-        VM&amp; vm = exec-&gt;vm();
</del><ins>+        VM* vm = &amp;exec-&gt;vm();
</ins><span class="cx">         if (!length)
</span><del>-            return vm.smallStrings.emptyString();
-        s-&gt;value(exec); // For effect. We need to ensure that any string that is used as a substring base is not a rope.
-        return JSRopeString::create(vm, s, offset, length);
</del><ins>+            return vm-&gt;smallStrings.emptyString();
+        return jsSubstring(vm, s-&gt;value(exec), offset, length);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     inline JSString* jsSubstring8(VM* vm, const String&amp; s, unsigned offset, unsigned length)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpMatchesArraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -74,8 +74,6 @@
</span><span class="cx">     ASSERT(m_state != ReifiedAll);
</span><span class="cx">     ASSERT(m_result);
</span><span class="cx">  
</span><del>-    SamplingRegion samplingRegion(&quot;Reifying substring properties&quot;);
-    
</del><span class="cx">     reifyMatchPropertyIfNecessary(exec);
</span><span class="cx"> 
</span><span class="cx">     if (unsigned numSubpatterns = m_regExp-&gt;numSubpatterns()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp (168254 => 168255)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2014-05-05 04:54:19 UTC (rev 168254)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2014-05-05 06:10:03 UTC (rev 168255)
</span><span class="lines">@@ -1218,7 +1218,6 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
</span><span class="cx"> {
</span><del>-    SamplingRegion samplingRegion(&quot;Doing substringing&quot;);
</del><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><span class="cx">         return throwVMTypeError(exec);
</span></span></pre>
</div>
</div>

</body>
</html>