From 8b5d645df65e54a4ffe4e37a323d1eb68a45a79c Mon Sep 17 00:00:00 2001
From: Zoltan Herczeg <zherczeg.u-szeged@partner.samsung.com>
Date: Thu, 19 Jan 2017 11:34:24 +0100
Subject: [PATCH] Track all NULL values in the property hashmap. (#1534)

There are two types of NULL values in the property hashmap: deleted
entries, and never used entries. The current implementation tracks
only the never used entries, and never scales back the hashmap.
After this patch property delete can also recreate the hashmap, or
remove it entirely if there are too few items in the array.

JerryScript-DCO-1.0-Signed-off-by: Zoltan Herczeg zherczeg.u-szeged@partner.samsung.com
---
 jerry-core/ecma/base/ecma-property-hashmap.c | 25 +++++++++++++------
 tests/jerry/regression-test-issue-1533.js    | 26 ++++++++++++++++++++
 2 files changed, 44 insertions(+), 7 deletions(-)
 create mode 100644 tests/jerry/regression-test-issue-1533.js

diff --git a/jerry-core/ecma/base/ecma-property-hashmap.c b/jerry-core/ecma/base/ecma-property-hashmap.c
index 2c1634f1e..ed3b1db9b 100644
--- a/jerry-core/ecma/base/ecma-property-hashmap.c
+++ b/jerry-core/ecma/base/ecma-property-hashmap.c
@@ -300,13 +300,8 @@ ecma_property_hashmap_insert (ecma_object_t *object_p, /**< object */
   bits_p += (entry_index >> 3);
   mask = (uint32_t) (1 << (entry_index & 0x7));
 
-  if (!(*bits_p & mask))
-  {
-    /* Deleted entries also has ECMA_NULL_POINTER
-     * value, but they are not NULL values. */
-    hashmap_p->null_count--;
-    JERRY_ASSERT (hashmap_p->null_count > 0);
-  }
+  hashmap_p->null_count--;
+  JERRY_ASSERT (hashmap_p->null_count > 0);
 
   if (property_index == 0)
   {
@@ -338,6 +333,22 @@ ecma_property_hashmap_delete (ecma_object_t *object_p, /**< object */
 
   JERRY_ASSERT (hashmap_p->header.types[0] == ECMA_PROPERTY_TYPE_HASHMAP);
 
+  hashmap_p->null_count++;
+
+  /* The NULLs are above 3/4 of the hashmap. */
+  if (hashmap_p->null_count > ((hashmap_p->max_property_count * 3) >> 2))
+  {
+    uint32_t max_property_count = hashmap_p->max_property_count;
+
+    ecma_property_hashmap_free (object_p);
+
+    if (max_property_count >= ECMA_PROPERTY_HASMAP_MINIMUM_SIZE * 2)
+    {
+      ecma_property_hashmap_create (object_p);
+    }
+    return;
+  }
+
   uint32_t entry_index = ecma_string_get_property_name_hash (*property_p, name_cp);
   uint32_t step = ecma_property_hashmap_steps[entry_index & (ECMA_PROPERTY_HASHMAP_NUMBER_OF_STEPS - 1)];
   uint32_t mask = hashmap_p->max_property_count - 1;
diff --git a/tests/jerry/regression-test-issue-1533.js b/tests/jerry/regression-test-issue-1533.js
new file mode 100644
index 000000000..3b77ec50f
--- /dev/null
+++ b/tests/jerry/regression-test-issue-1533.js
@@ -0,0 +1,26 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var a = [];
+
+for (var i = 0; i < 200; ++i)
+  a[i] = 5;
+
+for (var i = 0; i < 200; ++i)
+  a[i] = a[i] + 5;
+
+for (var i = 0; i < 200; ++i)
+  delete a[i]
+
+a[0] = 5