From 9cb0eb6ae098be34703daa985fcf5160fcf766d2 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Tue, 25 Aug 2015 18:05:45 +0300
Subject: [PATCH] Bug 489820 part 1 - Make charRefBuf non-growable and have the
 same lifetime as the tokenizer. r=wchen.

---
 parser/html/javasrc/Tokenizer.java | 18 +++++++-----------
 parser/html/nsHtml5Tokenizer.cpp   |  6 +-----
 parser/html/nsHtml5Tokenizer.h     |  5 -----
 3 files changed, 8 insertions(+), 21 deletions(-)

diff --git a/parser/html/javasrc/Tokenizer.java b/parser/html/javasrc/Tokenizer.java
index 838440a861fb..00b11a89981b 100644
--- a/parser/html/javasrc/Tokenizer.java
+++ b/parser/html/javasrc/Tokenizer.java
@@ -390,7 +390,7 @@ public class Tokenizer implements Locator {
      * Buffer for characters that might form a character reference but may
      * end up not forming one.
      */
-    private @Auto char[] charRefBuf;
+    private final @Auto char[] charRefBuf;
 
     /**
      * Number of significant <code>char</code>s in <code>charRefBuf</code>.
@@ -510,6 +510,9 @@ public class Tokenizer implements Locator {
         this.tokenHandler = tokenHandler;
         this.encodingDeclarationHandler = null;
         this.newAttributesEachTime = newAttributesEachTime;
+        // &CounterClockwiseContourIntegral; is the longest valid char ref and
+        // the semicolon never gets appended to the buffer.
+        this.charRefBuf = new char[32];
         this.bmpChar = new char[1];
         this.astralChar = new char[2];
         this.tagName = null;
@@ -536,6 +539,9 @@ public class Tokenizer implements Locator {
         // [NOCPP[
         this.newAttributesEachTime = false;
         // ]NOCPP]
+        // &CounterClockwiseContourIntegral; is the longest valid char ref and
+        // the semicolon never gets appended to the buffer.
+        this.charRefBuf = new char[32];
         this.bmpChar = new char[1];
         this.astralChar = new char[2];
         this.tagName = null;
@@ -808,11 +814,6 @@ public class Tokenizer implements Locator {
     }
 
     @Inline private void appendCharRefBuf(char c) {
-        if (charRefBufLen == charRefBuf.length) {
-            char[] newBuf = new char[charRefBuf.length + Tokenizer.BUFFER_GROW_BY];
-            System.arraycopy(charRefBuf, 0, newBuf, 0, charRefBuf.length);
-            charRefBuf = newBuf;
-        }
         charRefBuf[charRefBufLen++] = c;
     }
 
@@ -6521,7 +6522,6 @@ public class Tokenizer implements Locator {
 
     public void end() throws SAXException {
         strBuf = null;
-        charRefBuf = null;
         doctypeName = null;
         if (systemIdentifier != null) {
             Portability.releaseString(systemIdentifier);
@@ -6639,9 +6639,6 @@ public class Tokenizer implements Locator {
         System.arraycopy(other.strBuf, 0, strBuf, 0, strBufLen);
 
         charRefBufLen = other.charRefBufLen;
-        if (charRefBufLen > charRefBuf.length) {
-            charRefBuf = new char[charRefBufLen];
-        }
         System.arraycopy(other.charRefBuf, 0, charRefBuf, 0, charRefBufLen);
 
         stateSave = other.stateSave;
@@ -6714,7 +6711,6 @@ public class Tokenizer implements Locator {
     public void initializeWithoutStarting() throws SAXException {
         confident = false;
         strBuf = new char[1024];
-        charRefBuf = new char[64];
         line = 1;
         // [NOCPP[
         html4 = false;
diff --git a/parser/html/nsHtml5Tokenizer.cpp b/parser/html/nsHtml5Tokenizer.cpp
index 090c0b2b02e8..04450ed6f6e1 100644
--- a/parser/html/nsHtml5Tokenizer.cpp
+++ b/parser/html/nsHtml5Tokenizer.cpp
@@ -91,6 +91,7 @@ staticJArray<char16_t,int32_t> nsHtml5Tokenizer::NOFRAMES_ARR = { NOFRAMES_ARR_D
 nsHtml5Tokenizer::nsHtml5Tokenizer(nsHtml5TreeBuilder* tokenHandler, bool viewingXmlSource)
   : tokenHandler(tokenHandler),
     encodingDeclarationHandler(nullptr),
+    charRefBuf(jArray<char16_t,int32_t>::newJArray(32)),
     bmpChar(jArray<char16_t,int32_t>::newJArray(1)),
     astralChar(jArray<char16_t,int32_t>::newJArray(2)),
     tagName(nullptr),
@@ -3899,7 +3900,6 @@ void
 nsHtml5Tokenizer::end()
 {
   strBuf = nullptr;
-  charRefBuf = nullptr;
   doctypeName = nullptr;
   if (systemIdentifier) {
     nsHtml5Portability::releaseString(systemIdentifier);
@@ -3981,9 +3981,6 @@ nsHtml5Tokenizer::loadState(nsHtml5Tokenizer* other)
   }
   nsHtml5ArrayCopy::arraycopy(other->strBuf, strBuf, strBufLen);
   charRefBufLen = other->charRefBufLen;
-  if (charRefBufLen > charRefBuf.length) {
-    charRefBuf = jArray<char16_t,int32_t>::newJArray(charRefBufLen);
-  }
   nsHtml5ArrayCopy::arraycopy(other->charRefBuf, charRefBuf, charRefBufLen);
   stateSave = other->stateSave;
   returnStateSave = other->returnStateSave;
@@ -4049,7 +4046,6 @@ nsHtml5Tokenizer::initializeWithoutStarting()
 {
   confident = false;
   strBuf = jArray<char16_t,int32_t>::newJArray(1024);
-  charRefBuf = jArray<char16_t,int32_t>::newJArray(64);
   line = 1;
   resetToDataState();
 }
diff --git a/parser/html/nsHtml5Tokenizer.h b/parser/html/nsHtml5Tokenizer.h
index c0fa3df2befe..ac29ac49fda0 100644
--- a/parser/html/nsHtml5Tokenizer.h
+++ b/parser/html/nsHtml5Tokenizer.h
@@ -157,11 +157,6 @@ class nsHtml5Tokenizer
   private:
     inline void appendCharRefBuf(char16_t c)
     {
-      if (charRefBufLen == charRefBuf.length) {
-        jArray<char16_t,int32_t> newBuf = jArray<char16_t,int32_t>::newJArray(charRefBuf.length + NS_HTML5TOKENIZER_BUFFER_GROW_BY);
-        nsHtml5ArrayCopy::arraycopy(charRefBuf, newBuf, charRefBuf.length);
-        charRefBuf = newBuf;
-      }
       charRefBuf[charRefBufLen++] = c;
     }