Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5f7ab40afc2d8c7dd20253955edbe834a91db32e
https://github.com/WebKit/WebKit/commit/5f7ab40afc2d8c7dd20253955edbe834a91db32e
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
M Source/WebCore/inspector/InspectorAuditResourcesObject.cpp
M Source/WebCore/inspector/InspectorAuditResourcesObject.h
Log Message:
-----------
[Web Inspector] InspectorAuditResourcesObject::getResources() is O(n²) due to
linear reverse lookup
https://bugs.webkit.org/show_bug.cgi?id=318425
rdar://181206139
Reviewed by Devin Rousso.
getResources() maps each CachedResource to a previously-assigned string
identifier. m_resources is a forward map (identifier -> CachedResource),
so the reverse lookup ("do I already have this resource, and what is its
id?") was done by linearly scanning the entire map for every resource
returned by cachedResourcesForFrame(). That is O(n) per resource, or
O(n²) per call. Because m_resources is never pruned, it accumulates every
resource seen across all getResources() calls for the object's lifetime,
so the scan grows unboundedly across repeated audit calls.
Add a reverse map m_resourceIdentifiers (CachedResource -> identifier)
kept in sync on insertion, turning the reverse lookup into O(1). Because
CachedResource is RefCountedAndCanMakeWeakPtr, this uses a WeakHashMap
rather than a raw-pointer key, matching how ResourceTimingInformation
keys CachedResource and satisfying the SaferCPP prohibition on raw
pointer map keys.
While here, change the forward map to hold WeakPtr<CachedResource>
instead of a raw CachedResource*. Clients are non-owning and
~CachedResource neither asserts on nor notifies outstanding clients, so a
resource could be destroyed while this (never-pruned) map still held a
raw pointer to it, leaving the destructor's removeClient() and
getResourceContent()'s lookup as latent use-after-frees. Weak pointers
make both sites null-check safely and, as a bonus, prevent a reused
address from ever false-matching a stale entry. Identifier numbering is
unchanged: dead entries remain in the map as null weak pointers, so
size()-based ids stay unique.
* Source/WebCore/inspector/InspectorAuditResourcesObject.cpp:
(WebCore::InspectorAuditResourcesObject::~InspectorAuditResourcesObject):
(WebCore::InspectorAuditResourcesObject::getResources):
(WebCore::InspectorAuditResourcesObject::getResourceContent):
* Source/WebCore/inspector/InspectorAuditResourcesObject.h:
Canonical link: https://commits.webkit.org/317967@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
