[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

barraclough at apple.com barraclough at apple.com
Thu Apr 8 00:44:57 UTC 2010


The following commit has been merged in the webkit-1.2 branch:
commit 1c68c3def85aeac6541c3806d0c8bd1f1261f5ab
Author: barraclough at apple.com <barraclough at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Dec 22 00:38:24 2009 +0000

    https://bugs.webkit.org/show_bug.cgi?id=32831
    Replace UString::Rep implementation, following introduction of ropes to JSC.
    
    Reviewed by Darin Adler.
    
    JavaScriptCore:
    
        * Remove redundant overcapacity mechanisms.
        * Reduce memory cost of Rep's.
        * Add an inline storage mechanism akin to that in WebCore's StringImpl.
    
    ~1% Sunspider progression.
    
    * JavaScriptCore.exp:
    * JavaScriptCore.xcodeproj/project.pbxproj:
    * runtime/JSString.cpp:
    (JSC::JSString::resolveRope):
    * runtime/SmallStrings.cpp:
    (JSC::SmallStringsStorage::SmallStringsStorage):
    * runtime/UString.cpp:
    (JSC::initializeUString):
    (JSC::createRep):
    (JSC::UString::createFromUTF8):
    (JSC::UString::createUninitialized):
    (JSC::UString::spliceSubstringsWithSeparators):
    (JSC::UString::replaceRange):
    (JSC::UString::ascii):
    (JSC::UString::operator=):
    (JSC::UString::toStrictUInt32):
    (JSC::equal):
    * runtime/UString.h:
    (JSC::UString::isEmpty):
    (JSC::UString::cost):
    (JSC::makeString):
    * runtime/UStringImpl.cpp: Added.
    (JSC::UStringImpl::baseSharedBuffer):
    (JSC::UStringImpl::sharedBuffer):
    (JSC::UStringImpl::destroy):
    (JSC::UStringImpl::computeHash):
    * runtime/UStringImpl.h: Added.
    (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
    (JSC::UntypedPtrAndBitfield::asPtr):
    (JSC::UntypedPtrAndBitfield::operator&=):
    (JSC::UntypedPtrAndBitfield::operator|=):
    (JSC::UntypedPtrAndBitfield::operator&):
    (JSC::UStringImpl::create):
    (JSC::UStringImpl::createCopying):
    (JSC::UStringImpl::createUninitialized):
    (JSC::UStringImpl::data):
    (JSC::UStringImpl::size):
    (JSC::UStringImpl::cost):
    (JSC::UStringImpl::hash):
    (JSC::UStringImpl::computedHash):
    (JSC::UStringImpl::setHash):
    (JSC::UStringImpl::identifierTable):
    (JSC::UStringImpl::setIdentifierTable):
    (JSC::UStringImpl::ref):
    (JSC::UStringImpl::deref):
    (JSC::UStringImpl::allocChars):
    (JSC::UStringImpl::copyChars):
    (JSC::UStringImpl::computeHash):
    (JSC::UStringImpl::null):
    (JSC::UStringImpl::empty):
    (JSC::UStringImpl::checkConsistency):
    (JSC::UStringImpl::):
    (JSC::UStringImpl::UStringImpl):
    (JSC::UStringImpl::operator new):
    (JSC::UStringImpl::bufferOwnerString):
    (JSC::UStringImpl::bufferOwnership):
    (JSC::UStringImpl::isStatic):
    
    JavaScriptGlue:
    
    * ForwardingHeaders/wtf/PossiblyNull.h: Added.
        - add forwarding header.
    
    WebCore:
    
    * ForwardingHeaders/runtime/UStringImpl.h: Added.
        - add forwarding header.
    
    * platform/text/StringImpl.cpp:
    (WebCore::StringImpl::ustring):
        - order of arguments to UString::Rep constructor for shared strings changed.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@52463 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 82ed237..d07c3a0 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,74 @@
+2009-12-21  Gavin Barraclough  <barraclough at apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
 2009-12-18  Laszlo Gombos  <laszlo.1.gombos at nokia.com>
 
         Reviewed by Kenneth Rohde Christiansen.
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index 5e34bab..6a06215 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -90,12 +90,12 @@ __Z12jsRegExpFreeP8JSRegExp
 __Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
 __Z15jsRegExpExecutePK8JSRegExpPKtiiPii
 __ZN14OpaqueJSString6createERKN3JSC7UStringE
-__ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPNS_7UString3RepE
-__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_7UString3RepE
-__ZN3JSC10Identifier24checkSameIdentifierTableEPNS_12JSGlobalDataEPNS_7UString3RepE 
-__ZN3JSC10Identifier24checkSameIdentifierTableEPNS_9ExecStateEPNS_7UString3RepE 
+__ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPNS_11UStringImplE
+__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_11UStringImplE
+__ZN3JSC10Identifier24checkSameIdentifierTableEPNS_12JSGlobalDataEPNS_11UStringImplE
+__ZN3JSC10Identifier24checkSameIdentifierTableEPNS_9ExecStateEPNS_11UStringImplE
 __ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
-__ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
+__ZN3JSC10Identifier5equalEPKNS_11UStringImplEPKc
 __ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
 __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
@@ -103,6 +103,11 @@ __ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
 __ZN3JSC11JSByteArray15createStructureENS_7JSValueE
 __ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
 __ZN3JSC11ParserArena5resetEv
+__ZN3JSC11UStringImpl11computeHashEPKci
+__ZN3JSC11UStringImpl11computeHashEPKti
+__ZN3JSC11UStringImpl12sharedBufferEv
+__ZN3JSC11UStringImpl6s_nullE
+__ZN3JSC11UStringImpl7destroyEv
 __ZN3JSC11checkSyntaxEPNS_9ExecStateERKNS_10SourceCodeE
 __ZN3JSC12DateInstance4infoE
 __ZN3JSC12DateInstanceC1EPNS_9ExecStateEd
@@ -157,7 +162,7 @@ __ZN3JSC16JSVariableObject14symbolTableGetERKNS_10IdentifierERNS_18PropertyDescr
 __ZN3JSC16JSVariableObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
 __ZN3JSC16toUInt32SlowCaseEdRb
 __ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
-__ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
+__ZN3JSC17PropertyNameArray3addEPNS_11UStringImplE
 __ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RKNS_7ArgListEE
 __ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
 __ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
@@ -194,7 +199,7 @@ __ZN3JSC4Heap7protectENS_7JSValueE
 __ZN3JSC4Heap8allocateEm
 __ZN3JSC4Heap9unprotectENS_7JSValueE
 __ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
-__ZN3JSC5equalEPKNS_7UString3RepES3_
+__ZN3JSC5equalEPKNS_11UStringImplES2_
 __ZN3JSC6JSCell11getCallDataERNS_8CallDataE
 __ZN3JSC6JSCell11getJSNumberEv
 __ZN3JSC6JSCell14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
@@ -226,13 +231,6 @@ __ZN3JSC7Profile5focusEPKNS_11ProfileNodeE
 __ZN3JSC7Profile7excludeEPKNS_11ProfileNodeE
 __ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
 __ZN3JSC7UString16createNonCopyingEPti
-__ZN3JSC7UString3Rep11computeHashEPKci
-__ZN3JSC7UString3Rep11computeHashEPKti
-__ZN3JSC7UString3Rep12sharedBufferEv
-__ZN3JSC7UString3Rep14createFromUTF8EPKc
-__ZN3JSC7UString3Rep14nullBaseStringE
-__ZN3JSC7UString3Rep6createEPtiN3WTF10PassRefPtrINS3_21CrossThreadRefCountedINS3_16OwnFastMallocPtrItEEEEEE
-__ZN3JSC7UString3Rep7destroyEv
 __ZN3JSC7UString4fromEd
 __ZN3JSC7UString4fromEi
 __ZN3JSC7UString4fromEj
@@ -280,7 +278,7 @@ __ZN3JSC9MarkStack10s_pageSizeE
 __ZN3JSC9MarkStack12releaseStackEPvm
 __ZN3JSC9MarkStack13allocateStackEm
 __ZN3JSC9MarkStack18initializePagesizeEv
-__ZN3JSC9Structure13hasTransitionEPNS_7UString3RepEj
+__ZN3JSC9Structure13hasTransitionEPNS_11UStringImplEj
 __ZN3JSC9Structure17stopIgnoringLeaksEv
 __ZN3JSC9Structure18startIgnoringLeaksEv
 __ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
@@ -290,7 +288,7 @@ __ZN3JSC9Structure27addAnonymousSlotsTransitionEPS0_j
 __ZN3JSC9Structure27despecifyDictionaryFunctionERKNS_10IdentifierE
 __ZN3JSC9Structure27despecifyFunctionTransitionEPS0_RKNS_10IdentifierE
 __ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEjPNS_6JSCellE
-__ZN3JSC9Structure3getEPKNS_7UString3RepERjRPNS_6JSCellE
+__ZN3JSC9Structure3getEPKNS_11UStringImplERjRPNS_6JSCellE
 __ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjPNS_6JSCellERm
 __ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoE
 __ZN3JSC9StructureD1Ev
@@ -348,7 +346,7 @@ __ZN3WTF8fastFreeEPv
 __ZN3WTF9ByteArray6createEm
 __ZNK3JSC10JSFunction23isHostFunctionNonInlineEv
 __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
-__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE  
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
 __ZNK3JSC14JSGlobalObject14isDynamicScopeEv
 __ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 58a9d39..9c99282 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -207,6 +207,8 @@
 		869083150E6518D7000D36ED /* WREC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 869083130E6518D7000D36ED /* WREC.cpp */; };
 		869083160E6518D7000D36ED /* WREC.h in Headers */ = {isa = PBXBuildFile; fileRef = 869083140E6518D7000D36ED /* WREC.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8698B86910D44D9400D8D01B /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 8698B86810D44D9400D8D01B /* StringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8698BB3910D86BAF00D8D01B /* UStringImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 8698BB3710D86BAF00D8D01B /* UStringImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8698BB3A10D86BAF00D8D01B /* UStringImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8698BB3810D86BAF00D8D01B /* UStringImpl.cpp */; };
 		869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */ = {isa = PBXBuildFile; fileRef = 869EBCB60E8C6D4A008722CC /* ResultType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */; };
 		86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */; };
@@ -734,6 +736,8 @@
 		869083130E6518D7000D36ED /* WREC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WREC.cpp; sourceTree = "<group>"; };
 		869083140E6518D7000D36ED /* WREC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WREC.h; sourceTree = "<group>"; };
 		8698B86810D44D9400D8D01B /* StringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuilder.h; sourceTree = "<group>"; };
+		8698BB3710D86BAF00D8D01B /* UStringImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringImpl.h; sourceTree = "<group>"; };
+		8698BB3810D86BAF00D8D01B /* UStringImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UStringImpl.cpp; sourceTree = "<group>"; };
 		869EBCB60E8C6D4A008722CC /* ResultType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResultType.h; sourceTree = "<group>"; };
 		86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic.cpp; sourceTree = "<group>"; };
 		86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7Assembler.h; sourceTree = "<group>"; };
@@ -1610,6 +1614,8 @@
 				5D53726E0E1C54880021E549 /* Tracing.h */,
 				F692A8850255597D01FF60F7 /* UString.cpp */,
 				F692A8860255597D01FF60F7 /* UString.h */,
+				8698BB3810D86BAF00D8D01B /* UStringImpl.cpp */,
+				8698BB3710D86BAF00D8D01B /* UStringImpl.h */,
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
 				14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
@@ -2027,6 +2033,7 @@
 				14A1563210966365006FA260 /* DateInstanceCache.h in Headers */,
 				1420BE7B10AA6DDB00F455D2 /* WeakRandom.h in Headers */,
 				8698B86910D44D9400D8D01B /* StringBuilder.h in Headers */,
+				8698BB3910D86BAF00D8D01B /* UStringImpl.h in Headers */,
 				14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -2472,6 +2479,7 @@
 				1429DAC00ED263E700B89619 /* WRECParser.cpp in Sources */,
 				A7C2217810C7479400F97913 /* JSZombie.cpp in Sources */,
 				655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */,
+				8698BB3A10D86BAF00D8D01B /* UStringImpl.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 71d9973..69164f8 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -96,13 +96,13 @@ void JSString::resolveRope(ExecState* exec) const
 
     // Allocate the buffer to hold the final string, position initially points to the end.
     UChar* buffer;
-    if (!tryFastMalloc(m_stringLength * sizeof(UChar)).getValue(buffer)) {
+    m_value = UString::createUninitialized(m_stringLength, buffer);
+    if (!buffer) {
         for (unsigned i = 0; i < m_ropeLength; ++i)
             m_fibers[i].deref();
         m_ropeLength = 0;
         ASSERT(!isRope());
         ASSERT(m_value == UString());
-
         throwOutOfMemoryError(exec);
         return;
     }
@@ -133,7 +133,6 @@ void JSString::resolveRope(ExecState* exec) const
             if (workQueue.isEmpty()) {
                 // Create a string from the UChar buffer, clear the rope RefPtr.
                 ASSERT(buffer == position);
-                m_value = UString::Rep::create(buffer, m_stringLength);
                 for (unsigned i = 0; i < m_ropeLength; ++i)
                     m_fibers[i].deref();
                 m_ropeLength = 0;
diff --git a/JavaScriptCore/runtime/SmallStrings.cpp b/JavaScriptCore/runtime/SmallStrings.cpp
index 04701cb..068c81e 100644
--- a/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/JavaScriptCore/runtime/SmallStrings.cpp
@@ -42,30 +42,21 @@ public:
 
 private:
     UChar m_characters[numCharactersToStore];
-    UString::BaseString m_base;
+    UString::Rep m_base;
     UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : m_base(m_characters, numCharactersToStore)
+    : m_base(m_characters, numCharactersToStore, UStringImpl::ConstructStaticString)
 {
-    m_base.rc = numCharactersToStore + 1;
-    // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    m_base.usedCapacity = numCharactersToStore + 1;
-    m_base.capacity = numCharactersToStore + 1;
     m_base.checkConsistency();
 
     for (unsigned i = 0; i < numCharactersToStore; ++i)
         m_characters[i] = i;
 
     memset(&m_reps, 0, sizeof(m_reps));
-    for (unsigned i = 0; i < numCharactersToStore; ++i) {
-        m_reps[i].offset = i;
-        m_reps[i].len = 1;
-        m_reps[i].rc = 1;
-        m_reps[i].setBaseString(&m_base);
-        m_reps[i].checkConsistency();
-    }
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        new (&m_reps[i]) UString::Rep(m_base.data() + i, 1, &m_base);
 }
 
 SmallStrings::SmallStrings()
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 267112f..e04b798 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -52,52 +52,11 @@ using namespace WTF;
 using namespace WTF::Unicode;
 using namespace std;
 
-// This can be tuned differently per platform by putting platform #ifs right here.
-// If you don't define this macro at all, then copyChars will just call directly
-// to memcpy.
-#define USTRING_COPY_CHARS_INLINE_CUTOFF 20
-
 namespace JSC {
  
 extern const double NaN;
 extern const double Inf;
 
-// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
-static const int minLengthToShare = 10;
-
-static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
-static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
-
-static inline PossiblyNull<UChar*> allocChars(size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastMalloc(sizeof(UChar) * length);
-}
-
-static inline PossiblyNull<UChar*> reallocChars(UChar* buffer, size_t length)
-{
-    ASSERT(length);
-    if (length > maxUChars())
-        return 0;
-    return tryFastRealloc(buffer, sizeof(UChar) * length);
-}
-
-static inline void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
-{
-#ifdef USTRING_COPY_CHARS_INLINE_CUTOFF
-    if (numCharacters <= USTRING_COPY_CHARS_INLINE_CUTOFF) {
-        for (unsigned i = 0; i < numCharacters; ++i)
-            destination[i] = source[i];
-        return;
-    }
-#endif
-    memcpy(destination, source, numCharacters * sizeof(UChar));
-}
-
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
-
 CString::CString(const char* c)
     : m_length(strlen(c))
     , m_data(new char[m_length + 1])
@@ -190,371 +149,17 @@ bool operator==(const CString& c1, const CString& c2)
 // These static strings are immutable, except for rc, whose initial value is chosen to 
 // reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
 static UChar sharedEmptyChar;
-UString::BaseString* UString::Rep::nullBaseString;
-UString::BaseString* UString::Rep::emptyBaseString;
+UStringImpl* UStringImpl::s_null;
+UStringImpl* UStringImpl::s_empty;
 UString* UString::nullUString;
 
-static void initializeStaticBaseString(UString::BaseString& base)
-{
-    base.rc = INT_MAX / 2;
-    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
-    base.checkConsistency();
-}
-
 void initializeUString()
 {
-    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
-    initializeStaticBaseString(*UString::Rep::nullBaseString);
-
-    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
-    initializeStaticBaseString(*UString::Rep::emptyBaseString);
-
+    UStringImpl::s_null = new UStringImpl(0, 0, UStringImpl::ConstructStaticString);
+    UStringImpl::s_empty = new UStringImpl(&sharedEmptyChar, 0, UStringImpl::ConstructStaticString);
     UString::nullUString = new UString;
 }
 
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
-
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
-{
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
-}
-
-PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
-{
-    if (!string)
-        return &UString::Rep::null();
-
-    size_t length = strlen(string);
-    Vector<UChar, 1024> buffer(length);
-    UChar* p = buffer.data();
-    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null();
-
-    return UString::Rep::createCopying(buffer.data(), p - buffer.data());
-}
-
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    PassRefPtr<UString::Rep> rep = create(string, length);
-    rep->baseString()->setSharedBuffer(sharedBuffer);
-    rep->checkConsistency();
-    return rep;
-}
-
-UString::SharedUChar* UString::Rep::sharedBuffer()
-{
-    UString::BaseString* base = baseString();
-    if (len < minLengthToShare)
-        return 0;
-
-    return base->sharedBuffer();
-}
-
-void UString::Rep::destroy()
-{
-    checkConsistency();
-
-    // Static null and empty strings can never be destroyed, but we cannot rely on 
-    // reference counting, because ref/deref are not thread-safe.
-    if (!isStatic()) {
-        if (identifierTable())
-            Identifier::remove(this);
-
-        UString::BaseString* base = baseString();
-        if (base == this) {
-            if (m_sharedBuffer)
-                m_sharedBuffer->deref();
-            else
-                fastFree(base->buf);
-        } else
-            base->deref();
-
-        delete this;
-    }
-}
-
-// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
-// or anything like that.
-const unsigned PHI = 0x9e3779b9U;
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const UChar* s, int len)
-{
-    unsigned l = len;
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    int rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += s[0];
-        tmp = (s[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += s[0];
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
-unsigned UString::Rep::computeHash(const char* s, int l)
-{
-    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-    // were 16-bit chunks, which should give matching results
-
-    uint32_t hash = PHI;
-    uint32_t tmp;
-
-    size_t rem = l & 1;
-    l >>= 1;
-
-    // Main loop
-    for (; l > 0; l--) {
-        hash += static_cast<unsigned char>(s[0]);
-        tmp = (static_cast<unsigned char>(s[1]) << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        s += 2;
-        hash += hash >> 11;
-    }
-
-    // Handle end case
-    if (rem) {
-        hash += static_cast<unsigned char>(s[0]);
-        hash ^= hash << 11;
-        hash += hash >> 17;
-    }
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // this avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
-}
-
-#ifndef NDEBUG
-void UString::Rep::checkConsistency() const
-{
-    const UString::BaseString* base = baseString();
-
-    // There is no recursion for base strings.
-    ASSERT(base == base->baseString());
-
-    if (isStatic()) {
-        // There are only two static strings: null and empty.
-        ASSERT(!len);
-
-        // Static strings cannot get in identifier tables, because they are globally shared.
-        ASSERT(!identifierTable());
-    }
-
-    // The string fits in buffer.
-    ASSERT(base->usedPreCapacity <= base->preCapacity);
-    ASSERT(base->usedCapacity <= base->capacity);
-    ASSERT(-offset <= base->usedPreCapacity);
-    ASSERT(offset + len <= base->usedCapacity);
-}
-#endif
-
-UString::SharedUChar* UString::BaseString::sharedBuffer()
-{
-    if (!m_sharedBuffer)
-        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
-    return m_sharedBuffer;
-}
-
-void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
-{
-    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
-    // is in a union with another variable to avoid making BaseString any larger.
-    if (m_sharedBuffer)
-        m_sharedBuffer->deref();
-    m_sharedBuffer = sharedBuffer.releaseRef();
-}
-
-bool UString::BaseString::slowIsBufferReadOnly()
-{
-    // The buffer may not be modified as soon as the underlying data has been shared with another class.
-    if (m_sharedBuffer->isShared())
-        return true;
-
-    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
-    // so get rid of m_sharedBuffer.
-    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
-    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
-    setSharedBuffer(0);
-    preCapacity += (buf - unsharedBuf);
-    buf = unsharedBuf;
-    return false;
-}
-
-// Put these early so they can be inlined.
-static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
-{
-    // Combine capacitySize & precapacitySize to produce a single size to allocate,
-    // check that doing so does not result in overflow.
-    size_t size = capacitySize + precapacitySize;
-    if (size < capacitySize)
-        return overflowIndicator();
-
-    // Small Strings (up to 4 pages):
-    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
-    // to our previous policy, however 112.5% is cheaper to calculate.
-    if (size < 0x4000) {
-        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Medium Strings (up to 128 pages):
-    // For pages covering multiple pages over-allocation is less of a concern - any unused
-    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
-    // these strings allocate 2x the requested size.
-    if (size < 0x80000) {
-        size_t expandedSize = ((size + size) | 0xfff) + 1;
-        // Given the limited range within which we calculate the expansion in this
-        // fashion the above calculation should never overflow.
-        ASSERT(expandedSize >= size);
-        ASSERT(expandedSize < maxUChars());
-        return expandedSize;
-    }
-
-    // Large Strings (to infinity and beyond!):
-    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
-    // any individual string be responsible for.
-    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
-
-    // Check for overflow - any result that is at least as large as requested (but
-    // still below the limit) is okay.
-    if ((expandedSize >= size) && (expandedSize < maxUChars()))
-        return expandedSize;
-    return overflowIndicator();
-}
-
-static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
-{
-    rep->checkConsistency();
-    ASSERT(!rep->baseString()->isBufferReadOnly());
-
-    UString::BaseString* base = rep->baseString();
-
-    if (requiredLength > base->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
-        UChar* oldBuf = base->buf;
-        if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-            base->buf = oldBuf;
-            return false;
-        }
-        base->capacity = newCapacity - base->preCapacity;
-    }
-    if (requiredLength > base->usedCapacity)
-        base->usedCapacity = requiredLength;
-
-    rep->checkConsistency();
-    return true;
-}
-
-bool UString::Rep::reserveCapacity(int capacity)
-{
-    // If this is an empty string there is no point 'growing' it - just allocate a new one.
-    // If the BaseString is shared with another string that is using more capacity than this
-    // string is, then growing the buffer won't help.
-    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
-    UString::BaseString* base = baseString();
-    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
-        return false;
-    
-    // If there is already sufficient capacity, no need to grow!
-    if (capacity <= base->capacity)
-        return true;
-
-    checkConsistency();
-
-    size_t newCapacity = expandedSize(capacity, base->preCapacity);
-    UChar* oldBuf = base->buf;
-    if (!reallocChars(base->buf, newCapacity).getValue(base->buf)) {
-        base->buf = oldBuf;
-        return false;
-    }
-    base->capacity = newCapacity - base->preCapacity;
-
-    checkConsistency();
-    return true;
-}
-
-void UString::expandCapacity(int requiredLength)
-{
-    if (!JSC::expandCapacity(m_rep.get(), requiredLength))
-        makeNull();
-}
-
-void UString::expandPreCapacity(int requiredPreCap)
-{
-    m_rep->checkConsistency();
-    ASSERT(!m_rep->baseString()->isBufferReadOnly());
-
-    BaseString* base = m_rep->baseString();
-
-    if (requiredPreCap > base->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
-        int delta = newCapacity - base->capacity - base->preCapacity;
-
-        UChar* newBuf;
-        if (!allocChars(newCapacity).getValue(newBuf)) {
-            makeNull();
-            return;
-        }
-        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
-        fastFree(base->buf);
-        base->buf = newBuf;
-
-        base->preCapacity = newCapacity - base->capacity;
-    }
-    if (requiredPreCap > base->usedPreCapacity)
-        base->usedPreCapacity = requiredPreCap;
-
-    m_rep->checkConsistency();
-}
-
 static PassRefPtr<UString::Rep> createRep(const char* c)
 {
     if (!c)
@@ -565,14 +170,13 @@ static PassRefPtr<UString::Rep> createRep(const char* c)
 
     size_t length = strlen(c);
     UChar* d;
-    if (!allocChars(length).getValue(d))
+    PassRefPtr<UStringImpl> result = UStringImpl::createUninitialized(length, d);
+    if (!result)
         return &UString::Rep::null();
-    else {
-        for (size_t i = 0; i < length; i++)
-            d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-        return UString::Rep::create(d, static_cast<int>(length));
-    }
 
+    for (size_t i = 0; i < length; i++)
+        d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
+    return result;
 }
 
 static inline PassRefPtr<UString::Rep> createRep(const char* c, int length)
@@ -584,12 +188,13 @@ static inline PassRefPtr<UString::Rep> createRep(const char* c, int length)
         return &UString::Rep::empty();
 
     UChar* d;
-    if (!allocChars(length).getValue(d))
+    PassRefPtr<UStringImpl> result = UStringImpl::createUninitialized(length, d);
+    if (!result)
         return &UString::Rep::null();
 
     for (int i = 0; i < length; i++)
         d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
-    return UString::Rep::create(d, length);
+    return result;
 }
 
 UString::UString(const char* c)
@@ -610,14 +215,6 @@ UString::UString(const UChar* c, int length)
         m_rep = Rep::createCopying(c, length);
 }
 
-UString::UString(const Vector<UChar>& buffer)
-{
-    if (!buffer.size())
-        m_rep = &Rep::empty();
-    else
-        m_rep = Rep::createCopying(buffer.data(), buffer.size());
-}
-
 UString UString::createNonCopying(UChar* c, int length)
 {
     if (length == 0)
@@ -628,312 +225,29 @@ UString UString::createNonCopying(UChar* c, int length)
 
 UString UString::createFromUTF8(const char* string)
 {
-    return Rep::createFromUTF8(string);
-}
-
-static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
-{
-    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
-
-    const int plusLength = plusOne ? 1 : 0;
-    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
-        CRASH();
-
-    return currentCapacity + extendLength + plusLength;
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (tSize == 0) {
-        // t is empty
-    } else if (thisSize == 0) {
-        // this is empty
-        rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
-            rep = &UString::Rep::null();
-        if (rep->data()) {
-            copyChars(rep->data() + thisSize, tData, tSize);
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            copyChars(d + thisSize, tData, tSize);
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    rep->checkConsistency();
-
-    return rep.release();
-}
-
-static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const char* t)
-{
-    RefPtr<UString::Rep> rep = r;
-
-    rep->checkConsistency();
-
-    int thisSize = rep->size();
-    int thisOffset = rep->offset;
-    int tSize = static_cast<int>(strlen(t));
-    int length = thisSize + tSize;
-    UString::BaseString* base = rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        rep = createRep(t);
-    } else if (tSize == 0) {
-        // t is empty, we'll just return *this below.
-    } else if (rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep->len = length;
-            rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
-        UChar* d = rep->data();
-        if (d) {
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            rep = &UString::Rep::null();
-        else {
-            copyChars(d, rep->data(), thisSize);
-            for (int i = 0; i < tSize; ++i)
-                d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
-            rep = UString::Rep::create(d, length);
-            rep->baseString()->capacity = newCapacity;
-        }
-    }
+    if (!string)
+        return null();
 
-    rep->checkConsistency();
+    size_t length = strlen(string);
+    Vector<UChar, 1024> buffer(length);
+    UChar* p = buffer.data();
+    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
+        return null();
 
-    return rep.release();
+    return UString(buffer.data(), p - buffer.data());
 }
 
-PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
+UString UString::createUninitialized(unsigned length, UChar*& output)
 {
-    a->checkConsistency();
-    b->checkConsistency();
-
-    int aSize = a->size();
-    int bSize = b->size();
-    int aOffset = a->offset;
-
-    // possible cases:
-
-    UString::BaseString* aBase = a->baseString();
-    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
-        // b is a single character (common fast case)
-        ++aBase->usedCapacity;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, aSize + 1);
-    }
-
-    // a is empty
-    if (aSize == 0)
-        return b;
-    // b is empty
-    if (bSize == 0)
-        return a;
-
-    int bOffset = b->offset;
-    int length = aSize + bSize;
-
-    UString::BaseString* bBase = b->baseString();
-    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
-        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
-        // - a reaches the end of its buffer so it qualifies for shared append
-        // - also, it's at least a quarter the length of b - appending to a much shorter
-        //   string does more harm than good
-        // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
-        
-        UString x(a);
-        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
-        if (!a->data() || !x.data())
-            return 0;
-        copyChars(a->data() + aSize, b->data(), bSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(a, 0, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
-        return result;
+    if (!length) {
+        output = &sharedEmptyChar;
+        return UString(&Rep::empty());
     }
 
-    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
-        // - b reaches the beginning of its buffer so it qualifies for shared prepend
-        // - also, it's at least a quarter the length of a - prepending to a much shorter
-        //   string does more harm than good
-        UString y(b);
-        y.expandPreCapacity(-bOffset + aSize);
-        if (!b->data() || !y.data())
-            return 0;
-        copyChars(b->data() - aSize, a->data(), aSize);
-        PassRefPtr<UString::Rep> result = UString::Rep::create(b, -aSize, length);
-
-        a->checkConsistency();
-        b->checkConsistency();
-        result->checkConsistency();
-
+    if (PassRefPtr<UStringImpl> result = UStringImpl::createUninitialized(length, output))
         return result;
-    }
-
-    // a does not qualify for append, and b does not qualify for prepend, gotta make a whole new string
-    size_t newCapacity = expandedSize(length, 0);
-    UChar* d;
-    if (!allocChars(newCapacity).getValue(d))
-        return 0;
-    copyChars(d, a->data(), aSize);
-    copyChars(d + aSize, b->data(), bSize);
-    PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->baseString()->capacity = newCapacity;
-
-    a->checkConsistency();
-    b->checkConsistency();
-    result->checkConsistency();
-
-    return result;
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, int i)
-{
-    UChar buf[1 + sizeof(i) * 3];
-    UChar* end = buf + sizeof(buf) / sizeof(UChar);
-    UChar* p = end;
-  
-    if (i == 0)
-        *--p = '0';
-    else if (i == INT_MIN) {
-        char minBuf[1 + sizeof(i) * 3];
-        sprintf(minBuf, "%d", INT_MIN);
-        return concatenate(rep, minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return concatenate(rep, p, static_cast<int>(end - p));
-
-}
-
-PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
-{
-    // avoid ever printing -NaN, in JS conceptually there is only one NaN value
-    if (isnan(d))
-        return concatenate(rep, "NaN");
-
-    if (d == 0.0) // stringify -0 as 0
-        d = 0.0;
-
-    char buf[80];
-    int decimalPoint;
-    int sign;
-
-    char result[80];
-    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
-    int length = static_cast<int>(strlen(result));
-  
-    int i = 0;
-    if (sign)
-        buf[i++] = '-';
-  
-    if (decimalPoint <= 0 && decimalPoint > -6) {
-        buf[i++] = '0';
-        buf[i++] = '.';
-        for (int j = decimalPoint; j < 0; j++)
-            buf[i++] = '0';
-        strcpy(buf + i, result);
-    } else if (decimalPoint <= 21 && decimalPoint > 0) {
-        if (length <= decimalPoint) {
-            strcpy(buf + i, result);
-            i += length;
-            for (int j = 0; j < decimalPoint - length; j++)
-                buf[i++] = '0';
-            buf[i] = '\0';
-        } else {
-            strncpy(buf + i, result, decimalPoint);
-            i += decimalPoint;
-            buf[i++] = '.';
-            strcpy(buf + i, result + decimalPoint);
-        }
-    } else if (result[0] < '0' || result[0] > '9')
-        strcpy(buf + i, result);
-    else {
-        buf[i++] = result[0];
-        if (length > 1) {
-            buf[i++] = '.';
-            strcpy(buf + i, result + 1);
-            i += length - 1;
-        }
-        
-        buf[i++] = 'e';
-        buf[i++] = (decimalPoint >= 0) ? '+' : '-';
-        // decimalPoint can't be more than 3 digits decimal given the
-        // nature of float representation
-        int exponential = decimalPoint - 1;
-        if (exponential < 0)
-            exponential = -exponential;
-        if (exponential >= 100)
-            buf[i++] = static_cast<char>('0' + exponential / 100);
-        if (exponential >= 10)
-            buf[i++] = static_cast<char>('0' + (exponential % 100) / 10);
-        buf[i++] = static_cast<char>('0' + exponential % 10);
-        buf[i++] = '\0';
-    }
-    
-    return concatenate(rep, buf);
+    output = 0;
+    return UString();
 }
 
 UString UString::from(int i)
@@ -1076,18 +390,18 @@ UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, in
         return "";
 
     UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
+    if (!UStringImpl::allocChars(totalLength).getValue(buffer))
         return null();
 
     int maxCount = max(rangeCount, separatorCount);
     int bufferPos = 0;
     for (int i = 0; i < maxCount; i++) {
         if (i < rangeCount) {
-            copyChars(buffer + bufferPos, data() + substringRanges[i].position, substringRanges[i].length);
+            UStringImpl::copyChars(buffer + bufferPos, data() + substringRanges[i].position, substringRanges[i].length);
             bufferPos += substringRanges[i].length;
         }
         if (i < separatorCount) {
-            copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
+            UStringImpl::copyChars(buffer + bufferPos, separators[i].data(), separators[i].size());
             bufferPos += separators[i].size();
         }
     }
@@ -1105,138 +419,17 @@ UString UString::replaceRange(int rangeStart, int rangeLength, const UString& re
         return "";
 
     UChar* buffer;
-    if (!allocChars(totalLength).getValue(buffer))
+    if (!UStringImpl::allocChars(totalLength).getValue(buffer))
         return null();
 
-    copyChars(buffer, data(), rangeStart);
-    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    UStringImpl::copyChars(buffer, data(), rangeStart);
+    UStringImpl::copyChars(buffer + rangeStart, replacement.data(), replacementLength);
     int rangeEnd = rangeStart + rangeLength;
-    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
+    UStringImpl::copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
 
     return UString::Rep::create(buffer, totalLength);
 }
 
-
-UString& UString::append(const UString &t)
-{
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    int thisSize = size();
-    int thisOffset = m_rep->offset;
-    int tSize = t.size();
-    int length = thisSize + tSize;
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (thisSize == 0) {
-        // this is empty
-        *this = t;
-    } else if (tSize == 0) {
-        // t is empty
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep->len = length;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
-        if (data()) {
-            copyChars(m_rep->data() + thisSize, t.data(), tSize);
-            m_rep = Rep::create(m_rep, 0, length);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), thisSize);
-            copyChars(d + thisSize, t.data(), tSize);
-            m_rep = Rep::create(d, length);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-    t.rep()->checkConsistency();
-
-    return *this;
-}
-
-UString& UString::append(const UChar* tData, int tSize)
-{
-    m_rep = concatenate(m_rep.release(), tData, tSize);
-    return *this;
-}
-
-UString& UString::append(const char* t)
-{
-    m_rep = concatenate(m_rep.release(), t);
-    return *this;
-}
-
-UString& UString::append(UChar c)
-{
-    m_rep->checkConsistency();
-
-    int thisOffset = m_rep->offset;
-    int length = size();
-    BaseString* base = m_rep->baseString();
-
-    // possible cases:
-    if (length == 0) {
-        // this is empty - must make a new m_rep because we don't want to pollute the shared empty one 
-        size_t newCapacity = expandedSize(1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            d[0] = c;
-            m_rep = Rep::create(d, 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    } else if (m_rep == base && !base->isShared()) {
-        // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep->len = length + 1;
-            m_rep->_hash = 0;
-        }
-    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
-        // this reaches the end of the string - extend it and share
-        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
-        UChar* d = m_rep->data();
-        if (d) {
-            d[length] = c;
-            m_rep = Rep::create(m_rep, 0, length + 1);
-        }
-    } else {
-        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
-        size_t newCapacity = expandedSize(length + 1, 0);
-        UChar* d;
-        if (!allocChars(newCapacity).getValue(d))
-            makeNull();
-        else {
-            copyChars(d, data(), length);
-            d[length] = c;
-            m_rep = Rep::create(d, length + 1);
-            m_rep->baseString()->capacity = newCapacity;
-        }
-    }
-
-    m_rep->checkConsistency();
-
-    return *this;
-}
-
 bool UString::getCString(CStringBuffer& buffer) const
 {
     int length = size();
@@ -1262,13 +455,15 @@ bool UString::getCString(CStringBuffer& buffer) const
 
 char* UString::ascii() const
 {
+    static char* asciiBuffer = 0;
+
     int length = size();
     int neededSize = length + 1;
-    delete[] statBuffer;
-    statBuffer = new char[neededSize];
+    delete[] asciiBuffer;
+    asciiBuffer = new char[neededSize];
 
     const UChar* p = data();
-    char* q = statBuffer;
+    char* q = asciiBuffer;
     const UChar* limit = p + length;
     while (p != limit) {
         *q = static_cast<char>(p[0]);
@@ -1277,7 +472,7 @@ char* UString::ascii() const
     }
     *q = '\0';
 
-    return statBuffer;
+    return asciiBuffer;
 }
 
 UString& UString::operator=(const char* c)
@@ -1294,20 +489,13 @@ UString& UString::operator=(const char* c)
 
     int l = static_cast<int>(strlen(c));
     UChar* d;
-    BaseString* base = m_rep->baseString();
-    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
-        d = base->buf;
-        m_rep->_hash = 0;
-        m_rep->len = l;
-    } else {
-        if (!allocChars(l).getValue(d)) {
-            makeNull();
-            return *this;
-        }
-        m_rep = Rep::create(d, l);
+    if (!UStringImpl::allocChars(l).getValue(d)) {
+        makeNull();
+        return *this;
     }
     for (int i = 0; i < l; i++)
         d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
+    m_rep = Rep::create(d, l);
 
     return *this;
 }
@@ -1465,7 +653,7 @@ uint32_t UString::toStrictUInt32(bool* ok) const
         *ok = false;
 
     // Empty string is not OK.
-    int len = m_rep->len;
+    int len = m_rep->size();
     if (len == 0)
         return 0;
     const UChar* p = m_rep->data();
@@ -1692,8 +880,8 @@ int compare(const UString& s1, const UString& s2)
 
 bool equal(const UString::Rep* r, const UString::Rep* b)
 {
-    int length = r->len;
-    if (length != b->len)
+    int length = r->size();
+    if (length != b->size())
         return false;
     const UChar* d = r->data();
     const UChar* s = b->data();
diff --git a/JavaScriptCore/runtime/UString.h b/JavaScriptCore/runtime/UString.h
index 016a21d..0f63c36 100644
--- a/JavaScriptCore/runtime/UString.h
+++ b/JavaScriptCore/runtime/UString.h
@@ -24,6 +24,7 @@
 #define UString_h
 
 #include "Collector.h"
+#include "UStringImpl.h"
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
@@ -40,8 +41,6 @@ namespace JSC {
     using WTF::PlacementNewAdoptType;
     using WTF::PlacementNewAdopt;
 
-    class IdentifierTable;
-  
     class CString {
     public:
         CString()
@@ -71,174 +70,20 @@ namespace JSC {
         char* m_data;
     };
 
+    bool operator==(const CString&, const CString&);
+
     typedef Vector<char, 32> CStringBuffer;
 
     class UString {
         friend class JIT;
 
     public:
-        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
-        struct BaseString;
-        struct Rep : Noncopyable {
-            friend class JIT;
-
-            static PassRefPtr<Rep> create(UChar* buffer, int length)
-            {
-                return adoptRef(new BaseString(buffer, length));
-            }
-
-            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
-            {
-                // Guard against integer overflow
-                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
-                    void* buf = 0;
-                    if (tryFastMalloc(size * sizeof(UChar)).getValue(buf))
-                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
-                }
-                return adoptRef(new BaseString(0, 0, 0));
-            }
-
-            static PassRefPtr<Rep> createCopying(const UChar*, int);
-            static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
-
-            // Constructs a string from a UTF-8 string, using strict conversion (see comments in UTF8.h).
-            // Returns UString::Rep::null for null input or conversion failure.
-            static PassRefPtr<Rep> createFromUTF8(const char*);
-
-            // Uses SharedUChar to have joint ownership over the UChar*.
-            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
-
-            SharedUChar* sharedBuffer();
-            void destroy();
-
-            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
-            UChar* data() const;
-            int size() const { return len; }
-
-            unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
-            unsigned computedHash() const { ASSERT(_hash); return _hash; } // fast path for Identifiers
-            void setHash(unsigned hash) { ASSERT(hash == computeHash(data(), len)); _hash = hash; } // fast path for Identifiers
-
-            static unsigned computeHash(const UChar*, int length);
-            static unsigned computeHash(const char*, int length);
-            static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
-
-            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
-
-            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
-            void setStatic(bool);
-            void setBaseString(PassRefPtr<BaseString>);
-            BaseString* baseString();
-            const BaseString* baseString() const;
-
-            Rep* ref() { ++rc; return this; }
-            ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
-
-            void checkConsistency() const;
-            enum UStringFlags {
-                StaticFlag,
-                BaseStringFlag
-            };
-
-            // unshared data
-            int offset;
-            int len;
-            int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
-            mutable unsigned _hash;
-            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
-
-            static BaseString& null() { return *nullBaseString; }
-            static BaseString& empty() { return *emptyBaseString; }
-
-            bool reserveCapacity(int capacity);
-
-        protected:
-            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
-            Rep(int length)
-                : offset(0)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(0)
-            {
-            }
-
-            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
-                : offset(offsetInBase)
-                , len(length)
-                , rc(1)
-                , _hash(0)
-                , m_baseString(base.releaseRef())
-            {
-                checkConsistency();
-            }
-
-            union {
-                // If !baseIsSelf()
-                BaseString* m_baseString;
-                // If baseIsSelf()
-                SharedUChar* m_sharedBuffer;
-            };
-
-        private:
-            // For SmallStringStorage which allocates an array and does initialization manually.
-            Rep() { }
-
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-            JS_EXPORTDATA static BaseString* nullBaseString;
-            JS_EXPORTDATA static BaseString* emptyBaseString;
-        };
-
-
-        struct BaseString : public Rep {
-            bool isShared() { return rc != 1 || isBufferReadOnly(); }
-            void setSharedBuffer(PassRefPtr<SharedUChar>);
-
-            bool isBufferReadOnly()
-            {
-                if (!m_sharedBuffer)
-                    return false;
-                return slowIsBufferReadOnly();
-            }
-
-            // potentially shared data.
-            UChar* buf;
-            int preCapacity;
-            int usedPreCapacity;
-            int capacity;
-            int usedCapacity;
-
-            size_t reportedCost;
-
-        private:
-            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
-                : Rep(length)
-                , buf(buffer)
-                , preCapacity(0)
-                , usedPreCapacity(0)
-                , capacity(length + additionalCapacity)
-                , usedCapacity(length)
-                , reportedCost(0)
-            {
-                m_identifierTableAndFlags.setFlag(BaseStringFlag);
-                checkConsistency();
-            }
-
-            SharedUChar* sharedBuffer();
-            bool slowIsBufferReadOnly();
-
-            friend struct Rep;
-            friend class SmallStringsStorage;
-            friend void initializeUString();
-        };
-
+        typedef UStringImpl Rep;
+    
     public:
+        // UString constructors passed char*s assume ISO Latin-1 encoding; for UTF8 use 'createFromUTF8', below.
         UString();
-        // Constructor for null-terminated ASCII string.
-        UString(const char*);
-        // Constructor for non-null-terminated ASCII string.
+        UString(const char*); // Constructor for null-terminated string.
         UString(const char*, int length);
         UString(const UChar*, int length);
         UString(const Vector<UChar>& buffer);
@@ -260,6 +105,7 @@ namespace JSC {
 
         static UString createNonCopying(UChar* c, int length);
         static UString createFromUTF8(const char*);
+        static UString createUninitialized(unsigned length, UChar*& output);
 
         static UString from(int);
         static UString from(long long);
@@ -287,12 +133,6 @@ namespace JSC {
 
         UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
 
-        UString& append(const UString&);
-        UString& append(const char*);
-        UString& append(UChar);
-        UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
-        UString& append(const UChar*, int size);
-
         bool getCString(CStringBuffer&) const;
 
         // NOTE: This method should only be used for *debugging* purposes as it
@@ -311,13 +151,10 @@ namespace JSC {
 
         UString& operator=(const char*c);
 
-        UString& operator+=(const UString& s) { return append(s); }
-        UString& operator+=(const char* s) { return append(s); }
-
         const UChar* data() const { return m_rep->data(); }
 
-        bool isNull() const { return (m_rep == &Rep::null()); }
-        bool isEmpty() const { return (!m_rep->len); }
+        bool isNull() const { return m_rep == &Rep::null(); }
+        bool isEmpty() const { return !m_rep->size(); }
 
         bool is8Bit() const;
 
@@ -353,22 +190,9 @@ namespace JSC {
             ASSERT(m_rep);
         }
 
-        size_t cost() const;
-
-        // Attempt to grow this string such that it can grow to a total length of 'capacity'
-        // without reallocation.  This may fail a number of reasons - if the BasicString is
-        // shared and another string is using part of the capacity beyond our end point, if
-        // the realloc fails, or if this string is empty and has no storage.
-        //
-        // This method returns a boolean indicating success.
-        bool reserveCapacity(int capacity)
-        {
-            return m_rep->reserveCapacity(capacity);
-        }
+        size_t cost() const { return m_rep->cost(); }
 
     private:
-        void expandCapacity(int requiredLength);
-        void expandPreCapacity(int requiredPreCap);
         void makeNull();
 
         RefPtr<Rep> m_rep;
@@ -376,11 +200,7 @@ namespace JSC {
 
         friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
-        friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, UString::Rep*);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
-    PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
     inline bool operator==(const UString& s1, const UString& s2)
     {
@@ -428,72 +248,8 @@ namespace JSC {
         return !JSC::operator==(s1, s2);
     }
 
-    bool operator==(const CString&, const CString&);
-
-    inline UString operator+(const UString& s1, const UString& s2)
-    {
-        RefPtr<UString::Rep> result = concatenate(s1.rep(), s2.rep());
-        return UString(result ? result.release() : UString::nullRep());
-    }
-
     int compare(const UString&, const UString&);
 
-    bool equal(const UString::Rep*, const UString::Rep*);
-
-    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
-    {
-        ASSERT(rep);
-        rep->checkConsistency();
-
-        int repOffset = rep->offset;
-
-        PassRefPtr<BaseString> base = rep->baseString();
-
-        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
-        ASSERT(offset + repOffset + length <= base->usedCapacity);
-
-        // Steal the single reference this Rep was created with.
-        return adoptRef(new Rep(base, repOffset + offset, length));
-    }
-
-    inline UChar* UString::Rep::data() const
-    {
-        const BaseString* base = baseString();
-        return base->buf + base->preCapacity + offset;
-    }
-
-    inline void UString::Rep::setStatic(bool v)
-    {
-        ASSERT(!identifierTable());
-        if (v)
-            m_identifierTableAndFlags.setFlag(StaticFlag);
-        else
-            m_identifierTableAndFlags.clearFlag(StaticFlag);
-    }
-
-    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
-    {
-        ASSERT(base != this);
-        ASSERT(!baseIsSelf());
-        m_baseString = base.releaseRef();
-    }
-
-    inline UString::BaseString* UString::Rep::baseString()
-    {
-        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
-    }
-
-    inline const UString::BaseString* UString::Rep::baseString() const
-    {
-        return const_cast<Rep*>(this)->baseString();
-    }
-
-#ifdef NDEBUG
-    inline void UString::Rep::checkConsistency() const
-    {
-    }
-#endif
-
     inline UString::UString()
         : m_rep(&Rep::null())
     {
@@ -516,23 +272,6 @@ namespace JSC {
     // fix UString sizes to be size_t instead of int
     static const int minShareSize = Heap::minExtraCost / sizeof(UChar);
 
-    inline size_t UString::cost() const
-    {
-        BaseString* base = m_rep->baseString();
-        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
-        size_t reportedCost = base->reportedCost;
-        ASSERT(capacity >= reportedCost);
-
-        size_t capacityDelta = capacity - reportedCost;
-
-        if (capacityDelta < static_cast<size_t>(minShareSize))
-            return 0;
-
-        base->reportedCost = capacity;
-
-        return capacityDelta;
-    }
-
     struct IdentifierRepHash : PtrHash<RefPtr<JSC::UString::Rep> > {
         static unsigned hash(const RefPtr<JSC::UString::Rep>& key) { return key->computedHash(); }
         static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
@@ -618,7 +357,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -626,7 +366,7 @@ namespace JSC {
         result += adapter1.length();
         adapter2.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3>
@@ -638,7 +378,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -648,7 +389,7 @@ namespace JSC {
         result += adapter2.length();
         adapter3.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
@@ -661,7 +402,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length() + adapter4.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -673,7 +415,7 @@ namespace JSC {
         result += adapter3.length();
         adapter4.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
@@ -687,7 +429,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length() + adapter4.length() + adapter5.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -701,7 +444,7 @@ namespace JSC {
         result += adapter4.length();
         adapter5.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
@@ -716,7 +459,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length() + adapter4.length() + adapter5.length() + adapter6.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -732,7 +476,7 @@ namespace JSC {
         result += adapter5.length();
         adapter6.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
@@ -748,7 +492,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length() + adapter4.length() + adapter5.length() + adapter6.length() + adapter7.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -766,7 +511,7 @@ namespace JSC {
         result += adapter6.length();
         adapter7.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
     template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
@@ -783,7 +528,8 @@ namespace JSC {
 
         UChar* buffer;
         unsigned length = adapter1.length() + adapter2.length() + adapter3.length() + adapter4.length() + adapter5.length() + adapter6.length() + adapter7.length() + adapter8.length();
-        if (!tryFastMalloc(length * sizeof(UChar)).getValue(buffer))
+        UString resultString = UString::createUninitialized(length, buffer);
+        if (!buffer)
             return UString();
 
         UChar* result = buffer;
@@ -803,7 +549,7 @@ namespace JSC {
         result += adapter7.length();
         adapter8.writeTo(result);
 
-        return UString::createNonCopying(buffer, length);
+        return resultString;
     }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/UStringImpl.cpp b/JavaScriptCore/runtime/UStringImpl.cpp
new file mode 100644
index 0000000..6724747
--- /dev/null
+++ b/JavaScriptCore/runtime/UStringImpl.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UStringImpl.h"
+
+#include "Identifier.h"
+#include "UString.h"
+#include "UTF8.h"
+
+using namespace WTF::Unicode;
+using namespace std;
+
+namespace JSC {
+ 
+SharedUChar* UStringImpl::baseSharedBuffer()
+{
+    ASSERT((bufferOwnership() == BufferShared)
+        || ((bufferOwnership() == BufferOwned) && !m_dataBuffer.asPtr<void*>()));
+
+    if (bufferOwnership() != BufferShared)
+        m_dataBuffer = UntypedPtrAndBitfield(SharedUChar::create(new OwnFastMallocPtr<UChar>(m_data)).releaseRef(), BufferShared);
+
+    return m_dataBuffer.asPtr<SharedUChar*>();
+}
+
+SharedUChar* UStringImpl::sharedBuffer()
+{
+    if (m_length < s_minLengthToShare)
+        return 0;
+    ASSERT(!isStatic());
+
+    UStringImpl* owner = bufferOwnerString();
+    if (owner->bufferOwnership() == BufferInternal)
+        return 0;
+
+    return owner->baseSharedBuffer();
+}
+
+void UStringImpl::destroy()
+{
+    ASSERT(!isStatic());
+    checkConsistency();
+
+    if (identifierTable())
+        Identifier::remove(this);
+
+    if (bufferOwnership() != BufferInternal) {
+        if (bufferOwnership() == BufferOwned)
+            fastFree(m_data);
+        else if (bufferOwnership() == BufferSubstring)
+            m_dataBuffer.asPtr<UStringImpl*>()->deref();
+        else {
+            ASSERT(bufferOwnership() == BufferShared);
+            m_dataBuffer.asPtr<SharedUChar*>()->deref();
+        }
+    }
+
+    delete this;
+}
+
+// Golden ratio - arbitrary start value to avoid mapping all 0's to all 0's
+// or anything like that.
+const unsigned PHI = 0x9e3779b9U;
+
+// Paul Hsieh's SuperFastHash
+// http://www.azillionmonkeys.com/qed/hash.html
+unsigned UStringImpl::computeHash(const UChar* s, int len)
+{
+    unsigned l = len;
+    uint32_t hash = PHI;
+    uint32_t tmp;
+
+    int rem = l & 1;
+    l >>= 1;
+
+    // Main loop
+    for (; l > 0; l--) {
+        hash += s[0];
+        tmp = (s[1] << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        s += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += s[0];
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x80000000;
+
+    return hash;
+}
+
+// Paul Hsieh's SuperFastHash
+// http://www.azillionmonkeys.com/qed/hash.html
+unsigned UStringImpl::computeHash(const char* s, int l)
+{
+    // This hash is designed to work on 16-bit chunks at a time. But since the normal case
+    // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
+    // were 16-bit chunks, which should give matching results
+
+    uint32_t hash = PHI;
+    uint32_t tmp;
+
+    size_t rem = l & 1;
+    l >>= 1;
+
+    // Main loop
+    for (; l > 0; l--) {
+        hash += static_cast<unsigned char>(s[0]);
+        tmp = (static_cast<unsigned char>(s[1]) << 11) ^ hash;
+        hash = (hash << 16) ^ tmp;
+        s += 2;
+        hash += hash >> 11;
+    }
+
+    // Handle end case
+    if (rem) {
+        hash += static_cast<unsigned char>(s[0]);
+        hash ^= hash << 11;
+        hash += hash >> 17;
+    }
+
+    // Force "avalanching" of final 127 bits
+    hash ^= hash << 3;
+    hash += hash >> 5;
+    hash ^= hash << 2;
+    hash += hash >> 15;
+    hash ^= hash << 10;
+
+    // this avoids ever returning a hash code of 0, since that is used to
+    // signal "hash not computed yet", using a value that is likely to be
+    // effectively the same as 0 when the low bits are masked
+    if (hash == 0)
+        hash = 0x80000000;
+
+    return hash;
+}
+
+}
diff --git a/JavaScriptCore/runtime/UStringImpl.h b/JavaScriptCore/runtime/UStringImpl.h
new file mode 100644
index 0000000..569fd70
--- /dev/null
+++ b/JavaScriptCore/runtime/UStringImpl.h
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef UStringImpl_h
+#define UStringImpl_h
+
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
+#include <wtf/PossiblyNull.h>
+#include <wtf/unicode/Unicode.h>
+#include <limits>
+
+namespace JSC {
+
+class IdentifierTable;
+  
+typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+
+class UntypedPtrAndBitfield {
+public:
+    UntypedPtrAndBitfield() {}
+
+    UntypedPtrAndBitfield(void* ptrValue, uintptr_t bitValue)
+        : m_value(reinterpret_cast<uintptr_t>(ptrValue) | bitValue)
+    {
+        ASSERT(ptrValue == asPtr<void*>());
+        ASSERT((*this & ~s_alignmentMask) == bitValue);
+    }
+
+    template<typename T>
+    T asPtr() const { return reinterpret_cast<T>(m_value & s_alignmentMask); }
+
+    UntypedPtrAndBitfield& operator&=(uintptr_t bits)
+    {
+        m_value &= bits | s_alignmentMask;
+        return *this;
+    }
+
+    UntypedPtrAndBitfield& operator|=(uintptr_t bits)
+    {
+        m_value |= bits & ~s_alignmentMask;
+        return *this;
+    }
+
+    uintptr_t operator&(uintptr_t mask) const
+    {
+        return m_value & mask & ~s_alignmentMask;
+    }
+
+private:
+    static const uintptr_t s_alignmentMask = ~0x7;
+    uintptr_t m_value;
+};
+
+class UStringImpl : Noncopyable {
+public:
+    static PassRefPtr<UStringImpl> create(UChar* buffer, int length)
+    {
+        return adoptRef(new UStringImpl(buffer, length, BufferOwned));
+    }
+
+    static PassRefPtr<UStringImpl> createCopying(const UChar* buffer, int length)
+    {
+        UChar* newBuffer;
+        if (!UStringImpl::allocChars(length).getValue(newBuffer))
+            return &null();
+        copyChars(newBuffer, buffer, length);
+        return adoptRef(new UStringImpl(newBuffer, length, BufferOwned));
+    }
+
+    static PassRefPtr<UStringImpl> create(PassRefPtr<UStringImpl> rep, int offset, int length)
+    {
+        ASSERT(rep);
+        rep->checkConsistency();
+        return adoptRef(new UStringImpl(rep->m_data + offset, length, rep->bufferOwnerString()));
+    }
+
+    static PassRefPtr<UStringImpl> create(PassRefPtr<SharedUChar> sharedBuffer, UChar* buffer, int length)
+    {
+        return adoptRef(new UStringImpl(buffer, length, sharedBuffer));
+    }
+
+    static PassRefPtr<UStringImpl> createUninitialized(unsigned length, UChar*& output)
+    {
+        ASSERT(length);
+        if (length > ((std::numeric_limits<size_t>::max() - sizeof(UStringImpl)) / sizeof(UChar)))
+            return 0;
+
+        UStringImpl* resultImpl;
+        if (!tryFastMalloc(sizeof(UChar) * length + sizeof(UStringImpl)).getValue(resultImpl))
+            return 0;
+
+        output = reinterpret_cast<UChar*>(resultImpl + 1);
+        return adoptRef(new(resultImpl) UStringImpl(output, length, BufferInternal));
+    }
+
+    SharedUChar* sharedBuffer();
+    UChar* data() const { return m_data; }
+    int size() const { return m_length; }
+    size_t cost()
+    {
+        UStringImpl* base = bufferOwnerString();
+        if (m_dataBuffer & s_reportedCostBit)
+            return 0;
+        m_dataBuffer |= s_reportedCostBit;
+        return base->m_length;
+    }
+    unsigned hash() const { if (!m_hash) m_hash = computeHash(data(), m_length); return m_hash; }
+    unsigned computedHash() const { ASSERT(m_hash); return m_hash; } // fast path for Identifiers
+    void setHash(unsigned hash) { ASSERT(hash == computeHash(data(), m_length)); m_hash = hash; } // fast path for Identifiers
+    IdentifierTable* identifierTable() const { return m_identifierTable; }
+    void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTable = table; }
+
+    UStringImpl* ref() { m_refCount += s_refCountIncrement; return this; }
+    ALWAYS_INLINE void deref() { if (!(m_refCount -= s_refCountIncrement)) destroy(); }
+
+    static WTF::PossiblyNull<UChar*> allocChars(size_t length)
+    {
+        ASSERT(length);
+        if (length > std::numeric_limits<size_t>::max() / sizeof(UChar))
+            return 0;
+        return tryFastMalloc(sizeof(UChar) * length);
+    }
+
+    static void copyChars(UChar* destination, const UChar* source, unsigned numCharacters)
+    {
+        if (numCharacters <= s_copyCharsInlineCutOff) {
+            for (unsigned i = 0; i < numCharacters; ++i)
+                destination[i] = source[i];
+        } else
+            memcpy(destination, source, numCharacters * sizeof(UChar));
+    }
+
+    static unsigned computeHash(const UChar*, int length);
+    static unsigned computeHash(const char*, int length);
+    static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
+
+    static UStringImpl& null() { return *s_null; }
+    static UStringImpl& empty() { return *s_empty; }
+
+    ALWAYS_INLINE void checkConsistency() const
+    {
+        // There is no recursion of substrings.
+        ASSERT(bufferOwnerString()->bufferOwnership() != BufferSubstring);
+        // Static strings cannot be put in identifier tables, because they are globally shared.
+        ASSERT(!isStatic() || !identifierTable());
+    }
+
+private:
+    enum BufferOwnership {
+        BufferInternal,
+        BufferOwned,
+        BufferSubstring,
+        BufferShared,
+    };
+
+    // For SmallStringStorage, which allocates an array and uses an in-place new.
+    UStringImpl() { }
+
+    // Used to construct normal strings with an internal or external buffer.
+    UStringImpl(UChar* data, int length, BufferOwnership ownership)
+        : m_data(data)
+        , m_length(length)
+        , m_refCount(s_refCountIncrement)
+        , m_hash(0)
+        , m_identifierTable(0)
+        , m_dataBuffer(0, ownership)
+    {
+        ASSERT((ownership == BufferInternal) || (ownership == BufferOwned));
+        checkConsistency();
+    }
+
+    // Used to construct static strings, which have an special refCount that can never hit zero.
+    // This means that the static string will never be destroyed, which is important because
+    // static strings will be shared across threads & ref-counted in a non-threadsafe manner.
+    enum StaticStringConstructType { ConstructStaticString };
+    UStringImpl(UChar* data, int length, StaticStringConstructType)
+        : m_data(data)
+        , m_length(length)
+        , m_refCount(s_staticRefCountInitialValue)
+        , m_hash(0)
+        , m_identifierTable(0)
+        , m_dataBuffer(0, BufferOwned)
+    {
+        checkConsistency();
+    }
+
+    // Used to create new strings that are a substring of an existing string.
+    UStringImpl(UChar* data, int length, PassRefPtr<UStringImpl> base)
+        : m_data(data)
+        , m_length(length)
+        , m_refCount(s_refCountIncrement)
+        , m_hash(0)
+        , m_identifierTable(0)
+        , m_dataBuffer(base.releaseRef(), BufferSubstring)
+    {
+        checkConsistency();
+    }
+
+    // Used to construct new strings sharing an existing shared buffer.
+    UStringImpl(UChar* data, int length, PassRefPtr<SharedUChar> sharedBuffer)
+        : m_data(data)
+        , m_length(length)
+        , m_refCount(s_refCountIncrement)
+        , m_hash(0)
+        , m_identifierTable(0)
+        , m_dataBuffer(sharedBuffer.releaseRef(), BufferShared)
+    {
+        checkConsistency();
+    }
+
+    void* operator new(size_t size) { return fastMalloc(size); }
+    void* operator new(size_t, void* inPlace) { return inPlace; }
+
+    // This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+    static const int s_minLengthToShare = 10;
+    static const unsigned s_copyCharsInlineCutOff = 20;
+    static const uintptr_t s_bufferOwnershipMask = 3;
+    static const uintptr_t s_reportedCostBit = 4;
+    // We initialize and increment/decrement the refCount for all normal (non-static) strings by the value 2.
+    // We initialize static strings with an odd number (specifically, 1), such that the refCount cannot reach zero.
+    static const int s_refCountIncrement = 2;
+    static const int s_staticRefCountInitialValue = 1;
+
+    void destroy();
+    UStringImpl* bufferOwnerString() { return (bufferOwnership() == BufferSubstring) ? m_dataBuffer.asPtr<UStringImpl*>() :  this; }
+    const UStringImpl* bufferOwnerString() const { return (bufferOwnership() == BufferSubstring) ? m_dataBuffer.asPtr<UStringImpl*>() :  this; }
+    SharedUChar* baseSharedBuffer();
+    unsigned bufferOwnership() const { return m_dataBuffer & s_bufferOwnershipMask; }
+    bool isStatic() const { return m_refCount & 1; }
+
+    // unshared data
+    UChar* m_data;
+    int m_length;
+    unsigned m_refCount;
+    mutable unsigned m_hash;
+    IdentifierTable* m_identifierTable;
+    UntypedPtrAndBitfield m_dataBuffer;
+
+    JS_EXPORTDATA static UStringImpl* s_null;
+    JS_EXPORTDATA static UStringImpl* s_empty;
+
+    friend class JIT;
+    friend class SmallStringsStorage;
+    friend void initializeUString();
+};
+
+bool equal(const UStringImpl*, const UStringImpl*);
+
+}
+
+#endif
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index be59d4b..669cd5e 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,13 @@
+2009-12-21  Gavin Barraclough  <barraclough at apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+            - add forwarding header.
+
 2009-12-16  Mark Rowe  <mrowe at apple.com>
 
         Build fix.  Disable debug variants of WebKit frameworks.
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/PossiblyNull.h b/JavaScriptGlue/ForwardingHeaders/wtf/PossiblyNull.h
new file mode 100644
index 0000000..af7c120
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/PossiblyNull.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/PossiblyNull.h>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 4545ba8..1e383f6 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2009-12-21  Gavin Barraclough  <barraclough at apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+        * ForwardingHeaders/runtime/UStringImpl.h: Added.
+            - add forwarding header.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring):
+            - order of arguments to UString::Rep constructor for shared strings changed.
+
 2009-12-18  Nate Chapin  <japhet at chromium.org>
 
         Reviewed by Adam barth.
diff --git a/WebCore/ForwardingHeaders/runtime/UStringImpl.h b/WebCore/ForwardingHeaders/runtime/UStringImpl.h
new file mode 100644
index 0000000..94167a4
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/UStringImpl.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_UStringImpl_h
+#define WebCore_FWD_UStringImpl_h
+#include <JavaScriptCore/UStringImpl.h>
+#endif
diff --git a/WebCore/platform/text/StringImpl.cpp b/WebCore/platform/text/StringImpl.cpp
index cec8398..3b61a0b 100644
--- a/WebCore/platform/text/StringImpl.cpp
+++ b/WebCore/platform/text/StringImpl.cpp
@@ -980,7 +980,7 @@ JSC::UString StringImpl::ustring()
 {
     SharedUChar* sharedBuffer = this->sharedBuffer();
     if (sharedBuffer)
-        return JSC::UString::Rep::create(const_cast<UChar*>(m_data), m_length, sharedBuffer);
+        return JSC::UString::Rep::create(sharedBuffer, const_cast<UChar*>(m_data), m_length);
 
     return JSC::UString(m_data, m_length);
 }

-- 
WebKit Debian packaging



More information about the Pkg-webkit-commits mailing list