Commit Graph

380 Commits

Author SHA1 Message Date
lrn@chromium.org
385e4deff5 Make the preparser standalone library and process build in debug mode.
It should now be possible to build the preparser using 'scons preparser' in both release and debug modes.
Remove v8.h include from scanner-base.h and other files.
Remove NativeAllocationChecker and all of its kind.
Moved Isolate::PreallocatedStorage* to isolate.cc

Review URL: http://codereview.chromium.org/6749029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7413 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-29 13:06:48 +00:00
vitalyr@chromium.org
1ae2ea08b9 Remove more TLS hurting Dromaeo DOM.
Patch by Dmitry Lomov.

Review URL: http://codereview.chromium.org/6745029


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7380 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-28 08:44:30 +00:00
ricow@chromium.org
fb6d7e17df Follow jsc on not throwing when trying to add a property to a non-extensible object.
This change makes us compatible with Safari on not throwing when trying to add a property to a non-extensible object. 
Review URL: http://codereview.chromium.org/6712059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-28 06:11:08 +00:00
ager@chromium.org
1bdc8031fa Introduce accessors on builtins instance and use them to avoid TLS access when getting builtins.
R=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/6717018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7327 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 13:40:07 +00:00
ager@chromium.org
4f5de28a9b Avoid TLS access for counters.
Get rid of the COUNTERS macro and fetch the counters from a locally
stored isolate instead.

R=karlklose@chromium.org

Review URL: http://codereview.chromium.org/6723014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 11:13:07 +00:00
danno@chromium.org
88854cd712 Remember and reuse derived map for external arrays
Ensure that all objects that had the same map before attaching an external array have the same map once the external array is attached.

BUG=75639
TEST=fast/canvas/webgl/uninitialized-test.html

Review URL: http://codereview.chromium.org/6685073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 09:57:12 +00:00
vitalyr@chromium.org
41c7632a41 Some Isolate usage cleanups in objects.{h,cc}.
Review URL: http://codereview.chromium.org/6723001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-22 19:15:02 +00:00
vitalyr@chromium.org
7976ca2cbc Merge isolates to bleeding_edge.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 20:35:07 +00:00
vitalyr@chromium.org
76e226f832 Revert r7268: it borked the history.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 19:41:05 +00:00
vitalyr@chromium.org
6ff7fdebd3 Merge isolates to bleeding_edge.
Review URL: http://codereview.chromium.org/6685088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 18:49:56 +00:00
mmaly@chromium.org
1d1018aec7 Strict mode ThrowTypeError functions for
- function.caller
- function.arguments

Review URL: http://codereview.chromium.org/6694044/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-17 20:28:17 +00:00
ager@chromium.org
6428822811 Revert "Strict mode ThrowTypeError functions for"
TBR=mmaly@chromium.org

Review URL: http://codereview.chromium.org/6696018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 11:01:21 +00:00
mmaly@chromium.org
80bd958df2 Strict mode ThrowTypeError functions for
- function.caller
- function.arguments

Review URL: http://codereview.chromium.org/6691003/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7168 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-14 17:46:37 +00:00
mikhail.naganov@gmail.com
dee9c00267 Add an interface for an embedder to provide information about native
objects retained by object groups and global handles.

This information is then used during heap snapshot generation
to provide a more complete memory picture.

This patch will be needed to fix https://bugs.webkit.org/show_bug.cgi?id=53659.

Review URL: http://codereview.chromium.org/6626043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-10 12:05:31 +00:00
danno@chromium.org
9cca7d2733 Combine typed and pixel arrays.
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.

Review URL: http://codereview.chromium.org/6546036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-09 15:01:16 +00:00
mmaly@chromium.org
9dc156ac62 Passing strict mode throughout SetElement.
Throw if assigning to read only element.
Adding tests for element assignment in strict mode.

Fix tests for strict mode SetElement.

Review URL: http://codereview.chromium.org/6613005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 00:21:52 +00:00
mmaly@chromium.org
30bd09cbd6 Renaming strict to strict_mode for uniformity.
Review URL: http://codereview.chromium.org/6611003/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 16:17:28 +00:00
lrn@chromium.org
4707d7ac08 Stop using plain Arrays internally in built-in functions.
In built-in code we use arrays for internal computations.
This makes it possible to affect the built-in code by putting getters
or setters on the Array prototype chain.
This adds a new internal Array constructor that creates Arrays with
a very simplistic prototype chain that doesn't include any publicly
visible objects. These Arrays shoudl ofcourse never leak outside the
builtins, since that would expose the prototype object.
The prototype object contains only the array functions that we use:
push, pop and join (and not even a toString, so it doesn't stringify
well).

Also change uses of .call to %_CallFunction.

BUG=1206

Review URL: http://codereview.chromium.org/6602081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 11:49:03 +00:00
lrn@chromium.org
8fddb2a664 Handled return-value of SetElement in some cases, or avoided it in other.
SetElement can cause an exception to be thrown. If its return value
isn't checked, this exception might not be handled at the correct time.
In some cases, it's a matter of returning Exception::Failure() from
a runtime function.
In other cases, code using SetElement on a JSArray has been changed
to setting directly on a FixedArray and only creating the JSArray
at the end.

Review URL: http://codereview.chromium.org/6588130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 10:16:22 +00:00
mmaly@chromium.org
1d040083b0 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 04:53:43 +00:00
mmaly@chromium.org
749b69853a Revert "Assignment to read only properties throws in strict mode."
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 01:42:37 +00:00
ager@chromium.org
a1cf6f2636 Fix assertion failure because of incorrect use of MaybeObjects.
Review URL: http://codereview.chromium.org/6599001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6950 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-25 12:56:46 +00:00
lrn@chromium.org
485f4ea0d9 Clear exceptions set during attempts to lazily optimize.
Resubmit of patch for issue 1145 with a few additions:
- Now also clears exceptions when calling Runtime_LazyRecompile.
- Sets function where parsing fails to not be optimizable.

BUG=v8:1145
TEST=test/mjsunit/regress/regress-1145.js

Review URL: http://codereview.chromium.org/6469050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-25 11:17:31 +00:00
ager@chromium.org
c2969bfb1a Implement pixel array elements access in the presence of an
interceptor that does not handle the elements load.

Review URL: http://codereview.chromium.org/6551001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-21 15:59:23 +00:00
ricow@chromium.org
95892799e1 Add access checks to Object.preventExtensions + add regression test for 1027.
Object.preventExtensions can currently be used cross-domain. With this
change we follow firefox (IE9 has our current behaviour). In addition
this includes a regression test for 1027 and access tests for
Object.seal and Object.freeze.


Review URL: http://codereview.chromium.org/6534019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 10:39:02 +00:00
ager@chromium.org
a0364d795d Handle indexed properties on value objects correctly.
As with named properties, search the value wrapper prototypes for properties.

Review URL: http://codereview.chromium.org/6526046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6810 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-16 12:10:48 +00:00
mmaly@chromium.org
9adaeb6a17 Strict mode delete of non-configurable property.
Strict mode flag is passed to runtime DELETE function
and then to JSObject::Delete(Property/Element) as STRICT_DELETION enum.
When deleting non-configurable property/eleemnt, TypeError is thrown.
Adding mozilla test to .gitignore.
Incorporate CR feedback.

Review URL: http://codereview.chromium.org/6515005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 23:41:47 +00:00
mmaly@chromium.org
e0be3072b5 Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-13 16:19:53 +00:00
mmaly@chromium.org
3f4701df7f Revert r6756. Check failed on V8 arm - debug - crankshaft.
Need to investigate.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 23:25:07 +00:00
mmaly@chromium.org
fd6338bdda Implement assignment to undefined reference in ES5 Strict Mode.
Strict mode assignment to undefined reference.
Simple assignments (x = <value>) use CODE_TARGET_CONTEXT.
StoreIC stores its own strictness in extra_ic_state.
The strcitness is propagated as further ic stubs are generated.

Details:
* ReferenceError on assignment to non-resolvable reference in strict mode.
* Fix es5conform test expectation file.
* Add es5conform test suite into .gitignore.
* Fix Xcode project.
* Change implemented in virtual frame code generator, as well as full-codegen
  for all architectures.
* Fix debugger test.
* Fix comment for CODE_TARGET_CONTEXT
* Implement remaining StoreIC stubs to be strict mode aware.
* Trace extra_ic_state() for ic code stubs.

Code Review URL: http://codereview.chromium.org/6474026/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 21:39:59 +00:00
vegorov@chromium.org
49adfd0f0a Bailout from PrepareSlowElementsForSort when hiting a key outside of smi-range.
BUG=v8:1131
TEST=test/mjsunit/regress/regress-1131.js

Review URL: http://codereview.chromium.org/6469006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6726 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 12:33:34 +00:00
antonm@chromium.org
0273e8185b Propagate exceptions thrown when setting elements.
Plus use more robust path when formatting messages---work
directly with fixed arrays.

BUG=v8:1107
TEST=test/mjsunit/getter-in-prototype.js,test/mjsunit/regress/regress-1107.js

Review URL: http://codereview.chromium.org/6451004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6689 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:42:14 +00:00
ricow@chromium.org
81787f986b Make sure that we never call prevent extension on the global proxy,
but instead call this on the global object.

BUG: 1103

Review URL: http://codereview.chromium.org/6454001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 12:41:16 +00:00
mmaly@chromium.org
87233c49c8 Pass strict mode to eval.
Code review feedback.

Code Review URL: http://codereview.chromium.org/6286043/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 18:15:49 +00:00
lrn@chromium.org
19b734fd82 Fix potential overwriting of debug jumps of following code.
Add JSArrayLength, CallKnownFunction, and InstanceType operations.
Remove LadGlobal and StoreGlobal again (they fail).

Review URL: http://codereview.chromium.org/6347067

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-04 14:09:03 +00:00
peterhal@chromium.org
c894b1f317 Fix bugs 992, 1083 and 1092
My previous patch added an assert which uncovered 1092 in the sputnik tests.
This patch adds the fix for 1092, which is to ensure that NormalizeProperties
does not get called for a JSGlobalProxy along all code paths.

Add sputnik tests to .gitignore.

BUG=
TEST=

Review URL: http://codereview.chromium.org/6286060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 19:29:10 +00:00
antonm@chromium.org
0da3dc3e43 Properly process getOwnPropertyDescriptor for elements on global proxy object.
We need to go down to actual global object to perform those operations.

Review URL: http://codereview.chromium.org/6246054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6612 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 10:19:41 +00:00
kmillikin@chromium.org
e4a4804546 Streamline the code for patching optimized code for lazy deopt.
Rewrite the lazy deopt patching code on IA32 to use addresses throughout,
rather than offsets and a base address.

Also, rename a couple of ambiguous Code fields from _start to _offset.

Review URL: http://codereview.chromium.org/6334083

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6611 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-03 10:07:22 +00:00
ager@chromium.org
73a4ecfae1 A MessageObject is a purely internal object to hold information about
an error message that needs to be generated and reported. This change
hides all of the error information from JavaScript code so user
callbacks cannot get hold of it.

Review URL: http://codereview.chromium.org/6368051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6574 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-02 13:31:52 +00:00
peterhal@chromium.org
5ca89179d7 Revert "Fix bugs 992 and 1083"
This reverts commit 6561 as the new assert caused failures in sputnik.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-01 20:08:01 +00:00
peterhal@chromium.org
9c89aa6dd9 Fix bugs 992 and 1083
Fixes JS portion of DefineOwnProperty when there is
an existing property and the new descriptor is generic.

Makes code follow spec steps more closely.

Fixes typo for check for unchanged enumerable in step 6.

Adds regression tests.
Fixes errors in object-define-property test

Don't normalize the JSGlobalProxy. Gets webkit http/tests/security/xss-DENIED-defineProperty.html working.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-01 17:08:14 +00:00
antonm@chromium.org
fae90d4f32 Make closures optimizable by Crankshaft compiler.
Currently only closures which only read from the context are supported.

Review URL: http://codereview.chromium.org/5753005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-17 08:11:03 +00:00
vitalyr@chromium.org
e2f8c938c3 Allow arguments in safepoints with registers.
This should enable calling runtime functions with arguments from
deferred lithium code.

Review URL: http://codereview.chromium.org/6125007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6285 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-12 14:14:14 +00:00
lrn@chromium.org
a50e69bda5 Avoid calling inherited setters when creating object literals and their boilerplates.
Fix issue 1015.

Review URL: http://codereview.chromium.org/6118001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-06 14:00:50 +00:00
ricow@chromium.org
aa396c5779 Allow getters and setters on JSArray elements.
This fixes bug 900 

Review URL: http://codereview.chromium.org/5959009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6158 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 13:59:34 +00:00
lrn@chromium.org
e7ecb74b8a Don't let JSON parsed objects hit inherited setters.
Review URL: http://codereview.chromium.org/6101001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-04 12:19:55 +00:00
lrn@chromium.org
c9928c0595 Change scanner buffers to not use utf-8.
Make preparser keep its symbol text itself instead of relying on the scanner.

Review URL: http://codereview.chromium.org/6075005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6115 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-22 20:14:19 +00:00
sgjesse@chromium.org
e21d76a0e3 1. Added support for object printing for release mode using the
objectprint=on (defaults to off) option (which defines OBJECT_PRINT).
2. Added the ability to print objects to a specified file instead of
   just stdout.
3. Added a use_verbose_printer flag (true by default) to allow some
   object printouts to be less verbose when the flag is false.
4. Fixed a bug in VSNPrintF() where it can potentially write into an
   empty char vector.

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/5998001


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6080 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-20 10:38:19 +00:00
ricow@chromium.org
357afa385b Change Object.defineProperty to accept undefined as getters and setters and to correctly accept overriding an accessor with a data property.
In the past we only accepted functions as argument for setting an
accessor. Since one should be able to set an accessor to undefined
this had to be changed to take either.

In addition, we did not lookup properties in the prototype chain,
causing us to call the setter of an existing accessor up the prototype
chain when trying to replace an existing accessor (that was not local)
with a data property.


Review URL: http://codereview.chromium.org/5861006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 12:21:08 +00:00