Commit Graph

176 Commits

Author SHA1 Message Date
lrn@chromium.org
54f8947d44 Added possibility of miscompiled regexp to verfifier.
Review URL: http://codereview.chromium.org/188005


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-09-02 08:36:26 +00:00
sgjesse@chromium.org
33a8bdad62 Reverting 2797.
Review URL: http://codereview.chromium.org/176060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-09-01 15:23:35 +00:00
sgjesse@chromium.org
00a2afeaa6 First step in allocating objects in generated code on ARM
This change moves the allocation of new objects into generated code. The allocation will bail out into the runtime system if the number of properties to allocate for the object exceeds the number of in-object properties.
Review URL: http://codereview.chromium.org/175045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-09-01 14:18:27 +00:00
whesse@chromium.org
13d59a069d Add explicit integer type-casts to make WIN64 build without errors.
Review URL: http://codereview.chromium.org/178054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2795 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-09-01 13:08:16 +00:00
sgjesse@chromium.org
717394492d Generate specialized constructor code for constructing simple objects.
For objects which only have simple assignments of the form this.x = ...; a
specialized constructor stub is now generated. This generated code allocates the
object and fills in the initial properties directly. If this fails for some
reason code continues in the generic constructor stub which in turn might pass
control to the runtime system.

Added counter to see how many objects are constructed using a specialized stub.

The specialized stub is only implemented for ia32 architecture in this change.
For x64 and ARM the generic construct stub is used.

This is change is identical to http://codereview.chromium.org/174392 (committed in r2753 and reverted in r2754) except that a few parts have already been committed from http://codereview.chromium.org/173469 (committed in r2762).
Review URL: http://codereview.chromium.org/173470

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-26 12:22:44 +00:00
christian.plesner.hansen@gmail.com
af6c6a5533 Api inlining. Made some core functionality available in the api and
made inline versions of some hot functions.  Changed api to use
internal Object pointers rather than void pointers.

Speeds up getElementById by ~7%.
Review URL: http://codereview.chromium.org/173348

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-26 10:33:11 +00:00
sgjesse@chromium.org
3fdbc0848c Reverting 2753.
Review URL: http://codereview.chromium.org/173349

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2754 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-25 15:00:07 +00:00
sgjesse@chromium.org
53531ed48a Generate specialized constructor code for constructing simple objects.
For objects which only have simple assignments of the form this.x = ...; a specialized constructor stub is now generated. This generated code allocates the object and fills in the initial properties directly. If this fails for some reason code continues in the generic constructor stub which in turn might pass control to the runtime system.

Added counter to see how many objects are constructed using a specialized stub.

The specialized stub is only implemented for ia32 architecture in this change. For x64 and ARM the generic construct stub is used.
Review URL: http://codereview.chromium.org/174392

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-25 12:23:58 +00:00
whesse@chromium.org
1dfac258a3 Change some integer types to make the x64 Win32 platform happier.
Review URL: http://codereview.chromium.org/173115

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-24 11:56:29 +00:00
sgjesse@chromium.org
4e03645dc4 Analyze functions for assignment to this properties.
During parsing functions are analyzed for statements of the form this.x = ...;. These assignments are categorized in two types: simple and non simple. The simple ones are where the right hand side is known to be either a constant or an argument to the function. If a function only contains statements of this type the property names are collected and for the simple assignments the index of the argument or the constant value assigned are stored as well.

When the initial map for a function is created and the function consists of only this type of assignemnts the initial map is created with a descriptor array describing these properties which will be known to always exist in an object created from the function.

The information on this property assignments is not collected during pre-parsing so if compiling using pre-parse data these optimization hints are not available.

Next step will be to use the information collected for the simple assignments to generate constructor code which will create and initialize the object from this information without calling the code for the function.
Review URL: http://codereview.chromium.org/172088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-19 07:30:20 +00:00
vitalyr@chromium.org
d6fcda0044 API: added function to find instance of template in prototype chain.
Also inlined Object::IsInstanceOf.

This new function is intended to be used to speed up DOM bindings.

Review URL: http://codereview.chromium.org/165044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2636 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-06 13:35:21 +00:00
lrn@chromium.org
6f21761ea8 X64: Fix bug in boolean conversion of empty string.
Review URL: http://codereview.chromium.org/165043


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-08-06 10:22:38 +00:00
sgjesse@chromium.org
cffc051177 Avoid dictionary expansion during bootstrapping.
Allocate the code stubs dictionary and non monomorphic cache dictionary with an initial size which avoids these dictionaries to be expanded during bootstrapping. This gets rid of 9 dictionary expansions during bootstrapping.

Preallocate the dictionary when normalizing an object to a size sufficient for holding the number of properties which is expected to be added to the object. This is used when ceating an object from an object literal boilerplate where multiple properties are known to be added.  This gets rid of 10 dictionary expansions during bootstrapping.

There are now 3 dictionary expansions left during bootstrapping.
Review URL: http://codereview.chromium.org/160382

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-30 09:13:48 +00:00
whesse@chromium.org
79b52509d3 X64: Fix error in division & modulus, adjust mjsunit test status, fix lint error in objects.h
Review URL: http://codereview.chromium.org/159584

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-30 07:31:54 +00:00
antonm@chromium.org
0d2c81584b Compile precanned answers for the case of failed interceptor for some combinations.
Review URL: http://codereview.chromium.org/140069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2577 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-29 12:34:21 +00:00
kasperl@chromium.org
84d8e51df4 Change the check for builtin functions to not be based on identity,
which seems shaky in the presence of multiple builtin objects.
Review URL: http://codereview.chromium.org/159583

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-29 09:51:41 +00:00
antonm@chromium.org
4354661a49 Get rid of unnecessary handle management when invoking interceptors.
Review URL: http://codereview.chromium.org/155682

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2562 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-28 14:46:06 +00:00
kasperl@chromium.org
b2fc0598c1 Fix lint issues. TBR=iposva@chromium.org
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2550 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-28 09:05:05 +00:00
iposva@chromium.org
1ce28eda0b - Expose CanvasPixelArray functionality directly in JavaScript
indexed property accesses.
- The IC stubs have not been updated to handle these directly, but
  at least we do not have to leave the VM to access bytes.

Review URL: http://codereview.chromium.org/159263

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2549 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-28 08:43:51 +00:00
whesse@chromium.org
76833936b7 Make Array::kHeaderSize protected, and only use kHeaderSize of its subclasses.
Many X64 bugs have been due to the difference between (unaligned) Array::kHeaderSize and (aligned) FixedArray::kHeaderSize.
Review URL: http://codereview.chromium.org/155687

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2502 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-17 12:12:24 +00:00
kasperl@chromium.org
94c4760225 Revert r2486, r2487, and r2488 until I get the chance to fix
the performance issue with number dictionaries.

TBR=kmillikin@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-17 04:57:17 +00:00
bak@chromium.org
e0047e4331 Changed hash table to use more of the hash value when probing.
Review URL: http://codereview.chromium.org/155350

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2486 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-16 12:56:50 +00:00
ager@chromium.org
00cdc3f1a3 Remove the descriptor stream abstractions.
The abstractions have led to bugs because it looks like descriptor
streams are GC safe but they are not.

I have moved the descriptor stream helper functions to descriptor
arrays and I find most of the code just as readable now as it was
before.
Review URL: http://codereview.chromium.org/149458

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-10 19:25:18 +00:00
kasperl@chromium.org
875dbe6584 Re-enable ICs for loads and calls that skips a global object during
lookup through the prototype chain.
Review URL: http://codereview.chromium.org/155344

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2425 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-10 09:40:47 +00:00
kmillikin@chromium.org
d0c35af612 Create a new paged heap space for global property cells. The new
space is similar to map space in that it has fixed-size objects.  A
common superclass for a space with fixed size objects is used for the
map space and cell space.

Allocate all cells in cell space.  Handle it during all GCs.  Modify
the free-list node representation (so that the size is not at a fixed
offset in all cells) to allow two-pointer free-list nodes.  Clean up
some stuff in the MC collector.

Review URL: http://codereview.chromium.org/155211

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2411 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-09 11:13:08 +00:00
erik.corry@gmail.com
8f73ae0325 * Move almost all roots into an array ready for use by a constant-pool
register on ARM.
* Make some compile-time loops into run-time loops for compactness.
Review URL: http://codereview.chromium.org/149324

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-08 19:12:58 +00:00
lrn@chromium.org
72235cf06c Changed ?: into if/else to placate compiler.
Review URL: http://codereview.chromium.org/155131


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2368 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-07 09:29:41 +00:00
lrn@chromium.org
72de7ab74e Separate native and interpreted regexp by compile time flag, not runtime.
Clean-up of RegExp code.

Review URL: http://codereview.chromium.org/155085


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-07 08:11:19 +00:00
antonm@chromium.org
12c7246cff Use attributes to communicate failed lookup instead of retval.
Review URL: http://codereview.chromium.org/151151

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-06 11:00:53 +00:00
bak@chromium.org
9aa0f380a6 Fixed arm/mac errors and presubmitting 2324.
Review URL: http://codereview.chromium.org/151193

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2328 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-02 06:50:43 +00:00
ager@chromium.org
e75a173ff7 Revert r2324 until we can fix build and test errors.
TBR=bak@chromium.org

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-01 16:49:54 +00:00
bak@chromium.org
5cbb209425 Removed virtual behavior from Dictionaries.
Review URL: http://codereview.chromium.org/150168

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2324 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-01 15:38:25 +00:00
kasperl@chromium.org
6cfc5f1ef9 Treat the builtins object like other global objects (with
cells in old space for properties) and avoid allocating tons
of unused properties in new space when creating new contexts.
Review URL: http://codereview.chromium.org/151146

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2319 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-07-01 11:44:37 +00:00
christian.plesner.hansen@gmail.com
118a2ccc8e When Error.collectStackTraces is set to true all new instances of
Error, ReferenceError, etc. are given a stack property that gives a
stack trace.  Here's an example stack trace:

ReferenceError: FAIL is not defined
    at Constraint.execute (deltablue.js:527)
    at Constraint.recalculate (deltablue.js:426)
    at Planner.addPropagate (deltablue.js:703)
    at Constraint.satisfy (deltablue.js:186)
    at Planner.incrementalAdd (deltablue.js:593)
    at Constraint.addConstraint (deltablue.js:164)
    at Constraint.BinaryConstraint (deltablue.js:348)
    at Constraint.EqualityConstraint (deltablue.js:517)
    at chainTest (deltablue.js:809)
    at deltaBlue (deltablue.js:881)
    at deltablue.js:888

If Error.prepareStackTrace holds a function this function is used to
format the stack trace, for instance allowing code generators to
customize the way stack traces are reported to make them easier to
process.

Next step: performance measurements to see if it is feasible to turn
this on by default.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2302 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-30 11:08:37 +00:00
sgjesse@chromium.org
a54a4ada5c Changed the global object representation.The global object is now always in dictionary (slow) mode with each of its properties stored in a cell object. A cell object has one field containing the actual value for the property. Inline caches for access to global properties which uses direct to the cell are now created for load, store and call to properties of the global object. When properties of the global object are deleted the cell for that property is kept with an indcation of that the property is deleted.Added counters to track the use of the global property inline caches.Added additional information on IC's in the disassembler.
Review URL: http://codereview.chromium.org/151019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-30 10:05:36 +00:00
whesse@chromium.org
0746d93014 X64 Implementation: Correct type, add VisitCallEval
Review URL: http://codereview.chromium.org/149066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2282 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-26 11:35:42 +00:00
whesse@chromium.org
74ddab9d94 Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitions.
Review URL: http://codereview.chromium.org/141031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-22 07:41:15 +00:00
kasperl@chromium.org
5f5fbd4e4a Allow functions to have custom construct stubs that are called
when the function is instantiated.
Review URL: http://codereview.chromium.org/132063

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2222 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-19 07:36:16 +00:00
ager@chromium.org
885259ffab Inline fast case of the method that ensures that an array has a
certain size.
Review URL: http://codereview.chromium.org/126265

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2200 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-17 10:55:58 +00:00
bak@chromium.org
1155ba8e8e Reimplemented the KeyedLookupCache to speed up access.
Review URL: http://codereview.chromium.org/126262

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-17 06:07:49 +00:00
erik.corry@gmail.com
cf07b3141c Fix fp code for mixed-endian ARM.
Review URL: http://codereview.chromium.org/119420

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2140 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-10 16:32:15 +00:00
whesse@chromium.org
85720fc05e Make JSObjects with both indexed interceptors and indexed accessors work safely.
Review URL: http://codereview.chromium.org/118499

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-10 15:33:31 +00:00
whesse@chromium.org
bedff67b6e Make Array.sort safely generic on JSObject types. Fix bug 346 http://code.google.com/p/v8/issues/detail?id=346
Review URL: http://codereview.chromium.org/119357

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-10 11:42:22 +00:00
erik.corry@gmail.com
b7d48f5807 A bunch of changes to speed up math on ARM.
* Identify heap numbers that contain non-Smi int32s and do bit
ops on them without calling the fp hardware or emulation.
* Identify results that are non-Smi int32s and write them into
heap numbers without calling the fp hardware or emulation.
* Do unary minus on heap numbers without going into the runtime
system.
* On add, sub and mul if we have both Smi and heapnumber inputs
to the same operation then convert the Smi to a double and do
the op without going into runtime system.  This also applies
if we have two Smi inputs but the result is not Smi.
Review URL: http://codereview.chromium.org/119241

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2131 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-10 10:20:37 +00:00
sgjesse@chromium.org
d498361c5f Add more debugging information to scripts compiled through eval.
Scripts now have a compilation type which can be host, eval or JSON. Host scripts are compiled through the API, eval scripts are compiled through call to evan and JSON scripts are compiled as a result of calling JSON.parse.

For scripts scripts compiled through eval the JavaScript function in top of the stack and the pc offset into the code is stored in the script object. This makes it possible to calculate the source position of the eval call later when requested. This information can be obtained through the script mirror object and is part of the script mirror JSON serialization for the debugger protocol.

Moved the enumeration ScripType into class Script and remamed to Type. The new compilation type enumeration is also inside the class Script.

This information is now shown when using the scripts command in he developer shell debugger.
Review URL: http://codereview.chromium.org/119108

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2119 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-08 10:47:49 +00:00
ager@chromium.org
24d22b567a Introduce an API to force the deletion of a property ignoring
interceptors and dont-delete attributes.

Minor change to the behavior of eval: throw exception when calling
eval in a context for which the global has been detached.  This
matches the behavior of both Firefox and Safari post navigation in the
browser.
Review URL: http://codereview.chromium.org/118374

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2118 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-08 09:46:09 +00:00
kasperl@chromium.org
dfbc850ebc Revert revision 2108. This brings back the changes
submitted in revisions 2093, 2094, 2099, and 2106.
There's no evidence that supports that these changes
should be the cause of the unexplained performance
regressions on the intl2 and DHTML page cyclers. 


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2109 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-05 08:07:15 +00:00
kasperl@chromium.org
84c09c6de4 Experimental revert of revisions 2093, 2094, 2099, and
2106 to try to isolate a performance regression on the
page cyclers.

I'll roll the changes back in if this doesn't fix the
regression.

TBR=antonm@chromium.org
Review URL: http://codereview.chromium.org/118302

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2108 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-05 06:57:30 +00:00
antonm@chromium.org
0a0ede0716 Fix the issue with layout tests.
The problem was I incorrectly treated NULL result as failure to fetch
a property with a getter.  However, if getter returns zero, it is
manifested as NULL pointer (see added test case).

Good news: that gives another boost as before this CL if getter returned
0, I did another slow lookup.

Review URL: http://codereview.chromium.org/119172

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-04 19:19:53 +00:00
antonm@chromium.org
2e49a1c03d Follow up to r2093: forgotten files and changes.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2009-06-03 12:04:53 +00:00