When a function is called with a value type as the receiver this is now boxed as an object.
This is a low-impact solution where the receiver is only boxed when required. For IC calls to the V8 builtins values are not boxed and as most of the functions on String.prototype, Number.prototype and Boolean.prototype are sitting there most IC calls on values will not need any boxing of the receiver.
For calls which are not IC calls but calls through the CallFunctionStub a flag is used to determine whether the receiver might be a value and only when that is the case will the receiver be boxed.
No changtes to Function.call and Function.apply - they already boxed values. According to the ES5 spec the receiver should not be boxed for these functions, but current browsers have not adopted that change yet.
BUG=223
TEST=test/mjsunit/value-wrapper.js
TEST=test/mjsunit/regress/regress-crbug-3184.js
Review URL: http://codereview.chromium.org/542087
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
A callback on the debugger thread when a message is received. Allows the
embedding application to wake up the main thread in order to handle the
message. Useful when the embedding application is idle and sitting in a
select() call.
Patch by Ryan Dahl <coldredlemur@gmail.com>
Review URL: http://codereview.chromium.org/395013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
When starting JS profiling under Chromium, a map from function addresses to function names is created. During it, for sourceful scripts, an attempt to access script source is made. This can cause a crash, if a source is an external string, which already has been disposed. We had a similar problem in the past with DebugGetLoadedScripts.
BUG=http://crbug.com/23768
TEST=test-log/Issue23768
Review URL: http://codereview.chromium.org/269003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3027 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Got rid of the debug break on return entry code which did not add anything. It just jumped directly to the debug break on return code.
Removed the CodePatcher class on x64 as it was not implemented.
Added instruction cache flush to where the return sequence was patched on x64.
Added some missing ENABLE_DEBUGGER_SUPPORT #ifdef/#endif.
Review URL: http://codereview.chromium.org/193057
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Scripts now have a compilation type which can be host, eval or JSON. Host scripts are compiled through the API, eval scripts are compiled through call to evan and JSON scripts are compiled as a result of calling JSON.parse.
For scripts scripts compiled through eval the JavaScript function in top of the stack and the pc offset into the code is stored in the script object. This makes it possible to calculate the source position of the eval call later when requested. This information can be obtained through the script mirror object and is part of the script mirror JSON serialization for the debugger protocol.
Moved the enumeration ScripType into class Script and remamed to Type. The new compilation type enumeration is also inside the class Script.
This information is now shown when using the scripts command in he developer shell debugger.
Review URL: http://codereview.chromium.org/119108
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2119 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
* Running "system" JavaScript with the debug break flag active leads to slow running code while waiting for the break in non "system" JavaScript (one exception to this it is to try to avoid breaks in the clear mirror cache JavaScript code called when leaving the debugger).
* If this happens while processing RegExp running in native code an infinite loop is created as the stack guard handler for RegExp does not move execution forward
Fixed a GC bug in the interrupt handling for RegExp running in native code.
Added test of debug break while in debug message handler callback and debug break while executing a RegExp.
Review URL: http://codereview.chromium.org/115262
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This issue was raised by Brett Wilson while reviewing my changelist for readability. Craig Silverstein (one of C++ SG maintainers) confirmed that we should declare one namespace per line. Our way of namespaces closing seems not violating style guides (there is no clear agreement on it), so I left it intact.
Review URL: http://codereview.chromium.org/115756
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Without the change the debugger may crash as Debugger::EventActive(v8::Break) called from OnDebugBreak may clear current debugger context.
Also when compilation cache was enabled debugger could fail on second attach for the same reason(see AfterCompileMessageWhenMessageHandlerIsReset).
BUG=12404
Review URL: http://codereview.chromium.org/115709
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
When loaded scripts are requested this cache is filled with all the script objects in the heap. Hereafter its content is kept in sync with the active scripts in the heap through the notifications of new scripts compiled and by using weak handles to get notified when a script is collected.
Through the tracking of collected scripts the debugger event OnScriptCollected have been added to notify a debugger that a script previously returned through the scripts command is no longer in use.
Make the ComputeIntegerHash globally available.
Moved clearing of the mirror cache to when debugger is really left. Previously recursive invocations of the debugger cause the mirror cache to be cleared causing handles to become either stale or reference other objects.
Review URL: http://codereview.chromium.org/115462
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The object delivered to the debug message handler contains additional information on the current break handling the messages.
Clients which require just JSON message parsing can simply get the JSON using the GetJSON message on the message object to still have the previous behaviour.
NewMessageHangler(const v8::Debug::Message& message) {
v8::String::Value val(message.GetJSON());
OldMessageHandler(Vector<uint16_t>(const_cast<uint16_t*>(*val), val.length()));
}
Refactored some of the debugger code to use internal handles instead of API handles. Also changed Object to JSObject is some places.
The access to the active context when the break occurred is still not implemented. I will add this in a new CL, as this one is quite big already.
Review URL: http://codereview.chromium.org/99122
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The debug message thread was introduced to make it possible to have the message handler callback be called from a different thread than the thread running V8 where the debug event occoured, but it never had any practical use, and prevents providing information to the message handler which is only available from the V8 thread.
In the future any thread decoupling will have do be done by the embedder.
This also removes the queue used for outbound messages.
Renamed the class Message to CommandMessage as it is only used for debugger commands from the client. Related message queue classes has also been renamed.
Review URL: http://codereview.chromium.org/93118
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
For keyed IC loads setting a break point now ensures that the inlined code is not used. When the break point is set the inlined map check is changed to fail causing the inlined code not to be used but the IC to be called. As long at the break point is set the map check will stay invalid.
Review URL: http://codereview.chromium.org/87025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1756 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
ENABLE_DEBUGGER_SUPPORT is enabled by default unless it is on Android platform.
On Android platform, it can also enabled by passing -DENABLE_DEBUGGER_SUPPORT flag to the compiler.
This should not affect any existing build (I hope, cross my fingers) except the build in real Android environment (in other word, it only affects me now).
There are lot of room for code refactoring in stead of using #ifdef all over the place. I will leave this to v8 folks.
Review URL: http://codereview.chromium.org/77035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1745 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The generic step-in mechanism floods the function called with break points to ensure a break is hit when entering the function. This generic mechanism was also used for function.apply. The code for function.apply contains a keyed load IC which was patched when stepping into function.apply. However function.apply enteres an internal frame not a JavaScript frame. This caused the logic for returning from the break in function.apply to fail as it forced a jump to the IC on the top JavaScript frame. The top JavaScript frame was the frame for the function calling function.apply not the frame for the apply function. Now returning from the break point in the keyed load IC in the apply code caused a jump to the code for the call IC for the function calling function.apply in the first place. Not a pretty sight.
Step-in now handles function.apply as a separate case where the actual JavaScript function called through apply is flodded with breakpoints instead of the function.apply function.
BUG=269
BUG=8210@chromium.org
Review URL: http://codereview.chromium.org/63055
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add a semaphore for accessing debugger varaibles which can be changed from a different thread. This is mainly the debug message handler which can be set to NULL to disconnect the debugger.
Control the unloading of the debugger from the V8 thread. Before the debugger unload was called from the thread setting the debug message handler to NULL. This was not safe as this involves calling into V8. This change handles the unloading of the debugger either when entering a debugger event and the debugger was disconnected while the debugger was not active or when leaving the debugger and the debugger was disconnected while the debugger was active.
Add a flag to avoid unloading the debugger if debugger code is used by the application for other purposes than debugging.
Added tests for clearing the debug message handler.
Review URL: http://codereview.chromium.org/56102
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The message handler function set through the debugger API is normally called in a different thread than the V8 thread where execution is stopped due to debugger event. This change adds an option to the API for specifying that the message handler should be called directly from the V8 thread. For an application like Chrome where thread dispatching is already in place this makes more sense.
Add an option to the message handler debugger API to process messages in the thread where V8 is running instead of posting it to a queue for processing on a additional thread.
Review URL: http://codereview.chromium.org/42643
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- String traversal test data (now in a zone)
- Debug message thread (now joined on exit)
- Threading test threads (now joined on exit)
- Changed message tests framework to cope with valgrind
Also, fixed a bug where we'd try to delete stack-allocated objects
when tearing down v8. Good times.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
During bind and listen socket errors are now handled. If the listen socket is occoupied the agent will retry its bind operation until success or shutdown.
Added orderly shutdown of the debugger agent both with and without a client connected.
Review URL: http://codereview.chromium.org/50007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This makes it possible to remote debuggers to just add commands to the queue without having to request a break as well. As soon as any JavaScript executes the debugger commands will be processed and the response send to the remote debugger.
Currently hide this behind a flag (--debugger-auto-break) as the current command line debugger in Chrome is not designed for this new behaviour, whereas the new Chrome developer tools will use it.
Review URL: http://codereview.chromium.org/42173
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The debugger agent listens on a TCP/IP port for a remote debugger connection. When such a connection is established the debuger JSON protocol is communicated between the agent the the remote debugger. The messages containing the JSON protocol has a RFC-822 like header with a Content-Length field and with the body containing the JSON in UTF-8 encoding.
The D8 shell has option --debugger-agent to start the debugger agent.
Review URL: http://codereview.chromium.org/27355
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1405 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add the ability to have the host embedding V8 receive a callback in the V8 thread while V8 is processing a debug callback. When V8 is processing a debug callback the thread where V8 is executing is sitting in a tight loop processing debug commands until the continue command has been executed. In some embedding situations it is beneficial to be able to call back into the embedding host from the thread where V8 is sitting. The might have functions which needs to be called to complement the JavaScript debugging.
Using the uint16_t array to pass a void* is a temporary hack.
Review URL: http://codereview.chromium.org/20491
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Added a number of handle scopes to the debugger code to keep handles local to the function using them.
Fixed SetDebugEventListener to actually unregister when passed a NULL pointer. Previously this NULL pointer was wrapped in a Proxy.
BUG=1242702
Review URL: http://codereview.chromium.org/21347
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The debugger compile events (BeforeCompile and AfterCompile) have not been used by any V8 debuggers lately and where actually not working any more. Added the correct information to the compile event.
Added a simple 'trace compile' command to the developer shell for testing.
Added a test for compile evnets.
Review URL: http://codereview.chromium.org/21076
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1230 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Moved the registrered debug event listener from the context to a global handle in the Debugger class. Storing it in the context did not make much sense.
Changed a lot of tests to handle the API change.
BUG=1242707
Review URL: http://codereview.chromium.org/19753
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1212 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
it is assigned a numeric handle. Handles are used to make a 1:1
correspondence between objects and mirrors. Currently the mirrors are
cached in a JavaScript array and when creating a mirror this cache is
checked to see if a mirror already exists for the object. This cache is
cleared when leaving the debugger.
Changed the serialization format to take advantage of these handles. When
an object is serialized referenced objects are represented just by their
handle id serialized as '{ref:<handle>}'. During serialization the
referenced handles are collected and the serializer can provide a
serialization of all the referenced objects.
Removed the special handling of array properties. Indexed properties and
the length property are now rendered as named properties in the
serialization.
Removed the special serialization handling of RegExp properties. The
properties 'source', 'global', 'ignoreCase' and 'multiline' are serialized
with the rest of the properties.
Changed a lot of tests to handle the changed format.
Review URL: http://codereview.chromium.org/18092
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Changed the serialization format to take advantage of these handles. When an object is serialized referenced objects are represented just by their handle id serialized as '{ref:<handle>}'. During serialization the referenced handles are collected and the serializer can provide a serialization of all the referenced objects.
Removed the special handling of array properties. Indexed properties and the length property are now rendered as named properties in the serialization.
Removed the special serialization handling of RegExp properties. The properties 'source', 'global', 'ignoreCase' and 'multiline' are serialized with the rest of the properties.
Changed a lot of tests to handle the changed format.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- Changed WeakReferenceCallback to take a Persistent<Value> instead of
a Persistent<Object>.
- Removed Message::GetUnderline and Message::GetScriptData.
- Added Value::IsDate, Date::Cast and Date::Value.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr
This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.
V8 support of split window:
There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;
V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.
Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.
When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.
It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.
I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.
Review URL: http://codereview.chromium.org/7366
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
upper case. Moved it into the RelocInfo class together with the associated
is_xxx functions. Renamed is_xxx to IsXxx in the process.
Removed the exit_js_frame mode as it was no longer used.
Patch Set 2 renames RELOC_MODE_COUNT to NUMBER_OF_MODES and fixes a couple of lint errors.
Review URL: http://codereview.chromium.org/3186
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
until a possible debug break location is reached. Currently this is call sites
with calls to code objects and JS return. Source position information in the
code therefore no longer refers to the "first" instruction generated for a
given source position (which was not the case defered code anyway) but to the
first break location after that source position was passed (again defered code
always start with source position information). This doesn't make a difference
for the debugger as it will always be stopped only at debug break locations.
However, this makes the life of the peep-hole optimizer much easier as many
oportunities for posh/pop eliminations where previosly blocked by relocation
information already written to the code object.
Two types of source positions are still collected. Statement positions indicate
the position of the start of the statement leading to this code and (plain)
positions indicate other places typically call sites to help indicate current
position in backtraces. The two different types of positions are also used to
distinguish between step next and step in.
Runs all the tests (including debugger tests) as before.
Moved the checking for the FLAG_debug_info to one place.
I will do the same changes to the ARM codegenerator in a seperate changelist.
Review URL: http://codereview.chromium.org/2957
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@335 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
method ensures that there are no allocations during the setup.
This fixes test breakage on Linux in debug mode where allocation
happened while the debug info object was not fully set up making
verify heap unhappy.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@70 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
while V8 is running.
A debugger using the V8 message based interface now needs to control the
call to DebugBreak in order for the messages send to be processed. Commands can
still be send when V8 is not in a break, but they will not be processed until
there is a break. The response "request queued" when queuing up messages have
been removed. This gets rid of a non JSON message being used.
Modified the threaded debugger tests to call DebugBreak instead of relying
on it occouring automatically.
This change will not be committed until the outstanding Chrome change
http://chrome-reviews.prom.corp.google.com/2072 (which updates Chrome to control
the DebugBreak call) have been reviewed and committed.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@47 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Extended the shell sample with a --runtime-flags option.
Added Visual Studio project files for the shell.cc and process.cc samples.
git-svn-id: http://v8.googlecode.com/svn/trunk@14 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Cleaned up ARM version by removing top of stack caching and by introducing push/pop elimination.
Cleaned up the way runtime functions are called to allow runtime calls with no arguments.
Changed Windows build options to make sure that exceptions are disabled and that optimization flags are enabled.
Added first version of Visual Studio project files.
git-svn-id: http://v8.googlecode.com/svn/trunk@13 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fixed the handling of '>' and '<=' to use right-to-left conversion and left-to-right evaluation as specified by ECMA-262.
Fixed a branch elimination bug on the ARM platform where incorrect code was generated because of overly aggressive branch elimination.
Improved performance of code that repeatedly assigns the same function to the same property of different objects with the same map.
Untangled DEBUG and ENABLE_DISASSEMBLER defines. The disassembler no longer expects DEBUG to be defined.
Added platform-nullos.cc to serve as the basis for new platform implementations.
git-svn-id: http://v8.googlecode.com/svn/trunk@9 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Added a few samples and support for building them. The samples include a simple shell that can be used to benchmark and test V8.
Changed V8::GetVersion to return the version as a string.
Added source for lazily loaded scripts to snapshots and made serialization non-destructive.
Improved ARM support by fixing the write barrier code to use aligned loads and stores and by removing premature locals optimization that relied on broken support for callee-saved registers (removed).
Refactored the code for marking live objects during garbage collection and the code for allocating objects in paged spaces. Introduced an abstraction for the map word of a heap-allocated object and changed the memory allocator to allocate executable memory only for spaces that may contain code objects.
Moved StringBuilder to utils.h and ScopedLock to platform.h, where they can be used by debugging and logging modules. Added thread-safe message queues for dealing with debugger events.
Fixed the source code reported by toString for certain builtin empty functions and made sure that the prototype property of a function is enumerable.
Improved performance of converting values to condition flags in generated code.
Merged disassembler-{arch} files.
git-svn-id: http://v8.googlecode.com/svn/trunk@8 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Allowed aliased eval invocations by treating them as evals in the global context. This may change in the future.
Added support for accessing the last entered context through the API and renamed Context::Current to Context::GetCurrent and Context::GetSecurityContext to Context::GetCurrentSecurityContext.
Fixed bug in the debugger that would cause the debugger scripts to be recursively loaded and changed all disabling of interrupts to be block-structured.
Made snapshot data read-only to allow it to be more easily shared across multiple users of V8 when linked as a shared library.
git-svn-id: http://v8.googlecode.com/svn/trunk@6 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Added propagation of stack overflow exceptions that occur while compiling nested functions.
Improved debugger with support for recursive break points and handling of exceptions that occur in the debugger JavaScript code.
Renamed GetInternal to GetInternalField and SetInternal to SetInternalField in the API and moved InternalFieldCount and SetInternalFieldCount from FunctionTemplate to ObjectTemplate.
git-svn-id: http://v8.googlecode.com/svn/trunk@5 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
non-tagged value in register eax was pushed to the stack.
Fixed potential quadratic behavior when converting strings to numbers.
Fixed bug where the return value from Object::SetProperty could end up
being the property holder instead of the written value.
Improved debugger support by allowing nested break points and by
dealing with stack-overflows when compiling functions before setting
break points in them.
git-svn-id: http://v8.googlecode.com/svn/trunk@4 ce2b1a6d-e550-0410-aec6-3dcde31c8c00