AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
6,984 Commits 1 Branch 0 Tags 839 MiB
2c8680cc46
Commit Graph

142 Commits

Author SHA1 Message Date
lrn@chromium.org
2c8680cc46 Avoid size increase of snapshot. 
The prototype of builtin functions is already unwritable, so we don't
have to make it so (the default map for functions changes after builtins
are initialized).

We no longer need to make the prototype non-extensible, since all properties
that are ever read by the bultins code has been added and frozen already.
Adding properties to the prototype, or changing its __proto__, cannot affect
code.

Removing these two pieces of initialization code reduces the snapshot size
by a few Kb.

Review URL: http://codereview.chromium.org/7839028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9166 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-07 11:56:06 +00:00
ricow@chromium.org
df9d8ee8be Fix map space explosion from changing the arguments and caller properties on native functions. 
Adding these local properties on all native functions made us do a
ConvertDescriptorToField on the callback on each and every native
functions, resulting in us creating an extra map for each of these.
Review URL: http://codereview.chromium.org/7779046

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9152 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-06 14:03:32 +00:00
lrn@chromium.org
6875d5e734 Optimize isFinite and isNaN. 
Arithmetic on infinities and NaN is much slower than doing several exact comparisons.

Review URL: http://codereview.chromium.org/7830036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9134 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-05 11:08:57 +00:00
lrn@chromium.org
ffffa716c5 Lock the prototype of internal classes. 
Prototypes and their properties and methods are locked down to prevent fiddling with their operation, even if the build-in object leaks.

Made some built-in functions only work during bootstrapping.

Review URL: http://codereview.chromium.org/7799027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9122 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-05 07:30:35 +00:00
lrn@chromium.org
b7eb138eab The spec (15.1.2.2 parseInt (string , radix)) says ToString should be called before ToInt32. 
http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf

In the current implementation, the order is reversed. So this webkit test (https://bugs.webkit.org/show_bug.cgi?id=65366) fails on Chromium.

BUG=1649
TEST=parse-int-float.js

Review URL: http://codereview.chromium.org/7740080

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-02 11:38:40 +00:00
ricow@chromium.org
4e94cd8b08 Make arguments and caller always be null on native functions (fixes issue 1548 and issue 1643). 
With this change we follow Firefox, Safari has a slightly different approach where the property is just not there (at least according to GetOwnProperty). 
Review URL: http://codereview.chromium.org/7792054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-09-01 11:09:11 +00:00
lrn@chromium.org
893b8320b8 Added access check to Runtime_GetPrototype. 
BUG=93759

Review URL: http://codereview.chromium.org/7701023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9016 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-25 13:22:55 +00:00
lrn@chromium.org
0946ce67d3 Make FromPropertyDescriptor not trigger inherited setters. 
Review URL: http://codereview.chromium.org/7745017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-25 09:07:43 +00:00
lrn@chromium.org
d2626be5d9 Prune some internal objects' prototypes. 
Review URL: http://codereview.chromium.org/7703005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8979 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-22 09:51:56 +00:00
ricow@chromium.org
d9c1984fe3 Use InternalArray in Object.defineProperties to avoid issues with overwriten properties on Array.prototype 
TEST=mjsunit/regress/regress-1625
BUG=v8:1625
Review URL: http://codereview.chromium.org/7631039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-18 08:39:06 +00:00
kmillikin@chromium.org
d941053dbe Revert "Revert "Fix a bug in scope analysis."" 
Reapply r8838 with a fix for the issue of function names.

Because function names can be added/changed/removed through the API,
remember whether the function is anonymous when initially parsed and use
that information when compiling.

R=vegorov@chromium.org
BUG=1583
TEST=regress-1583

Review URL: http://codereview.chromium.org/7491097

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8858 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-08 16:14:46 +00:00
kmillikin@chromium.org
3e28347d55 Revert "Fix a bug in scope analysis." 
This reverts commit revision 8838.

TBR=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7584005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-05 09:20:08 +00:00
kmillikin@chromium.org
b625ce2b6b Fix a bug in scope analysis. 
When recompiling code (e.g., when optimizing) we could incorrectly hoist
some function expressions.  This leads to incorrect results or a crash.  The
root cause was that functions were not correctly categorized as expression
or declaration at parse time.

This requires some extra hoops to prevent the print name "anonymous" for
functions created by 'new Function' from establishing a binding.

R=vegorov@chromium.org,kasperl@chromium.org
BUG=1583
TEST=regress-1583

Review URL: http://codereview.chromium.org/7572019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-05 08:28:11 +00:00
ricow@chromium.org
9721eddc1f Ensure that the length property of bound functions are actual unique 
for the individually bound functions.

Our existing code will generate a new function on every call to bind,
but it will use the same shared function. When setting the lenght this
will be set on the shared function, i.e., the length of all bound
functions will be that of the last bound function.
Review URL: http://codereview.chromium.org/7475002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8816 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 12:44:17 +00:00
jkummerow@chromium.org
a41c25607d Revert "Make window.{undefined,NaN,Infinity} read-only" 
This reverts r8766.

TEST=WebKit LayoutTests green again.

Review URL: http://codereview.chromium.org/7562005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-03 09:53:14 +00:00
jkummerow@chromium.org
15c979eeaa Make window.{undefined,NaN,Infinity} read-only 
as per ES5.

BUG=89490
TEST=es5conform 15.1.*, 15.2.3.*; mjsunit/undeletable-functions

Review URL: http://codereview.chromium.org/7538016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-08-01 12:18:03 +00:00
rossberg@chromium.org
bab9ec0b48 Fix ClassOf check on ARM. 
R=ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7472034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-21 12:39:35 +00:00
rossberg@chromium.org
3f5bc11c55 Implement Object.prototype.{hasOwnProperty, propertyIsEnumerable} for proxies. 
Refactor trap invocation.
Test other Object.prototype functionality for proxies.

R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7436004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-21 11:20:27 +00:00
jkummerow@chromium.org
9de5255b60 Revert "Make window.undefined, window.NaN, window.Infinitiy read-only (ES5 section 15.1.1)" 
This reverts r8691.

Review URL: http://codereview.chromium.org/7457020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8692 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 10:51:11 +00:00
jkummerow@chromium.org
6768c5e24e Make window.undefined, window.NaN, window.Infinitiy read-only (ES5 section 15.1.1) 
BUG=89490
TEST=manual: "Infinity = 42;" doesn't change the value of "Infinity"

Review URL: http://codereview.chromium.org/7457019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-20 10:06:53 +00:00
rossberg@chromium.org
5e62e325ac Implement sealing, freezing, and related functions for proxies. 
R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7391001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-18 13:04:52 +00:00
rossberg@chromium.org
ddb782dcb8 Implement Object.getOwnPropertyDescriptor for proxies. 
Fix bug in compilation of calls with proxy receivers.

R=kmillikin@chromium.org,ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7237050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8630 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:57:15 +00:00
rossberg@chromium.org
6e2da733da Implement Object.keys for proxies. 
R=kmillikin@chromium.org,ager@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7321004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-13 11:01:17 +00:00
rossberg@chromium.org
58b913f9f0 Implement Object.defineProperty for proxies. 
R=kmillikin@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7314003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-07-07 12:41:20 +00:00
keuchel@chromium.org
3f70c456eb Fix "illegal access" when calling parseInt with a radix that is not a smi. 
BUG=v8:1246
TEST=regress-1246.js

Review URL: http://codereview.chromium.org/7206019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-28 12:31:42 +00:00
karlklose@chromium.org
cc19d1e278 Revert "Merge arguments branch to bleeding merge." 
This reverts commit ceb31498b9d69edca3260820fb4047045891ce6d.

TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7172030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-16 06:37:49 +00:00
karlklose@chromium.org
6cfeb2d400 Merge arguments branch to bleeding merge. 
Review URL: http://codereview.chromium.org/7167006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8300 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 15:09:28 +00:00
ricow@chromium.org
23d0aa614b Ensure that bound functions does not have a prototype (fixes issue 794) 
Review URL: http://codereview.chromium.org/7148014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8293 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-15 10:47:37 +00:00
ricow@chromium.org
38a75cf731 Geve correct error message when Object.isExtensible is called on a non object (fixes issue 1452) 
Review URL: http://codereview.chromium.org/7146010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-14 11:28:14 +00:00
ager@chromium.org
aa7ad8ee9d Fix issue 1447 by not redefining properties unneccesarily in seal and freeze. 
This avoids attempting to redefine function.arguments with a different
value than the current one. function.arguments returns a new copy on
each invocation.

R=lrn@chromium.org
BUG=v8:1447
TEST=mjsunit/regress/regress-1447.js

Review URL: http://codereview.chromium.org/7044104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-10 09:45:02 +00:00
ager@chromium.org
626cdffaef Fix Array.prototype.{reduce,reduceRight} to pass undefined as receiver for strict mode callbacks. 
Propagate strict mode information from pre-parser to parser for lazily compiled functions.

R=lrn@chromium.org
BUG=v8:1436
TEST=mjsunit/regress/regress-1436.js

Review URL: http://codereview.chromium.org/7044054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8227 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-09 09:05:15 +00:00
ager@chromium.org
22b5dfd395 Reapply: "Make instanceof and Object.getPrototypeOf work for proxies, 
plus a few other tweaks."

The problem with the original patch was that it did not take hidden
prototype objects into account in Runtime_GetPrototype.

R=kmillikin@chromium.org,rossberg@chromium.org
TEST=es5conform

Review URL: http://codereview.chromium.org/7056041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-03 10:15:49 +00:00
ager@chromium.org
ece7700d7c Revert "Make instanceof and Object.getPrototypeOf work for proxies, plus a few other tweaks." 
This change caused errors in es5conform tests for getPrototypeOf.

TBR=rossberg@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7109004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8159 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-02 10:12:00 +00:00
rossberg@chromium.org
2255860992 Make instanceof and Object.getPrototypeOf work for proxies, plus a few other tweaks. 
R=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/7080053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-06-01 17:44:08 +00:00
ager@chromium.org
017935408d Reapply change to Pass undefined to JS builtins when called with 
implicit receiver.

A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=fschneider@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7085034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-30 13:49:22 +00:00
ager@chromium.org
c832c467a4 Revert "Pass undefined to JS builtins when called with implicit receiver." 
Presubmit and failing test.

TBR=lrn@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7071009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8075 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 11:22:29 +00:00
ager@chromium.org
19b718fe73 Pass undefined to JS builtins when called with implicit receiver. 
A couple of corner cases have to be treated specially to not break
everything: eval and getter/setter definitions.

R=lrn@chromium.org
BUG=v8:1365
TEST=mjsunit/regress/regress-1365.js

Review URL: http://codereview.chromium.org/7068009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-26 11:07:48 +00:00
ager@chromium.org
98778dc802 Remove execScript from V8. No longer present i neither Firefox nor Safari. 
R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7046002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7948 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-19 08:10:27 +00:00
ricow@chromium.org
964dbff40d Only send null or undefined as receiver for es5 natives, not generally 
for builtin functions.
Review URL: http://codereview.chromium.org/7012012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7879 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-13 07:26:44 +00:00
vitalyr@chromium.org
658e323e87 Micro-optimize passing of args to HasLocalProperty. 
Review URL: http://codereview.chromium.org/7018001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-12 16:19:03 +00:00
ricow@chromium.org
03852da3b8 Remove extra debug line from Object.prototype.toString 
Fixes mozilla failures
Review URL: http://codereview.chromium.org/6935020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-05 05:51:43 +00:00
ricow@chromium.org
e0eb110130 Reapply 7763, including arm and x64 variants. 
The only difference to revision 7763 is the implementation in the
builtins file for arm and x64, plus a move of Array.prototype.toString
and Array.prototype.toLocaleString from should throw on null or
undefined to the non generic test cases in the function-call test (due
to us not currently supporting generic cases with these to functions)
Review URL: http://codereview.chromium.org/6928007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-05 05:21:30 +00:00
ricow@chromium.org
4d890da191 Revert 7763, missing implementation on x64 and arm for call and apply with null or undefined. 
Review URL: http://codereview.chromium.org/6913024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 13:45:19 +00:00
ricow@chromium.org
2b730c2bf6 Don't exchange null and undefined with the global object in function.prototype.{call, apply} for natives. 
This makes us compatible with firefox in throwing an exception when
call is invoked on a builtin with null as the this argument.
Review URL: http://codereview.chromium.org/6902104

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-05-03 13:19:04 +00:00
ricow@chromium.org
e8ff324583 Follow Safari on not throwing when __defineGetter__ fails. 
In addition, this fixes defineOwnProperty to actually not throw when
the should_throw flag is false (we had no usage of this priorly).

Review URL: http://codereview.chromium.org/6695018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7176 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-15 14:19:18 +00:00
ricow@chromium.org
7cb35bcfa5 Reapply 7143 after fixing issue 1250 
Review URL: http://codereview.chromium.org/6698027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-15 12:25:13 +00:00
whesse@chromium.org
f6e1b82fd4 Fix a problem where Object.getOwnPropertyDescriptor and related functions unintentionally called toString on the values of an object's properties. Fixes issue 1233. 
Review URL: http://codereview.chromium.org/6677017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-11 13:57:20 +00:00
ricow@chromium.org
f2730d2ab8 Revert revision 7143, this causes a number of webkit tests to fail. 
This includes a security test. Reverting to investigate further.

Review URL: http://codereview.chromium.org/6673019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-11 09:02:54 +00:00
ricow@chromium.org
fa9e57e326 Change __defineGetter__ and __defineSetter__ to respect non-configurable. 
This makes us compatible with firefox. Earlier on we were somehow
compatible with safari - which will allow defining a getter even when
an existing getter is present and non-configurable. We would, however,
in addition to overwriting the getter also change configurable to
true. The approach used by firefox seems much more sound, i.e., why
should it be possible to use __defineGetter__ or __defineSetter__ to
overwrite a non-configurable getter or setter respectively.

I will file a bug on the webkit bugtracker. 

Review URL: http://codereview.chromium.org/6658037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-11 08:05:59 +00:00
lrn@chromium.org
4707d7ac08 Stop using plain Arrays internally in built-in functions. 
In built-in code we use arrays for internal computations.
This makes it possible to affect the built-in code by putting getters
or setters on the Array prototype chain.
This adds a new internal Array constructor that creates Arrays with
a very simplistic prototype chain that doesn't include any publicly
visible objects. These Arrays shoudl ofcourse never leak outside the
builtins, since that would expose the prototype object.
The prototype object contains only the array functions that we use:
push, pop and join (and not even a toString, so it doesn't stringify
well).

Also change uses of .call to %_CallFunction.

BUG=1206

Review URL: http://codereview.chromium.org/6602081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7040 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-03 11:49:03 +00:00