Commit Graph

97 Commits

Author SHA1 Message Date
feng@chromium.org
736c7a9d35 Some debugging support fixes on ARM simulator port.
1) Let SaveContext remember the top JS frame stack pointer so it works in simulator where C stack and JS stack are separated;
2) Use the new calling convension in %DebugBreakCallHelper function;

Review URL: http://codereview.chromium.org/10663

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@774 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-17 17:44:16 +00:00
kasperl@chromium.org
7940adb1ec Track loop nesting across function calls when the function
is called through an IC the first time.
Review URL: http://codereview.chromium.org/10746

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-17 05:50:52 +00:00
erik.corry@gmail.com
b4e7335c0c Removed some unsafe uses of StringShape.
Simplified some uses of StringShape.
Removed unused function SlicedStringFlatten.
Review URL: http://codereview.chromium.org/9408

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@695 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-05 10:26:08 +00:00
ager@chromium.org
439f3e6708 Do not put failures in handles.
Assert in the Handle constructor that the object is not a failure.

I have run our own tests in debug mode and the WebKit layout tests in
debug mode and there are no regressions.
Review URL: http://codereview.chromium.org/9114

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-04 16:23:56 +00:00
lrn@chromium.org
4e3bbd8247 If a HeapNumber is the incoming value, it must be converted to Smi before
checking. This is not done in a fast way.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-03 13:33:13 +00:00
erik.corry@gmail.com
c390485090 Fix place where linter complains about lonely {
Fix place where ARM compiler loses track of whether variables were initialized.
Review URL: http://codereview.chromium.org/9244

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-03 12:08:01 +00:00
erik.corry@gmail.com
eca89dc765 Create an abstraction for the string type flags so that they can be cached.
Read the objects.h change first to understand what's going on here.
Review URL: http://codereview.chromium.org/9038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@675 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-11-03 10:16:05 +00:00
olehougaard
bf3efa1c72 Fixing propertyIsEnumerable for properties that are *both* enumerable and read-only.
Review URL: http://codereview.chromium.org/8962

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-31 11:53:29 +00:00
olehougaard
77a92988d2 Introduce access control in propertyIsEnumerable.
Also, fix JSObject::getPropertyAttribute() so it deals correctly with access control modifiers.
Review URL: http://codereview.chromium.org/8834

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-31 09:42:14 +00:00
kasperl@chromium.org
744aedd2d0 Fix natives fuzzing: Let the StringIndexOf runtime function
deal with start indexes that are out of range.
Review URL: http://codereview.chromium.org/8762

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-31 08:51:26 +00:00
ager@chromium.org
2013421859 Add support for API accessors that prohibit overwriting by accessors
defined in JavaScript code by using __defineGetter__ and
__defineSetter__.

Also, disable access checks when configuring objects created from
templates.
Review URL: http://codereview.chromium.org/8914

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@656 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-30 12:51:06 +00:00
ager@chromium.org
69e8060636 Move assertion that might cause garbage collections to before
extracting raw pointers.
Review URL: http://codereview.chromium.org/8913

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@654 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-30 11:38:22 +00:00
kasperl@chromium.org
a2be3b6f84 Make sure that allocations through CALL_HEAP_FUNCTION
and runtime calls from JavaScript will always succeed
eventually if we have enough memory.
Review URL: http://codereview.chromium.org/8700

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-30 09:15:58 +00:00
kasperl@chromium.org
a26b3535de Allow three runtime call attempts before throwing an out of
memory exception. Still needs work in Runtime_PerformGC to
make sure we'll allow future allocations.
Review URL: http://codereview.chromium.org/8873

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-29 12:16:34 +00:00
whessev8
28cee257b6 Remove unused maps during marking garbage collections.
Review URL: http://codereview.chromium.org/8831

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@637 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-29 10:37:14 +00:00
kasperl@chromium.org
b5fe75f950 Fix issue with Array.concat not preserving holes in the
top-level arrays.
Review URL: http://codereview.chromium.org/8694

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-29 10:02:09 +00:00
feng@chromium.org
d0b263c37b Fix the lint error.
TBR=iposva

Review URL: http://codereview.chromium.org/8664

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@629 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-28 17:32:01 +00:00
feng@chromium.org
6ac8e45528 Check that an index is in the range of 0 to array length in ArrayConcatVisitor.
Elements out of range are discarded.

Review URL: http://codereview.chromium.org/8836

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@628 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-28 17:23:10 +00:00
feng@chromium.org
91dffb0c4e fix build error in debug mode, TBR=iposva
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-28 16:27:09 +00:00
kasperl@chromium.org
51058d276f Fix lint issues.
TBR=feng@chromium.org
Review URL: http://codereview.chromium.org/8659

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-28 14:54:52 +00:00
feng@chromium.org
4c1a5810b9 Implement Array::concat function in C++.
The performance of Array::concat is critical of jQuery benchmark from
http://www.dromaeo.com. Our current implementation in JavaScript is very
generic and is several times slower than JSC and SpiderMonkey.

Re-implement Array::concat in C++ to take advantage of underlying implementation
details. This cuts dom-travesal-jquery execution time by half.

We may want to move Array specific implementation into a separate source file,
say jsarray.cc.

Review URL: http://codereview.chromium.org/7990

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@625 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-28 14:47:50 +00:00
whesse@chromium.org
d08b095bce Revert changes 601 and 602. TBR
Review URL: http://codereview.chromium.org/8190

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@605 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-27 12:45:24 +00:00
whesse@chromium.org
724f5648b9 Rewrites a ternary choice operator to fix a compiler
linkage bug.

Review URL: http://codereview.chromium.org/8189

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-27 12:24:22 +00:00
whesse@chromium.org
6941a4f389 Collects unused maps that are only kept alive by map transitions.
If a map has descendents in the map transition tree that are alive,
it is kept.  Only maps such that they and all their descendants
have no live objects are collected.  This happens in mark-sweep and
mark-compact garbage collections.
Review URL: http://codereview.chromium.org/8099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-27 11:55:31 +00:00
kasperl@chromium.org
c128b8d9de Improve code for looking up in context slots in runtime.cc and
use safe casting operations to slot access on contexts when
possible.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-24 10:59:40 +00:00
kmillikin@chromium.org
681ae19bd4 Change a few runtime functions that took and returned a dummy argument
to instead take no arguments and return the undefined value.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-24 10:13:22 +00:00
bak@chromium.org
d296a22917 - Fixed performance regression caused by ComputeContextSlotReceiver.
- Eliminated a few write barriers.

Review URL: http://codereview.chromium.org/8103

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 14:55:45 +00:00
bak@chromium.org
187879a25a - Added conditional write barrier to object accessors.
- Sped up allocation of Arguments object.

Review URL: http://codereview.chromium.org/8098

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@567 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 08:46:32 +00:00
kasperl@chromium.org
b727198587 Fix issue 124 by computing the receiver correctly when
the property is found in a context slot.
Review URL: http://codereview.chromium.org/8097

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@566 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 08:42:22 +00:00
christian.plesner.hansen@gmail.com
c7ed0707a3 - Added const in a few places.
- Changed WeakReferenceCallback to take a Persistent<Value> instead of
  a Persistent<Object>.
- Removed Message::GetUnderline and Message::GetScriptData.
- Added Value::IsDate, Date::Cast and Date::Value.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 08:25:23 +00:00
erik.corry@gmail.com
dbc6dd66e4 Fix some style issues.
Review URL: http://codereview.chromium.org/8055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@563 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 07:28:21 +00:00
ager@chromium.org
8e0979e2ff Introduce a lookup cache class in the runtime system and use it for
keyed loads that enter the runtime.

Review URL: http://codereview.chromium.org/7879

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-23 07:04:56 +00:00
christian.plesner.hansen@gmail.com
b338967098 Replaced the implementation of %StringEquals, which was a poorly
optimized duplicate of String::Equals, with a simple call to
String::Equals.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@555 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-22 12:33:20 +00:00
bak@chromium.org
b26322d4c1 - Applied FixedArray::WriteBarrierMode to NewArgumentsFast.
Review URL: http://codereview.chromium.org/8052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@551 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-22 09:47:20 +00:00
erik.corry@gmail.com
1aae797ddd Use direct copy and templates to speed up flattening of strings.
Review URL: http://codereview.chromium.org/8011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@549 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-22 09:09:07 +00:00
bak@chromium.org
bf948c8313 - Optimized CopyFixedArray and CopyJSObject.
- Refactored block copying.

Review URL: http://codereview.chromium.org/7863

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-22 08:21:18 +00:00
feng@chromium.org
42ef2c3d77 Split window support from V8.
Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr

This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.

V8 support of split window:
  There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;

  V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.

  Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.

  When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.


It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.

I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.


Review URL: http://codereview.chromium.org/7366

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-21 19:07:58 +00:00
bak@chromium.org
617bdc34a4 - Specialized IsClassOf for Number, Boolean, Arguments, and Function.
Review URL: http://codereview.chromium.org/7475

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@520 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-17 11:33:04 +00:00
lrn@chromium.org
dc87d51f70 Changed Boyer-Moore's bad-char table code:
- Reduce it to half size if the pattern is ASCII, saving on initialization
- If pattern is ASCII and subject is not, any non-ASCII char can cause a
  full pattern-length shift, even if we haven't indexed the entire pattern.
- Use memset to initialize buffer in the common case where the pattern is
  shorter than the max significant suffix limit.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-17 11:15:54 +00:00
lrn@chromium.org
c04546333a * Special case for last char in BM-match
* Patch from Erik Corry to separate BM-algoritm into special case
  functions. Also changes condition for bailing out of simple search.
* Added simple search with no bailout for very short patterns.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-16 11:33:19 +00:00
whesse@chromium.org
f12e120463 Fixes bug 1426704.
Constructors no longer print out their source code.  They print [native code]
instead.  Some web applications don't like constructors with complex ToString
results.
Review URL: http://codereview.chromium.org/7345

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@506 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-15 10:22:26 +00:00
iposva@chromium.org
d09fcf70b7 Allocate room for expected number of properties based on the
constructor in the JSObject. This removes the need to allocate
a properties array if the object is never assigned any extra
properties.

Review URL: http://codereview.chromium.org/7341

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@501 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-15 06:03:26 +00:00
lrn@chromium.org
be10124ab5 Test for non-ASCII character in a needle used on an ASCII string is now handled first
instead of only in the unrelated table-construction of Boyer-Moore.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 14:25:37 +00:00
lrn@chromium.org
c54b5e5d9b Selecting between simple text search and Boyer-Moore now happens by trying
the simple search and bailing out and continuing with Boyer-Moore if the simple
version seems too expensive.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@498 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 14:02:48 +00:00
lrn@chromium.org
19fceabff0 The BoyerMooreStringSearch now uses separate functions to build its tables.
This hightens readability.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@497 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 13:25:54 +00:00
lrn@chromium.org
51c7fa95ce Boyer-Moore delayes computation of Good-Suffix table until bad-char has shown itself
to be insufficient.x
Changed order of tests in loop in simple text search.
Changed limit on pattern length for when we pick simple search.


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@496 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 12:45:06 +00:00
christian.plesner.hansen@gmail.com
a601594796 Fixed bug 114
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 09:13:23 +00:00
lrn@chromium.org
9e0609db8e Most operations are faster than before.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@492 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-14 08:57:31 +00:00
bak@chromium.org
80098968d8 - Inlined JSArray::SetContent.
- Implemented Runtime_KeyedGetProperty to make slow case faster.

Review URL: http://codereview.chromium.org/7226

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@487 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-10 10:27:44 +00:00
kasperl@chromium.org
be8762564e Introduce a special kind of frames for construct frames, e.g.
the trampoline frames introduced for invoking functions through
the new keyword.
Review URL: http://codereview.chromium.org/7223

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2008-10-10 09:09:38 +00:00