If object enters NEAR_DEATH state, it must be explicitly cleared and/or disposed, otherwise
it would retain JS object forever. Note as well that parameter is reset to NULL on first
invocation so weak handle callback would be in hard situation.
Review URL: http://codereview.chromium.org/3011009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Changed a static cast from static_cast<int> to static_cast<size_t>
that previously introduced a signed/unsigned comparison issue in the
main allocator for V8 (MemoryAllocator::AllocateRawMemory) that could
be used to bypass the V8 allocation limitations or trigger integer
overflows.
Review URL: http://codereview.chromium.org/3027006/show
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
TYPE_CHECK in v8.h should assign to volatile qualified null-pointer.
Unless the pointer is volatile qualified, Clang will warn that LLVM
removes the assignment during optimization. This is not a problem as
that code should never execute, but the warning is treated as an error
when building Chromium, and thus stops the build.
Code review URL: http://codereview.chromium.org/3005010/show
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5093 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This fixes issue 49099 (http://crbug.com/49099) that makes chromium
crash if a gc is triggered by setting the scopeinfo in CompileLazy. If
this gc triggers code flushing the compiled function could be flushed,
causing the ASSERT(shared->is_compiled()) to fail. By reordering the
two methods we make sure that no allocation happens before the end of
the method.
Review URL: http://codereview.chromium.org/3035006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This includes adding a new inline IsSpecObject method to the code
generator. The old approach was somehow ineffecient since we would
call both IsObject, IsUndetectable and IsFunction to determine if
something was an object according to the spec. This change introduces
a new macro that determines if something is an object according to the
spec (and this does not include null).
This change also corrects a few places where undetectable objects was
not allowed even when they should be (priorly they would use only
IS_SPEC_OBJECT_OR_NULL, which would return false on an undetectable
object, the new IS_SPEC_OBJECT returns true on an undetectable object.
Review URL: http://codereview.chromium.org/2877018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
To trace objects between snapshots, an external map of object tags is
maintained. After the first heap snapshot has been taken, the map is
updated by reporting object moves from the GC. If no snapshots were
taken, there is no overhead (except for flag checking).
I considered graph comparison algorithms that doesn't require using
object tags, but they are all of a high computational complexity, and
will still fail to detect object moves properly, even for trivial
cases, so using tags looks like unavoidable.
Review URL: http://codereview.chromium.org/3020002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Since out internal representation of a property descriptor does not have configurable and writable
attributes Object.isFrozen returns true whenever an object is not extensible.
This change makes use of the right method calls on our internal representation (isWritable() and
isConfigurable()). Tests added directly to the mjsunit test.
Review URL: http://codereview.chromium.org/2904015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5068 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The static ScopeInfo members moved into this class.
The new class is named ScopeInfoObject which I am not proud of,
better ideas are very welcome.
Also got rid of the sentinels in the serialized scope info which saves 3 words per function
and is not slower.
Review URL: http://codereview.chromium.org/2908009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5067 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Use virtually dispatched specialized scavengers instead of single generic ScavengeObjectSlow implementation.
Rollback of r5041 with assertion checking callback alignment removed. Map space is iterated in a special fashion during scavenges so special callback alignment is not required.
Review URL: http://codereview.chromium.org/2950003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5047 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The main fix is for current_state() and external_callback() accessors.
I also applied memory access ordering on current_state_ modification,
mainly to reflect the fact that it is being shared among VM and profiler
sampler threads.
BUG=361
Review URL: http://codereview.chromium.org/2852047
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5035 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
