AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
5,851 Commits 1 Branch 0 Tags 839 MiB
fa69fd0817
Commit Graph

322 Commits

Author SHA1 Message Date
danno@chromium.org
fa69fd0817 Fix opmitized external array access for compound assignments and count operations, also implement missing ARM typed array Hydrogen loads and stores. 
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/6805005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-07 09:51:25 +00:00
antonm@chromium.org
56b53dd5dc Introduce v8::Object::CreationContext method. 
That allows to find out a global context in which the object
was created.

Review URL: http://codereview.chromium.org/6759054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7476 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-04-01 12:17:20 +00:00
ricow@chromium.org
fb6d7e17df Follow jsc on not throwing when trying to add a property to a non-extensible object. 
This change makes us compatible with Safari on not throwing when trying to add a property to a non-extensible object. 
Review URL: http://codereview.chromium.org/6712059

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-28 06:11:08 +00:00
ager@chromium.org
1a9e8d12b9 Correct order of arguments to CHECK_EQ in an API test. 
R=karlklose@chromium.org
BUG=1275
TEST=

Review URL: http://codereview.chromium.org/6713125

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-25 10:34:39 +00:00
danno@chromium.org
fbbace7fbe Fix build 
BUG=none
TEST=none
TBR=ager@chromium.org

Review URL: http://codereview.chromium.org/6732038

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7355 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-24 22:30:53 +00:00
danno@chromium.org
ea45f6719e Support external arrays in Crankshaft 
Add specialized hydrogen and lithium instructions to support loading and storing to external arrays.

Review URL: http://codereview.chromium.org/6656001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-24 22:14:15 +00:00
vitalyr@chromium.org
401b308778 Allow calling stats API functions before we have an isolate. 
Review URL: http://codereview.chromium.org/6733030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-24 19:05:49 +00:00
danno@chromium.org
88854cd712 Remember and reuse derived map for external arrays 
Ensure that all objects that had the same map before attaching an external array have the same map once the external array is attached.

BUG=75639
TEST=fast/canvas/webgl/uninitialized-test.html

Review URL: http://codereview.chromium.org/6685073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-23 09:57:12 +00:00
vitalyr@chromium.org
04537cb227 Use v8::internal threading support in samples/shell.cc. 
We need this for isolates testing. To make it work I had to extend the
internal Thread constructor with an option to set the stack size (see
the comment in shell.cc).

BUG=1264

Review URL: http://codereview.chromium.org/6711068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-21 15:04:17 +00:00
vitalyr@chromium.org
7976ca2cbc Merge isolates to bleeding_edge. 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-18 20:35:07 +00:00
vitalyr@chromium.org
76e226f832 Revert r7268: it borked the history. 
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-18 19:41:05 +00:00
vitalyr@chromium.org
6ff7fdebd3 Merge isolates to bleeding_edge. 
Review URL: http://codereview.chromium.org/6685088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-18 18:49:56 +00:00
antonm@chromium.org
6f45ce4529 Revert r7258 and r7260. 
They apparently break Threading tests on at least Mac and Win64.

TBR=vitalyr@chromium.org

Review URL: http://codereview.chromium.org/6709028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-18 13:24:38 +00:00
antonm@chromium.org
4722f692e4 Make exception thrown via v8 public API propagate to v8::TryCatch as JS thrown exceptions do. 
Correctly process failures which can be returned by Object::GetProperty
when performing GetRealNamedProperty* queries.

Callback properties can produce exceptions so we need to wrap access to them
into exception checks.  However, despite of many other methods with exception
checks, property access doesn't mandatroy go via JavaScript and hence we
need to inject code to propagate exception to public API TryCatch handlers.

Review URL: http://codereview.chromium.org/6397011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-18 12:33:19 +00:00
ager@chromium.org
4f7fe371b2 Fix Array::New(length) in the API to return an array with the provided length. 
The internal factory method initializes the elements but does not set
the length property of the array.

Add array api test case for length.

R=antonm@chromium.org
BUG=v8:1256
TEST=cctest/test-api/Array

Review URL: http://codereview.chromium.org/6674034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7210 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-16 19:55:31 +00:00
antonm@chromium.org
a7bb1d5278 Introduce one way dependencies into object grouping. 
Those are necessary to properly manage relationship between objects in cases
when they don't form proper tree structure.

Review URL: http://codereview.chromium.org/6686053

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-16 12:02:28 +00:00
ricow@chromium.org
fc38a2e509 Do not set value on host objects in Object.defineProperty (fixes issue 1250). 
To be compatible with safari we should not change the value on API
objects in Object.defineProperty (e.g., the window.location object).

Review URL: http://codereview.chromium.org/6673042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-15 09:16:12 +00:00
danno@chromium.org
9cca7d2733 Combine typed and pixel arrays. 
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.

Review URL: http://codereview.chromium.org/6546036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-09 15:01:16 +00:00
mmaly@chromium.org
9dc156ac62 Passing strict mode throughout SetElement. 
Throw if assigning to read only element.
Adding tests for element assignment in strict mode.

Fix tests for strict mode SetElement.

Review URL: http://codereview.chromium.org/6613005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-04 00:21:52 +00:00
mmaly@chromium.org
1d040083b0 Assignment to read only properties throws in strict mode. 
Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-02 04:53:43 +00:00
mmaly@chromium.org
749b69853a Revert "Assignment to read only properties throws in strict mode." 
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353 Assignment to read only properties throws in strict mode. 
Review URL: http://codereview.chromium.org/6594037/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-03-01 01:42:37 +00:00
antonm@chromium.org
4718466e48 Landing for Zaheer. 
Direct call accessor getter callbacks (arm implementation).

Original review: http://codereview.chromium.org/6462029/

Review URL: http://codereview.chromium.org/6576035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-24 15:39:09 +00:00
ager@chromium.org
c2969bfb1a Implement pixel array elements access in the presence of an 
interceptor that does not handle the elements load.

Review URL: http://codereview.chromium.org/6551001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-21 15:59:23 +00:00
ricow@chromium.org
95892799e1 Add access checks to Object.preventExtensions + add regression test for 1027. 
Object.preventExtensions can currently be used cross-domain. With this
change we follow firefox (IE9 has our current behaviour). In addition
this includes a regression test for 1027 and access tests for
Object.seal and Object.freeze.


Review URL: http://codereview.chromium.org/6534019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-18 10:39:02 +00:00
danno@chromium.org
12b4e0efe7 Implement crankshaft support for pixel array stores. 
Review URL: http://codereview.chromium.org/6528013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-16 13:31:12 +00:00
antonm@chromium.org
6b4ff18b5b Properly process try/finally blocks. 
In some circumstances, try/finally block can actually catch the exception:

function f() {
  try {
    throw 42;
  } finally {
    return 0;
  }
}

Therefore when propagating exception to v8::TryCatch, we must be sure
there is no try/finally blocks as well.

When bulding the messages we should be more conservative and expect that
any v8::TryCatch with no JS try/catch in between can potentionally
be the right exception handler.

Plus various minor refactorings.

BUG=1147
TEST=cctest/test-api/TryCatchAndFinallyHidingException, cctest/test-api/TryCatchAndFinally

Review URL: http://codereview.chromium.org/6526016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6809 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-16 11:40:48 +00:00
ricow@chromium.org
4d07390196 Add access check when Object.keys is called on the global js proxy (fixes issue 1154) 
I will land access checks for a range of ES5 features in another patch (we added a bunch of cases like this in the past few weeks, i.e., cases where we simply use the global object instead of the js global proxy).


Review URL: http://codereview.chromium.org/6499013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-15 10:39:22 +00:00
danno@chromium.org
36088cb64f Implement specialized IC code stubs for pixel array stores. 
Review URL: http://codereview.chromium.org/6478027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6781 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-14 21:21:33 +00:00
antonm@chromium.org
5d3430a509 Fix forging of object's identity hashes. 
Do not do standard property lookup on hidden properties object as it might
reach Object.prototype which can be altered to forge identity hashes.
Instead do only local lookup.

Review URL: http://codereview.chromium.org/6472001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-10 14:09:52 +00:00
danno@chromium.org
1bd9f602be Implement crankshaft support for pixel array loads. 
Review URL: http://codereview.chromium.org/6410112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6725 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-10 12:02:36 +00:00
antonm@chromium.org
2f17f3e5d7 Do not invoke any setters when forming stack trace JS object. 
Review URL: http://codereview.chromium.org/6463022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-09 19:34:04 +00:00
antonm@chromium.org
47a22dcecd Reapply http://code.google.com/p/v8/source/detail?r=6555 
Compare JSObjects by identity immediately.

When invoking EQUALS JS builtin, 1st argument is passed as a receiver and
if it's a global object, it gets overwritten with global proxy object and
thus one gets incorrect results.

BUG=v8:1082

TBR=ricow@chromium.org

Review URL: http://codereview.chromium.org/6461028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-09 19:09:26 +00:00
ager@chromium.org
8c6c273236 Fix issues with using defineProperty on the global proxy object. 
Review URL: http://codereview.chromium.org/6452004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-08 16:31:58 +00:00
antonm@chromium.org
aecb05354b Landing for Zaheer Ahmad. 
Direct call api functions (arm implementation)

See: http://codereview.chromium.org/6170001/

Review URL: http://codereview.chromium.org/6286078

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6639 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-04 13:43:38 +00:00
antonm@chromium.org
710fbd2cfb Do proper security checks when accessing elements with getOwnPropertyDescriptor. 
This extends logic applied to regular properties to elements.

Review URL: http://codereview.chromium.org/6246055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-03 18:09:51 +00:00
antonm@chromium.org
73348e83ea Fix array boundary error. 
It made value of allowed_access_type[v8::ACCESS_KEYS] be a wild value.  On most of
platforms it was 0 and tests passed.  But on ARM (and on ia32 if you alter test a bit)
it could become true and hence allow enumeration of properties.

Review URL: http://codereview.chromium.org/6334089

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6618 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-03 13:30:22 +00:00
danno@chromium.org
a2fb4a12bb Create specialized code stubs for PixelArray loads. 
Review URL: http://codereview.chromium.org/6287030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6614 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-03 12:50:50 +00:00
antonm@chromium.org
fed5622671 Better security checks when accessing named properties via Object.getOwnPropertyDescriptor. 
Current approach returns undefined descriptor if caller is not granted v8::HAS_ACCESS.
If the caller has v8::HAS_ACCESS, for no JS accessors regular v8::GET_ACCESS check is
performed and value property of the descriptor is set to undefined if caller doesn't
have proper access.  For JS accessors both v8::GET_ACCESS and v8::SET_ACCESS are checked
and affect if getter and setter would be stored in the descriptor.

Review URL: http://codereview.chromium.org/6286020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-02 17:44:29 +00:00
ager@chromium.org
73a4ecfae1 A MessageObject is a purely internal object to hold information about 
an error message that needs to be generated and reported. This change
hides all of the error information from JavaScript code so user
callbacks cannot get hold of it.

Review URL: http://codereview.chromium.org/6368051

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6574 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-02 13:31:52 +00:00
ricow@chromium.org
0dd951ee84 Revert revision 6555 as it causes win32 debug to fail. 
Review URL: http://codereview.chromium.org/6349044

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6564 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-02 08:14:06 +00:00
antonm@chromium.org
32a631d8bc Compare JSObjects by identity immediately. 
When invoking EQUALS JS builtin, 1st argument is passed as a receiver and
if it's a global object, it gets overwritten with global proxy object and
thus one gets incorrect results.

BUG=v8::1082

Review URL: http://codereview.chromium.org/6287018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6555 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-01 13:29:37 +00:00
ager@chromium.org
471c0d2983 Avoid callbacks to user code during error formatting in a couple of 
other situations.

Do not use overwritten Object.prototype.hasOwnProperty and
Array.prototype.pop. Do not use split and join in the error formatting
implementation. They are too big to control and their generality is
not needed.

Review URL: http://codereview.chromium.org/6287041

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-02-01 12:31:16 +00:00
antonm@chromium.org
1023f569b9 Perform security checks before fetching the value in Object.getOwnPropertyDescriptor. 
Review URL: http://codereview.chromium.org/6386022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6539 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-31 13:49:15 +00:00
kmillikin@chromium.org
78b9981b90 Revert "Add custom typed ICs for pixel array loads. " 
This change caused failures in (out of bounds) keyed loads of strings.

TBR'd.

Review URL: http://codereview.chromium.org/6298019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6528 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-28 15:07:04 +00:00
danno@chromium.org
afd0906204 Add custom typed ICs for pixel array loads. 
Review URL: http://codereview.chromium.org/6323002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-28 14:06:20 +00:00
ager@chromium.org
f8b74a1541 Avoid using Function.prototype.call in a number of places in our 
builtins files. We should always use %_CallFunction for a couple of
reasons: it cannot be overwritten and it does not wrap basic types in
wrapper objects.

Review URL: http://codereview.chromium.org/6349018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6524 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-28 10:33:10 +00:00
ager@chromium.org
eb3970c822 Fix another message object leak. 
Review URL: http://codereview.chromium.org/6269021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-26 15:16:13 +00:00
ager@chromium.org
d69ef26f7d Another fix for leaking error objects. User code can overwrite 
ReferenceError.prototype.__proto__ which will make "error instanceof
Error" fail. However, the ReferenceError.prototype object itself
cannot be modified. Therefore, the error checks must check for
concrete error instances instead of only checking for Error.

Review URL: http://codereview.chromium.org/6388003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6450 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-25 08:48:59 +00:00
ager@chromium.org
b5151d118d Avoid calling overwritten toString methods for internal error 
formatting. I missed a couple of places. Extracting the error object
check to a separate function.

Review URL: http://codereview.chromium.org/6304015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6435 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2011-01-24 07:59:40 +00:00