Commit Graph

576 Commits

Author SHA1 Message Date
ager@chromium.org
4f5de28a9b Avoid TLS access for counters.
Get rid of the COUNTERS macro and fetch the counters from a locally
stored isolate instead.

R=karlklose@chromium.org

Review URL: http://codereview.chromium.org/6723014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7321 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 11:13:07 +00:00
danno@chromium.org
88854cd712 Remember and reuse derived map for external arrays
Ensure that all objects that had the same map before attaching an external array have the same map once the external array is attached.

BUG=75639
TEST=fast/canvas/webgl/uninitialized-test.html

Review URL: http://codereview.chromium.org/6685073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7318 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-23 09:57:12 +00:00
fschneider@chromium.org
8066271fd2 Optimize calls to object literal properties that are initialized with a function literal.
This allows fast calls and inlining of functions like:

var o = {f: function() { return "foo"; }}
o.f();


Object literals that contain function literals are initially created a dictionary mode
object and only transformed to fast properties once all properties are computed and
added. This allows us to create constant function properties for functions declared
inside the object literal. Function literals inside object literals are marked for
pretenuring so that they work as contant function properties.

Object literals without functions should just function as before.

Review URL: http://codereview.chromium.org/6240012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7283 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-21 12:25:31 +00:00
vitalyr@chromium.org
2d196e6393 Avoid TLS accesses in QuoteJsonString.
Review URL: http://codereview.chromium.org/6713056

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 23:55:11 +00:00
vitalyr@chromium.org
7976ca2cbc Merge isolates to bleeding_edge.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7271 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 20:35:07 +00:00
vitalyr@chromium.org
76e226f832 Revert r7268: it borked the history.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 19:41:05 +00:00
vitalyr@chromium.org
6ff7fdebd3 Merge isolates to bleeding_edge.
Review URL: http://codereview.chromium.org/6685088

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7268 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-18 18:49:56 +00:00
mmaly@chromium.org
4cbf3478d8 Implement strict mode ThrowTypeError functions for arguments object.
* Reverse order of arguments in-object fields for length and callee.
* Introduce arguments ThrowTypeError functions (caller/callee).
* Create strict mode arguments boilerplate object.
* Strict mode "new arguments object" stub.
* Runtime arguments object allocation.
* Update es5conform test expectations.

Review URL: http://codereview.chromium.org/6698015/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-17 20:28:41 +00:00
mmaly@chromium.org
1d1018aec7 Strict mode ThrowTypeError functions for
- function.caller
- function.arguments

Review URL: http://codereview.chromium.org/6694044/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7250 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-17 20:28:17 +00:00
mmaly@chromium.org
d12d1c40cc Strict mode renames and formatting cleanup.
BUG=
TEST=

Review URL: http://codereview.chromium.org/6693014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 18:20:10 +00:00
ager@chromium.org
6428822811 Revert "Strict mode ThrowTypeError functions for"
TBR=mmaly@chromium.org

Review URL: http://codereview.chromium.org/6696018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 11:01:21 +00:00
ricow@chromium.org
fc38a2e509 Do not set value on host objects in Object.defineProperty (fixes issue 1250).
To be compatible with safari we should not change the value on API
objects in Object.defineProperty (e.g., the window.location object).

Review URL: http://codereview.chromium.org/6673042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-15 09:16:12 +00:00
mmaly@chromium.org
80bd958df2 Strict mode ThrowTypeError functions for
- function.caller
- function.arguments

Review URL: http://codereview.chromium.org/6691003/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7168 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-14 17:46:37 +00:00
danno@chromium.org
9cca7d2733 Combine typed and pixel arrays.
Worth mentioning:
- Specialized versions of pixel array and store/loads inside the generic stubs have been removed, since to have parity for all external arrays, 8 different versions would have to be inlined/checked.
- There's a new constant in v8.h for external arrays with pixel array elements.

Review URL: http://codereview.chromium.org/6546036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-09 15:01:16 +00:00
ricow@chromium.org
da9fe0f961 Remove GetProvidedParametersCount from JavaScriptFrame, it simply calls ComputeParametersCount.
Review URL: http://codereview.chromium.org/6635042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7092 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-08 14:18:28 +00:00
mmaly@chromium.org
88b60ebc24 Fix presubmit.
TBR=ager@chromium.org

BUG=
TEST=

Review URL: http://codereview.chromium.org/6603032

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7054 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 00:28:54 +00:00
mmaly@chromium.org
9dc156ac62 Passing strict mode throughout SetElement.
Throw if assigning to read only element.
Adding tests for element assignment in strict mode.

Fix tests for strict mode SetElement.

Review URL: http://codereview.chromium.org/6613005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-04 00:21:52 +00:00
mmaly@chromium.org
30bd09cbd6 Renaming strict to strict_mode for uniformity.
Review URL: http://codereview.chromium.org/6611003/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 16:17:28 +00:00
lrn@chromium.org
8fddb2a664 Handled return-value of SetElement in some cases, or avoided it in other.
SetElement can cause an exception to be thrown. If its return value
isn't checked, this exception might not be handled at the correct time.
In some cases, it's a matter of returning Exception::Failure() from
a runtime function.
In other cases, code using SetElement on a JSArray has been changed
to setting directly on a FixedArray and only creating the JSArray
at the end.

Review URL: http://codereview.chromium.org/6588130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7039 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-03 10:16:22 +00:00
sgjesse@chromium.org
8481a75698 Adding debugger interface and runtime functions hooks for supporting
LiveObjectList functionality.

Patch by Mark Lam from Hewlett-Packard Development Company, LP

Review URL: http://codereview.chromium.org/6351007


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7011 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 08:10:38 +00:00
mmaly@chromium.org
1d040083b0 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

Revert "Revert "Assignment to read only properties throws in strict mode.""

This reverts commit aefcd82e1d36d458dd071ebf4777340f08aa67b1.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7007 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-02 04:53:43 +00:00
vitalyr@chromium.org
d9b0c93d23 Allow eval to be overridden with a callable non-function object.
We simply need to remove early checks in the resolve eval runtime
functions. CallFunctionStub that follows will handle non-functions in
the right way.

Review URL: http://codereview.chromium.org/6591075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7005 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 19:05:06 +00:00
lrn@chromium.org
6475f8d7e5 Remove HandleCell and use GlobalHandle and HandleScope::Escape instead.
Added HandleScope::Escape to HandleScope to allow exiting a value
from a scope.

Review URL: http://codereview.chromium.org/6594075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6993 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 14:00:55 +00:00
vegorov@chromium.org
97aecae1cb Fix several evaluation order sensitive GC-unsafe places.
Review URL: http://codereview.chromium.org/6596070

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6991 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 13:16:57 +00:00
ricow@chromium.org
c63d9c97cf Do not allow non-configurable global properties to be made configurable (fixes issue 1213).
We do not currently check that a global property is actually
configurable before overwriting it with a new property.


Review URL: http://codereview.chromium.org/6597045

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6978 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 08:09:17 +00:00
mmaly@chromium.org
749b69853a Revert "Assignment to read only properties throws in strict mode."
This reverts commit 503f2a501e504f330821f247074e731aa649b1f0.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6977 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 06:10:41 +00:00
mmaly@chromium.org
98aea3c353 Assignment to read only properties throws in strict mode.
Review URL: http://codereview.chromium.org/6594037/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6976 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-03-01 01:42:37 +00:00
lrn@chromium.org
485f4ea0d9 Clear exceptions set during attempts to lazily optimize.
Resubmit of patch for issue 1145 with a few additions:
- Now also clears exceptions when calling Runtime_LazyRecompile.
- Sets function where parsing fails to not be optimizable.

BUG=v8:1145
TEST=test/mjsunit/regress/regress-1145.js

Review URL: http://codereview.chromium.org/6469050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-25 11:17:31 +00:00
ricow@chromium.org
65e4a08793 Fix compile failure from revision 6934 and win64 compile failure from revision 6931.
Review URL: http://codereview.chromium.org/6576033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6935 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 14:22:36 +00:00
lrn@chromium.org
68f1c73a06 Fix array concat to follow the specification in the presence of element getters.
Also fix issue 1175 and 1177.

BUG=v8:1175

Review URL: http://codereview.chromium.org/6568007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-24 14:00:52 +00:00
antonm@chromium.org
e79bfcaf3f Use [[DefineOwnProperty]] to put 'constructor' field on the protoype object.
That better follows ECMA-262 (see 13.2 Creating Function Objects) and allows
to ignore nasty JS accessors for 'constructor' property.

BUG=v8:1172
TEST=test/mjsunit/regress/regress-1172.js

Review URL: http://codereview.chromium.org/6531037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 10:53:38 +00:00
ricow@chromium.org
95892799e1 Add access checks to Object.preventExtensions + add regression test for 1027.
Object.preventExtensions can currently be used cross-domain. With this
change we follow firefox (IE9 has our current behaviour). In addition
this includes a regression test for 1027 and access tests for
Object.seal and Object.freeze.


Review URL: http://codereview.chromium.org/6534019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6848 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-18 10:39:02 +00:00
ager@chromium.org
963472c516 Change behavior of global declarations in the presence of setters.
Call accessors in the global object prototype when initializing global
variables. Function declarations are special cased for compatibility
with Safari and setters are not called for them. If this special
casing was not done webkit layout tests would fail.

Make the declaration of global const variables in the presence of
callbacks a redeclaration error.

Handle const context slot declarations conflicting with a CALLBACK as
a redeclaration error. That is, unless it is on a context extension
object which is not a real object and therefore conceptually have no
accessors in prototype chains. Accessors in prototype chains of
context extension objects are explicitly ignored in SetProperty.

Review URL: http://codereview.chromium.org/6534029

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6846 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 21:04:53 +00:00
ager@chromium.org
65addc5165 Revert change to const and global variable declarations. It causes
may WebKit layout test failures.

I will look into it tomorrow.
TBR=kmillikin@chromium.org

Review URL: http://codereview.chromium.org/6537021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6843 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 16:54:49 +00:00
ager@chromium.org
dc38755aba Call accessors in the global object prototype when initializing global
variables.

Make the declaration of global const variables in the presence of
callbacks a redeclaration error.

Handle const context slot declarations conflicting with a CALLBACK as
a redeclaration error. That is, unless it is on a context extension
object which is not a real object and therefore conceptually have no
accessors in prototype chains. Accessors in prototype chains of
context extension objects are explicitly ignored in SetProperty.

Review URL: http://codereview.chromium.org/6519050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6841 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 16:30:15 +00:00
lrn@chromium.org
246560b902 Revert 6832.
The test contains a syntax error that shouldn't be detected, but it sometimes is.

TBR: kmillikin@chromium.org

Review URL: http://codereview.chromium.org/6519049

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6836 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 14:13:25 +00:00
lrn@chromium.org
cf50c5e27c Handle exceptions thrown while parsing lazy functions for inlining.
We currently leave the exception as pending without returning a Failure::Exception() value. This is either caught immediately if running with --debug-code, or caught later by an assert in debug mode.

This change makes the pending exception be cleared before returning from the failed optimization attempt.

BUG=v8::1145
TEST=test/mjsunit/regress/regress-1145.js

Review URL: http://codereview.chromium.org/6524039

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-17 12:23:18 +00:00
vitalyr@chromium.org
4143e4c097 Fix issue 1160: check array elements in ArrayJoin.
Review URL: http://codereview.chromium.org/6529020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 15:12:51 +00:00
vitalyr@chromium.org
54e7423007 Fix issue 1152: temporary JS array invariant violation in ArrayConcat.
Review URL: http://codereview.chromium.org/6524010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 13:53:30 +00:00
ricow@chromium.org
4d07390196 Add access check when Object.keys is called on the global js proxy (fixes issue 1154)
I will land access checks for a range of ES5 features in another patch (we added a bunch of cases like this in the past few weeks, i.e., cases where we simply use the global object instead of the js global proxy).


Review URL: http://codereview.chromium.org/6499013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-15 10:39:22 +00:00
mmaly@chromium.org
9adaeb6a17 Strict mode delete of non-configurable property.
Strict mode flag is passed to runtime DELETE function
and then to JSObject::Delete(Property/Element) as STRICT_DELETION enum.
When deleting non-configurable property/eleemnt, TypeError is thrown.
Adding mozilla test to .gitignore.
Incorporate CR feedback.

Review URL: http://codereview.chromium.org/6515005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 23:41:47 +00:00
antonm@chromium.org
186d832c79 Introduce new runtime function to make join with lower memory usage.
Do not use generic StringBuilderConcat which requires array passed
to keep both elements and separator (which roughly double size
of the array).  That should be faster as well.

BUG=crbug.com/54580

Review URL: http://codereview.chromium.org/6520004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 17:25:12 +00:00
ricow@chromium.org
34eeb88ee4 Use ForceSetObjectProperty in DefineOrRedefineDataProperty (fixes crbug 72736).
The current version uses SetObjectProperty which will not set the
value in case this is a readonly property. The spec explictly says
that a configurable but non writable property can have its value
changed with Object.defineProperty (because the same thing can be
accomplished by doing 3 calls (set writable to true, update the value,
set writable to false).


Review URL: http://codereview.chromium.org/6518004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 10:43:21 +00:00
ricow@chromium.org
46bde305b5 Add support for the global object in Object.keys (fixes issue 1150)
We do not currently handle the case where the JSGlobalProxy is passed
as argument to LocalKeys in runtime.cc.

Review URL: http://codereview.chromium.org/6516008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 07:49:13 +00:00
sgjesse@chromium.org
e3fd635f26 Small cleanup of bug ids
Review URL: http://codereview.chromium.org/6486028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-11 10:36:58 +00:00
antonm@chromium.org
2a25c444d5 Fix various places which do not check if SetProperty threw an exception.
Review URL: http://codereview.chromium.org/6480003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6729 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-10 14:41:16 +00:00
antonm@chromium.org
d724993138 Use GC-safe version when setting elements.
BUG=1125
TEST=test/mjsunit/regress/regress-1125.js

Review URL: http://codereview.chromium.org/6463001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6693 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-09 11:38:10 +00:00
antonm@chromium.org
da8b72f2b8 1) Return failure if any of property sets failed;
2) We cannot assert the declared property will go to the extension in the presence of callbacks and interceptors.

BUG=1119
TEST=test/mjsunit/regress/regress-1119.js

Review URL: http://codereview.chromium.org/6454011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 19:04:17 +00:00
ager@chromium.org
8c6c273236 Fix issues with using defineProperty on the global proxy object.
Review URL: http://codereview.chromium.org/6452004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6683 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 16:31:58 +00:00
lrn@chromium.org
2f32f27e8f Correct propagation of exceptions from setters.
BUG=v8:1105
TEST=test/mjsunit/regress/regress-1105.js

Review URL: http://codereview.chromium.org/6451003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6680 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-08 14:04:27 +00:00