Author: [EMAIL PROTECTED]
Date: Thu Nov 20 01:54:20 2008
New Revision: 801
Modified:
branches/0.3/ChangeLog
branches/0.3/src/api.cc
branches/0.3/src/flag-definitions.h
branches/0.3/src/ic-arm.cc
branches/0.3/src/ic-ia32.cc
branches/0.3/test/cctest/test-api.cc
Log:
Merge revision 799 and 800 to 0.3 branch version 0.3.9.2.
Removed ChangeLog entry that should not be in the 0.3 branch.
Modified: branches/0.3/ChangeLog
==============================================================================
--- branches/0.3/ChangeLog (original)
+++ branches/0.3/ChangeLog Thu Nov 20 01:54:20 2008
@@ -1,31 +1,3 @@
-2008-10-23: Version 0.4.0
-
- Split the global object into two parts: The state holding global
- object and the global object proxy.
-
- Fixed bug that affected the value of an assignment to an element
- in certain cases (issue 116).
-
- Added GetPropertyNames functionality (issue 33) and extra Date
- functions (issue 77) to the API.
-
- Changed WeakReferenceCallback to take a Persistent<Value> instead
- of a Persistent<Object> (issue 101).
-
- Fixed issues with message reporting for exceptions in try-finally
- blocks (issues 73 and 75).
-
- Optimized flattening of strings and string equality checking.
-
- Improved Boyer-Moore implementation for faster indexOf operations.
-
- Added development shell (d8) which includes counters and
- completion support.
-
- Fixed problem with the receiver passed to functions called from
- eval (issue 124).
-
-
2008-10-16: Version 0.3.5
Improved string hash-code distribution by excluding bit-field bits
Modified: branches/0.3/src/api.cc
==============================================================================
--- branches/0.3/src/api.cc (original)
+++ branches/0.3/src/api.cc Thu Nov 20 01:54:20 2008
@@ -2223,7 +2223,7 @@
const char* v8::V8::GetVersion() {
- return "0.3.9.1";
+ return "0.3.9.2";
}
Modified: branches/0.3/src/flag-definitions.h
==============================================================================
--- branches/0.3/src/flag-definitions.h (original)
+++ branches/0.3/src/flag-definitions.h Thu Nov 20 01:54:20 2008
@@ -134,7 +134,7 @@
DEFINE_int(gc_interval, -1, "garbage collect after <n> allocations")
DEFINE_bool(trace_gc, false,
"print one trace line following each garbage collection")
-DEFINE_bool(collect_maps, true,
+DEFINE_bool(collect_maps, false,
"garbage collect maps from which no objects can be reached")
// ic.cc
Modified: branches/0.3/src/ic-arm.cc
==============================================================================
--- branches/0.3/src/ic-arm.cc (original)
+++ branches/0.3/src/ic-arm.cc Thu Nov 20 01:54:20 2008
@@ -124,6 +124,32 @@
}
+// Helper function used to check that a value is either not a function
+// or is loaded if it is a function.
+static void GenerateCheckNonFunctionOrLoaded(MacroAssembler* masm,
+ Label* miss,
+ Register value,
+ Register scratch) {
+ Label done;
+ // Check if the value is a Smi.
+ __ tst(value, Operand(kSmiTagMask));
+ __ b(eq, &done);
+ // Check if the value is a function.
+ __ ldr(scratch, FieldMemOperand(value, HeapObject::kMapOffset));
+ __ ldrb(scratch, FieldMemOperand(scratch, Map::kInstanceTypeOffset));
+ __ cmp(scratch, Operand(JS_FUNCTION_TYPE));
+ __ b(ne, &done);
+ // Check if the function has been loaded.
+ __ ldr(scratch,
+ FieldMemOperand(value, JSFunction::kSharedFunctionInfoOffset));
+ __ ldr(scratch,
+ FieldMemOperand(scratch,
SharedFunctionInfo::kLazyLoadDataOffset));
+ __ cmp(scratch, Operand(Factory::undefined_value()));
+ __ b(ne, miss);
+ __ bind(&done);
+}
+
+
void LoadIC::GenerateArrayLength(MacroAssembler* masm) {
// ----------- S t a t e -------------
// -- r2 : name
@@ -342,6 +368,12 @@
__ cmp(r0, Operand(JS_FUNCTION_TYPE));
__ b(ne, &miss);
+ // Check that the function has been loaded.
+ __ ldr(r0, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
+ __ ldr(r0, FieldMemOperand(r0, SharedFunctionInfo::kLazyLoadDataOffset));
+ __ cmp(r0, Operand(Factory::undefined_value()));
+ __ b(ne, &miss);
+
// Patch the function on the stack; 1 ~ receiver.
__ str(r1, MemOperand(sp, (argc + 1) * kPointerSize));
@@ -447,6 +479,7 @@
__ bind(&probe);
GenerateDictionaryLoad(masm, &done, &miss, r1, r0);
+ GenerateCheckNonFunctionOrLoaded(masm, &miss, r0, r1);
__ Ret();
// Global object access: Check access rights.
Modified: branches/0.3/src/ic-ia32.cc
==============================================================================
--- branches/0.3/src/ic-ia32.cc (original)
+++ branches/0.3/src/ic-ia32.cc Thu Nov 20 01:54:20 2008
@@ -41,7 +41,7 @@
#define __ masm->
-// Helper function used from LoadIC/CallIC GenerateNormal.
+// Helper function used to load a property from a dictionary backing
storage.
static void GenerateDictionaryLoad(MacroAssembler* masm, Label* miss_label,
Register r0, Register r1, Register r2,
Register name) {
@@ -121,6 +121,29 @@
}
+// Helper function used to check that a value is either not a function
+// or is loaded if it is a function.
+static void GenerateCheckNonFunctionOrLoaded(MacroAssembler* masm, Label*
miss,
+ Register value, Register
scratch) {
+ Label done;
+ // Check if the value is a Smi.
+ __ test(value, Immediate(kSmiTagMask));
+ __ j(zero, &done, not_taken);
+ // Check if the value is a function.
+ __ mov(scratch, FieldOperand(value, HeapObject::kMapOffset));
+ __ movzx_b(scratch, FieldOperand(scratch, Map::kInstanceTypeOffset));
+ __ cmp(scratch, JS_FUNCTION_TYPE);
+ __ j(not_equal, &done, taken);
+ // Check if the function has been loaded.
+ __ mov(scratch, FieldOperand(value,
JSFunction::kSharedFunctionInfoOffset));
+ __ mov(scratch,
+ FieldOperand(scratch, SharedFunctionInfo::kLazyLoadDataOffset));
+ __ cmp(scratch, Factory::undefined_value());
+ __ j(not_equal, miss, not_taken);
+ __ bind(&done);
+}
+
+
void LoadIC::GenerateArrayLength(MacroAssembler* masm) {
// ----------- S t a t e -------------
// -- ecx : name
@@ -236,6 +259,7 @@
__ j(not_zero, &slow, not_taken);
// Probe the dictionary leaving result in ecx.
GenerateDictionaryLoad(masm, &slow, ebx, ecx, edx, eax);
+ GenerateCheckNonFunctionOrLoaded(masm, &slow, ecx, edx);
__ mov(eax, Operand(ecx));
__ IncrementCounter(&Counters::keyed_load_generic_symbol, 1);
__ ret(0);
@@ -481,6 +505,12 @@
__ cmp(edx, JS_FUNCTION_TYPE);
__ j(not_equal, &miss, not_taken);
+ // Check that the function has been loaded.
+ __ mov(edx, FieldOperand(edi, JSFunction::kSharedFunctionInfoOffset));
+ __ mov(edx, FieldOperand(edx, SharedFunctionInfo::kLazyLoadDataOffset));
+ __ cmp(edx, Factory::undefined_value());
+ __ j(not_equal, &miss, not_taken);
+
// Invoke the function.
ParameterCount actual(argc);
__ InvokeFunction(edi, actual, JUMP_FUNCTION);
@@ -583,6 +613,7 @@
// Search the dictionary placing the result in eax.
__ bind(&probe);
GenerateDictionaryLoad(masm, &miss, edx, eax, ebx, ecx);
+ GenerateCheckNonFunctionOrLoaded(masm, &miss, eax, edx);
__ ret(0);
// Global object access: Check access rights.
Modified: branches/0.3/test/cctest/test-api.cc
==============================================================================
--- branches/0.3/test/cctest/test-api.cc (original)
+++ branches/0.3/test/cctest/test-api.cc Thu Nov 20 01:54:20 2008
@@ -5054,3 +5054,27 @@
Local<Value> value = CompileRun("obj.x");
CHECK(value->BooleanValue());
}
+
+
+// This tests that we do not allow dictionary load/call inline caches
+// to use functions that have not yet been compiled. The potential
+// problem of loading a function that has not yet been compiled can
+// arise because we share code between contexts via the compilation
+// cache.
+THREADED_TEST(DictionaryICLoadedFunction) {
+ v8::HandleScope scope;
+ // Test LoadIC.
+ for (int i = 0; i < 2; i++) {
+ LocalContext context;
+ context->Global()->Set(v8_str("tmp"), v8::True());
+ context->Global()->Delete(v8_str("tmp"));
+ CompileRun("for (var j = 0; j < 10; j++) new RegExp('');");
+ }
+ // Test CallIC.
+ for (int i = 0; i < 2; i++) {
+ LocalContext context;
+ context->Global()->Set(v8_str("tmp"), v8::True());
+ context->Global()->Delete(v8_str("tmp"));
+ CompileRun("for (var j = 0; j < 10; j++) RegExp('')");
+ }
+}
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
