-----
The patch adds to NativeArray.put a check for (this == start) so the
length field or a dense array element would not be updated if this !=
start. The following script exposes the problem:
function Test() { }
var array = new Array(0, 0); // Trigger dense mode
Test.prototype = array;
var test = new Test();
array[0] = 1;
test[0] = 2;
print(array[0]); // Should print 1, not 2
-----
When initially I switched NativeDate to use IdScritable, I made
toGMTString just an alias to toUTCString. Later I realized that it could
cause troubles if someone would check Date.prototype.toGMTString.name to
get "toUTCString" so I made the code to allocate a separated IdFunction
to toUTCString. Now when I read ecma 3 appendixes I see that the initial
behavior is what actually Ecma 3 requires. Here is an extract from B.2.6:
The Function object that is the initial value of
Date.prototype.toGMTString is the same Function
object that is the initial value of Date.prototype.toUTCString.
Sometimes doing nothing is the best solution...
The attached patch fixes that and inlines many 1-3 lines functions as
optimization that java compilers typically do not want to do...
1. Keyword search via Java Hahstable is replaced by explicit "switch"
code generated by idswitch tool. It not only speed up keyword search and
eliminates all Integer objects created to hold keyword tokens and
corresponding Hahstable structures, but it also reduces code size due to
very poor array initialization support in JVM.
2. It replaces the isXDigit method by xDigitToInt that either converts
its argument to 0..15 or returns -1 if it is not a hex digit and updates
the method usage accordingly The patch updates NativeGlobal.js_unescape
to reflect this usage change.
In the attached patch I added documentation, did some inlining in the
get method implementation to gain some speed and overrode defineProperty
so it plays better with id-based properties.
-----
The patch fixes a bug in getIds method where the assignment "result =
tmp" was missed, adds the public method activateIdMap(int maxId) to
IdScriptable and changes setAttributes method not to allow setting of
attributes that are less restrictive then ones returned by
getIdDefaultAttributes. That was supposed to be the case and the patch
makes it explicit.
-----
The patch makes BaseFunction.setImmunePrototypeProperty public so it can
be called from other packages (regexp).
-----
The patch switches NativeRegExp and NativeRegExpCtor to use
IdScriptable. It also changes code in a few places to passes Context and
RegExpImpl directly instead of using Context.getCurrentContext().
The patch also fixes a bug when
for (var i in RegExp) { print(i); }
would not include $1..$9 in the output in violation with Ecma. It was
caused by not overriding ScriptableObject.getIds in
NativeRegExpCtor.
-----
The patch changes NativeCall to use IdScriptable. This is done mostly
for uniformity with other Native* classes plus it would allow to call
NativeCall.init directly and make NativeCall package private.
-----
The patch changes NativeScript to use id-based properties. Due to
inheritance from NativeFunction, id support requires to take into
account the fact that there are instance ids available from
BaseFunction. This is the reason to use "int prototypeIdShift" instead
of "boolean prototypeFlag" so it can store instance id offset.
The patch updates ScriptRuntime.callOrNewSpecial to check against
IdFunction and not FunctionObject for the Script exec method where it
also add finally clause to make sure that Context.exit would always be
called after Context.enter in the evalScript method.
-----
After converting NativeScript and NativeFunction to use IdScriptable,
they get scope argument directly as a parameter of execMethod call, so
cx.ctorScope is not used any more. The patch removes code to set/unset
cx.ctorScope.
-----
[This patch depends on conversion of NativeScript and NativeCall to use
IdScriptable and the patch to remove access of ctorScope from
FunctionObject]
The patch changes Context.initStandardObjects to call NativeCall.init
and NativeScript.init directly plus it unrolls the lazily initialization
loop. Due to rather poor support of an array initialization in Java byte
code, it actually decreases code size while eliminating are creation of
array object. The patch also removes ctorScope field as unused.
-----
The patch makes sure that ids used by NativeGlobal are visible only in
the object instance that initializes global scope and removes some junk
white space at line ends.
-----
To use the idswitch tool to generate map for strings that can not be
part of Id_ Java identifier like $*, I added code to the tool to look
for "// #string=...#" in the id definition line. The attached README
file also contains some documentation about the tool and should go to
idswitch directory.
The patch was made from toolsrc/org/mozilla/javascript/tools via:
cvs diff -u > idswitch_patch
to grows, shrinks, and compresses. This helps JS_DHashTableOperate callers
who hold returned entry pointers to validate those pointers and avoid having
to re-lookup an entry by its key.
- Balance that addition by removing JSDHashTable.sizeMask, which is induced by
JSDHashTable.sizeLog2 at the cost of two typically single-cycle instructions.
- Use JSDHashTable.generation in jsobj.c to avoid unsafely dereferencing an
entry pointer held across calls to JSClass.resolve from js_LookupProperty,
which may recur and add entries to cx->resolving, growing that table and
invalidating entry pointers held by earlier js_LookupProperty activations.
(bug 78121, r=jst@netscape.com, sr=jband@netscape.com, a=asa@mozilla.org)
----
The patch changes Notification to extend from BaseFunction and adjusts
Context, FunctionObject and NativeScript accordingly.
----
The patch changes BaseFunction.jsConstructor to use the scope argument
passed to execMethod instead of using cx.ctorScope. This argument is
null in this case because when calling execMethod IdFunction.construct
does not set cx.ctorScope because scope is passed to execMethod as argument.
for classes implementing the Function interface and switch
IdFunction.java to use it. The code in BaseFunction to serve as
Function.prototype is not used yet. The patch modifies NativeCall so it
can be used against BaseFunction.
The patch was made from org/mozilla directory via
diff -uN javascript.0 javascript > BaseFunction_patch
aWrappedNative when doing aggregation. r=dradley sr=jst.
- Fix bug 81877. Avoid infinite recursion when reporting threadsafety
error. r=perterv,dradley sr=jst.
- Fix bug 81882. Use JS_AddNamedRootRT in XPCWrappedNative::AddRef to avoid
the unnecessary cost of creating an XPCCallContext in this frequently called
method. r=dbaron,dbradley sr=jst.
in fields of the object itself instead of using the standard property
hashtable in ScriptableObject.java. This saves 3 object instances per
NativeError (2 slot entries and hashtable array itself) and given the
fact that NativeGlobal defines a few permanent Error instances, it is
visible saving even after taking into account code size increase.
The change also gives a good test of IdScriptable implementation.
-----
This patch introduces the uniform decompile method for NativeFunction
and IdFunction with the signature:
public String decompile(Context cx, int indent, boolean justbody)
instead of NativeFunction.decompile(int indent, boolean toplevel,
boolean justbody) and IdScriptable.toStringForScript(Context cx) and
replaces the special treatment of NativeJavaMethod in
NativeFunction.jsFunction_toString by overriding decompile in
NativeJavaMethod
-----
This patch adds getFunctionName to NativeFunction to return function
name and replaces few places with jsGet_name usage by getFunctionName
The patch was made via
diff -ru javascript.0 javascript > name_patch
from org/mozilla directory
add onForRuntime() method to jsdIDebuggerService to let native code turn on the deubgger (on() can only be called from js)
register an app-start observer so we can turn on the debugger at startup if "js.debugger.autostart" pref is true.
r=peterv, bug 81840
Rhino: behavior update for IdScriptable subclasses
Date:
Fri, 18 May 2001 11:45:00 +0200
From:
Igor Bukanov <igor.bukanov@windriver.com>
Organization:
Wind River
To:
Norris Boyd <nboyd@atg.com>
The attached patch introduces separation between id-base properties in
prototype instances and the rest of objects so it is possible to
allocate some ids for each instance and the rest only for prototype. The
patch adds to each descendants of IdScriptable a special prototypeFlag
which set to true only if object serves as a global prototype and all
methods that check/return ids first check for that flag. (This is the
reason for the patch size: diff is not very well in dealing with
indentation changes.)
In this way ids for prototype properties are completely hidden from
potential subclasses and there is no need to define methods like
getMaximumId in most cases, only if some ids present in each instance,
IdScriptable.maxInstanceId should be overridden to return max id present
in each instance.
The patch also replaces 2 boolean fields in IdScriptable by bit masks in
the setupFlag field.
Subject:
Embedding Rhino in an Applet
Resent-Date:
Thu, 17 May 2001 14:53:05 -0700 (PDT)
Resent-From:
mozilla-jseng@mozilla.org
Date:
Thu, 17 May 2001 16:39:14 -0700
From:
"Chester Kustarz II" <chester@monkey.org>
Organization:
monkey.org
To:
mozilla-jseng@mozilla.org
Newsgroups:
netscape.public.mozilla.jseng
Hello, I am trying to find a scripting language with an interpreter that I
can embed in an applet in order to run test scripts inside the applet. I
have already tried TCL-based Jacl and they do not support running inside an
applet. I then downloaded the Rhino/JS interpreter but am having trouble
getting it to run inside the browser (IE 5.5). Here is the exception I am
getting:
com.ms.security.SecurityExceptionEx[org/mozilla/javascript/ScriptRuntime.<cl
init>]: Reflective access to class java.lang.Thread prohibited.
at com/ms/security/permissions/ReflectionPermission.check
at com/ms/security/PolicyEngine.deepCheck
at com/ms/security/PolicyEngine.checkPermission
at com/ms/security/StandardSecurityManager.chk
at com/ms/security/StandardSecurityManager.checkMemberAccess
at java/lang/Class.checkMemberAccess
at java/lang/Class.getDeclaredMethod
at org/mozilla/javascript/ScriptRuntime.<clinit>
at org/mozilla/javascript/ScriptableObject.getExclusionList
at org/mozilla/javascript/ScriptableObject.defineClass
at org/mozilla/javascript/Context.initStandardObjects
at org/mozilla/javascript/Context.initStandardObjects
at RhinoShellApplet.init
at com/ms/applet/AppletPanel.securedCall0
at com/ms/applet/AppletPanel.securedCall
at com/ms/applet/AppletPanel.processSentEvent
at com/ms/applet/AppletPanel.processSentEvent
at com/ms/applet/AppletPanel.run
at java/lang/Thread.run
com.ms.security.SecurityExceptionEx[org/mozilla/javascript/Context.initStand
ardObjects]: Unable to access system property:
org.mozilla.javascript.JavaAdapter
at com/ms/security/permissions/PropertyPermission.check
at com/ms/security/PolicyEngine.shallowCheck
at com/ms/security/PolicyEngine.checkCallersPermission
at com/ms/security/StandardSecurityManager.chk
at com/ms/security/StandardSecurityManager.checkPropertyAccess
at java/lang/System.getProperty
at org/mozilla/javascript/Context.initStandardObjects
at org/mozilla/javascript/Context.initStandardObjects
at RhinoShellApplet.init
at com/ms/applet/AppletPanel.securedCall0
at com/ms/applet/AppletPanel.securedCall
at com/ms/applet/AppletPanel.processSentEvent
at com/ms/applet/AppletPanel.processSentEvent
at com/ms/applet/AppletPanel.run
at java/lang/Thread.run
1. In that patch I forgot to remove "import org.mozilla.classfile.*" and
simply catch Exception in newInvokerMaster which is not a good practice.
The attached patch FunctionObject_patch fixes that and removes other
unused imports.
2. In org.mozilla.classfile.DefiningClassLoader defineClass method first
tries to call via ClassManager the defineClass method in a class loader
that loaded DefiningClassLoader itself. But this would define new
classes in that class loader so they would not be subject of the garbage
collection until a classloader that loads DefiningClassLoader would go
away even if a DefiningClassLoader instance is gone. The
DefiningClassLoader_patch removes that and simply calls super.defineClass.
The patch also change the order of class search in loadClass so the
loader first looks for a class among its defined classes and only after
that in parent loaders.
Regards, Igor
1. In that patch I forgot to remove "import org.mozilla.classfile.*" and
simply catch Exception in newInvokerMaster which is not a good practice.
The attached patch FunctionObject_patch fixes that and removes other
unused imports.
2. In org.mozilla.classfile.DefiningClassLoader defineClass method first
tries to call via ClassManager the defineClass method in a class loader
that loaded DefiningClassLoader itself. But this would define new
classes in that class loader so they would not be subject of the garbage
collection until a classloader that loads DefiningClassLoader would go
away even if a DefiningClassLoader instance is gone. The
DefiningClassLoader_patch removes that and simply calls super.defineClass.
The patch also change the order of class search in loadClass so the
loader first looks for a class among its defined classes and only after
that in parent loaders.
Regards, Igor
> Igor Bukanov wrote:
>
>
>>Norris Boyd wrote:
>>
>>
>>>The intention was to keep classfile and JavaAdapter optional. Those
>>>dependencies crept in. We can use Invoker optionally--perhaps I should do
>>>some performance numbers to see if it's worth it.
>>>
>>I implemented that patch, it splits Invoker.java into Invoker.java and
>>its implementation in optimizer/InvokerImpl.java The reason to put it
>>into optimizer package is that Invoker is very similar in spirit to
>>NativeScript: it generates classes to speed up access and in this way
>>there is no need to have separated option not to use: one can simply
>>remove optimizer all together.
>>
>
> Yes, that sounds great.
>
>
>>
>>I noticed during implementation that JavaAdapter.DefiningClassLoader and
>>optimizer/JavaScriptClassLoader contains the same code, so maybe they
>>can be moved to org.mozilla.classfile package under one name?
>>
>
> Yes, that sounds like a good change too. Thanks for noticing that.
The update is pretty messy: it touches FunctionObject which I changed to
remove the special treatment of NativeWith in the previous patch, and it
also add/removes files.
Here is a description:
DefiningClassLoader.java should go to org/mozilla/classfile. It is the
same code that was in omj/optimizer/JavaScriptClassLoader.java with
class rename and adding public attribute and correspondingly
omj.optimizer/JavaScriptClassLoader.java should be removed. I guess it
would be nice to preserve logs/history in CVS during the move.
InvokerImpl.java should go to omj/optimizer. It is mostly what
omj.Invoker was.
invoker_changes_patch was generated via
cvs diff -u Invoker.java JavaAdapter.java optimizer/Codegen.java
and contains changes against the current CVS
FunctionObject_invoker_patch was generated via
diff -u ../../mozilla.1/javascript/FunctionObject.java FunctionObject.java
and contains changes against that With patch.
Igor
constructor, removes the special treatment of the With object from
IdScriptable and FunctionObject, adds to IdFunction the
initAsConstructor method similar in spirit to
FunctionObject.addAsConstructor (it is called now from IdScriptable and
NativeWith) and replaces in Context.java lazy initialization of
NativeWith by direct call of NativeWith.scopeInit.
The attached patch moves the IdFunction.Master interface to the
separated file IdFunctionMaster and eliminates getParentScope from the
interface: it is simpler to set scope explicitly.
The patch assumes the changes in IdFunction.java from the previous patch
and were produced via:
diff -uP javascript.2000-05-10 javascript
Regards, Igor
The attached patch allows subclasses of IdScriptable to override
hasIdValur/deleteIdValue and uses lazy initialization for idMapData
array to avoid its creation when an IdScriptable descendant does not
have any functions. The patch also touches NativeMath.java to replace in
its scopeInit method
super.scopeInit(cx, scope, sealed);
by
activateIdMap(cx, sealed);
This is the only reason NativeMath needs to call
IdScriptable.scopeInit() which is intended for creation
constructor/prototype pair.
Regards, Igor
Rhino: optimization for NativeFunction.java
Date:
Mon, 07 May 2001 14:19:59 +0200
From:
Igor Bukanov <igor.bukanov@windriver.com>
Organization:
Wind River
To:
Norris Boyd <nboyd@atg.com>
Hi, Norris!
This is the first of 3 patches that are completly independent from each
other.
Currently in NativeFunction its name stored as the first element in the
names array. But this lead to creation of a single element array for
each FunctionObject and for each script function that does not have
arguments or variables. The attached patch splits NativeFunction names
into simple functionName and argNames arrays and adjust code elsewhere
accordingly. This patch can increase memory footprint for anonymous
script functions without arguments because it adds additional field to
each NativeFunction, but I do not think this is a case to worry about.
Regards, Igor
Date: Mon, 07 May 2001 14:25:34 +0200
From: Igor Bukanov <igor.bukanov@windriver.com>
Organization: Wind River
To: Norris Boyd <nboyd@atg.com>
The current code that implements execMethod/methodArity for IdFunction
support returns an arbitrary value for id that is not known. This is not
very good behavior because it may hide bugs in the id support and it
also does not allow to distinguish ids that are used for function from
ids used for properties like String.length.
To fix this I changed semantic of the methodArity method to return -1
for an unknown/non-method id and added code to throw an exception for
bad ids. This change requires to adjust all NativeSomething objects that
use IdScriptabl and after a release all such interface changes would be
no go, but is not a release yet, right?
I also eliminated the "IdFunction f" argument from
IdFunction.Master.methodArity and the tagId field from IdFunction. When
I wrote the initial code for IdFunction.java, I added that just to be
able to use same id number in a class that implements IdFunction.Master
and its descendants via checking idTag. But that does not work in
general because IdScriptable can use id for non-function fields as well
so to avoid id clashes another way should be used. For example, if
someone would like to extend NativeMath to support more functionality,
he can use:
class Math2: extends NativeMath {
private static idBase;
{
if (idBase == 0) idBase = super.getMaximumId();
}
public int methodArity(int methodId) {
switch (methodId - idBase) {
case Id_foo: return 2;
case Id_bar: return 3;
}
return super.methodArity(methodId);
}
public Object execMethod
(int methodId, IdFunction f,
Context cx, Scriptable scope, Scriptable thisObj, Object[] args)
throws JavaScriptException
{
switch (methodId - idBase) {
case Id_foo: return ...;
case Id_bar: return ...;
}
return super.execMethod(methodId, f, cx, scope, thisObj, args);
}
protected int getMaximumId() { return idBase + MAX_ID; }
protected String getIdName(int id) {
switch (id - idBase) {
case Id_foo: return "for";
case Id_bar: return "bar";
}
return super.getIdName(id);
}
...
private static final int
Id_foo = 1,
Id_bar = 2,
MAX_ID = 2;
etc.
Note that a simpler solution to make MAX_ID field public in NativeMath
and write in Math2:
private static final int
Id_foo = NativeMath.MAX_ID + 1,
Id_bar = NativeMath.MAX_ID + 2,
MAX_ID = NativeMath.MAX_ID + 2;
does not work because in this way adding any new id to NativeMath would
break binary compatibility with Math2.
Rhino: fix for race conditions in listeners code in Context.java
Date:
Mon, 07 May 2001 14:22:57 +0200
From:
Igor Bukanov <igor.bukanov@windriver.com>
Organization:
Wind River
To:
Norris Boyd <nboyd@atg.com>
The current code for listeners and contextListeners in Context.java is
not race condition free. If contextListeners Vector would be modified
during context event firing loops, the code can produce
index-out-of-bounds exception. The problem with listeners array is more
subbtle and comes from the fact that ListenerCollection.java uses code like:
for(Enumeration enum = getAllListeners();enum.hasMoreElements();) {
Object listener = enum.nextElement();
if(iface.isInstance(listener)) {
array.addElement(listener);
}
}
where getAllListeners() uses Vector.elements to get element enumeration.
But to work with such enumeration in a thread safe way, one has to
synchronized against Vector, otherwise between enum.hasMoreElements()
and enum.nextElement() the last element can be removed.
Initially I thought to fix ListenerCollection and use it for
contextListeners as well, but then I realized that in its current form
ListenerCollection is very inefficient (it produces too many objects
just to get simple array to fire events), so I wrote ListenerArray.java
and use it in Context.java. It makes life simpler and shrinks code as well.
js_SetProtoOrParent should always have used a condvar in addition to a lock.
- Fix bug 79129, assert-botch in js_AllocSlot (r/sr=jband, sr=shaver)
JS_INITIAL_NSLOTS is the minimum number of slots, js_FreeSlot guarantees it.
Subject:
rhino bug(s)
Date:
Mon, 30 Apr 2001 23:07:00 -0700
From:
Mike Dixon <MDixon@placeware.com>
To:
nboyd@atg.com
hi. i'm a happy rhino user, and just stumbled across what looks like a
pretty basic bug in the property stuff on ScriptableObject... (i'm running
1.5, but it looks like this code hasn't changed in CVS.) since it looks
like you're actively developing (even though it's been a while since
1.5...) i figured you might be interested -- apologies if i missed a more
formal bug reporting process...
the symptom was that i got a "Hashtable internal error" thrown from
getSlotToSet. reading the code, here's what i think could happen:
- create a new object (slots.length is initially 5)
- add 3 properties
- delete those 3 properties
(now count == 0, and slots[i] == REMOVED for 3 values of i)
- add 2 more properties
now assume that you're unlucky, and that these two hash to different values
than the first three; now you have 2 elements of slots[] containing real
slots, and the other three containing REMOVED.
now what happens when you try to create another slot? getSlotToSet is only
willing to put something in a null slot[], and you haven't got one, so you
get the internal error.
writing this message encouraged me to try to write a test case to reproduce
it, and in fact it's trivial:
js> x={}; x.a=x.b=x.c=1; delete x.a; delete x.b; delete x.c; x.d=x.e=1
1
js> x.whatever=1
(boom)
by the way, while reading the code i also noticed what looks like another,
less consequential bug: addSlot increments count before deciding to grow
the table, which is done with a recursive call, which will cause count to
be incremented again -- right? as far as i can tell, setting count too big
will only cause it to grow the table a little early next time, so it
doesn't really matter, but it looks wrong.
.mike.
