Skip to content

V
V8
Switch branch/tag
  1. 07 Dec, 2010 3 commits
  3. 21 Oct, 2010 1 commit
  5. 04 Oct, 2010 1 commit
  7. 02 Jul, 2010 1 commit
  9. 06 May, 2010 1 commit
  11. 25 Mar, 2010 1 commit
  13. 23 Mar, 2010 1 commit
  15. 04 Nov, 2009 1 commit
  17. 29 Oct, 2009 1 commit
  19. 27 Oct, 2009 1 commit
  21. 26 Oct, 2009 2 commits
  23. 28 Sep, 2009 2 commits
  25. 04 Sep, 2009 1 commit
  27. 26 Aug, 2009 1 commit
  29. 13 Jul, 2009 1 commit
  31. 23 Mar, 2009 1 commit
  33. 20 Mar, 2009 1 commit
  35. 23 Jan, 2009 1 commit
  37. 08 Jan, 2009 2 commits
  39. 21 Oct, 2008 1 commit
    • feng@chromium.org's avatar
      Split window support from V8. · 42ef2c3d
      feng@chromium.org authored 
      Here is a description of the background and design of split window in Chrome and V8:
https://docs.google.com/a/google.com/Doc?id=chhjkpg_47fwddxbfr

This change list splits the window object into two parts: 1) an inner window object used as the global object of contexts; 2) an outer window object exposed to JavaScript and accessible by the name 'window'. Firefox did it awhile ago, here are some discussions: https://wiki.mozilla.org/Gecko:SplitWindow. One additional benefit of splitting window in Chrome is that accessing global variables don't need security checks anymore, it can improve applications that use many global variables.

V8 support of split window:
  There are a small number of changes on V8 api to support split window:
Security context is removed from V8, so does related API functions;
A global object can be detached from its context and reused by a new context;
Access checks on an object template can be turned on/off by default;
An object can turn on its access checks later;

  V8 has a new object type, ApiGlobalObject, which is the outer window object type. The existing JSGlobalObject becomes the inner window object type. Security checks are moved from JSGlobalObject to ApiGlobalObject. ApiGlobalObject is the one exposed to JavaScript, it is accessible through Context::Global(). ApiGlobalObject's prototype is set to JSGlobalObject so that property lookups are forwarded to JSGlobalObject. ApiGlobalObject forwards all other property access requests to JSGlobalObject, such as SetProperty, DeleteProperty, etc.

  Security token is moved to a global context, and ApiGlobalObject has a reference to its global context. JSGlobalObject has a reference to its global context as well. When accessing properties on a global object in JavaScript, the domain security check is performed by comparing the security token of the lexical context (Top::global_context()) to the token of global object's context. The check is only needed when the receiver is a window object, such as 'window.document'. Accessing global variables, such as 'var foo = 3; foo' does not need checks because the receiver is the inner window object.

  When an outer window is detached from its global context (when a frame navigates away from a page), it is completely detached from the inner window. A new context is created for the new page, and the outer global object is reused. At this point, the access check on the DOMWindow wrapper of the old context is turned on. The code in old context is still able to access DOMWindow properties, but it has to go through domain security checks.


It is debatable on how to implement the outer window object. Currently each property access function has to check if the receiver is ApiGlobalObject type. This approach might be error-prone that one may forget to check the receiver when adding new functions. It is unlikely a performance issue because accessing global variables are more common than 'window.foo' style coding.

I am still working on the ARM port, and I'd like to hear comments and suggestions on the best way to support it in V8.


Review URL: http://codereview.chromium.org/7366

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@540 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
      42ef2c3d
  41. 03 Oct, 2008 3 commits
  43. 09 Sep, 2008 1 commit
  45. 28 Aug, 2008 1 commit
  47. 25 Jul, 2008 1 commit
    • kasper.lund's avatar
      Fixed bug in JSObject::GetPropertyAttributePostInterceptor where map... · 44510671
      kasper.lund authored 
      Fixed bug in JSObject::GetPropertyAttributePostInterceptor where map transitions would count as properties.

Allowed aliased eval invocations by treating them as evals in the global context. This may change in the future.

Added support for accessing the last entered context through the API and renamed Context::Current to Context::GetCurrent and Context::GetSecurityContext to Context::GetCurrentSecurityContext.

Fixed bug in the debugger that would cause the debugger scripts to be recursively loaded and changed all disabling of interrupts to be block-structured.

Made snapshot data read-only to allow it to be more easily shared across multiple users of V8 when linked as a shared library.


git-svn-id: http://v8.googlecode.com/svn/trunk@6 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
      44510671
  49. 03 Jul, 2008 1 commit