The following test case case leads to a compilation error in Rhino. In this
script alert is an user defined
function in the global object and it shows the value of the specified
parameter in a popup window. Save the script as a html file and run it under
Netscape and IE. The output via their JS engines is that alert(1)
executes but the execution of line fails as blks variable is undefined. The
Fix bug:
Rhino engine fails at compilation time itself and cannot excute the script.
It doesn't like the syntax of line.
Steven
/// **************** test case ************** ///
<script>
alert(1);
blks[ 10 << 2 ] |= true;
alert(2);
</script>
/// ********************** Error Message ************************** ////
evaluating script: null
java.lang.NullPointerException
at org.mozilla.javascript.Interpreter.generateICode(Compiled Code)
at org.mozilla.javascript.Interpreter.generateICode(Compiled Code)
at org.mozilla.javascript.Interpreter.generateICode(Compiled Code)
at org.mozilla.javascript.Interpreter.generateICode(Compiled Code)
at org.mozilla.javascript.Interpreter.generateICode(Compiled Code)
at org.mozilla.javascript.Interpreter.generateICodeFromTree(Compiled Code)
at
org.mozilla.javascript.Interpreter.generateScriptICode(Interpreter.java)
at org.mozilla.javascript.Interpreter.compile(Interpreter.java)
at org.mozilla.javascript.Context.compile(Context.java)
at org.mozilla.javascript.Context.compile(Context.java)
I must admit this is very subtitle, but still...
Here are the lines from
public void defineProperty(String propertyName, Object delegateTo,
Method getter, Method setter, int attributes)
GetterSlot slot = (GetterSlot)getSlotToSet(propertyName,
propertyName.hashCode(),
true);
slot.delegateTo = delegateTo;
slot.getter = getter;
slot.setter = setter;
slot.setterReturnsValue = setter != null && setter.getReturnType() != Void.TYPE;
slot.value = null;
slot.attributes = (short) attributes;
slot.flags = (byte)flags;
Now suppose that after the new slot is added, another thread is accessing it. Then it would see not yet ready slot with all nasty consequences! For example, SMP computer can re-arrange writes so the new value of slot.flags would be visible before slot.getter then another thread would generate null pointer exception.
race2_fix.diff fixes that by using the explicit Slot argument to addSlot instead of boolean flag so the new slot can be fully initialized and then inserted under synchronization to the table. I also call addSlot directly because it is supposed to be used with not-yet existed properties and split addSlot to addSlot and addSlotImpl so in case of table growth there is no need to re-enter already synchronized monitor.
This changes also allows to explicitly throw RuntimeException if defineProperty is called for the property that is already exists instead of either throwing cast exception in "GetterSlot slot = (GetterSlot)getSlotToSet(propertyName," or worth yet re-initializing already existed slot.
Regards, Igor
Unsynchronized ScriptableObject.getSlotToSet contains references/modifications
to the slots array which is no go under multithreading. The attached patch
replaces references to slots by references to its local copy and moves code
to allocate the initial array to synchronized addSlot.
The patch also replace throwing of RuntimeException in case of broken code by
if (Context.check && badCondition) Context.codeBug();
Regards, Igor
also has a significant regression introduced in it. The default compiler
not only works, but also is noticably faster. Ant takes care of the
selection of the compiler automatically based on the JDK level, so the
following patch should make things better all around.
Patch from Igor:
The 2 attached patches allow to avoid wrapping of array indexes to Double object
when Interpreter knows that the index is an integer number. It speed up array
benchmark by 5-10%
array_access.diff adds to ScriptRuntime getStrIdElem and setStrIdElem to get/set
properties which known to be strings plus it modifies NativeArray to use these methods.
interpreter.diff contains the Interpreter modifications to call get/setElem for
integer or string properties when the property type is known for sure.
We have a tool that looks for a scary noop case of assigning an instance field
to itself. this usually comes from a constructor that assigns a argument to a
instance field with the same name and then later the argument changes name. we
ran our tool on all of our classes we have in our classpath here and found this
problem in your code.
rhino1_5R2/src/org/mozilla/javascript/regexp/NativeRegExp.java line 159 it has:
this.flags = flags;
This seems to be a bad cut and paste from the CompilerState constructor on line
2155. or has some initialization that used to work been lost?
There is a bug in JavaScriptException which prevents it from being used with
out a Rhino Context. When the getMessage() method is invoked on it, the
exception goes to the ScriptRuntime to toString the value. If you have
already exited your context, the runtime will throw an error. The solution
is to simply remove the overridden getMessage method from
JavaScriptException. JavaScriptException's constructor calls the Exception
constructor with the toString'ed value. The default implementation of
getMessage will return the exception message.
Jeff
I'm having problems getting inner class objects with Rhino.
I create a Hashmap, which is an implementation of Map. Map.Entry is an
inner interface of Map with key-value pairs. If I have a Map object,
"property", I should be able to get the key element with the expression
"property.key".
When I look at the "property" class name that Rhino returns I get:
"java.util.HashMap$Entry". I don't believe Rhino has a notion of the
inner Map.Entry object. The expression "property" succeeds. The
expression "property.key", which should retrieve the Map.Entry
keyValue(), fails with a "unexpected IllegalAccessException accessing
Java field".
I'm including a simple example that illustrates the problem. I hope you
can shed some light on this. Thanks!
Justyna
< Justyna.Horwat@Sun.com >
----
import java.io.*;
import java.util.*;
import org.mozilla.javascript.*;
public class MapTest {
public static void main(String argv[]) {
Test test = new Test();
test.testMap();
}
}
class Test {
Map map;
Set set;
Iterator it;
Map.Entry entry;
public void testMap() {
System.out.println("testMap");
map = new HashMap();
populate();
set = map.entrySet();
it = set.iterator();
// let's see if Map is populated correctly
while (it.hasNext()) {
entry = (Map.Entry) it.next();
System.out.println("entry: " + entry.getClass().getName());
System.out.println("key: " + entry.getKey());
System.out.println("value: " + entry.getValue());
}
evaluate();
}
void populate() {
map.put("firstKey", "firstValue");
map.put("secondKey", "secondValue");
map.put("thirdKey", "thirdValue");
map.put("fourthKey", "fourthValue");
}
public void evaluate() {
Context cx = Context.enter();
Scriptable scope = cx.initStandardObjects(null);
set = map.entrySet();
it = set.iterator();
while (it.hasNext()) {
entry = (Map.Entry) it.next();
scope.put("property", scope, cx.toObject(entry,scope));
}
Object eval = null;
try {
// attempt to get Map.Entry key value using Rhino
eval = cx.evaluateString(scope, "property.key", "", 0,
null);
// Unwrap scoped object
if (eval instanceof Wrapper)
eval = ((Wrapper) eval).unwrap();
} catch (JavaScriptException jse) {
System.out.println("EXCEPTION: " + jse.getMessage());
}
// DELETE
System.out.println("RHINO result: " + eval + ":");
System.out.println("RHINO class: " + eval.getClass().getName());
}
}
My optimization for PreorderNodeIterator has a bug that would cause an attempt
to access stack[-1] in
currentParent = (current == null) ? null : stack[stackTop - 1];
when current refers to a start node sibling. This is not visible in Rhino because
currently PreorderNodeIterator is always started from nodes with node.next == null.
iter.diff fixes that plus it removes currentParent field because it is always
available as stack[stackTop - 1] and code to access its value are executed less
frequently than the lines to update it in nextNode
Regarsd, Igor
As profiler data show, the execution time of the nextNode and replaceCurrent
methods in PreorderNodeIterator contribute quite significantly to the total
time to run Context.compileReader.
replaceCurrent is slow because it calls Node.replaceChild which have to
iterate through all previous siblings to find the nearest to the current.
But it is easy to avoid this search by caching the previous sibling of the
current while iterating over the node tree in nextNode.
nextNode slowness is attributed to the usage of java.lang.Stack which is
expensive due to its synchronized methods. In the attched patch I replaced
it by the explicit array management.
It allows to cut Context.compileReader time by 5%-30% when processing
20K-3MB sources assembled form JS files in the test suite.
Note form omj/Parser.java:
* OPT source info collection is a potential performance bottleneck;
* Source wraps a java.lang.StringBuffer, which is synchronized. It
* might be faster to implement Source with its own char buffer and
* toString method.
It is indeed a bottleneck under JDK 1.1. When I replaced StringBuffer
by a char array (see the attached patch), execution time of
Context.compileReader decreased by 15%: to test I combined a few test
cases to get a 3MB JS source and then measured time to process it by
Context.compileReader in the interpreter mode.
Under JDK 1.3 the difference is less then 1%, but still using the explicit
string buffer saves memory. When converting StringBuffer to String Sun JDK
shares the internal char array in StringBuffer with new String, but in the
Parser case typically the capacity of this buffer is bigger then the actual
string length, so this unused space in source strings is wasted in the
interpreter mode that keeps these strings in InterpreterData.
Regards, Igor
========
I implemented that member expression as function name syntactic sugar to
support scripts using this MS extension. This is only available when
Context.hasFeature(Context.FEATURE_MEMBER_EXPR_AS_FUNCTION_NAME)
returns true to allow the deviation from the standard only when required.
The patch effectively transforms 'function <memberExpr>(...)...' to
'<memberExpr> = function(...)...' when <memberExpr> is not simple
identifier. I am not sure that MS implementation does exactly this
but hopefully it is sufficiently general to cover MS cases.
(The patch assumes that source_change.patch is already applied)
Regards, Igor
I implemented that member expression as function name syntactic sugar to support
scripts using this MS extension. This is only available when
Context.hasFeature(Context.FEATURE_MEMBER_EXPR_AS_FUNCTION_NAME)
returns true to allow the deviation from the standard only when required.
The patch effectively transforms 'function <memberExpr>(...)...' to
'<memberExpr> = function(...)...' when <memberExpr> is not simple identifier.
I am not sure that MS implementation does exactly this but hopefully it is
sufficiently general to cover MS cases.
(The patch assumes that source_change.patch is already applied)
Regards, Igor
Currently omj/TokenStream and omj/optimizer/Optimizer.java both contain
code to convert number value to a wrapper object of smallest size. The
attached patch moves this wrapping to Node constructor to avoid code
duplication and eliminate special treatment of exact integers in
Optimizer.java.
The constant folding code in omj/optimizer/Optimizer.java currently always
replaces x * 1, x - 0 by simply x which does not force the toNumber convertion,
which is visible, for example, via typeof. For example, when running at
optimization level 2, the following
function f() {
return "0" * 1;
}
print(typeof(f()));
prints "string" instead of expected "number".
The const_fold.patch fixes this via replacing x*1 by (+x) to force number convertion.
It assumes that the patch with number wrapping changes is in place.
convert number value to a wrapper object of smallest size. The attached patch
moves this wrapping to Node constructor to avoid code duplication and eliminate
special treatment of exact integers in Optimizer.java.
Currently omj/optimizer/Codegen.java uses special classes ConstantList
and ConstantDude to store the list of static constants in the generated
class. It seems that using a simple double[] array with a constant
counter and checking via "(int)number == number" for constant types not
only eliminates these 2 classes but makes the whole code simple, see
the attached patch.
The patch also modifies nodeIsConvertToObjectOfNumber to return not a
Number, but the number node itself that is used to extract double
value directly via Node.getDouble() call. I changed it to allow to
store values of number literals in nodes without using wrapper object.
Replacing usage of ShallowNodeIterator to loop throw node children by
explicit calls to Node.getFirstChild()/ Node.getNextSibling()) with
comments when the node children list is modified while iterating
through it.
It avoids creation of ShallowNodeIterator objects and eliminates the
need to have ShallowNodeIterator class.
Currently Rhino source has quite a few places with code like (String)node.getDatum()
or ((Number)node.getDatum()).doubleValue(). The patch changes this usage to call
node.getString() or node.getDouble().
It also adds new constructors to Node to accept int or double values in addition to
Object datum to replace new Node(token, new Integer(x)) by Node(token, x) etc. It
may allow in future not to create a wrapper object for int or double datum to speed
up parsing.
Currently in the interpreter mode all number literals are stored in
InterpreterData.itsICode as an index to InterpreterData.itsNumberTable
which holds the actual value.
For integers that fit 2 or 4 bytes this is an overkill and the attached
patch stores integers in InterpreterData.itsICode inline after special
TokenStream.INTNUMBER or TokenStream.SHORTNUMBERS tokens.
The changes made benchmarks to run 1.5% faster. It also saves memory
because InterpreterData.itsNumberTable is allocated only for non-integers
that present only in a small number of scripts.
In principle, it may be possible to store all numbers inline as well, but
unfortunately re-assembling of 8 bytes from InterpreterData.itsICode array
into double is rather slow operation and is not worth the hassles.
Regards, Igor
Hi, Norris!
Currently ScriptableObject.put does not check lastAccess cache during its search for
slots. When I added this check (see the attached patch) it speeded up the benchmark
suite by about 1.5% and in particular for setProp_bench.js the win was about 8%.
I think that even on multiprocessor machines it would not introduces any additional
issues like accessing the old value in the processor cache because the put method
accesses existing properties via unsynchronized getSlot, and the check for lastAccess
is on pair with that.
Trgards, Igor
When handling an Exception the Context tries to get the current script
and line number from the Java Stacktrace. To get the indication of which
entry in the trace might be an ECMA script, the file extension ".js" is
assumed.
For our integration we use the standard extension ".ecma" which collides
with the above assumption. But we don't force this extension, we just
have a convention. We name these files ".ecma" as they are not plain
ECMA but JSP-like ECMA. That is instead of using Java as the programming
language we use ECMA. In this respect they would be ".esp".
Patch fixes issue of not ignoring UNICODE format characters in match
and peek methods, adds explicit assertions checks for code assumptions
and makes handling of ASCII '\r', '\n' and UNICODE U+2028, U+2029 line
ends uniform.
It was rather tricky to fix format character issue and I spend some
time figuring out what TokenStream assumes about LineBuffer that
breaks my initial thoughts on the patch in cases like very long
sequences of format characters that do not fit in the buffer. I
fixed that but it made the code rather unclear so I put explicit
checks for assumptions/preconditions to help with debugging.
I added Context.check flag to turn on/off these checks and
Context.codeBug to throw an exception in case of check violations,
and also modified UintMap to use them instead of the private
flags there.
It would be nice to add some tests about format characters to the test
suite with checks similar to "eval('1 =\u200C= 1') == true" and
"eval('.\u200C1') == 0.1".
Hi, Norris!
I have found few problems with NativeArraj.java.
1. jsSet_length requires that the new length value should be an instance of Number. But according to Ecma 15.4.5.1, item 12-13, an error should be thrown only if ToUint32(length_value) != ToNumber(length_value). Here is a simple test that demonstrates it:
Array(5).length = new Number(1)
It currenly throws an exception.
2. jsSet_length when executing the code marked with "// assume that the representation is sparse" effectively removes all properties with values less then the current length when String is used to represent its value. Note that simply changing lines "if (d == d && d < length) delete(id);" to "if (d == d && d >= longVal) delete(id);" is not good because it would remove properties like "4.5" or "007", the full array index check has to be used instead.
Here is a test case that catches the problem:
var BIG_INDEX = 4294967290;
var a = Array(BIG_INDEX);
a[BIG_INDEX - 1] = 'a';
a[BIG_INDEX - 10000] = 'b';
a[BIG_INDEX - 0.5] = 'c';
a.length = BIG_INDEX - 5000;
var s = '';
for (var i in a) s += a[i];
print('s="'+s+'"');
this should print s='cb' (or 'bc': EcmaScript does not fix the order), but currently it gives s=''.
3. There are race conditions in jsSet_length and getIds.
The first contains:
if (hasElem(this, i))
ScriptRuntime.delete(this, new Long(i));
which would lead to call to delete in the Array prototype if 2 threads would invoke this code. Simply calling ScriptableObject.delete without any checks for existence is enough here.
getIds assumes that the count of present elements in the dense array does not change, which is not true when another thread deletes elements from dense.
The attached patch fixes these issues.
Regards, Igor
It would be nice if the rhino shell would accept a URL as the source
for javascript.
I've added this feature to my local copy so that I can launch rhino
with js scripts using JavaWebStart.
Below is a context diff of the changes I made to
toolsrc/org/mozilla/javascript/tools/shell/Main.java
There is a bug in the JavaMembers class called to wrap a Java object.
In JavaMembers.lookup(), code was added to override the static type. The
code works in the case of an Enumeration returning an Object which would
have to be casted to the appropriate type.
The code does not work when the static type is an interface. In this case,
the interface class is the one which should be reflected, not a parent class
of the dynamic type. A simple staticType.isInterface() check around the
parent traversal code fixes the problem.
Jeff
I have found a couple problems with running Rhino 1.5R2 in a heavily
multi-threaded environment. The attached patches fix the problems.
- org.mozilla.javascript.optimizer.InvokerImpl - This class was accessing
the shared classNumber outside of the synchronized block.
- org.mozilla.javascript.optimizer.OptClassNameHelper - The reset method was
not synchronized. It needs to be because the class using the classNames map
is synchronized and does not handle nulling of the variable while it's
looping on the map.
Jeff
Also, fixes for :
#91343, (non-latin1 fails for [\S])
#78156, (Unicode line terminator matching)
#87231, (/(A)?(A.*)/ didn't reset paren state for empty first match)
improvements:
Subject:
Rhino: Problem in NativeJavaMethod
Date:
Tue, 14 Aug 2001 10:23:35 +0200
From:
felix.meschberger@day.com
To:
Norris Boyd <nboyd@atg.com>
Hi Norris,
While working with wrapped Java classes we discovered a problem in
NativeJavaMethod : If the public method to be called is part of a
non-public class, the Sun Java VM throws an IllegalAccessException. This
bug in the Sun VM has been reported as Bug 4071593 to Sun, but has not been
resolved since....
I implemented a circumvention, for which I provide you the patch. I quickly
tested it, and it seems to work.
Regards
Felix
And here's the patch :
diff -w -r1.19 NativeJavaMethod.java
227a228,234
> /**
> * Due to a bug in Suns VM, public methods in private
> * classes are not accessible by default (Sun Bug #4071593).
> * We have to explicitly set the method accessible beforehand
> */
> meth.setAccessible(true);
>
-----------------------------------------------------------------
This message is a private communication. If you are not the intended
recipient, please do not read, copy, or use it, and do not disclose it
to others. Please notify the sender of the delivery error by replying to
this message, and then delete it from your system. Thank you.
The sender does not assume any liability for timely, trouble-free,
complete, virus free, secure, error free or uninterrupted arrival of
this e-mail. For verification please request a hard copy version.
mailto:felix.meschberger@day.com
http://www.day.com
Felix Meschberger
Development
Day Interactive AG
Steinenberg 21-23
4001 Basel
Switzerland
T 41 61 226 98 98
F 41 61 226 98 97
Rhino: Problem in NativeJavaMethod
Date:
Tue, 14 Aug 2001 10:23:35 +0200
From:
felix.meschberger@day.com
To:
Norris Boyd <nboyd@atg.com>
Hi Norris,
While working with wrapped Java classes we discovered a problem in
NativeJavaMethod : If the public method to be called is part of a
non-public class, the Sun Java VM throws an IllegalAccessException. This
bug in the Sun VM has been reported as Bug 4071593 to Sun, but has not been
resolved since....
I implemented a circumvention, for which I provide you the patch. I quickly
tested it, and it seems to work.
Regards
Felix
[Fwd: Rhino 1.5.2 bug in debug support?]
Date:
Sun, 12 Aug 2001 14:13:26 -0700
From:
Christopher Oliver <coliver@mminternet.com>
Organization:
Primary Interface LLC
To:
nboyd@atg.com
Hi Norris,
Did you or are you fixing this problem? It seems to be simply a matter
of filtering out -1 before inserting line numbers into the
lineNumberTable. In this particular case the Parser generates -1 as a
line number for (? : ) in IRFactory.createTernary(). However the recent
changes to InterpreterData to use UintMap instead of Hashtable will not
tolerate negative numbers. Changing Interpreter.updateLineNumber() and
InterpreterData.getOffset() to check for negative line numbers (and
avoid generating line number code or accessing the lineNumberTable in
that case) will correct the problem.
Chris
Subject:
Rhino 1.5.2 bug in debug support?
Date:
8 Aug 2001 12:47:28 -0700
From:
d-russo@ti.com (dave russo)
Organization:
http://groups.google.com/
Newsgroups:
netscape.public.mozilla.jseng
I'm getting the following exception when running the Rhino debugger.
java.lang.RuntimeException
at org.mozilla.javascript.UintMap.check(UintMap.java:349)
at org.mozilla.javascript.UintMap.put(UintMap.java:158)
at
org.mozilla.javascript.Interpreter.updateLineNumber(Interpreter.java:234)
at
org.mozilla.javascript.Interpreter.generateICode(Interpreter.java:300)
at
org.mozilla.javascript.Interpreter.generateICode(Interpreter.java:926)
at
org.mozilla.javascript.Interpreter.generateICode(Interpreter.java:302)
at
org.mozilla.javascript.Interpreter.generateICode(Interpreter.java:302)
at
org.mozilla.javascript.Interpreter.generateICode(Interpreter.java:302)
at
org.mozilla.javascript.Interpreter.generateICodeFromTree(Interpreter.java:89)
at
org.mozilla.javascript.Interpreter.generateFunctionICode(Interpreter.java:186)
at
org.mozilla.javascript.Interpreter.generateNestedFunctions(Interpreter.java:164)
at
org.mozilla.javascript.Interpreter.generateScriptICode(Interpreter.java:124)
at org.mozilla.javascript.Interpreter.compile(Interpreter.java:78)
at org.mozilla.javascript.Context.compile(Context.java:1810)
at org.mozilla.javascript.Context.compile(Context.java:1735)
at org.mozilla.javascript.Context.compileReader(Context.java:852)
at org.mozilla.javascript.Context.evaluateReader(Context.java:770)
at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:300)
at org.mozilla.javascript.tools.shell.Main.processFile(Main.java:290)
at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:244)
at org.mozilla.javascript.tools.shell.Main.exec(Main.java:104)
at org.mozilla.javascript.tools.debugger.Main.main(Main.java:3156)
I'm using Rhino 1.5.2 prerelease
(ftp://ftp.mozilla.org/pub/js/rhino15R2pre.zip) and SUN's JDK 1.3.1
runtime for Windows.
I'm running the debugger as follows:
java -cp js.jar org.mozilla.javascript.tools.debugger.Main -f tconfini.tcf
Where the file tconfini.tcf is shown below:
function getBoard (defFile) {
if (arguments.length > 0 ) {
return (defFile != null ? defFile[1] : null);
}
return (null);
}
Any help would be appreciated. Thanks!
dave
=================================
Rhino: use of Node.get/putIntProperty to store integer values
The patch replaces usage like
node.putProp(PROPERTY, new Integer(int_value))
((Integer)node.getProp(PROPERTY))
by
node.putIntProp(PROPERTY, int_value)
node.getIntProp(PROPERTY, defaultValue)
node.getExistingIntProp(PROPERTY)
to avoid creation of Integer wrapper objects while storing integer
properties in Nodes.
Patch also ads Node.removeProp to explicitly remove Node properties
=================================
The patch changes the type of the first argument of Interpreter.addByte
from byte to int so there is no need to cast int arguments, adds
addShort(int value, int iCodeTop), getShort(byte[] iCode, int pc) to
pack/unpack short values from pc array, replaces calls to
getString(stringTable, byte[] iCode, int pc) by
stringTable[getShort(iCode, pc)] and similar for getNumber
It makes Interpreter.java easy to follow and slightly shrink its class file.
nboyd%atg.com
rogerl%netscape.com