JavaScript:ActionMonkey
ActionMonkey is the code-name for the project to integrate Tamarin and SpiderMonkey as part of Mozilla 2.
Want to help? Write to jason dot orendorff at gmail dot com. Or visit irc://irc.mozilla.org/actionmonkey and say hi.
Goals
The goals are:
- Preservation (with necessary additions and as few deletions as possible) of jsapi.h.
- SpiderMonkey's thread safety and property tree integrated/reimplemented in Tamarin.
- Replacement of SpiderMonkey's decompiler with a better decompiler that can work with ABC.
- Replacement of SpiderMonkey's GC with Tamarin:MMgc, evolved as needed.
- Replacement of SpiderMonkey's interpreter by an evolved version of Tamarin's.
- Advanced JIT optimization for hot paths and untyped code, inspired by Trace Trees.
- Information flow VM support for better security models.
Stage 0
Replace SpiderMonkey's GC with Tamarin's GC (MMgc).
Details:
- The plan is to hollow out jsgc.c and replace it with a new implementation based on MMgc. The API in jsgc.h will be preserved.
- We'll use MMgc in non-incremental mode to start with. (It's easier. Avoid premature optimization.)
- We'll use a C wrapper for MMgc instead of building SpiderMonkey as C++, for the moment. (Whether jsgc.c itself will be C or C++ isn't yet decided.)
Steps:
- Convince the SpiderMonkey and Tamarin build systems to cooperate.
- Change the few places where SpiderMonkey is directly using stdlib malloc() (malloc, free, realloc, calloc, strdup, etc.) to use a new internal API (lowercase
js_malloc
).- brendan: Hope these can all be macro-defined.
- Look into maybe tweaking some of the APIs in jsgc.h to be friendlier to MMgc. For example, I don't know that `js_GetGCThingFlags()` corresponds to anything in MMgc.
- Team hacking session to reimplement jsgc.c.
Notes on the jsgc.h API:
- Tracing API. (This is used by the cycle collector.)
- API for tracing private data. (DOM objects use this to participate in GC.)
- Rooting API. (No sweat - this can be implemented in terms of
MMgc::GCRoot
.) - Object pinning API. (Same here.)
JS_IsAboutToBeFinalized()
needs to be implemented for MMgc.JS_AddExternalStringFinalizer()
and friends. (We can probably implement these in terms ofMMgc::GCFinalizedObject
.)
Other notes:
- XPConnect garbage-collects
XPCWrapNative
objects and its own data structures. This needs some more research. (Brendan thinks this won't affect stage 0 work.)
We will, for the moment, lose one thing: the threading model where a single JSRuntime
has multiple threads, each with its own JSContext
.
During this stage, work will be done in the http://hg.mozilla.org/actionmonkey Mercurial repository. (This repo is a hard hat area, one step removed from the primary mozilla-central repository. This is because we expect things will break intermittently. Also because some of the people working on this aren't CVS committers yet, myself included. -jorendorff)
Stage 1
More to come.