dcarney@chromium.org
98d1cedac4
Get array_function from NativeContext
...
R=mvstanton@chromium.org
LOG=N
BUG=347528
Review URL: https://codereview.chromium.org/184173003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-28 10:01:27 +00:00
bmeurer@chromium.org
5945f9ebb9
Fix handling of constant global variable assignments.
...
BUG=347904
LOG=y
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/184303003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-28 09:40:12 +00:00
svenpanne@chromium.org
c4e90c15b8
Removed bogus ASSERT.
...
LOG=y
BUG=347542
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/183763007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-28 08:45:07 +00:00
ishell@chromium.org
2ab83cf192
HAllocate should never generate allocation code if the requested size does not fit into page. Regression test included.
...
BUG=347543
LOG=N
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/180803005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19591 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-27 17:33:25 +00:00
verwaest@chromium.org
aa14020bc7
Fix putting of prototype transitions. The length is also subject to GC, just like entry.
...
BUG=347536
LOG=n
R=danno@chromium.org
Review URL: https://codereview.chromium.org/183193003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-27 16:07:44 +00:00
jarin@chromium.org
05b98492a4
Handle arguments objects in frame when materializing arguments
...
R=mstarzinger@chromium.org
BUG=347262
Review URL: https://codereview.chromium.org/177293009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-27 15:12:12 +00:00
yangguo@chromium.org
6912a248ca
Fix bogus assertion in SetFastDoubleElements.
...
R=danno@chromium.org
BUG=347530
LOG=N
Review URL: https://codereview.chromium.org/181433016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-27 14:45:53 +00:00
mvstanton@chromium.org
b8f8cfabca
Fix for Clusterfuzz issue 343928.
...
The problem was that the debugger didn't expect that a JSFunction could
have a GlobalContext, which it can with harmony scoping.
BUG=343928
R=yangguo@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/183103003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-27 13:25:05 +00:00
ishell@chromium.org
1ae7e8a1e5
Fix for failing asserts in HBoundsCheck code generation on x64: index register should be zero extended.
...
BUG=345820
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/180013002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19549 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 16:33:54 +00:00
verwaest@chromium.org
d5caecccc5
Revert "Use stability to only conditionally flush information from the CheckMaps table."
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/180023002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19548 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 16:11:58 +00:00
jkummerow@chromium.org
e7e93cd433
Mark HCompareMap as having Tagged representation
...
BUG=chromium:346636
LOG=y
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/176923013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 15:09:47 +00:00
rossberg@chromium.org
63f1970c6c
Fix crasher in Object.getOwnPropertySymbols
...
R=arv@chromium.org , mstarzinger@chromium.org
BUG=346141
LOG=Y
Review URL: https://codereview.chromium.org/177883002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19539 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 12:01:34 +00:00
bmeurer@chromium.org
77f597d387
Don't eliminate loads with incompatible types or representations.
...
BUG=346343
LOG=y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/179553002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19536 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 09:55:50 +00:00
ishell@chromium.org
6c1659becf
Fix for a smi stores optimization on x64 with a regression test.
...
BUG=345715
LOG=N
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/178833002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19535 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 09:55:02 +00:00
dcarney@chromium.org
cb05cff594
negative bounds checking on realm calls
...
R=rossberg@chromium.org
LOG=N
BUG=344285
Review URL: https://codereview.chromium.org/169393002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19533 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-25 09:15:05 +00:00
jkummerow@chromium.org
37b6fd07c1
Fix optimistic BCE to back off after deopt
...
BUG=v8:3176
LOG=n
R=danno@chromium.org
Review URL: https://codereview.chromium.org/177523002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19530 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-24 13:15:31 +00:00
verwaest@chromium.org
84b366516e
Don't turn objects with empty-string properties into fast-mode.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/165743003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19511 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-20 16:11:48 +00:00
ishell@chromium.org
1342cb8b00
Bugfix in check elimination with a regression test.
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/172173003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-19 12:34:50 +00:00
jkummerow@chromium.org
6e3b81a7b2
Fix Hydrogen bounds check elimination
...
When combining bounds checks, they must all be moved before the first load/store
that they are guarding.
BUG=chromium:344186
LOG=y
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/172093002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19475 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-19 10:30:39 +00:00
verwaest@chromium.org
60c08a8bf2
Directly store the transition target on LookupResult in TransitionResult.
...
BUG=chromium:343964
LOG=N
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/170343003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19440 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-18 12:19:32 +00:00
jarin@chromium.org
4c7ed144e1
Comparison in effect context lazy deopt fix.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/163623002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-16 05:51:10 +00:00
ulan@chromium.org
6744ff61ae
Fix dictionary element load to pass correct elements kind.
...
Using FAST_SMI_ELEMENTS triggers optimization on 64-bit architectures that load
only the higher 32 bits of the element. If the element is a pointer to undefined
that has 0 in the higher half than it is erroneously treated as SMI 0.
BUG=v8:3158
LOG=N
TEST=mjsunit/sparse-array-reverse,mjsunit/regress/regress-3158.js
R=danno@chromium.org , ishell@chromium.org
Review URL: https://codereview.chromium.org/166653005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-14 15:52:24 +00:00
yangguo@chromium.org
68c7523e63
Fix assignment of function name constant.
...
If it's shadowed by a variable of the same name and both are forcibly
context-allocated, the function is assigned to the wrong context slot.
R=rossberg@chromium.org
BUG=v8:3138
LOG=Y
Review URL: https://codereview.chromium.org/159903008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-14 12:40:47 +00:00
jarin@chromium.org
8acefb33fe
Test and fix for polymorphic named call deoptimization.
...
The fix removes wrong simulates from the number branch of polymorphic
call/field access handling.
The change also fixes the same thing for polymorphic named field
access even thourgh the field access is probably safe in practice
(because it cannot deoptimize). It is better to keep all our simulates
in sync with full codegen.
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/166503002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19375 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-14 12:02:39 +00:00
yangguo@chromium.org
a676bc1bbf
Fix typed array error message.
...
R=dslomov@chromium.org
BUG=v8:3159
LOG=N
Review URL: https://codereview.chromium.org/163293002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-14 09:33:03 +00:00
verwaest@chromium.org
e0960e19aa
Fix polymorphic inlining of accessors in a test-context.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/164003002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19363 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-13 16:55:38 +00:00
verwaest@chromium.org
161b2f689a
Reland: "Use stability to only conditionally flush information from the CheckMaps table."
...
BUG=
R=ishell@chromium.org
Original CL: https://codereview.chromium.org/153823003
Review URL: https://codereview.chromium.org/153653007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 18:48:12 +00:00
verwaest@chromium.org
7b7e3658f7
Don't propagate information through phis in loop headers.
...
To properly do this, we'd have to iterate over CompareMaps (and their bodies) handling phis, until we have learned enough to decide which paths can be taken. For now, just disable learning from phis in loop headers.
BUG=
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/147023005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 18:30:41 +00:00
verwaest@chromium.org
75432b7696
Revert "Use stability to only conditionally flush information from the CheckMaps table."
...
R=ishell@chromium.org
BUG=
Review URL: https://codereview.chromium.org/137863005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19331 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 15:38:42 +00:00
verwaest@chromium.org
2b7d33572a
Use stability to only conditionally flush information from the CheckMaps table.
...
BUG=
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/153823003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 15:07:41 +00:00
jarin@chromium.org
af29e31a11
Fix for (One|Two)ByteSeqStringSetChar evaluation order/deopt.
...
This makes the evaluation order consistent between full codegen
and Hydrogen (so that deopt does not screw up stack).
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/159983008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19326 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 13:31:24 +00:00
ulan@chromium.org
e95bc7eec8
Merge experimental/a64 to bleeding_edge.
...
BUG=v8:3113
LOG=Y
R=jochen@chromium.org , rmcilroy@chromium.org , rodolph.perfetta@arm.com
Review URL: https://codereview.chromium.org/148293020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19311 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-12 09:19:30 +00:00
jarin@chromium.org
21bf99e53e
Fix environment of the optimized version of the _SetValueOf intrinsic.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/158723006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-11 16:11:53 +00:00
rossberg@chromium.org
e8175a3e9f
Revert "Make Function.length and Function.name configurable properties."
...
Plenty of test failures on test262, Mozilla, Webkit. Will have to investigate.
TBR=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/139983003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19203 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-07 15:29:18 +00:00
rossberg@chromium.org
7317b71f02
Make Function.length and Function.name configurable properties.
...
ES6 makes the Function object properties "length" and "name"
configurable; switch the implementation over to follow that.
Doing so exposed a problem in the handling of non-writable, but
configurable properties backed by foreign callback accessors
internally. As an optimization, if such an accessor property is
re-defined with a new value, its setter was passed the new value
directly, keeping the property as an accessor property. However, this
is not correct should the property be non-writable, as its setter will
then simply ignore the updated value. Adjust the enabling logic for
this optimization accordingly, along with adding a test.
LOG=N
R=rossberg@chromium.org , rossberg
BUG=v8:3045
Review URL: https://codereview.chromium.org/116083006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19200 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-07 14:55:30 +00:00
jarin@chromium.org
476881ce5b
Test and fix for _CallFunction intrinsic deoptimization.
...
I have also cleaned up HOptimizedGraphBuilder::GenerateCallFunction
to use IfBuilder.
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/131343013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-06 12:42:26 +00:00
jarin@chromium.org
eb502fe599
Binary operation deoptimization fix.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/132453009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-06 09:36:55 +00:00
dslomov@chromium.org
a03d31394c
Check the offset argument of TypedArray.set for fitting into Smi.
...
R=jkummerow@chromium.org
BUG=340125
LOG=Y
Review URL: https://codereview.chromium.org/145623009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-04 09:53:05 +00:00
yangguo@chromium.org
9e70f6a4e7
Fix short-circuiting logical and/or in HOptimizedGraphBuilder.
...
R=jkummerow@chromium.org
BUG=336148
LOG=Y
Review URL: https://codereview.chromium.org/143263022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19031 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-03 14:29:34 +00:00
verwaest@chromium.org
db7124dc28
Return a valid map for PropertyAccessInfos with Boolean type.
...
BUG=340064
LOG=N
R=dcarney@chromium.org
Review URL: https://codereview.chromium.org/152603002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-02-03 10:20:32 +00:00
jarin@chromium.org
3c2363f4b4
Simpler repro for bug 2989.
...
We do not correctly handle accesses to f.arguments after one
of the argument has changed (where f is crankshafted).
R=machenbach@chromium.org
BUG=v8:2989
LOG=n
Review URL: https://codereview.chromium.org/151403003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18999 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-31 16:12:58 +00:00
bmeurer@chromium.org
3214cf11ff
Don't crash in Array.join() if the resulting string exceeds the max string length.
...
LOG=y
BUG=336820
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/144533003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18986 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-31 12:21:17 +00:00
verwaest@chromium.org
bef13f739c
Fix regression caused by supporting inlining accesses to non-JSObjects
...
TBR=dcarney@chromium.org
BUG=
Review URL: https://codereview.chromium.org/150983002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-31 00:29:04 +00:00
mvstanton@chromium.org
371d6f6a98
We shouldn't throw under FLAG_debug_code, rather abort.
...
Throwing under FLAG_debug_code confuses the rest of our infrastructure
which expects a safe point at the site of call into the runtime
for throw. We were doing that to make a clusterfuzz test happy, but
the better solution is to assert/abort under debug_code, and prevent
clusterfuzz from fuzzing on internal APIs that crash on incorrect
values.
We'll need to alter the fuzzer to turn off fuzzing for:
string-natives.js
lithium/SeqStringSetChar.js
regress/regress-seqstrsetchar-ex3.js
regress/regress-seqstrsetchar-ex1.js
regress/regress-crbug-320922.js
So as to prevent the fuzzer from running
%_OneByteSeqStringSetChar() and
%_TwoByteSeqStringSetChar().
BUG=
R=hpayer@chromium.org , machenbach@chromium.org
Review URL: https://codereview.chromium.org/139903005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18878 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-28 11:53:11 +00:00
verwaest@chromium.org
21532ddfdc
Reland ArrayPop / ArrayPush.
...
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/138443012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18814 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-24 11:47:53 +00:00
machenbach@chromium.org
cde3ed1fe3
Speed up some mjsunit test cases and clean up test expectations for arm and mips.
...
Many skipped test cases already run very fast. Removing the corresponding expectations.
BUG=
R=jkummerow@chromium.org , mvstanton@chromium.org
Review URL: https://codereview.chromium.org/138503008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18812 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-24 11:36:45 +00:00
jkummerow@chromium.org
ee4e034d70
Revert broken ArrayPop changes
...
This reverts:
r18749 "Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs."",
r18790 "Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft.", and
r18798 "MIPS: Remove ArrayPush from the custom call generators, and instead call directly to the handler in crankshaft."
For causing crashes on Canary.
BUG=chromium:337686
LOG=N
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/146003006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18805 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-24 08:32:50 +00:00
hpayer@chromium.org
83a1df2354
Remove Heap::MaxRegularSpaceAllocationSize and use Page::MaxRegularHeapObjectSize instead.
...
BUG=
R=mstarzinger@chromium.org , mvstanton@chromium.org
Review URL: https://codereview.chromium.org/141653016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18776 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-23 13:02:27 +00:00
verwaest@chromium.org
f30330325e
Reland (and fix) "Add hydrogen support for ArrayPop, and remove the handwritten call stubs."
...
BUG=
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/144913003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-22 13:22:58 +00:00
svenpanne@chromium.org
b4949cfd62
Fixed floor-of-div optimization.
...
We removed an HDiv by hand which was still used by an HChange. The
solution is letting dead code removal do the cleanup.
Removed a fragile "optimization" (looking through an HChange), too,
this obviously never triggered and is hard to get right given all our
global invariants and state/type/... changes.
The repro is a bit tricky, because you need inlining to make our
representations and types disagree in this case.
LOG=y
BUG=334708
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/143903016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18737 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-22 11:54:51 +00:00
machenbach@chromium.org
1864f7388e
Add infrastructure for skipping tests in GC stress mode.
...
Also move the GC stress configuration from the buildbot to the test runner.
BUG=
R=jkummerow@chromium.org , mvstanton@chromium.org
Review URL: https://codereview.chromium.org/141653008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-21 12:41:25 +00:00
mvstanton@chromium.org
155ef100e9
Fix logic error in assert in IsUndeclaredGlobal()
...
Recent changes in IC logic meant that CallStubs no longer use the Contextual bit. IsUndeclaredGlobal() needed to adjust for that.
In fact, now the CL has morphed to remove the notion of storing contextual state in the IC at all, it just becomes some extra ic state of the load ic. This took some adjustment in harmony code to use the global receiver for certain stores.
Now it's clearer that only LoadICs actually record any information about contextual or not.
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/140943002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18660 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-17 11:08:24 +00:00
verwaest@chromium.org
53f46c5214
Get rid of ContextualMode for call ICs.
...
BUG=
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/137083002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18594 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-14 16:15:05 +00:00
jkummerow@chromium.org
be4c1bdac2
Fix test after r18586
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/138063003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-14 14:00:10 +00:00
jkummerow@chromium.org
1ed94acf0c
Turn Runtime_MigrateInstance into Runtime_TryMigrateInstance
...
because it must not cause lazy deopts because it is called from deferred code that cannot handle lazy deopts.
Hat tip to Ben for doing most of the debugging work, and to Toon for writing the regression test.
BUG=chromium:315252
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/131243003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-14 13:41:09 +00:00
verwaest@chromium.org
f2245a9cf9
Make the strict-mode calling convention for contextual calls the default one.
...
BUG=
R=dcarney@chromium.org
Review URL: https://codereview.chromium.org/131663003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18581 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-14 12:04:10 +00:00
ulan@chromium.org
8db7aaa03d
Correctly handle instances without elements in polymorphic keyed load/store.
...
BUG=331416
TEST=mjsunit/regress/regress-331416.js
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/121893003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-08 09:57:28 +00:00
ulan@chromium.org
43d1c23e2a
Fix selection of popular pages in store buffer.
...
BUG=331444
TEST=mjsunit/regress/regress-331444.js
LOG=Y
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/125983002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18483 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-08 09:49:37 +00:00
jkummerow@chromium.org
7761059a98
Fix d8's Shell::ReadBuffer after r18227
...
BUG=v8:3085
LOG=N
R=jochen@chromium.org
Review URL: https://codereview.chromium.org/127853003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18482 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-08 09:48:38 +00:00
mvstanton@chromium.org
fc5834343f
Remove flag track-allocation-sites.
...
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.
R=verwaest@chromium.org
Committed: https://code.google.com/p/v8/source/detail?r=18385
Review URL: https://codereview.chromium.org/104923010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18474 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-01-07 15:58:25 +00:00
ulan@chromium.org
711bcbb0e3
ARM: fix loading of global object in LWrapReceiver.
...
Since r16993 the cp register is handled by registers allocator,
and we cannot assume that the cp always contains the context.
BUG=318420
LOG=Y
TEST=test/mjsunit/regress/regress-318420.js
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/121703002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18421 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-27 14:38:00 +00:00
yangguo@chromium.org
2a4be7067c
Refactor the compiling pipeline.
...
Goals:
- easier to read, more suitable identifiers.
- better distinction between compiling optimized/unoptimized code
- compiler does not install code on the function.
- easier to add features (e.g. caching optimized code for osr).
- remove unnecessary code.
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/110203002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-23 14:30:35 +00:00
yangguo@chromium.org
cd7d61cfc2
Fix small spec violation in String.prototype.split.
...
Also slightly extended the test coverage.
R=rossberg@chromium.org
BUG=v8:3026
LOG=Y
Review URL: https://codereview.chromium.org/119093002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18405 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-23 10:01:22 +00:00
yangguo@chromium.org
c61d07e03f
Correctly resolve forcibly context allocated parameters in debug-evaluate.
...
R=ulan@chromium.org
BUG=325676
LOG=Y
Review URL: https://codereview.chromium.org/107243006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18402 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-23 08:37:03 +00:00
rossberg@chromium.org
b882bddcfd
Make a strict function's "name" property non-writable.
...
Set [[Writable]] to false for the "name" property of strict
functions as well, mirroring what non-strict functions have
it as.
LOG=N
R=rossberg@chromium.org
TEST=mjsunit/regress/regress-270142
BUG=270142
Review URL: https://codereview.chromium.org/99203006
Patch from Sigbjorn Finne <sigbjornf@opera.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 12:06:11 +00:00
hpayer@chromium.org
f583b73b70
Revert "Remove flag track-allocation-sites."
...
This reverts commit 6c430da40efe388035504d3603756aa8c46ed1dc.
BUG=
Review URL: https://codereview.chromium.org/109303006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 12:04:34 +00:00
mvstanton@chromium.org
e654c88fab
Remove flag track-allocation-sites.
...
The flag has been on in the build for ~9 months, and we aren't likely to turn it off. The only customer of the flag is a set of tests that want to verify transitioning behavior in isolation. This CL removes the flag and updates those tests to get what they want without the flag.
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/104923010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18385 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-20 11:46:31 +00:00
jkummerow@chromium.org
3c76ecd732
Fix switch statements with non-Smi integer labels and no type feedback
...
BUG=chromium:329709
LOG=Y
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/98643010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-19 14:25:58 +00:00
yangguo@chromium.org
213b05b5b9
Fix off-by-one error in AstTyper, part 2.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/112933002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18308 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 15:19:57 +00:00
jkummerow@chromium.org
48ff79a300
Fix polymorphic inlined calls with migrating prototypes
...
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/104793003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18307 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-12 14:57:00 +00:00
ulan@chromium.org
cc401095fb
Initialize Date parse cache with SMI instead of double to workaround sharing mutable heap numbers in snapshot.
...
This is the only field in the snapshot that was tracked as double.
R=verwaest@chromium.org
TEST=mjsunit/regress/regress-280531.js
BUG=280531
LOG=Y
Review URL: https://chromiumcodereview.appspot.com/112003005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 13:11:44 +00:00
yangguo@chromium.org
5bc64b9fa5
Fix off-by-one error in AstTyper.
...
This causes the first parameter to be confused with the first
stack local when we collect type information.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/105943007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18296 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-11 11:34:09 +00:00
hpayer@chromium.org
75a84eca0b
Added regression test for escape analysis.
...
BUG=
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/99133011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18290 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-10 15:54:20 +00:00
svenpanne@chromium.org
e1db6d86a9
Avoid FP exceptions when doing integer division.
...
BUG=v8:3039
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/104003004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-09 10:15:19 +00:00
mvstanton@chromium.org
b807f4f82f
Bugfix: HCheckInstanceType::GetCheckMaskAndTag used an incorrect mask.
...
The mask to check for an internalized string was incorrectly formed. Hat
tip to Weiliang Lin for discovering the bug.
BUG=v8:3038
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/108033002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18265 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-06 09:43:07 +00:00
verwaest@chromium.org
8a4df124a4
Fix loop side-effects of deoptimizing loops with a nested live OSR loop.
...
R=titzer@chromium.org
Review URL: https://chromiumcodereview.appspot.com/106723002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-05 18:31:06 +00:00
verwaest@chromium.org
d4eaae37d1
Check whether the receiver to a keyed-call is actually a heapobject.
...
BUG=325225
LOG=n
R=dslomov@chromium.org
Review URL: https://chromiumcodereview.appspot.com/101863004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-03 17:59:31 +00:00
bmeurer@chromium.org
aa83f2900a
Fix invalid assertion with OSR in BuildBinaryOperation.
...
BUG=v8:3032
LOG=n
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/98623004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 13:12:07 +00:00
mstarzinger@chromium.org
db915fe97e
Handle captured objects in OptimizedFrame::Summarize.
...
R=yangguo@chromium.org
BUG=v8:3029
TEST=mjsunit/regress/regress-3029
LOG=N
Review URL: https://codereview.chromium.org/96773002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18187 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-12-02 12:11:02 +00:00
mvstanton@chromium.org
5ba1304d60
Array builtins need to be prevented from changing frozen objects, and changing structure on sealed objects.
...
BUG=299979
LOG=Y
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/80623002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-29 15:22:16 +00:00
yangguo@chromium.org
f235194518
Fix bug in inlining Function.apply.
...
R=jkummerow@chromium.org
BUG=323942
LOG=Y
Review URL: https://codereview.chromium.org/95123003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18135 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:30:17 +00:00
dslomov@chromium.org
7372596615
Ensure that length is Smi in TypedArrayFromArrayLike constructor.
...
R=jkummerow@chromium.org
BUG=324028
LOG=Y
Review URL: https://codereview.chromium.org/94473002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18129 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 15:22:36 +00:00
mstarzinger@chromium.org
d53e38777f
Fix missing bounds check in n-arguments Array constructor.
...
LOG=N
R=mvstanton@chromium.org
BUG=v8:3027
TEST=mjsunit/regress/regress-3027
Review URL: https://codereview.chromium.org/92103003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-28 09:29:57 +00:00
yangguo@chromium.org
ab96631177
Increase precision for base conversion for large integers.
...
R=jkummerow@chromium.org
BUG=v8:3025
LOG=Y
Review URL: https://codereview.chromium.org/88583002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 15:48:13 +00:00
yangguo@chromium.org
afd8e5a305
Speed up long-running test cases.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/85163003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18070 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 11:32:39 +00:00
yangguo@chromium.org
4716b292db
Make some ARM test cases faster.
...
R=ishell@chromium.org
Review URL: https://codereview.chromium.org/85473004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18069 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-26 10:43:44 +00:00
yangguo@chromium.org
aa3518a0f3
Make sure files end with exactly one new line and police this in presubmit.
...
The changes are (excluding presubmit.py) mechanical. I added the following
lines after the check and iterated the presubmit script until all errors
went away:
f = open(name, "w");
if contents.endswith('\n\n'):
f.write(contents[0:-1])
else:
f.write(contents + '\n')
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/82803005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 13:50:39 +00:00
ulan@chromium.org
21fb1401bd
Restore saved caller FP registers on stub failure
...
and preserve FP registers on NotifyStubFailure.
In debug mode, clobber FP registers on each runtime call to increase
chances of catching such bugs.
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/78283002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18000 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-22 10:21:47 +00:00
danno@chromium.org
06c7620302
Fixed crashes exposed though fuzzing.
...
The %_OneByteSeqStringSetChar intrinsic expects its arguments to be checked before being called for efficiency reasons, but the fuzzer provided no such checks. Now the intrinsic is robust to bad input if FLAG_debug_code is set.
R=yangguo@chromium.org
TEST=test/mjsunit/regress/regress-320948.js
BUG=chromium:320948
LOG=Y
Review URL: https://codereview.chromium.org/72813004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 16:41:07 +00:00
jkummerow@chromium.org
37443768bf
Fix register trashing in Emit*ByteSeqStringSetChar
...
This is currently not observable without --allow-natives-syntax because all internal usages are safe, but it deserves to be fixed nonetheless.
BUG=chromium:320922
LOG=N
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/67103003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 12:59:09 +00:00
mvstanton@chromium.org
bff41483dc
Bugfix: dependent code field in AllocationSite was keeping code objects alive even after context death.
...
BUG=320532
LOG=Y
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/62803008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-19 10:17:33 +00:00
dslomov@chromium.org
4228132e74
Use mock ArrayBuffer allocator to avoid really allocating 1Gb.
...
R=jkummerow@chromium.org
BUG=v8:3014
LOG=N
Review URL: https://codereview.chromium.org/61623009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17837 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-18 14:50:45 +00:00
danno@chromium.org
f27f2fa420
Match max property descriptor length to corresponding bit fields
...
BUG=v8:3010
R=verwaest@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/72333004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17823 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-18 11:44:06 +00:00
jkummerow@chromium.org
c9b41c6995
Limit size of dehoistable array indices
...
LOG=Y
BUG=chromium:319835,chromium:319860
R=dslomov@chromium.org
Review URL: https://codereview.chromium.org/74113002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17801 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 17:24:10 +00:00
dslomov@chromium.org
7936ca39be
Limit the size for typed arrays to MaxSmi.
...
R=jkummerow@chromium.org
LOG=Y
BUG=319722
Review URL: https://codereview.chromium.org/73943004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17800 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:37:15 +00:00
dslomov@chromium.org
c01aa1fc1f
Revert "Limit the size for typed arrays to MaxSmi."
...
This reverts commit r17798 for allocating too much memroy in tests.
TBR=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/74093002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:25:51 +00:00
dslomov@chromium.org
09ca1318ab
Limit the size for typed arrays to MaxSmi.
...
R=jkummerow@chromium.org
LOG=Y
BUG=319722
Review URL: https://codereview.chromium.org/73943004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17798 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 16:09:56 +00:00
verwaest@chromium.org
341d405301
Reland and fix "Add support for keyed-call on arrays of fast elements"
...
BUG=
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/71783003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 10:52:05 +00:00
bmeurer@chromium.org
2ee5aa951c
Fix missing type feedback check for Generic*String addition.
...
TEST=mjsunit/regress/regress-crbug-318671
BUG=318671
LOG=y
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/67473007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17772 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-15 09:13:36 +00:00
danno@chromium.org
28ed69b8fb
Fix overflow in TypedArray initialization function
...
BUG=chromium:319120
TEST=test/mjsunit/regress/regress-319120.js
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/61753013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17711 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-14 06:20:48 +00:00
mstarzinger@chromium.org
d5cb83f4aa
Fix invalid reuse of weak global handle in GetScriptWrapper.
...
This fixes a direct usage of a weak global handle in GetScriptWrapper
that just casted it to a strong local handle, while a subsequent GC
might clear it. Handlepocalypse anyone?
R=machenbach@chromium.org
BUG=v8:2988
TEST=mjsunit/regress/regress-2988
Review URL: https://codereview.chromium.org/67273004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-11 16:27:36 +00:00
ulan@chromium.org
bc4ad49b25
Do not add values to HGraph in Lithium.
...
Lithium uses indexes after the maximium value ID in the HGraph as indexes
of virtual registers and assumes that the maximum value ID does not change.
The IsStandardConstant and GetConstantXX functions could add constants to
HGraph, which aliased virtual registers with real values. This could confuse
the register allocator to think that a value in a virtual register is tagged
and to incorrectly set it in the pointer map.
BUG=298269
TEST=mjsunit/regress/regress-298269.js
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/66693002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 14:16:34 +00:00
mstarzinger@chromium.org
59536de77d
Make HCapturedObjects non-deletable for DCE.
...
R=jkummerow@chromium.org
BUG=v8:2987
TEST=mjsunit/regress/regress-2987
Review URL: https://codereview.chromium.org/64433002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17569 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-07 16:07:19 +00:00
yangguo@chromium.org
eb550c6da4
Fix y-umlaut to uppercase.
...
R=dcarney@chromium.org
BUG=v8:2984
Review URL: https://codereview.chromium.org/59853006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17545 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-07 09:08:34 +00:00
yangguo@chromium.org
a5ed9a71c8
Correctly load message from an Error object.
...
R=mstarzinger@chromium.org
BUG=306220
Review URL: https://codereview.chromium.org/46593010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-05 13:04:51 +00:00
jkummerow@chromium.org
2ebfd6e90e
Add missing negative dictionary lookup to NonexistentHandlerFrontend
...
BUG=v8:2980
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/57433003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-04 14:14:09 +00:00
jkummerow@chromium.org
316271fc35
Fix uint32-to-smi conversion in Lithium
...
BUG=chromium:309623
R=vegorov@google.com , yangguo@chromium.org
Review URL: https://codereview.chromium.org/54393002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17441 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-31 10:18:51 +00:00
yangguo@chromium.org
3f1a833524
Do not remove HAdd with zero if the other operand is a double.
...
The other operand might be minus zero, and -0 + 0 = +0
R=svenpanne@chromium.org
BUG=
Review URL: https://codereview.chromium.org/52173003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17432 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-30 10:22:52 +00:00
jkummerow@chromium.org
9e88c23cbf
ia32: Fix comparisons of two constant double operands when exactly one of them is in new space.
...
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/46883008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17428 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-29 14:34:07 +00:00
yangguo@chromium.org
7dd2d6c590
Reland "Make Array.prototype.pop throw if the last element is not configurable."
...
This relands r17346.
R=machenbach@chromium.org
BUG=311164
Review URL: https://codereview.chromium.org/43923002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-25 11:55:56 +00:00
svenpanne@chromium.org
7fb61a78d4
Tune mjsunit/regress/regress-2612.
...
Lower the bounds to something bearable which would still timeout if we
used a quadratic algorithm.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/39863003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17377 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 13:07:16 +00:00
svenpanne@chromium.org
f2122438e0
Removed long-running obselete test case.
...
The test was the 2nd longest-running test case in debug mode, and the
stuff it tests has already been moved long ago to some other place,
which is in turn heavily tested by far simpler and faster things
(%TruncateString etc.).
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/39233003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17361 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 08:09:32 +00:00
yangguo@chromium.org
0f564cb1b0
Revert "Make Array.prototype.pop throw if the last element is not configurable."
...
This reverts commit r17346.
R=bmeurer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/39593002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-24 07:48:23 +00:00
yangguo@chromium.org
e25920da19
Make Array.prototype.pop throw if the last element is not configurable.
...
Popping an element from an array should call [[Delete]] internal method
and pass true as the second argument (ECMA-262/5.1/#sec-15.4.4.6).
When the last element can't be deleted, throw a Type Error.
Not throwing the error would result in endless loop in the following test.
TEST=var a=[];Object.defineProperty(a,0,{});while(a.length)a.pop();
By the way fix another bug, or else i can't post any issues.
"presubmit.py" throw a "missing a correct copyright header" on windows.
Both the slash and the backslash are valid path separator on windows.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/29513004
Patch from Yanagi <admin@web-tinker.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 16:19:24 +00:00
jkummerow@chromium.org
8259439ae8
Fix HObjectAccess for loads from migrating prototypes
...
BUG=chromium:305309
R=danno@chromium.org
Review URL: https://codereview.chromium.org/35173005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17345 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-23 15:15:15 +00:00
svenpanne@chromium.org
dd74f5aa08
Removed obsolete unit tests.
...
As discussed offline, these tests don't test what they were supposed to
test anymore and were the longest running ones.
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/32433009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17317 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-22 11:26:07 +00:00
mstarzinger@chromium.org
0a2b4ecdcc
Add regression test for optimized count operation.
...
This is a regression test for a bug with handling of count operations
that target a JavaScript accessor on the prototype chain in Crankshaft.
R=jkummerow@chromium.org
BUG=chromium:306851
TEST=mjsunit/regress/regress-crbug-306851
Review URL: https://codereview.chromium.org/27702002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 12:48:28 +00:00
dslomov@chromium.org
5ccd697875
Do not look up ArrayBuffer on global object in typed array constructor.
...
BUG=v8:2931
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/27238009
Patch from Ben Noordhuis <info@bnoordhuis.nl>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-15 11:27:12 +00:00
yangguo@chromium.org
71ba8c5fb4
Retire concurrent recompilation delay for non-stress testing.
...
Instead, we block concurrent recompilation until unblocked. This makes
affected tests more predictable and run shorter.
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/26758003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17199 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-14 14:15:22 +00:00
mstarzinger@chromium.org
f878c1c359
Fix pre-parsing of 'use strict' directive after string literals.
...
R=ulan@chromium.org
TEST=mjsunit/regress/regress-parse-use-strict
Review URL: https://codereview.chromium.org/27025002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17164 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-11 14:03:54 +00:00
olivf@chromium.org
4b6d0e33f2
Only set binary operation side effects flags, when observable.
...
BUG=
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/26712002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17147 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 16:49:25 +00:00
mstarzinger@chromium.org
63d8abb6c6
Unify and fix checkers for duplicate object literal properties.
...
R=ulan@chromium.org
TEST=preparser/duplicate-property,mjsunit/regress/regress-parse-object-literal
Review URL: https://codereview.chromium.org/26375004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-10 11:58:16 +00:00
verwaest@chromium.org
7e0ea6ab46
Only fold polymorphic into monomorphic load if all load from either receiver or same prototype.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/25718002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-02 13:24:08 +00:00
olivf@chromium.org
d268078ce0
Fix flaky parallel recompilation test.
...
On very rare circumstances parallel recompilation would install
the optimized method earlier than expected and the test would fail.
BUG=
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/24495005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16933 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-25 08:23:14 +00:00
olivf@chromium.org
6fc2875d51
Fix Environment size mismatch in r6849.
...
TBR=svenpanne@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23983043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16851 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-20 08:34:23 +00:00
yangguo@chromium.org
cb10ceb19d
Reland "Clean up after r16292 (disable optimization for StringWrappers)."
...
BUG=
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/23619036
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 16:17:58 +00:00
yangguo@chromium.org
ad25a2969d
Revert "Clean up after r16292 (disable optimization for StringWrappers)."
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23600040
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16679 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 11:15:12 +00:00
yangguo@chromium.org
996813cca2
Clean up after r16292 (disable optimization for StringWrappers).
...
R=jochen@chromium.org
BUG=v8:2855
Review URL: https://codereview.chromium.org/22891028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-12 10:55:57 +00:00
titzer@chromium.org
49d9555a97
Generate a custom OSR entrypoint for OSR compiles on all platforms, and transition to optimized code using the special entrypoint, instead of through the deoptimizer. Do not install the OSR compiled code as _the_ optimized code for a function.
...
Remove OSR-related stuff from deoptimizer.
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/21340002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16599 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-09 16:34:40 +00:00
jkummerow@chromium.org
daee0d83db
Fix bitwise negation on x64
...
BUG=chromium:285355
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/24037003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16579 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-06 15:21:38 +00:00
yangguo@chromium.org
d9659da6f4
Fix bug in regexp result object construction.
...
R=verwaest@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23548018
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16556 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 14:32:49 +00:00
verwaest@chromium.org
b41a7b9cea
Properly close the CountOperation value/effect context after leaving the store effect context.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23897003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16554 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-05 12:33:14 +00:00
yangguo@chromium.org
070e3b0af4
Introduce concurrent on-stack replacement.
...
Currently disabled behind --concurrent-osr.
R=titzer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23710014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16527 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-04 12:55:59 +00:00
verwaest@chromium.org
3f70c3b07b
Allow uncacheable identifiers to go generic.
...
BUG=v8:2867
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23453019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-09-02 16:32:11 +00:00
jkummerow@chromium.org
2c9ac9c7e1
Always visit branches during HGraph building
...
even if constant values indicate that they are unreachable.
BUG=chromium:280333
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/23623009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-29 14:55:45 +00:00
jkummerow@chromium.org
3747b5bc6d
Delete HAbnormalExit. It does more harm than good.
...
BUG=v8:2843
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/23462007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 15:00:30 +00:00
verwaest@chromium.org
652b174cfc
Merge verbatim descriptors from other (the descriptor of the map being updated) rather than this (descriptors of the most updated map found in the transition tree).
...
BUG=v8:2863
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23676003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-28 12:37:14 +00:00
jkummerow@chromium.org
11fd577261
Lower kInitialMaxFastElementArray constant to 95K
...
to work around erroneous "illegal access" error on x64.
BUG=v8:2790
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/22877039
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16324 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-26 13:04:05 +00:00
jochen@chromium.org
de7352db92
Temporarily disable optimization for StringWrappers to use native valueOf
...
V8 stores this information directly in the map of the wrapper, however,
it is not invalidated when the prototype of the wrapper is changed, so
once the bit is set, it is no longer possible to override valueOf.
This bug is currently hidden in Chrome since the i18n extension always
modifies the String.prototype, and so the optimization never kicks in.
Disabling the optimization temporarily allows for snapshotting i18n now.
BUG=v8:2855
R=yangguo@chromium.org
TEST=mjsunit/regress/regress-2855.js
Review URL: https://codereview.chromium.org/23060030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 11:31:18 +00:00
rossberg@chromium.org
971df386b3
Fix scoping of function declarations in eval inside non-trivial local scope
...
R=mstarzinger@chromium.org
BUG=v8:2594
Review URL: https://codereview.chromium.org/22901010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16286 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-23 09:25:37 +00:00
yangguo@chromium.org
be48c5ae26
Rename "parallel recompilation" to "concurrent recompilation".
...
Also introduced macros for flag aliases for temporary backwards compatibility.
R=hpayer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/23014007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16280 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 16:14:37 +00:00
mstarzinger@chromium.org
0ecd03ab4c
Fix hidden properties on object with frozen prototype.
...
This fixes a corner-case where a frozen prototype with existing hidden
properties might prevent setting hidden properties on another object.
R=rossberg@chromium.org
BUG=v8:2829
Review URL: https://codereview.chromium.org/22799021
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16276 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 13:51:32 +00:00
verwaest@chromium.org
eb6cbe1486
Never clear debug-stub call ICs. Make a clear distinction between is_debug_stub
...
used everywhere but the debugger, and IsDebugBreak, used by the debugger.
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23361014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16269 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-22 12:16:00 +00:00
jkummerow@chromium.org
e814a9b96b
Fix "Hole" leak in TryBuildConsolidatedElementLoad
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/23361007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16262 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-21 15:31:03 +00:00
olivf@chromium.org
383a167279
Add X87 implementations for Integer32ToDouble, DoubleToI, DoubleToSmi
...
Additionally refactor the X87Stack tracking
BUG=
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/20781007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16246 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-20 13:01:54 +00:00
verwaest@chromium.org
d81af53131
Store copied value rather than the original double.
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23262002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16208 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-16 15:43:42 +00:00
mstarzinger@chromium.org
3e4fbd0e85
Mark HStringCompareAndBranch as potentially causing GCs.
...
This also adds a %SetAllocationTimout runtime function which helps to
write regression tests that need to trigger a GC at a certain point in
program execution.
R=hpayer@chromium.org
BUG=chromium:274438
TEST=mjsunit/regress/regress-crbug-274438
Review URL: https://codereview.chromium.org/22933006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-16 15:10:07 +00:00
jkummerow@chromium.org
e71a91ca08
Fix Math.round/floor that had bogus Smi representation
...
BUG=chromium:272564
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/23022005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-14 12:14:08 +00:00
verwaest@chromium.org
169f5a9d7b
Never hchange nan-hole to hole or hole to nan-hole.
...
Only allow changing hole to nan if all uses allow undefined as nan.
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22152003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-14 08:54:27 +00:00
jkummerow@chromium.org
6f800f90ee
Fix overflow check computation for Smi Phis
...
BUG=v8:2836
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/22629011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 18:18:24 +00:00
yangguo@chromium.org
415b61e12e
Fix bug in HPhi::SimplifyConstantInput
...
R=jkummerow@chromium.org
BUG=269679
Review URL: https://codereview.chromium.org/23075003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 16:47:27 +00:00
verwaest@chromium.org
145f240060
Store doubles before calling into the elements transition stub on ARM
...
BUG=
R=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22854011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16172 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-13 15:06:17 +00:00
yangguo@chromium.org
c52b7bba05
Fix regressions triggered by map invalidation during graph creation.
...
BUG=
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/22807003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-12 14:10:25 +00:00
verwaest@chromium.org
ee53b0a5ed
Make all load-named-fields depend on their map-check, unless explicitly ignored.
...
BUG=
R=titzer@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22555004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 18:40:10 +00:00
verwaest@chromium.org
19659646ca
Fix smi-based math floor.
...
BUG=chromium:270268
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22623007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-09 11:21:03 +00:00
verwaest@chromium.org
e5afd32129
Fix Object.freeze, Object.observe wrt CountOperation and CompoundAssignment.
...
BUG=2774,2779
R=adamk@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22562004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16111 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 18:45:41 +00:00
jkummerow@chromium.org
371ac893f9
Check for empty handle in JSON stringifier
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/22420004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16106 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 16:34:13 +00:00
yangguo@chromium.org
ef8d394f12
Re-reland "Flush parallel recompilation queues on context dispose notification"
...
BUG=
R=hpayer@chromium.org , mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/22379002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-07 09:33:09 +00:00
ulan@chromium.org
3511f7a428
Fix Array index dehoisting.
...
BUG=264203
TEST=test/mjsunit/regress/regress-264203
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/22314012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 16:38:39 +00:00
rossberg@chromium.org
5e121882c6
Remove test that causes illegal access now
...
TBR=mstarzinger@chromium.org
BUG=265369
Review URL: https://codereview.chromium.org/22428002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 14:34:25 +00:00
rossberg@chromium.org
f56ad9cab7
Turn assert into runtime assertion to make fuzzer happy
...
R=mstarzinger@chromium.org
BUG=265369
Review URL: https://codereview.chromium.org/22284009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16076 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 14:19:13 +00:00
jkummerow@chromium.org
232a2c0d88
Regression test for issue 2813 / r16008
...
BUG=v8:2813
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/21806002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16030 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-02 12:17:19 +00:00
verwaest@chromium.org
2af164f4d9
Mark maps as unstable if their instances potentially transition away.
...
Use this as a prerequisite for adding code dependencies.
R=ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/21095005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 16:33:58 +00:00
titzer@chromium.org
45d4afbde5
Fix many tests that try to force an OSR by checking OptimizationStatus() to instead check OptimizationCount().
...
BUG=
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/21221003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15951 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 09:28:55 +00:00
mstarzinger@chromium.org
3202e1d795
Re-revert "Flush parallel recompilation queues on context dispose notification" (r15883).
...
R=danno@chromium.org
BUG=
Review URL: https://codereview.chromium.org/21156009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15947 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-30 08:35:48 +00:00
jkummerow@chromium.org
3619dcf868
Add regression test for recently fixed bug
...
BUG=chromium:258519
R=machenbach@chromium.org
Review URL: https://codereview.chromium.org/20732002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15912 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-26 14:58:30 +00:00
machenbach@chromium.org
53c95353c9
Disable mjsunit test when parallel recompilation is not available.
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/20573003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-26 12:34:46 +00:00
jkummerow@chromium.org
32e2e37230
Fix JSArray-specific length lookup in polymorphic array handling
...
BUG=chromium:263276
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/20295005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-25 15:04:21 +00:00
yangguo@chromium.org
14e205e9cf
Reland "Flush parallel recompilation queues on context dispose notification."
...
BUG=
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/19500022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-25 15:01:23 +00:00
ulan@chromium.org
b2dd5c67f7
ARM: Ensure space for lazy deoptimization before calling IC.
...
If IC triggers deoptimization, then subsequent patching might get invalid
target address that was overwritten.
R=verwaest@chromium.org
BUG=247688
TEST=mjsunit/regress/regress-247688.js
Review URL: https://chromiumcodereview.appspot.com/19972002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15808 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 17:21:41 +00:00
yangguo@chromium.org
cd41cb9b6d
Turn on parallel recompilation for tests that assert optimization status.
...
R=mvstanton@chromium.org
BUG=
Review URL: https://codereview.chromium.org/19807002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15793 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-22 09:16:33 +00:00
ulan@chromium.org
88a4b0d6ca
Fix deopt in store with effect context.
...
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/19693004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15780 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 13:45:26 +00:00
verwaest@chromium.org
be472d82fd
Fix wrong bailout id in polymorphic stores.
...
BUG=chromium:259787
R=titzer@chromium.org , ulan@chromium.org
Review URL: https://chromiumcodereview.appspot.com/19528005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 08:45:47 +00:00
mstarzinger@chromium.org
3eded2c06c
Fix %NeverOptimizeFunction runtime call.
...
The current usage of this runtime function is broken as it does not
prevent inlining of the affected function but rather bails out from the
whole unit of compilation after trying to inline affected functions.
This simplifies said runtime function to avoid accidental misuse.
R=titzer@chromium.org
TEST=mjsunit/never-optimize
Review URL: https://codereview.chromium.org/19776006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15762 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-19 08:25:44 +00:00
svenpanne@chromium.org
b951f03cee
Fixed type feedback in presence of negative lookups.
...
To fix the issue at hand regarding constant function calls and perhaps
other hidden issues regarding negative lookups, we basically add a
"marker instruction", just for harvesting purposes. Our type feedback
oracle is really, really fragile, we should better switch to some more
explicit and robust scheme soon.
BUG=chromium:252797
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/19588002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15741 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-18 09:12:44 +00:00
yangguo@chromium.org
9d6445cf32
Do not materialize context-allocated values for debug-evaluate.
...
BUG=259300
R=ulan@chromium.org , verwaest@chromium.org
Review URL: https://codereview.chromium.org/19569003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 15:29:00 +00:00
jkummerow@chromium.org
22f2fd8397
Synchronize Compare-Literal behavior in FullCodegen and Hydrogen
...
BUG=chromium:260345
R=danno@chromium.org
Review URL: https://codereview.chromium.org/19582002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15723 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-17 13:13:38 +00:00
rossberg@chromium.org
db76aa2717
Fix sloppy-mode 'const' under Harmony flag.
...
R=yangguo@chromium.org
BUG=173361
Review URL: https://codereview.chromium.org/19199002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15670 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-15 14:12:20 +00:00
danno@chromium.org
c65f4f7f7b
Don't use StoreIC_ArrayLength on frozen arrays
...
The code previously assumed that an array with fast properties must have
a writable length property. But Object.freeze() now exposes a way to make
length read-only without moving the object into slow mode. This patch
simply adds a !is_frozen check to the IC code. Any future optimizations
to attribute-setting on JSArrays will need to make similar accomodations.
R=danno
BUG=v8:2711,259548
Review URL: https://chromiumcodereview.appspot.com/19115002
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-14 22:03:46 +00:00
titzer@chromium.org
9e7819fac4
Added %NeverOptimize runtime call that can disable optimizations for a method for tests.
...
BUG=
Review URL: https://codereview.chromium.org/18214005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15632 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-11 14:17:56 +00:00
yangguo@chromium.org
b99ca1ab12
Do not implicitly convert receivers for builtin functions when inspecting frames.
...
R=jkummerow@chromium.org
BUG=
Review URL: https://codereview.chromium.org/18900004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15574 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-09 13:58:11 +00:00
danno@chromium.org
bd50e6d38f
Refactoring and cleanup of control instructions
...
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/18331004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15513 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:40:14 +00:00
danno@chromium.org
345cc98a25
Generate StoreGlobal stubs with Hydrogen
...
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.
R=rossberg@chromium.org , ulan@chromium.org
Committed: http://code.google.com/p/v8/source/detail?r=15419
Review URL: https://codereview.chromium.org/16925008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15512 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 10:34:02 +00:00
ulan@chromium.org
74d147a25d
Enable weak embedded maps in optimized code.
...
If the top optimized code in call stack is at the point that does not support
deoptimization, then treat the maps in the code as strong pointers.
Note that other optimized code in call stack must support deoptimization
because of the call instruction with side-effects.
BUG=217858,v8:2073
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16955008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15452 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-02 15:15:58 +00:00
danno@chromium.org
77c20c30a3
Revert r15419: "Generate StoreGlobal stubs with Hydrogen"
...
TBR=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/18357004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15427 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 15:12:21 +00:00
danno@chromium.org
a3bce19868
Generate StoreGlobal stubs with Hydrogen
...
- Constants globals are inlined into Hydrogen code using code dependencies that invalidate the Crankshafted code when global PropertyCells or the global object change.
- The more general case generates code that is just as good as the hand-written assembly stubs on all platforms.
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/16925008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15419 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-01 13:22:13 +00:00
yangguo@chromium.org
85d7a36ee0
Abort optimization when debugger is turned on.
...
BUG=v8:2751
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/18198003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15378 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-28 11:34:51 +00:00
dslomov@chromium.org
ef189ecd82
Do not allow invocation of ArrayBuffer and array buffer views' constructors as functions.
...
ES6 bug 695 (https://bugs.ecmascript.org/show_bug.cgi?id=695 ).
This never worked in WebKit, so no compatibility issues.
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/17904007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15346 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-27 07:42:08 +00:00
yangguo@chromium.org
b7b92bd9ac
Short-circuit embedded cons strings.
...
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/17418003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15263 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-21 09:24:30 +00:00
verwaest@chromium.org
2ca5c6cd03
Fix using monomorphic store instruction for polymorphic stores.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16875008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15214 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 18:07:35 +00:00
svenpanne@chromium.org
010d9aba16
Avoid relying on monkey-patchable things in String.prototype.split.
...
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/17391016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15206 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-19 12:25:40 +00:00
svenpanne@chromium.org
fb7310b1fd
Fixed read-only attribute of Function.length in strict mode.
...
R=cira@chromium.org
Review URL: https://codereview.chromium.org/17006006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-18 07:51:50 +00:00
wingo@igalia.com
09fcac5e39
Use keyed-call inline caches in delegating yield
...
Since we can't assume anything about the shape of the iterator in a
yield* (delegating yield), use an IC to do the next() and throw()
iterator method calls.
BUG=v8:2691
R=rossberg@chromium.org
TEST=mjsunit/regress/regress-2691
Review URL: https://codereview.chromium.org/15455002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15111 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-13 10:18:28 +00:00
mvstanton@chromium.org
75afb8ce79
Fix for bug 245480. Calling new Array(a) with a single argument could result in creating a holey array with a packed elements kind.
...
BUG=245480
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/16341004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-12 18:04:16 +00:00
jkummerow@chromium.org
9447014780
Skip some conditional deopts for Div/Mul when all uses are truncating.
...
- set "can be minus zero" flag properly so minus-zero checks are skipped
- skip "integer result?" check in division code when uses are truncating
- drive-by cleanup: consolidated computation of kCanOverflow flag for Add/Sub into range inference phase
BUG=v8:2132
R=svenpanne@chromium.org
Review URL: https://codereview.chromium.org/16741002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15060 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:43:57 +00:00
wingo@igalia.com
f68d6a10f8
Fix crasher when checking for "of", but next token has no literal buffer
...
Also fix a typo in an assertion in scanner.h.
R=mstarzinger@chromium.org
BUG=248025
TEST=mjsunit/regress/regress-crbug-248025.js
Review URL: https://codereview.chromium.org/16549003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-11 11:30:03 +00:00
mstarzinger@chromium.org
ecc41e30c0
Fix re-initialization of existing double field.
...
R=verwaest@chromium.org
BUG=v8:2717
TEST=mjsunit/regress/regress-2717
Review URL: https://codereview.chromium.org/16735003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15033 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-10 11:55:47 +00:00
verwaest@chromium.org
3588aa45cd
Take all uses into account to clear int32 truncation.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16656002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15017 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-07 17:28:46 +00:00
verwaest@chromium.org
5e8679beea
Remove the optimized construct stub.
...
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15993016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14946 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-05 08:43:25 +00:00
mvstanton@chromium.org
3d3c6b1599
Special Array constructor type feedback erroneously recorded when Array
...
was called as a function. Issue was found with optimize_constructed_array
turned on. This patch makes the fix, and turns the flag back on.
BUG=244461
R=danno@chromium.org
Review URL: https://codereview.chromium.org/16057005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-03 14:46:23 +00:00
jkummerow@chromium.org
b4058a3bd4
Fast literals: fixed initialization of non-copied in-object property fields
...
BUG=chromium:245424
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/16190008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14906 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-31 15:50:19 +00:00
verwaest@chromium.org
5b08a1a119
Fix DeferredTaggedToINoSSE2 to not unconditionally untag undefined to 0.
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16228002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14896 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-31 08:37:34 +00:00
verwaest@chromium.org
1a4a904bef
Replace DeoptimizeOnUndefined with whitelisting AllowUndefinedAsNan
...
R=danno@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15952007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14894 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-30 09:11:06 +00:00
yurys@chromium.org
09959efe41
Add support for //# sourceURL similar to deprecated //@ sourceURL one.
...
BUG=v8:2702
R=yangguo@chromium.org , yurys@chromium.org
Review URL: https://codereview.chromium.org/15859010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-29 12:40:21 +00:00
mstarzinger@chromium.org
3b114cdd64
Fix IfBuilder::Deopt to clear the current block.
...
R=jkummerow@chromium.org
BUG=chromium:243868
TEST=mjsunit/regress/regress-crbug-243868
Review URL: https://codereview.chromium.org/16155003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14854 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-28 15:30:49 +00:00
verwaest@chromium.org
aa2444269b
Fix the hole loading optimization.
...
- Holes are only ever loaded as double or tagged.
- Change to tagged has to deoptimize on undefined (no implicit
conversions from double the hole NaN -> tagged undefined).
BUG=
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/16099006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-27 17:33:14 +00:00
yangguo@chromium.org
3e41834721
Regexp parser: reset flag after scanning ahead for capture groups.
...
When the regexp pattern parser encounters an unbound reference to a
capturing group, it needs to scan ahead to decide whether it really
is a reference. The scan advances to the end of the pattern string
and sets has_more_ to false, but fails to reset it to true so that
later on, parsing a character class wrongly fails.
R=ulan@chromium.org
BUG=v8:2690
Review URL: https://chromiumcodereview.appspot.com/15712006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-27 10:53:37 +00:00
yangguo@chromium.org
7c2a1346d6
Fix edge case in stack trace formatting.
...
Bug description: in strict mode, null as receiver is not implicitly converted
to the global object, so that when formatting the stack trace, the receiver of
the stack frame is null. The IS_OBJECT check returns true for null, but
%GetDataProperty expected a JSObject, which results in a failed RUNTIME_ASSERT.
R=mvstanton@chromium.org
BUG=237617
Review URL: https://chromiumcodereview.appspot.com/15670003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14797 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-24 11:33:46 +00:00
yangguo@chromium.org
1d39355405
Add belated test for the SeqStringSetChar bug.
...
R=titzer@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/15849003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-24 08:37:27 +00:00
mstarzinger@chromium.org
8fb2086847
Fix embedded new-space pointer in LCmpObjectEqAndBranch.
...
R=mvstanton@chromium.org
BUG=chromium:240032
TEST=mjsunit/regress/regress-crbug-240032
Review URL: https://codereview.chromium.org/15779004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14777 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-23 14:06:28 +00:00
mstarzinger@chromium.org
b704cb9139
Fix bogus deopt in BuildEmitDeepCopy for holey arrays.
...
R=verwaest@chromium.org
BUG=chromium:242924
TEST=mjsunit/regress/regress-crbug-242924
Review URL: https://codereview.chromium.org/15735012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14757 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 17:58:21 +00:00
verwaest@chromium.org
b353b1d131
Don't allow copying holes to fields.
...
R=jkummerow@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15745006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 15:33:53 +00:00
mstarzinger@chromium.org
bf413b5122
Fix VisitLogicalExpression for empty blocks on RHS.
...
R=jkummerow@chromium.org
BUG=chromium:242870
TEST=mjsunit/regress/regress-crbug-242870
Review URL: https://codereview.chromium.org/15744002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14747 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 13:27:00 +00:00
yangguo@chromium.org
9960b24694
Fix unexpected elements transition in JSON.parse
...
R=verwaest@chromium.org
BUG=241344
Review URL: https://chromiumcodereview.appspot.com/15739003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14746 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-22 13:24:18 +00:00
mstarzinger@chromium.org
db4a770c3f
Add regression test for fix from r14732.
...
R=verwaest@chromium.org
BUG=chromium:242502
TEST=mjsunit/regress/regress-crbug-242502
Review URL: https://codereview.chromium.org/15288008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14734 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-21 14:20:42 +00:00
titzer@chromium.org
5746d38351
Fix code gen bug on arm and mips; SeqStringSetChar overwrites a register; Add better default PrintDataTo for HInstruction
...
BUG=
Review URL: https://codereview.chromium.org/14895019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14710 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-16 14:27:39 +00:00
wingo@igalia.com
d6fa1d8ad9
Function constructor should avoid String.prototype methods
...
Replace a use of .indexOf with a call to StringIndexOf. As always,
lexical scoping to the rescue.
R=mstarzinger@chromium.org
TEST=mjsunit/regress/regress-2686
BUG=v8:2686
Review URL: https://codereview.chromium.org/14668013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14678 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-15 10:52:06 +00:00
wingo@igalia.com
1634369af7
Don't flush code for generator functions.
...
R=mstarzinger@chromium.org
BUG=v8:2681
TEST=mjsunit/regress/regress-2681
Review URL: https://codereview.chromium.org/14731023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 17:36:26 +00:00
jkummerow@chromium.org
7636fdec27
Fix missing hole check for loads from Smi arrays when all uses are changes
...
BUG=chromium:233737
Review URL: https://codereview.chromium.org/14978004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-13 11:58:10 +00:00
ulan@chromium.org
cd4e9866b7
Fix environment in HOptimizedGraphBuilder::VisitCountOperation. Follow-up for r14584.
...
R=danno@chromium.org
BUG=v8:2671
TEST=mjsunit/regress/regress-2671-1.js
Review URL: https://chromiumcodereview.appspot.com/14972009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14596 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 14:58:06 +00:00
ulan@chromium.org
e5a29e8ff9
Do not change environment between simulate and scope with no observable side-effects in HandlePropertyAssignment.
...
LChunkBuilder reconstructs the environment by applying simulates. A scope with no observable side-effects has no simulates. If the scope deoptimizes, then LChunkBuilder would miss the changes to the environment between the last simulate and the scope.
R=danno@chromium.org
BUG=v8:2671
TEST=mjsunit/regress/regress-2671.js
Review URL: https://chromiumcodereview.appspot.com/14793009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14584 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-05-08 07:40:28 +00:00
danno@chromium.org
528792e39b
Fix beyond-heap load on x64 Crankshafted StringCharFromCode
...
BUG=chromium:235311
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/14387008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14481 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-29 14:34:24 +00:00
jkummerow@chromium.org
628875475e
Fix overflow check in mul-i which was missing since r14322
...
Review URL: https://codereview.chromium.org/14471012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14430 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-25 07:36:59 +00:00
dslomov@chromium.org
852f90339a
Adds EXTERNAL_DOUBLE_ARRAY to a list of instance types
...
BUG=v8:2646
Patch by Andrei Kashcha <anvaka@gmail.com>
Review URL: https://codereview.chromium.org/14042008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14398 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 17:02:09 +00:00
ulan@chromium.org
bc4d7878e6
Do not emit Simulates in HandlePolymorphicElementAccess.
...
BUG=v8:2653
R=jkummerow@chromium.org
TEST=mjsunit/regress/regress-2653.js
Review URL: https://chromiumcodereview.appspot.com/14081025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 15:28:44 +00:00
svenpanne@chromium.org
cd34acdae3
Do not emit double values at their use sites.
...
Revert part of r14179. From the regression test's comment:
Currently, the gap resolver doesn't handle moves from a ConstantOperand to a
DoubleRegister, but these kind of moves appeared when HConstant::EmitAtUses
was changed to allow special double values (-0, NaN, hole). So we should
either enhance the gap resolver or make sure that such moves don't happen.
BUG=chrome:234101
Review URL: https://codereview.chromium.org/14429002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14394 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-23 13:08:10 +00:00
mstarzinger@chromium.org
adf9afc09e
Fix missing Smi check in grow mode keyed stores.
...
R=danno@chromium.org
TEST=mjsunit/regress/regress-grow-store-smi-check
Review URL: https://codereview.chromium.org/14352011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14332 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-18 14:18:27 +00:00
yangguo@chromium.org
d7b78dc230
Fix OOB write in --print-code.
...
R=jkummerow@chromium.org
BUG=v8:2624
Review URL: https://chromiumcodereview.appspot.com/14018010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14267 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-15 15:19:51 +00:00
yangguo@chromium.org
da5c11a44a
Fix JSON.stringify's slow path wrt sliced strings.
...
R=mvstanton@chromium.org
BUG=229923
Review URL: https://chromiumcodereview.appspot.com/14107004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-11 09:53:00 +00:00
yangguo@chromium.org
996a80df45
Fix OSR for nested loops.
...
R=jkummerow@chromium.org
BUG=v8:2618
Review URL: https://chromiumcodereview.appspot.com/13811014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-10 09:24:31 +00:00
verwaest@chromium.org
79d18ea332
Let ComputeTarget fail if it skips over NORMAL objects.
...
BUG=v8:2595
Review URL: https://chromiumcodereview.appspot.com/13862008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 16:38:51 +00:00
yangguo@chromium.org
fe6fc554b0
Fix slow path of JSON.stringifier when GC strikes.
...
FlatContent is not GC-safe.
R=verwaest@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/13782002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 08:12:59 +00:00
verwaest@chromium.org
98d8c9e452
Always check global property cells for readonliness before storing.
...
Add check when the global object is the last in the chain.
Review URL: https://chromiumcodereview.appspot.com/13730002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-09 08:09:05 +00:00
yangguo@chromium.org
9559181b0e
Fix worst-case behavior of MergeRemovableSimulates().
...
Currently, when a long series of removable simulates are merged, we do
this by merging them one by one as we find them. As we merge the value
value lists of the simulates, those lists snowball so that we get a
quadratic complexity wrt runtime and memory consumption.
Instead, we gather simulates that need to be merged, and merge them
backwards starting from the last simulate.
R=jkummerow@chromium.org
BUG=v8:2612
Review URL: https://chromiumcodereview.appspot.com/13649003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-08 17:37:22 +00:00
yangguo@chromium.org
e33b68817b
Fix Array.prototype.concat when exceeding array size limit.
...
R=verwaest@chromium.org
BUG=v8:581
Review URL: https://chromiumcodereview.appspot.com/13465008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-05 15:12:59 +00:00
yangguo@chromium.org
deecbb2e01
Do not implicitly convert non-object receivers for strict mode functions.
...
This was still the case for Array.prototype.* builtin functions.
R=rossberg@chromium.org
BUG=v8:2273
Review URL: https://chromiumcodereview.appspot.com/13473009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-05 11:57:02 +00:00
mstarzinger@chromium.org
9e757a604c
Make __proto__ a real JavaScript accessor property.
...
This turns the __proto__ callback from a foreign callback into a real
JavaScript accessor. It makes the accessor behavior of this property
explicit.
R=rossberg@chromium.org
BUG=v8:1949,v8:2606
TEST=mjsunit/regress/regress-2606
Review URL: https://codereview.chromium.org/13533004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 12:10:23 +00:00
ulan@chromium.org
eee5884f8d
Add extra flag for load-ic stubs in code cache.
...
This allows to distinguish between stubs compiled for the current object from
stubs compiled for objects that have the current object as a prototype.
BUG=v8:2593
R=verwaest@chromium.org
Review URL: https://chromiumcodereview.appspot.com/13552003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-04 08:29:25 +00:00
danno@chromium.org
98281c62f0
Ensure UseRegisterAtStart not used with fixed temp/return register
...
R=vegorov@chromium.org
BUG=chromium:201590
Review URL: https://codereview.chromium.org/13527007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14124 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-03 14:45:39 +00:00
yangguo@chromium.org
443f85eed9
Add test to check that Function.caller must not expose native functions.
...
R=svenpanne@chromium.org
BUG=v8:105
Review URL: https://chromiumcodereview.appspot.com/13166002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 14:31:48 +00:00
dslomov@chromium.org
47d8af7616
Canonicalize NaNs on store to Fast(Float|Double) arrays
...
Also treat holey NaN coming from external float/double arrays correctly
BUG=2596
Review URL: https://codereview.chromium.org/12918028
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 13:30:16 +00:00
yangguo@chromium.org
9155d20282
Stack trace API: poison stack frames below the first strict mode frame.
...
Function and receiver objects are not accessible for poisoned frames.
R=rossberg@chromium.org
BUG=v8:2564
Review URL: https://chromiumcodereview.appspot.com/13150003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-28 10:40:07 +00:00
yangguo@chromium.org
a942fcd984
Add test case for missing deopt sequence after forced deopt.
...
R=danno@chromium.org
BUG=217858
Review URL: https://chromiumcodereview.appspot.com/13042005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-27 09:58:32 +00:00
yangguo@chromium.org
bb632dc49d
Only copy with, block and catch scopes in DebugEvaluate.
...
R=ulan@chromium.org
BUG=171715
Review URL: https://chromiumcodereview.appspot.com/13093003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-26 17:46:16 +00:00
danno@chromium.org
c3486bc4eb
Remove bogus test flags
...
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/12872007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 17:59:15 +00:00
danno@chromium.org
dfd9ea8087
Fix store_mode bug involving polymorphism with external and JS arrays.
...
Review URL: https://codereview.chromium.org/12987014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 15:19:22 +00:00
verwaest@chromium.org
a8b3215afa
Change LookupForWrite to always do a full lookup and check the result.
...
If we find a property in the prototype-chain that we can overwrite, and
we have a transition, keep the holder in the lookup-result as the actual
holder. We will need it for the consistency-check in GenerateStoreField.
By directly checking the entire chain we avoid having to lazily bail out
to a copy of the miss stub while generating the Field Store IC.
Currently this CL disallows a normal non-receiver holder, given that
that would require a positive lookup + details verification to ensure
the property did not become read-only. This fixes the regressions in the
attached tests.
Review URL: https://chromiumcodereview.appspot.com/12810006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 12:55:27 +00:00
yangguo@chromium.org
b347a0dcae
Correctly materialize arguments object in Runtime_DebugEvaluate.
...
The problem was that if the # arguments specified in the function
declaration and the # arguments passed to the function are not
the same, we use an arguments adapter frame to make it work. This
confuses the existing implementation to materialize the arguments
object.
R=peter.rybin@gmail.com
BUG=222893
Review URL: https://chromiumcodereview.appspot.com/12674027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-25 10:01:53 +00:00
yangguo@chromium.org
27b0979347
Restore correct regression test for crbug/146910.
...
For some reason (rebase conflicts?) the regression test introduced
in r12547 was overwritten by r13340.
The test in question already exists in regress-latin-1
R=dcarney@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/13023003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 09:04:36 +00:00
yangguo@chromium.org
b522319a98
Extend test coverage for JSON.stringify's slow path.
...
R=verwaest@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/12702009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-20 14:07:30 +00:00
verwaest@chromium.org
002ba9c76d
Turn Flags into a uint32_t typedef.
...
We cannot rely on C++ compilers inferring the int-type from the enum
value range. Whereas Linux/OSX find uint32_t as type for [0,MaxUInt32],
Windows insists it's int.
Update the test to execute its original intent on all platforms: 1 value
larger than max arguments, 1 smaller than max arguments (on all
platforms). This makes the test run a lot faster.
BUG=chromium:194749
Review URL: https://chromiumcodereview.appspot.com/12507010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-19 13:11:49 +00:00
verwaest@chromium.org
010f36f94b
Raise the limit since it is 2**16 (65536) on x64.
...
Review URL: https://chromiumcodereview.appspot.com/12700012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13973 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 15:49:33 +00:00
jkummerow@chromium.org
e2cd7aa423
Fix detection of |handle_smi| case in HOptimizedGraphBuilder::HandlePolymorphicCallNamed
...
BUG=chromium:196583
Review URL: https://codereview.chromium.org/12620014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-18 12:41:52 +00:00
yangguo@chromium.org
b85237a0bc
Fix white space matching in latin-1 strings wrt \u00a0.
...
R=dcarney@chromium.org
BUG=181422
Review URL: https://chromiumcodereview.appspot.com/12644008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-11 11:52:11 +00:00
mstarzinger@chromium.org
d70523dce6
Restore Function()'s expected string representation.
...
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470
Review URL: https://codereview.chromium.org/12687002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-08 11:47:20 +00:00
mstarzinger@chromium.org
4b0395cc23
Harden Function()'s parsing of function literals.
...
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470
Review URL: https://codereview.chromium.org/12613007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 15:46:14 +00:00
yangguo@chromium.org
3a497dfd51
Insert missing type cast in JSON.stringify.
...
R=dcarney@chromium.org
BUG=v8:2570
Review URL: https://chromiumcodereview.appspot.com/12599003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-07 09:58:27 +00:00
yangguo@chromium.org
a62cfd1db0
Fix Array.length, String.length and Function.prototype LoadICs on x64.
...
R=jkummerow@chromium.org
BUG=v8:2568
Review URL: https://chromiumcodereview.appspot.com/12545004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-06 18:19:35 +00:00
adamk@chromium.org
7fe9bd5a09
Properly handle misses for StoreArrayLengthStub on ia32 and x64
...
Both failed to generate a miss if the key wasn't "length".
ARM and MIPS were already correct.
BUG=v8:2566
Review URL: https://codereview.chromium.org/12378085
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-05 16:31:11 +00:00
mstarzinger@chromium.org
2aabf6257d
Add workaround for redefinition of __proto__ property.
...
This is a temporary workaround when the __proto__ property is being
redefined (e.g. by Object.freeze()) to not loose the foreign callback.
Once the __proto__ property is a real JavaScript accessor this hack is
no longer necessary. This change also makes __proto__ configurable.
R=rossberg@chromium.org
BUG=v8:2565
TEST=mjsunit/regress/regress-2565
Review URL: https://codereview.chromium.org/12398010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 17:53:40 +00:00
yangguo@chromium.org
358311e8ec
Limit EatAtLeast recursion by a budget.
...
BUG=178790
Review URL: https://chromiumcodereview.appspot.com/12380026
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-01 14:50:14 +00:00
yangguo@chromium.org
2a3063a7c3
Handle negative input in inlined Math.round on Intel CPUs.
...
R=jkummerow@chromium.org
BUG=v8:2451
Review URL: https://chromiumcodereview.appspot.com/12342037
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:44:57 +00:00
mstarzinger@chromium.org
ea5e9edac4
Fix materialization of arguments objects with unknown values.
...
This fixes the deoptimizer to materialize arguments objects of correct
length even in cases where the actual argument values are unknown and
were optimized away by Crankshaft. This can happen if only the length
property or the identity of an arguments object is used.
R=svenpanne@chromium.org
BUG=chromium:163530
TEST=mjsunit/regress/regress-crbug-163530
Review URL: https://codereview.chromium.org/12335132
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-27 14:37:51 +00:00
dcarney@chromium.org
52a015b1af
Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString
...
R=yangguo@chromium.org
BUG=
Review URL: https://codereview.chromium.org/12326120
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 11:02:39 +00:00
mstarzinger@chromium.org
ce1e10f5fc
Make __proto__ a foreign callback on Object.prototype.
...
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.
The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.
R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262
Review URL: https://codereview.chromium.org/12212011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-26 10:46:00 +00:00
mstarzinger@chromium.org
300413b5a9
Fix f.apply() optimization when declared arguments are mutated.
...
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539
Review URL: https://codereview.chromium.org/12255033
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-14 15:12:49 +00:00
jkummerow@chromium.org
19dab057b4
Fix NegateCompareOp and InvertCompareOp
...
BUG=v8:2537
Review URL: https://codereview.chromium.org/12217136
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-13 14:36:19 +00:00
jkummerow@chromium.org
e83ff197bf
Add regression test for r13617
...
Many thanks to Vyacheslav Egorov for coming up with this test!
BUG=173907
Review URL: https://codereview.chromium.org/12212066
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-07 15:38:24 +00:00
mstarzinger@chromium.org
79607d20e6
Make the GC stress builder go green.
...
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/12218034
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-06 13:21:28 +00:00
verwaest@chromium.org
aca87c2fcd
Tag stubs that rely on instance types as MEGAMORPHIC.
...
BUG=chromium:173974
Review URL: https://chromiumcodereview.appspot.com/12178017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-02-04 13:12:03 +00:00
verwaest@chromium.org
c8636a2809
Do not try to collect the map if the monomorphic IC stub has no map.
...
This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.
BUG=chromium:172345
Review URL: https://chromiumcodereview.appspot.com/12082023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-28 13:19:53 +00:00
yangguo@chromium.org
24ec13cbd2
Fix additional spec violations wrt RegExp.lastIndex.
...
R=svenpanne@chromium.org
BUG=v8:2437
Review URL: https://chromiumcodereview.appspot.com/12033099
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-25 10:53:26 +00:00
ulan@chromium.org
e6224d275f
Make embedded maps in optimized code weak.
...
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.
BUG=v8:2073
R=mstarzinger@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11575007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-24 11:55:05 +00:00
ulan@chromium.org
d29826544e
Correctly set kCanBeDivByZero flag for HMathFloorOfDiv.
...
After r13289 the divisor can be non-constant, so we should check for zero.
BUG=171641
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047050
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 15:58:49 +00:00
yangguo@chromium.org
9296975c04
Correctly reset lastIndex in an RegExp object.
...
R=svenpanne@chromium.org
BUG=170856
Review URL: https://chromiumcodereview.appspot.com/11896060
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-23 12:28:16 +00:00
ulan@chromium.org
79a0e3b017
Fix pattern detection for replacing shifts by rotation.
...
BUG=2499
R=svenpanne@chromium.org
Review URL: https://chromiumcodereview.appspot.com/12047015
Patch from Hirofumi Mako <mkhrfm@gmail.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-22 13:55:22 +00:00
mvstanton@chromium.org
c3746b4388
allocation-site-info.js broken on arm with new changes. Reverting to previous version until diagnosed.
...
Regress-2185.js test takes too long on slow path when allocation site info is discovered.
BUG=
Review URL: https://codereview.chromium.org/12049003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:15:08 +00:00
yangguo@chromium.org
0c822b21cb
Fix some latin-1 webkit units tests
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11962035
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-21 16:11:31 +00:00
mstarzinger@chromium.org
0484ddcf50
Fix arguments materialization for inlined apply().
...
This fixes materialization of the arguments object in case the constant
function check if TryCallApply() inside an inlined frame fails.
R=svenpanne@chromium.org
BUG=v8:2489
TEST=mjsunit/regress/regress-2489
Review URL: https://codereview.chromium.org/11931012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-16 09:25:45 +00:00
yangguo@chromium.org
f15f294127
Sync laziness between BuildFunctionInfo and MakeFunctionInfo.
...
BuildFunctionInfo compiles the function eagerly when there are debug
break points. However, the AST may have been parsed lazily since
MakeFunctionInfo does not check for debug break points.
This fixes a regression introduced in r11866.
BUG=147497
Review URL: https://chromiumcodereview.appspot.com/11661008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-15 10:16:52 +00:00
mstarzinger@chromium.org
c5cff2c75a
Make recent regression test resilient against GC stress.
...
R=danno@chromium.org
TEST=mjsunit/regress/regress-165637
Review URL: https://codereview.chromium.org/11824062
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 14:21:27 +00:00
mstarzinger@chromium.org
1079642c97
Fix missing exception check in typed array constructor (2).
...
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11791052
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-10 11:45:29 +00:00
yangguo@chromium.org
e41c17084f
Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag.
...
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 15:47:53 +00:00
yangguo@chromium.org
45f20e366a
Introduce ENABLE_LATIN_1 compile flag
...
Mostly a bunch of renaming when flag is disabled.
R=yangguo@chromium.org
BUG=
Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 10:30:54 +00:00
svenpanne@chromium.org
0aacbf9619
Added %FlattenString and use it to speed up a regression test.
...
Flattening strings is relatively costly and by doing it after every duplication
we avoid combinatorial explosion.
Note that flattening could have been done by e.g. using a regular expression,
too, but this is just another implementation detail and %FlattenString seems
general enough to be useful in other tests, too.
Review URL: https://codereview.chromium.org/11828014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-09 09:32:12 +00:00
mstarzinger@chromium.org
0e46919c32
Fix missing exception check in typed array constructor.
...
The typed array constructor might fail if the first argument is an
object with a length property. Accessing the property can cause an
exception to be thrown and an explicit check needs to be performed.
R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11777014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-07 14:01:04 +00:00
yangguo@chromium.org
4ee20d857b
Check for read-only-ness when preparing for array sort.
...
R=verwaest@chromium.org
BUG=v8:2419
Review URL: https://chromiumcodereview.appspot.com/11759022
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-01-04 15:24:47 +00:00
ulan@chromium.org
b64f834383
Fix x64 MathMinMax for negative untagged int32 arguments.
...
An untagged int32 has zeros in the upper half even if it is negative.
Using cmpq to compare such numbers will incorrectly ignore the sign.
BUG=164442
R=mvstanton@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11665007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-21 17:52:00 +00:00
yangguo@chromium.org
362218a037
Deopt on overflow in integer mod.
...
R=ulan@chromium.org
BUG=166379
Review URL: https://chromiumcodereview.appspot.com/11618017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-19 12:01:22 +00:00
ulan@chromium.org
8574054b59
Correctly handle negative codes in String.fromCharCode()
...
BUG=166553
R=yangguo@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11576069
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:37:57 +00:00
rossberg@chromium.org
c6bb497437
Simplify implementation of assignment-to-const checks.
...
Also, add test that assignment to function name is a syntax error with harmony scoping.
Does not fix issue 2243 directly, but with ES6, the required behaviour will change to what is implemented already anyway.
R=yangguo@chromium.org
BUG=v8:2243
Review URL: https://codereview.chromium.org/11607016
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-18 12:00:50 +00:00
danno@chromium.org
facad070e9
Remove over-zealous hole checking in Array.slice()
...
R=jkummerow@chromium.org
BUG=chromium:165637
TEST=regress-165637.js
Review URL: https://codereview.chromium.org/11442054
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 15:20:45 +00:00
rossberg@chromium.org
76375de29d
Object.observe: prevent observed objects from using fast elements.
...
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.
R=mstarzinger@chromium.org
BUG=v8:2409
Review URL: https://codereview.chromium.org/11477006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-12 11:38:24 +00:00
rossberg@chromium.org
3348b5c2b4
Allow lazy compilation (and thus optimisation) of functions inside eval.
...
For strict-mode eval, this requires _disabling_ lazy parsing of inner functions,
because we need to collect their free variables to do allocation for the
eval scope properly.
R=mstarzinger@chromium.org
BUG=v8:2315
Review URL: https://codereview.chromium.org/11438042
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:35:50 +00:00
yangguo@chromium.org
3388f92e63
Fix spec violations in methods of Number.prototype.
...
R=svenpanne@chromium.org
BUG=v8:2443
Review URL: https://chromiumcodereview.appspot.com/11465005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-07 10:20:35 +00:00
yangguo@chromium.org
276c790c61
Iterate through all arguments for side effects in Math.min/max.
...
R=svenpanne@chromium.org
BUG=v8:2444
Review URL: https://chromiumcodereview.appspot.com/11444030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-06 13:13:38 +00:00
yangguo@chromium.org
c75ca45000
Improve array to string conversion.
...
BUG=v8:2435
Review URL: https://chromiumcodereview.appspot.com/11348349
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 15:49:22 +00:00
yangguo@chromium.org
6c92aba643
Fix spec violations related to regexp.lastIndex
...
BUG=v8:2437, v8:2438
Review URL: https://chromiumcodereview.appspot.com/11451005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-12-05 12:32:25 +00:00
verwaest@chromium.org
7553f0d68e
CopyPackedSmiToDoubleElements should fill the FixedDoubleArray with holes
...
BUG=v8:2433
Review URL: https://chromiumcodereview.appspot.com/11280223
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-29 08:34:19 +00:00
verwaest@chromium.org
09b1574baa
Make ElementsAccessors more tolerant of varying backing store types
...
This avoids bogus calls to Fixed*Array::cast() when FastElements-backed objects are empty (and thus backed by empty_fixed_array).
Review URL: https://chromiumcodereview.appspot.com/11299190
Patch from Adam Klein <adamk@chromium.org>.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13071 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-11-28 08:41:45 +00:00