AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
19,418 Commits 1 Branch 0 Tags 839 MiB
02d37b8f10
Commit Graph

1155 Commits

Author SHA1 Message Date
adamk@chromium.org
02d37b8f10 Widen definition of %HasComplexElements() to include non-enumerability 
This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:04:13 +00:00
adamk@chromium.org
0ef073d556 Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/673893002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 21:13:29 +00:00
adamk@chromium.org
5f1ae66d56 Narrow cases where Sparse/Smart versions of Array methods are used 
Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/656423004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 18:21:50 +00:00
ishell@chromium.org
5509cc2c07 Fixed mutable heap numbers leak in JSON parser. 
BUG=chromium:423687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/669403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 14:41:39 +00:00
dslomov@chromium.org
96105a90fc harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=24834

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 12:30:20 +00:00
dslomov@chromium.org
707ed29a51 Revert "harmony-scoping: Allow 'const' iteration variables in strict mode." 
This reverts commit r24834 for breaking debug tests.

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/672193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:55:19 +00:00
dslomov@chromium.org
b54f7d3c46 harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:18:50 +00:00
rodolph.perfetta@arm.com
ecbfc43f37 ARM64: Fix stack manipulation. 
Builtins::Generate_StringConstructCode was claiming stack space instead of
giving it back.

BUG=chromium:425585
LOG=Y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/672623003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 18:24:20 +00:00
dslomov@chromium.org
b664c12235 Flatten the string in StringToDouble function. 
R=yangguo@chromium.org
BUG=chromium:425551
LOG=N

Review URL: https://codereview.chromium.org/654763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 08:19:05 +00:00
adamk@chromium.org
b6d0113abc Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/649063003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 17:46:42 +00:00
mvstanton@chromium.org
8330178b4c The issue is that by handling strings with map/handler pairs instead of a special 
version of the keyed load stub (https://code.google.com/p/v8/source/detail?r=24661),
I allowed polymorphism between string and non-string types in the IC. Before, the
IC would go generic.

Then, at crankshaft time, we special case when we only saw strings. The error
here is that crankshaft can't emit code that handles polymorphism between string
and non-string types. The choice is either to get that to happen (I don't deem
this necessary from a performance point of view, an IC with such type feedback
before would have gone generic), or simply check for the case of "polymorphic
with some string maps" and require crankshaft to go generic. I'll do the latter.

BUG=425519
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/667923004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 13:04:51 +00:00
yangguo@chromium.org
83ddaa0df7 Fix break location calculation. 
R=ulan@chromium.org
BUG=chromium:419663
LOG=Y

Review URL: https://codereview.chromium.org/658723005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 14:11:01 +00:00
adamk@chromium.org
ae7161e4cb Revert "Remove SmartMove, bringing Array methods further into spec compliance" 
This reverts https://code.google.com/p/v8/source/detail?r=24647

It caused test failures in Array methods in Linux64 OptimizeForSize.

BUG=v8:2615
TBR=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/656683003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:53:02 +00:00
adamk@chromium.org
bb885a79db Remove SmartMove, bringing Array methods further into spec compliance 
This is one step towards a single codepath for each method in array.js.

This patch is based on rafaelw's https://codereview.chromium.org/349073002

BUG=v8:2615
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/455933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:36:58 +00:00
adamk@chromium.org
a6ff3f7f4a Handle exceptions thrown by Array.observe machinery 
BUG=chromium:417709
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/651323003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 18:22:20 +00:00
verwaest@chromium.org
23868b419c Optimize Function.prototype.call 
BUG=
R=verwaest@chromium.org, jarin@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/588573002

Patch from Petka Antonov <p.antonov@partner.samsung.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 12:22:15 +00:00
yangguo@chromium.org
9a21ba499c Catch exceptions thrown when enqueuing change records. 
R=ishell@chromium.org
BUG=chromium:417709
LOG=N

Review URL: https://codereview.chromium.org/653593002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-14 14:46:11 +00:00
ulan@chromium.org
29296d7e50 Fix computation of UTC time from local time at DST change points. 
This also reverts r23606, which was an incorrect fix.

BUG=v8:3116,chromium:417640,chromium:415424
LOG=Y
TEST=mjsunit/regress/regress-3116.js
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/639383002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-09 14:17:33 +00:00
jkummerow@chromium.org
1bb52d0da8 Fix Hydrogen's BuildStore() 
BUG=chromium:417508
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/612423002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-01 13:17:34 +00:00
jarin@chromium.org
5b742b356d Adding more missing deoptimization points in Turbofan. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/595863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-29 13:37:58 +00:00
jarin@chromium.org
b11c925142 Disable merging simulates across captured objects. 
BUG=chromium:416730
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/607453002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 12:16:32 +00:00
yangguo@chromium.org
86b3c3eea7 Insert materialized context at the right place in DebugEvaluate. 
R=aandrey@chromium.org, ulan@chromium.org
BUG=chromium:323936
LOG=N

Review URL: https://codereview.chromium.org/599113002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24218 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 09:33:40 +00:00
jkummerow@chromium.org
1903e560b0 Non-JSArrays must always have holey elements. 
Drive-by cleanup: remove unused elements_kind_ field in CallNew.

BUG=chromium:416558
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/595333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 08:25:25 +00:00
mvstanton@chromium.org
b0b59073ac Fix IC cache confusion on String.prototype.length 
BUG=416416
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/587363002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-24 09:33:04 +00:00
jarin@chromium.org
9ef343c18d [Turbofan] Insert nops for lazy bailout patching, fix translation of literals. 
The code for EnsureSpaceForLazyDeopt is taken from lithium-codegen-*.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/562033003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-23 08:46:18 +00:00
verwaest@chromium.org
83f64e8c1f Fix escaped index JSON parsing 
BUG=416449
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/592813002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-22 15:21:19 +00:00
mstarzinger@chromium.org
429924b780 Fix typed lowering to number comparison. 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3564
BUG=v8:3564
LOG=N

Review URL: https://codereview.chromium.org/574653002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-16 11:33:30 +00:00
mstarzinger@chromium.org
d313551a3e Disable lowering to StringAdd due to various issues. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/566303003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-16 08:29:46 +00:00
yangguo@chromium.org
7cb82a76b4 Reland "Remove V8_HOST_CAN_READ_UNALIGNED and its uses." 
BUG=chromium:412967
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/571903002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-15 10:54:49 +00:00
jarin@chromium.org
00e90b7e6e Remove deoptimization by patching the call stack. 
We go back to patching the code for lazy deoptimization because ICs need the on-stack return address to read/update the IC address/state.

The change also fixes bunch of tests, mostly by adding more deoptimization points.

(We still need to add code to ensure lazy deopt patching does not overwrite ICs and other lazy deopts; this is coming next.)

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/568783002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-15 09:21:39 +00:00
jarin@chromium.org
e401262400 Reland "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic." 
This relands commit r23899.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/565093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 10:58:43 +00:00
jarin@chromium.org
bc0674d0a7 Revert "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic." 
This reverts commit r23899.

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/552253003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:49:22 +00:00
jkummerow@chromium.org
b4375b77ec Fix Smi vs. HeapObject confusion in HConstants. 
Representation and HType should agree with each other.

BUG=chromium:412215
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/556563005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:44:14 +00:00
jarin@chromium.org
91e97f8371 Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic. 
This makes the syntactic order consistent with the evaluation order.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/561133005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:18:29 +00:00
rossberg@chromium.org
fc71f7fdb3 Fix inaccurate type condition in Hydrogen 
R=bmeurer@chromium.org
BUG=chromium:412210
LOG=Y

Review URL: https://codereview.chromium.org/550453003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 12:13:34 +00:00
jkummerow@chromium.org
bd97fcaed0 Fix regress-crbug-412203.js 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/563733002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 11:47:39 +00:00
jkummerow@chromium.org
11f7584d0a Fix ElementsKind handling of prototypes in Array.concat 
Double elements, typed elements, and sloppy arguments elements were all erroneously marked UNREACHABLE.

BUG=chromium:412203
LOG=n
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/560463002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 10:04:13 +00:00
ulan@chromium.org
d66ed1176f Don't inline Array functions if receiver map is not extensible. 
BUG=405517
LOG=N
TEST=mjsunit/regress/regress-crbug-405517.js
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/552333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 09:22:13 +00:00
ulan@chromium.org
99301fc8c5 Fix regress-411210 after r23824. 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/559863004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 08:48:40 +00:00
hpayer@chromium.org
ed37edc5c0 Remove guard page mechanism from promotion queue. 
BUG=chromium:411210
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/557243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 07:51:29 +00:00
jarin@chromium.org
01d63e43b2 Handle non-object constants in HConstant::GetMonomorphicJSObjectMap. 
R=ulan@chromium.org
BUG=chromium:412162
LOG=N

Review URL: https://codereview.chromium.org/552243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 12:58:34 +00:00
jkummerow@chromium.org
fd3e505fb6 Hydrogen: bailout when there is a throw statement in a non-effect context. 
This mirrors the behavior of the compilation pipeline before recent OptimizeFunctionOnNextCall changes.

BUG=chromium:412208
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/558593002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 12:16:33 +00:00
yangguo@chromium.org
4b0c076052 Turn old space cons strings into regular external strings (not short). 
R=hpayer@chromium.org
BUG=v8:3530
LOG=N

Review URL: https://codereview.chromium.org/368223002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 11:41:56 +00:00
jarin@chromium.org
83af12c21b Harden OptimizeFunctionOnNextCall. 
BUG=411237
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/547553003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 15:13:44 +00:00
verwaest@chromium.org
1dddf69fdc Allocate a new empty number dictionary when resetting elements 
BUG=410332
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/545773003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 11:38:22 +00:00
jarin@chromium.org
b74fae5511 Fix EvacuateJSFunction to obtain the target address from the forwarding pointer. 
R=mstarzinger@chromium.org
BUG=410912
LOG=N

Review URL: https://codereview.chromium.org/541353003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 09:38:04 +00:00
titzer@chromium.org
4923810a68 Remove redundant --always-full-compiler flag. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/538613006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 16:29:47 +00:00
jarin@chromium.org
1afada8d04 Ignore numbers as values of --expose-natives-as flag. 
R=yangguo@chromium.org
BUG=408036
LOG=N

Review URL: https://codereview.chromium.org/534943004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 15:05:06 +00:00
bmeurer@chromium.org
0baf275e20 Enforce correct number comparisons when inlining Array.indexOf. 
TEST=mjsunit/regress/regress-crbug-407946
BUG=407946
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/536393003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 12:25:57 +00:00
jarin@chromium.org
7572e779d0 Exclude LoadMutableDouble and FunctionBindArguments from fuzzing. 
BUG=409542,410262
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/535153002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-03 14:28:46 +00:00