Before, Hydrogen call instructions had uses of the PushArgument instructions
for their arguments. These operands were unneeded, bloated the IR, and
caused calls to be the only Hydrogen instructions with an unpredictable
number of operands.
Now, PushArgument is a pure side-effecting instruction that has no uses.
Review URL: http://codereview.chromium.org/6480030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Before, an attempt to delete a parameter in a function that used the
arguments object in any way would succeed with true and delete both
the parameter and the corresponding arguments object property.
Now, an attempt to delete such a parameter does not delete and
evaluates to false.
Parameters can be deleted, as before, from functions that use the
arguments object, by deleting the corresponding arguments object
property (this is a spec violation).
BUG=fixes v8:1136
Review URL: http://codereview.chromium.org/6484023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6745 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
There were a couple of bug fixes to this code on IA32 which have not yet
been ported to ARM. They are: failure to correctly handle non-JSObject
receivers and failure to restore the context register after calling JS code.
Review URL: http://codereview.chromium.org/6479019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6744 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
In the presence of JS accessors for elements on Object.prototype JSArray::SetFastElement
may throw or its behaviour can be altered. Instead operate on plain FixedArrays and
turn them into JSArry later.
BUG=v8:1130
TEST=test/mjsunit/regress/regress-1130.js
Review URL: http://codereview.chromium.org/6481001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Make esi available to the register allocator rather than dedicating it
permanently to the context.
The context is still passed in register esi to JavaScript and to the runtime
as part of the calling convention. Because some stubs might end up calling
JS or the runtime, it is also conservatively passed to stubs.
Roughly half the calls have been modified to use the context as an input
value in fixed register esi. The other half are marked as calls or deferred
code so esi is spilled and can be explicitly set.
It is no longer necessary to restore the context to esi after a call that
might change it.
Review URL: http://codereview.chromium.org/6452001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
If we have a property access of the form this.x, where the access site sees
the global object, we can specialize the IC stub so that it performs a map
check without first performing a heap object check.
Ensure that we do not get in JS code with a non-JSObject this value by
deoptimizing at Function.prototype.apply if the first argument is not a
JSObject.
BUG=v8:1128
Review URL: http://codereview.chromium.org/6463025
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6707 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Change the comparison in the full code generator to use CompareIC instead of the CompareStub to record the types. This also implements the patching in the full code generator where the inlined smi code is de-activated by default to call the CompareIC once and then activating the inlined smi code by patching the code.
Fixed the smi comparison in the ICCompareStub.
Fixed ToBooleanStub to ensure that the scratch register used is not the input. Use r9 as default as that will never be input with Crankshaft.
Implemented lithium instruction CmpTAndBranch.
Make sure that the lithium instruction CmpID have operands in registrers as the current optimized code expects that.
Review URL: http://codereview.chromium.org/6461017
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6704 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
When constructing stack traces we interpret the deoptimization data for
optimized frames to find the receiver value. This value could sometimes be
eliminated from the deoptimization data if we though it was unused.
BUG=v8:1118
Review URL: http://codereview.chromium.org/6465023
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6694 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- Don't use SmiSub when overflow can occur. It asserts that overflow
does not happen.
- Actually use CompareICs and signal to crankshaft whether or not smi
code was inlined.
- Fix bug in CmpI where 64 bits were compared instead of 32 bits.
- Implement Throw, DeferredStackCheck, StoreKeyedFastElement in
lithium backend.
BUG=
TEST=
Review URL: http://codereview.chromium.org/6312193
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6669 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Revision 6635 added an assert on IA32 that there were no 'const' parameters.
This assert could be hit at compile time because we compiled the unreachable
body of functions with illegal redeclarations, which are thrown at runtime.
Review URL: http://codereview.chromium.org/6286144
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Instead of constructing a temporary container for all LOperands of each
instruction, the register works directly on the LIR instructions that
provide an abstract interface for input/output/temp operands.
This saves allocation of zone memory and speeds up LIR construction,
but makes iterating over all uses in the register allocator slightly
more expensive because environment uses are stored in a linked list of
environments. We can fix this by using a flat representation of LOperands.
Review URL: http://codereview.chromium.org/6352006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6638 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
There was an unnecessary load on every statically-resolved context lookup.
Remove it.
This revealed a hidden bug in const initializers inside 'with'. They claim
to be statically resolved (having slot type CONTEXT) but they occur in a
spot where the runtime context chain and the static scope chain do not
agree. This is fixed by special casing const initializers in the backend.
Review URL: http://codereview.chromium.org/6384020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
My previous patch added an assert which uncovered 1092 in the sputnik tests.
This patch adds the fix for 1092, which is to ensure that NormalizeProperties
does not get called for a JSGlobalProxy along all code paths.
Add sputnik tests to .gitignore.
BUG=
TEST=
Review URL: http://codereview.chromium.org/6286060
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6627 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Aggregated snapshots: don't report unreachable objects.
Full snapshots: restore forcing GC prior to taking a snapshot.
I played with the repro page provided for the bug and found that GC
must be performed prior to taking a snapshot even if we only report
reachable objects. GC allows weak handles to finalize. Now heap
profiler produces aligned results for the repro page in both modes.
BUG=crbug/70434
TEST=none
Review URL: http://codereview.chromium.org/6410030
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6598 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Current approach returns undefined descriptor if caller is not granted v8::HAS_ACCESS.
If the caller has v8::HAS_ACCESS, for no JS accessors regular v8::GET_ACCESS check is
performed and value property of the descriptor is set to undefined if caller doesn't
have proper access. For JS accessors both v8::GET_ACCESS and v8::SET_ACCESS are checked
and affect if getter and setter would be stored in the descriptor.
Review URL: http://codereview.chromium.org/6286020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Record a safepoint with a deoptimization id for throw in optimized code. We
don't seem to much care what the AST ID is because we will not be using it
for lazy deoptimization (throw doesn't return to the point of throw). For
hygiene we use the actual ID of the throw expression. Throw is no longer a
control-flow instruction, but it's followed by an unconditional abnormal
exit. This is required to insert a simulate between the throw and the exit.
Make our optimized treatment of Function.prototype.apply act like a call and
have side effects. This ensures that it will get a lazy deoptimization
environment. Use that deoptimization ID in the safepoint for the call.
Deleting a property was also missing a deoptimization ID, though there was a
deoptimization environment assigned to the instruction. Record the
environment and use the deoptimization ID at the safepoint.
Review URL: http://codereview.chromium.org/6250105
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
If we, immediately after the deoptimization, but before actually
running the patched code, get a compacting GC, the addresses from the
calls might no longer be valid.
I have validated that this works by patching the existing code to
always do a compacting gc after we finish deoptimizing. I will create
a real regression test for this, but this includes additional code for
allowing us to force a deopt/opt from javascript test code. I will
land this in a seperate change.
Review URL: http://codereview.chromium.org/6349043
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fixes JS portion of DefineOwnProperty when there is
an existing property and the new descriptor is generic.
Makes code follow spec steps more closely.
Fixes typo for check for unchanged enumerable in step 6.
Adds regression tests.
Fixes errors in object-define-property test
Don't normalize the JSGlobalProxy. Gets webkit http/tests/security/xss-DENIED-defineProperty.html working.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6561 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
other situations.
Do not use overwritten Object.prototype.hasOwnProperty and
Array.prototype.pop. Do not use split and join in the error formatting
implementation. They are too big to control and their generality is
not needed.
Review URL: http://codereview.chromium.org/6287041
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6552 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Change OSR stack check patching to use the stack check table to iterate over the calls to stack guards platform independent. Introduce Deoptimizer::PatchStackCheckAt for each platform to perform the platform specific patch at a given pc.
BUG=none
TEST=none
Review URL: http://codereview.chromium.org/6392027
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6551 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
1. The placement of checks for negative zero has to be computed after
all conversion instructions have been inserted. I separated the code
into its own phase.
2. GVN need to take instruction flags into account when comparing
instructions for redundancy.
Review URL: http://codereview.chromium.org/6260035
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6534 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Deletion of global properties puts 'the hole' in the global property
cell and updates the property details in the property dictionary with
the information that the property has been deleted. When setting
global properties that have been deleted in generated code we just
store the new value in the global property cell. This does not update
the property details in the property dictionary. Therefore, it looks
like the property is not there eventhough it was just reintroduced.
Perform 'the hole' checks in generated code for global property stores
and bail out of ICs and optimized code if storing to a property cell
that contains 'the hole'.
Review URL: http://codereview.chromium.org/6306014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6508 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Refactor SafepointTableBuilder::DefineSafepoint and ARM LCodeGen::RecordSafepoint to use an enum for different kinds of safepoints. This change removes a lot of duplicated code and makes it easier to include new kinds of safepoints in the future. The remaining variants of LCodeGen::RecordSafepoint remain as a convinient way to record common safepoint kinds.
BUG=http://code.google.com/p/v8/issues/detail?id=1043
TEST=none
Review URL: http://codereview.chromium.org/6341008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6505 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
It is a type error to treat a flag (an enum) as if it were a flag mask (an
int derived from shifting a bit by the enum value). It is error prone to
have functions that take flag mask arguments because they will silently
accept flags.
Review URL: http://codereview.chromium.org/6373011
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The former default was true. The new default is false and the default
implementation is UNREACHABLE so it asserts in debug builds. The function
is overridden in all concrete instruction classes that might have the flag
kUseGVN set.
Review URL: http://codereview.chromium.org/6255013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6493 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Before, we disabled code motion for check instructions on the final
optimization attempt. It is unsafe to prevent movement of check
instructions but to allow movement of instructions that assume the checks
were performed.
Review URL: http://codereview.chromium.org/6378012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6485 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix a bug in the --debug-code alignment check in the C entry stub.
Don't force the --debug-code flag in the ARM disassembler tests. The framework does support passing flags and the test runner will when running tests in debug mode.
Skip some deserialization tests which crashes from time to time.
Review URL: http://codereview.chromium.org/6393007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6484 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
To avoid deopts a few extra changes were needed:
o Enable megamorphic state for special property loads on
primitives. We used to flip between monomorphic stubs.
o Extract pure string (no string wrapper support) version of the
string length stub.
Review URL: http://codereview.chromium.org/6334015
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6472 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This implements the type recording binary operation stub for ARM. This first iteration only supports ADD. Handling of 32-bit integers is currently not implemented but just transitions. The generic case for now delegates to the generic binary operation stub.
Review URL: http://codereview.chromium.org/6342019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Code generated for checks starting with primitive receivers skips one step
in the usual prototype checking algorithm, so the holder must always be set.
Not setting the holder did not cause an immediate failure because our
primitives have additional hidden prototypes before the real prototypes.
These extra objects in the chain usually contain no properties and so
allowed the right holders to be selected.
Review URL: http://codereview.chromium.org/6353014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6459 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
ReferenceError.prototype.__proto__ which will make "error instanceof
Error" fail. However, the ReferenceError.prototype object itself
cannot be modified. Therefore, the error checks must check for
concrete error instances instead of only checking for Error.
Review URL: http://codereview.chromium.org/6388003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6450 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Change the ARM exit frame to have the same layout as the IA32 exit frame. This basically re-arranges the order of fp and sp and changes the sp location of the entry frame to hold the sp used by the gc and not the sp for popping the arguments. This removes the option of tearing down the frame and returning using one ldm instruction.
The main motivation for this is to avoid pushing an alignment word before generating the entry frame. The GC handling of optimized frames process the registers pushed as part of a safepoint and asumes that these are at the top of the frame, so if an alignment word is pushed this processing will be one off.
The alignment handling in the C entry stub have also been simplified. Now the value of lr is stored to a stack slot already reserved avoiding pushing it and keeping track of "frame skew".
This does result in more instructions in the exit frame on ARM, but we can look into improving this later.
Review URL: http://codereview.chromium.org/6247019
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6448 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
files. On ARM it is not enough to iterate the relocation information
because that will only give us access to the constant pool and not to
the place in the instruction stream where the target in the constant
pool is called.
Review URL: http://codereview.chromium.org/6343005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The function Runtime_LookupContext searches the context chain for a
LOOKUP slot and returns the object holding the slot. It returned the
global context if the slot was not found or if it was found in a
function's context or arguments object. This is not the correct
object to use for 'delete'.
Since this lookup function is only ever used when deleting LOOKUP
slots (those that have to go through a with or a scope with eval), it
is simply replaced with a Runtime_DeleteContextSlot function that does
the appropriate thing for all kinds of context lookups.
This fixes Chromium bug 70066.
http://code.google.com/p/chromium/issues/detail?id=70066
Review URL: http://codereview.chromium.org/6280013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6442 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
conversions for external array types, which implement the Typed Array
spec. (Revision of http://codereview.chromium.org/6315004 .)
Prefer SSE2 code path on x86 processors. Non-SSE2 processors now make
a slow runtime call for float-to-int conversions. Use SSE3 for 32-bit
signed and unsigned int array types where possible.
The movement of code from ic-arm.cc to stub-cache-arm.cc caused the
VFP3 code path to be tested for the first time. Fixed bugs in the
register usage and in the constant value stored into integer arrays
for NaN and +/-Infinity.
Added new truncation test to test-api.cc. Storage of NaN and +/-Inf
was already covered. Ran unit tests on x86, x64 and ARM simulator.
Tested ia32 and x64 code in Chromium on Mac and Linux respectively
with Typed Array unit tests and WebGL content.
BUG=http://code.google.com/p/chromium/issues/detail?id=50972
TEST=test-api/ExternalArrays
Review URL: http://codereview.chromium.org/6303012
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This is svn r6415 with a bugfix.
The bug was that we can have scopes with 0 heap slots (functions with
such scopes do not need a local context) and scopes with at least
Context::MIN_CONTEXT_SLOTS. The code generator only allocated a local
context if there were strictly more than Context::MIN_CONTEXT_SLOTS.
Before the change to with/arguments, it was impossible to actually get
a function scope with exactly Context::MIN_CONTEXT_SLOTS because every
such scope included a heap-allocated arguments (and arguments shadow)
slot.
Review URL: http://codereview.chromium.org/6248014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6426 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- var eval | arguments
- catch (eval | arguments)
- 'with' is disabled
- function can't be named eval or arguments
Add FLAG_strict_mode
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6422 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Rename HBranch (the instruction that coerces an arbitrary HValue to
control flow) to HTest to free up the term Branch to refer to any
control instruction with two successors.
Change the virtual FirstSuccessor and SecondSuccessor functions on
control instructions to a pair of data members.
Review URL: http://codereview.chromium.org/6366002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6417 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Before, we conservatively marked every variable in a scope as used if the
scope contained 'with'. Instead, just mark the variables occurring in the
body of the with. This avoids marking 'arguments' as used whenever 'with'
occurs, which incurs an extra performance penalty (a use of arguments is
seen as an instruction to redirect all parameter accesses to the arguments
object).
Review URL: http://codereview.chromium.org/6357007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6415 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This patch adds H- and L-variants of StringCharCodeAt and StringLength.
StringCharCodeAt is used to inline a constant function call of
String.prototype.charCodeAt and to implement the corresponding inline
runtime function. It does not yet use the recently introduced extra IC
state. (We can specialize on string encoding and avoid deopts because
of out of bounds accesses.)
StringLength needs more work because the stub version of it also
supports strings wrappers and it matters in some cases. (We have to
separate the string only case.)
Review URL: http://codereview.chromium.org/6243008
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6408 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
We hit an assertion failure when we tried to record the AST ID of
the (shared) .arguments variable proxy more than once. This was hit
when we had multiple calls to the same parameter in a function that
used the arguments object. The fix is to not visit the subexpressions
of the (shared) property access expression.
BUG=1060
Review URL: http://codereview.chromium.org/6368007
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6404 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Windows compilation is broken. Will fix and reland later.
This reverts commit fe13ffaa6d0c3435bfe1ae930813e456650ec980.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6389 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Extra IC state is only two bits and only supported for call IC-s for
now. To change its extra state an IC stub jumps to a new miss stub
that goes to runtime as usual but then instead of going megamorphic
generates a monomorphic stub with the updated state.
Review URL: http://codereview.chromium.org/6344005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6370 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
- var eval | arguments
- catch (eval | arguments)
- 'with' is disabled
- function can't be named eval or arguments
- function parameter name cannot be eval or arguments
- no duplicate parameter names allowed
Add FLAG_strict_mode
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6369 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Add a README.chromium and LICENSE file for Strongtalk assembler.
This allows the Chromium license tool to automatically include
Strongtalk in about:credits.
BUG= None
TEST= Strongtalk section in Chrome's about:credits
R= ager
Codereview URL: http://codereview.chromium.org/6357004/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6354 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This change includes support for safepointtables and adding deoptimization info (but not for deoptimizing).
Implemented crankshaft functions:
CallCode
GenerateSafepointTable
RegisterEnvironmentForDeoptimization
EmitGoto
This change allows us to compile very simple functions with crankshaft:
An empty function
A function returning a constant.
A function returning a parameter.
There is 6 disabled tests that require us to be able to deoptimize
which is currently not supported.
Review URL: http://codereview.chromium.org/6310009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6350 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
emitted as part of the safepoint tables.
Always emit the constant pool as part of generating deferred code
(whether or not there actually is any deferred code) and ASSERT that
there is no pending relocation info while using db and dd to write
tables.
Review URL: http://codereview.chromium.org/6360003
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6347 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This change introduces the third template parameters for LIR instructions
to specify the number of temp-operands. This is one step towards
removing the instruction-summaries.
I also added hydrogen-accessors in more places and refactored
the LIR-branch instructions to have common super-classes to
avoid code duplication.
Added MUST_USE_RESULT to the functions that record uses
and definitions so that all LOperands are stored in the
LIR instructions (and not only in the summaries).
Review URL: http://codereview.chromium.org/6237002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6345 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Instead of spilling and then immediately restoring eax to resolve
memory to memory moves, the gap move resolver now tracks registers
that are known to be free and uses one if available. If not it spills
but restores lazily when the spilled value is needed or at the end of
the algorithm.
Instead of using esi for resolving cycles and assuming it is free to
overwrite because it can be rematerialized, the gap move resolver now
resolves cycles using swaps, possibly using a free register as above.
The algorithm is also changed to be simpler: a recursive depth-first
traversal of the move dependence graph. It uses a list of moves to be
performed (because it mutates the moves themselves), but does not use
any auxiliary structure other than the control stack. It does not
build up a separate list of scheduled moves to be interpreted by the
code generate, but emits code on the fly.
Review URL: http://codereview.chromium.org/6263005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
When processing register contraints we used to add writable input operands
also as temp operands to the same instruction.
This does not seem necessary since we create a fresh virtual register
for writable inputs and insert a definition in the gap before the instruction.
Review URL: http://codereview.chromium.org/6350002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6342 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This puts us very close to being able to compile the empty function.
This changes only has a small number of 64 bit specific assembler instructions.
The remaining changes are much more platform specific and will go in another change.
Review URL: http://codereview.chromium.org/6247005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6306 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This change provides fast code for a few special cases and calls the GenericBinaryOpStub for the rest.
It also changes the register allocation in the generation of lithium instructions to use fixed registers that are compatible with the generic stub. This allocation can be change once we use a more flexible implementation.
Finally, this change provides infrastructure to save double registers at safepoints, which is need to call the stub in deferred code.
BUG=
TEST=
Review URL: http://codereview.chromium.org/6164005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6304 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
On 32-bit platforms any pointer with 0 as LSB can be wrapped into Smi. However, on 64-bit
platforms it's currently not the case as x64 Smis must have 0s in lower 32 bit word.
Even worse, macroassembler Move instruction will try to fetch integer value from Smi
and will shift by 32 bits to the right rendering stored pointer incorrect.
BUG=v8:1037
Review URL: http://codereview.chromium.org/6119009
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6301 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This instruction only depends on the prototype and the holder and can
completely ignore the receiver and its map.
This change also fixes a small bug on arm where a cell was loaded
instead of the prototype from new space.
Review URL: http://codereview.chromium.org/6094020
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6290 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Fix CalculateEmitStore HashMap use.
The hash maps are setup to store strings or smis but instead Literal is being in them. It seems to only work by accident.
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Each LInstruction is now a subclass of LTemplateInstruction<R, I, T>
where R is number of outputs, I number of inputs and T number of temps.
This change only actually uses the parameter I for input operands.
Since the parameter T for temps is 0, it incurs no extra cost.
A separate change will introduce using the temps parameter.
Review URL: http://codereview.chromium.org/6215002
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6275 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Remove unused LOperands from keyed-loads. We do not have multiple representations
for load instructions anymore.
Correct number of output operands as for a couple of instructions form 1 to 0
because they do not produce a result (e.g. PushArgument)
Review URL: http://codereview.chromium.org/6158004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Unfortunately, arguments is pretty much the normal JS object. For now
I am adding more sanity checks (in hope that typically arguments
list is rather short.) However it probably requires more systematic
treatment, for example, we could optimistically copy elements until
we meet first hole and in this case resort to JS builtin.
Review URL: http://codereview.chromium.org/6062006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
I'm using the post call generator for the macro assembler
InvokeBuiltin call to be consistent with the ia32 version. It only
generates one call, but using the post call generator it should be
easier to catch if we change that at some point.
Review URL: http://codereview.chromium.org/6119004
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6247 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This change introduces LTemplateInstruction which is a specialized version
of LInstruction and takes one template parameter to indicate whether the
instruction produces a result operand.
All instruction that do not have a result inherit from LTemplateInstruction<0>.
Instructions that have a result operand from LTemplateInstruction<1>
All the Define* function only operate on instructions with a result.
For this to work I also refactored the places where we do
LInstruction* result = new Lxyy
into
Lxyz* result = new Lxyz
Review URL: http://codereview.chromium.org/6219001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6245 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
First cut at bug 992
Fixes JS portion of DefineOwnProperty when there is
an existing property and the new descriptor is generic.
Makes code follow spec steps more closely.
Fixes typo for check for unchanged enumerable in step 6.
Adds regression test.
Codereview url: http://codereview.chromium.org/6035014/
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6220 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
The the call of the builtin in InstanceofStub was not correctly protected with an internal frame leading to the return address being handled as a pointer during GC.
Marked the Instanceof stub as allowing stub calls (the RecordWriteStub was removed some days ago).
This issue was not caught by the assertion designed for this when debug mode is run with --debug-code (which out tests always does) as generating code for Abort set the allow stub calls flag to true. This has been fixed by restoring the allow stub calls flag correctly.
Review URL: http://codereview.chromium.org/6097010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6218 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
1. Added gdb style debugger commands (and their shortcuts) for d8.
These include:
- s[tep] : step into the current statement.
- s[tep]i[n]: step into the current statement with the minimum step.
- n[ext] : step to the next statement.
- fin[ish] : step out of the current function.
- cond : setting conditions on breakpoints.
- d[elete] : deletes breakpoints.
- en[able]|dis[able]: enables/disables breakpoints including
exception breakpoints.
- ignore : ignores a breakpoint for a specified period.
- inf[o] ar[gs] : info on arguments of the current function.
- inf[o] lo[cals] : info on local vars of the current function.
- inf[o] br[eakpoints] : info on breakpoints.
- l[ist] : similar to source, but allows the user to continually
dump subsequent lines of source code either in the
forward or backward direction.
- quit / exit / disconnect : terminates the remote debugger
session.
NOTE: Active breakpoints will automatically be disabled when
the remote debugger detaches. This allows v8 to continue to
run without worrying about a loss of a debugger session.
2. Added support for breaking the debugger by simply typing ENTER.
The break command is now optional.
3. Once the debugger is broken, the user can now just type ENTER
to repeat the last command. This is useful to functionality that
needs to be invoked repeatedly e.g. step, list.
4. Added more verbose descriptions in d8's help.
5. Fixed a line and column number offset bug in the listing of breakpoint
line and column numbers.
6. Added a gc command to allow GCs to be requested from the debugger
interface. The plumbing for requesting different types of GCs is
there, but the underlying implementation currently only triggers a
full mark-compact GC. The command also returns the before and after
sizes of the heap.
7. Added trace json, and flags commands that are not published in help.
trace json is used for tracing the debugger packets send from and
received by d8. flags is for setting v8 flags. These are useful for
people debugging v8 itself, but not necessarily users of v8.
8. Added the ability to enable and disable break on all / uncaught
exceptions in to d8.
9. Added a fix to prevent the Debugger Agent from being re-instantiated
if one already exists.
10. Added the ability to filter results of the script command by matching
text or numbers on the results.
11. Added v8 flags to enable/disable the sending of debugger BeforeCompile,
AfterCompile, and ScriptCollected events.
12. Fixed some undefined value bugs that resulted in v8 or the debugger
failing.
13. Added a few minor WEBOS__ customizations (analogous to ANDROID
customizations).
Patch by Mark Lam from Hewlett-Packard Development Company, LP
Review URL: http://codereview.chromium.org/5980006
Review URL: http://codereview.chromium.org/6086010
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6200 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Currently, the bind for the slow label is after the pushing of the
args registers which renders the args pushing dead code because there
is a Ret preceeding it. The comments also imply that the arg pushing
should be part of the InvokeBuiltins tail call.
Patch by Mark Lam from Hewlett-Packard Development Company, LP
Review URL: http://codereview.chromium.org/6107001
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6198 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
For polymorphic calls (also loads and stores) we construct a type switch
graph that has a basic block merging all the variants. There is an
environment simulation before the goto at the end of all the predecessor
blocks. This simulation is used to define the environment on entry to the
successor block, and captures the return value of the call. In effect
contexts, this value should not be present in the environment.
The fix is to use the AST context to decide whether to have this value in
the join node's environment at all.
BUG=1014
Review URL: http://codereview.chromium.org/6065014
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6189 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
If the instanceof stub was requested to deliver true/false objects as the result instead of 0/1 then 0/1 was actually returned if the builtin INSTANCE_OF ended up being called. This is now fixed.
BUG=v8:1020
TEST=test/mjsunit/regress/regress-1020.js
Review URL: http://codereview.chromium.org/6014013
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
1. Added gdb style debugger commands (and their shortcuts) for d8.
These include:
- s[tep] : step into the current statement.
- s[tep]i[n]: step into the current statement with the minimum step.
- n[ext] : step to the next statement.
- fin[ish] : step out of the current function.
- cond : setting conditions on breakpoints.
- d[elete] : deletes breakpoints.
- en[able]|dis[able]: enables/disables breakpoints including
exception breakpoints.
- ignore : ignores a breakpoint for a specified period.
- inf[o] ar[gs] : info on arguments of the current function.
- inf[o] lo[cals] : info on local vars of the current function.
- inf[o] br[eakpoints] : info on breakpoints.
- l[ist] : similar to source, but allows the user to continually
dump subsequent lines of source code either in the
forward or backward direction.
- quit / exit / disconnect : terminates the remote debugger
session.
NOTE: Active breakpoints will automatically be disabled when
the remote debugger detaches. This allows v8 to continue to
run without worrying about a loss of a debugger session.
2. Added support for breaking the debugger by simply typing ENTER.
The break command is now optional.
3. Once the debugger is broken, the user can now just type ENTER
to repeat the last command. This is useful to functionality that
needs to be invoked repeatedly e.g. step, list.
4. Added more verbose descriptions in d8's help.
5. Fixed a line and column number offset bug in the listing of breakpoint
line and column numbers.
6. Added a gc command to allow GCs to be requested from the debugger
interface. The plumbing for requesting different types of GCs is
there, but the underlying implementation currently only triggers a
full mark-compact GC. The command also returns the before and after
sizes of the heap.
7. Added trace json, and flags commands that are not published in help.
trace json is used for tracing the debugger packets send from and
received by d8. flags is for setting v8 flags. These are useful for
people debugging v8 itself, but not necessarily users of v8.
8. Added the ability to enable and disable break on all / uncaught
exceptions in to d8.
9. Added a fix to prevent the Debugger Agent from being re-instantiated
if one already exists.
10. Added the ability to filter results of the script command by matching
text or numbers on the results.
11. Added v8 flags to enable/disable the sending of debugger BeforeCompile,
AfterCompile, and ScriptCollected events.
12. Fixed some undefined value bugs that resulted in v8 or the debugger
failing.
13. Added a few minor WEBOS__ customizations (analogous to ANDROID
customizations).
Patch by Mark Lam from Hewlett-Packard Development Company, LP
Review URL: http://codereview.chromium.org/5980006
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6180 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
If the instance of is performed against what is beliwed to be a constant global function inline the instance of check and have the call to the instanceof stub in deferred code. The inlined check will be patched by the instanceof stub when called from deferred code. This is indicated by the lithium instruction LInstanceOfKnownGlobal.
To help the patching the delta from the return address to the patch site is placed just below the return address in the edi slot of the pushad/popad ares. This is safe because the edi register (which is pushed last) is a temporary for the lithium instruction.
As the instanceof stub can call other JavaScript an additional marking for saving all double registers have been added.
Also tweaked the instanceof stub to produce true/false objects instead of 0/1 for the case with deferred code.
Review URL: http://codereview.chromium.org/5990005
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
