Commit Graph

4340 Commits

Author SHA1 Message Date
ishell
156042f7f7 Cross-script variables handling fixed. It was possible to write to read-only global variable.
Review URL: https://codereview.chromium.org/1259853002

Cr-Commit-Position: refs/heads/master@{#29860}
2015-07-27 05:53:05 +00:00
littledan
024e39613a Class block scoping tests
Class bindings are mutable and lexically scoped, with TDZ semantics.
They may not overlap with var bindings in the same scope. This patch
adds tests for those properties.

R=adamk
BUG=v8:3305
LOG=N

Review URL: https://codereview.chromium.org/1254003004

Cr-Commit-Position: refs/heads/master@{#29856}
2015-07-25 01:59:24 +00:00
littledan
2d2b72f638 Split off a separate --harmony_sloppy_let flag
--harmony_sloppy includes behavior to turn on sloppy mode lexical
bindings. Before this patch, it also included a way to parse let
which is likely web-incompatible (let is disallowed as an
identifier). This patch splits off the let parsing from the more
general block scoping code, so that block scoping can be developed
independently.

R=adamk
LOG=N
BUG=v8:3305

Review URL: https://codereview.chromium.org/1255013002

Cr-Commit-Position: refs/heads/master@{#29855}
2015-07-25 00:05:18 +00:00
hichris123
f06754a8e1 Make dates default to the local timezone if none specified
In ES5, dates were supposed to default to UTC if no timezone was specified. However, this changed in ES6, which specified that dates should be in the local timezone if no timezone was specified. This CL updates our behavior to match that part of the ES6 spec.

BUG=chromium:391730, v8:4242
LOG=Y

Review URL: https://codereview.chromium.org/1229903004

Cr-Commit-Position: refs/heads/master@{#29854}
2015-07-24 17:19:52 +00:00
rossberg
3e40b64ade Find right scope associated with prologue
R=mstarzinger@chromium.org
BUG=513474,513475,513611,513612
LOG=N

Review URL: https://codereview.chromium.org/1250423002

Cr-Commit-Position: refs/heads/master@{#29845}
2015-07-24 13:08:32 +00:00
yangguo
cc8fa95f7c Debugger: fix deoptimizing inlined function.
BUG=v8:4320
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1255803004

Cr-Commit-Position: refs/heads/master@{#29842}
2015-07-24 10:37:57 +00:00
hichris123
ea056cbf2d Fix check for a date with a 24th hour
According to the ECMA spec, a 24th hour is allowed if the minutes, seconds, and milliseconds are all zero (i.e. it's midnight). Previously, we parsed the date correctly, however, we failed to account in all checks for the possibility of a 24th hour. This CL changes the check to allow a 24th hour if it's exactly midnight.

BUG=chromium:174609
LOG=Y

Review URL: https://codereview.chromium.org/1240093005

Cr-Commit-Position: refs/heads/master@{#29816}
2015-07-23 14:37:49 +00:00
rossberg
9ab8bfba7f [es6] Make sure temporaries are not allocated in block scope
While at it, remove the notion of INTERNAL variables.

@caitp: Took some parts from your CL, since I was blocked on the temp scope bug.

R=mstarzinger@chromium.org
BUG=512574
LOG=N

Review URL: https://codereview.chromium.org/1250513004

Cr-Commit-Position: refs/heads/master@{#29812}
2015-07-23 13:51:35 +00:00
danno
bc8041dc2b Unify "runtime-style" IC functions with Runtime intrinsics
Previous to this CL, ICs used a slightly different code idiom
to get to C++ code from generated code than runtime intrinsics,
using an IC_Utility class that in essence provided exactly
the same functionality as Runtime::FunctionForId, but in its
own quirky way.

This CL unifies the two mechanisms, folding IC_Utility
away by making all IC entry points in C++ code, e.g. IC
miss handlers, full-fledged runtime intrinsics. This makes
it possible to eliminate a bunch of ad-hoc declarations and
adapters that the IC system had to needlessly re-invent.

As a bonus and the original reason for this yak-shave:
IC-related C++ runtime functions are now callable from
TurboFan.

Review URL: https://codereview.chromium.org/1248303002

Cr-Commit-Position: refs/heads/master@{#29811}
2015-07-23 13:32:26 +00:00
rossberg
47d3bb1c0b [es6] Fix function context check for super and new.target
R=adamk@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/1244423003

Cr-Commit-Position: refs/heads/master@{#29803}
2015-07-23 09:58:59 +00:00
yurys
84f8e1af76 Remove RestartFrame from live edit API
There is already non-throwing version FrameMirror.restart and RestartFrame in the livedit-debugger.js just adds a throwing wrapper around it.

Also NEEDS_STEP_IN_PROPERTY_NAME was removed, the client code can decide based on the stack_modified field if "step in" is required.

Chromium side was fixed in https://codereview.chromium.org/1249013002/

BUG=None
LOG=N

Review URL: https://codereview.chromium.org/1247363002

Cr-Commit-Position: refs/heads/master@{#29797}
2015-07-23 07:46:55 +00:00
adamk
3a74348e09 [es6] Array.prototype[Symbol.iterator].name should be 'values'
R=littledan@chromium.org
BUG=v8:4311
LOG=n

Review URL: https://codereview.chromium.org/1242623002

Cr-Commit-Position: refs/heads/master@{#29794}
2015-07-23 05:50:47 +00:00
bbudge
5d8c105428 SIMD.js: Update Float32x4 and tests to current spec.
LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1239423004

Cr-Commit-Position: refs/heads/master@{#29781}
2015-07-22 03:14:06 +00:00
adamk
4b8200078a Remove unnecessary coupling between Promise tests and Object.observe
Many mjsunit tests (as well as the promises-aplus adapter scripts) were
using Object.observe simply for microtask-enqueueing purposes. Replaced
such uses with %EnqueueMicrotask.

Review URL: https://codereview.chromium.org/1246933002

Cr-Commit-Position: refs/heads/master@{#29779}
2015-07-21 17:17:07 +00:00
yangguo
35c28ce0a7 Debugger: prepare code for debugging on a per-function basis.
Prior to this patch, we enter a global debug mode whenever a break point
is set. By entering this mode, all code is deoptimized and activated
frames are recompiled and redirected to newly compiled debug code.

After this patch, we only deoptimize/redirect for functions we want to
debug. Trigger for this is Debug::EnsureDebugInfo, and having DebugInfo
object attached to the SFI prevents optimization/inlining.

The result is that we can have optimized code for functions without break
points alongside functions that do have break points, which are not
optimized.

R=mstarzinger@chromium.org, ulan@chromium.org
BUG=v8:4132
LOG=Y

Review URL: https://codereview.chromium.org/1233073005

Cr-Commit-Position: refs/heads/master@{#29758}
2015-07-20 14:53:37 +00:00
rossberg
fa94ca3ea4 [es6] Check declaration conflicts between non-simple parameters and the function body
Also, more tests for parameters containing functions or eval or both.

R=adamk@chromium.org, caitpotter88@gmail.com, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1225413005

Cr-Commit-Position: refs/heads/master@{#29752}
2015-07-20 13:49:13 +00:00
ishell
9e6647c216 Speedup some slow running stack-overflow tests.
BUG=chromium:505007
LOG=N

Review URL: https://codereview.chromium.org/1238273003

Cr-Commit-Position: refs/heads/master@{#29747}
2015-07-20 09:50:53 +00:00
adamk
e6cb6bb6b7 Fix element enumeration on String wrappers with dictionary elements
BUG=chromium:510426
LOG=n

Review URL: https://codereview.chromium.org/1246513002

Cr-Commit-Position: refs/heads/master@{#29745}
2015-07-20 09:01:06 +00:00
yangguo
01902e4eab Debugger: use FrameInspector in ScopeIterator to find context.
In optimized code, it's not guaranteed that the current context
is stored in its frame slot.

R=bmeurer@chromium.org
BUG=v8:4309
LOG=N

Committed: https://crrev.com/3a0ee39cbde6a9778cfc4e2a6a0a8ff68933ff38
Cr-Commit-Position: refs/heads/master@{#29697}

Review URL: https://codereview.chromium.org/1239033002

Cr-Commit-Position: refs/heads/master@{#29744}
2015-07-20 08:53:39 +00:00
ishell
cc66a1c64e Crankshaft part of the 'loads and stores to global vars through property cell shortcuts' feature.
BUG=chromium:510738
LOG=N

Review URL: https://codereview.chromium.org/1228113008

Cr-Commit-Position: refs/heads/master@{#29743}
2015-07-20 08:49:28 +00:00
caitpotter88
c9007d8f7e [d8] bounds-check before getting Shell::Worker internal field
Prevents fatal error in debug builds

BUG=v8:4271, 506954
R=binji@chromium.org
LOG=N

Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
Cr-Commit-Position: refs/heads/master@{#29524}

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29737}
2015-07-17 21:44:37 +00:00
binji
35b2114874 Atomics Futex API
BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208933006

Cr-Commit-Position: refs/heads/master@{#29736}
2015-07-17 17:11:47 +00:00
dusan.milosavljevic
82339644b2 MIPS: Fix missing falthru handling for some branch cases in TF.
TEST=mjsunit/asm/embenchen/zlib
BUG=

Review URL: https://codereview.chromium.org/1232313007

Cr-Commit-Position: refs/heads/master@{#29735}
2015-07-17 15:59:40 +00:00
yangguo
c062b28aeb Revert of Debugger: use FrameInspector in ScopeIterator to find context. (patchset id:40001 of https://codereview.chromium.org/1239033002/)
Reason for revert:
breaks roll: http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_rel_ng/builds/87292/steps/browser_tests%20%28with%20patch%29/logs/DevToolsSanityTest.TestPauseWhenScriptIsRunning

Original issue's description:
> Debugger: use FrameInspector in ScopeIterator to find context.
>
> In optimized code, it's not guaranteed that the current context
> is stored in its frame slot.
>
> R=bmeurer@chromium.org
> BUG=v8:4309
> LOG=N
>
> Committed: https://crrev.com/3a0ee39cbde6a9778cfc4e2a6a0a8ff68933ff38
> Cr-Commit-Position: refs/heads/master@{#29697}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4309

Review URL: https://codereview.chromium.org/1243553002

Cr-Commit-Position: refs/heads/master@{#29722}
2015-07-17 09:53:49 +00:00
littledan
8068b91d15 Additional TypedArray tests
- Test that TypedArray properties cannot be set in strict mode
  Properties like %TypedArray%.prototype.length have a getter and no
  setter. This test verifies that property, which was apparently not
  true in the past or had no test ensuring throwing in this case.
- Test that TypedArray integer indexed properties (array elements)
  are not configurable

Both of these have passed for some time, but there are open bugs against
them and apparently no tests verifying that they are fixed.

BUG=v8:3048, v8:3799
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1232843005

Cr-Commit-Position: refs/heads/master@{#29717}
2015-07-17 00:21:31 +00:00
littledan
f76dfee9df Array.prototype.reverse should call [[HasProperty]] on elements before [[Get]]
This is a change from ES5 to ES6: When reversing an array, first it is checked
whether the element exists, before the element is looked up. The order in ES6
is

[[HasElement]] lower
[[Get]] lower (if present)
[[HasElement]] upper
[[Get]] upper (if present)

In ES5, on the other hand, the order was

[[Get]] lower
[[Get]] upper
[[HasElement]] lower
[[HasElement]] upper

To mitigate the performance impact, this patch implements a new, third copy
of reversing arrays if %_HasPackedElements. This allows us to skip all
membership tests, and a quick and dirty benchmark shows that the new version
is faster:

Over 4 runs, the slowest for the new version:
d8> var start = Date.now(); for (var i = 0; i < 100000000; i++) [1, 2, 3, 4, 5].reverse(); Date.now() - start
4658

Over 3 runs, the fastest for the old version:
d8> var start = Date.now(); for (var i = 0; i < 100000000; i++) [1, 2, 3, 4, 5].reverse(); Date.now() - start
5176

BUG=v8:4223
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1238593003

Cr-Commit-Position: refs/heads/master@{#29716}
2015-07-16 23:12:23 +00:00
bbudge
6113058427 Expose SIMD.Float32x4 type to Javascript.
This CL exposes the constructor function, defines type related
information, and implements value type semantics.
It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.

TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc

LOG=Y
BUG=v8:4124

Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
Cr-Commit-Position: refs/heads/master@{#29689}

Review URL: https://codereview.chromium.org/1219943002

Cr-Commit-Position: refs/heads/master@{#29712}
2015-07-16 19:43:32 +00:00
caitpotter88
dfe2dd835a [parser] use-strict directives in function body affect init block
BUG=
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1234213004

Cr-Commit-Position: refs/heads/master@{#29710}
2015-07-16 16:45:06 +00:00
mstarzinger
bdd2be879d [turbofan] Disable one failing debugger test.
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1242023003

Cr-Commit-Position: refs/heads/master@{#29707}
2015-07-16 15:12:41 +00:00
mstarzinger
07dc66dcd5 Represent implicit 'this' binding by 'super' in AST.
This makes the implicit initializing assignment to 'this' performed
after a super constructor call explicit in the AST. It removes the
need to handle the special case where a CallExpression behaves like a
AssignmentExpression from various AstVisitor implementations.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1226123010

Cr-Commit-Position: refs/heads/master@{#29705}
2015-07-16 14:26:31 +00:00
hablich
40c38c5a5a Revert of Expose SIMD.Float32x4 type to Javascript. (patchset id:450001 of https://codereview.chromium.org/1219943002/)
Reason for revert:
Seems to brake the latest roll into Chromium: http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_compile_dbg_ng/builds/59796/steps/compile%20%28with%20patch%29/logs/stdio

Original issue's description:
> Expose SIMD.Float32x4 type to Javascript.
> This CL exposes the constructor function, defines type related
> information, and implements value type semantics.
> It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.
>
> TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc
>
> LOG=Y
> BUG=v8:4124
>
> Committed: https://crrev.com/e5ed3bee99807c502fa7d7a367ec401e16d3f773
> Cr-Commit-Position: refs/heads/master@{#29689}

TBR=rossberg@chromium.org,littledan@chromium.org,martyn.capewell@arm.com,bbudge@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review URL: https://codereview.chromium.org/1241533004

Cr-Commit-Position: refs/heads/master@{#29701}
2015-07-16 12:36:11 +00:00
yangguo
3a0ee39cbd Debugger: use FrameInspector in ScopeIterator to find context.
In optimized code, it's not guaranteed that the current context
is stored in its frame slot.

R=bmeurer@chromium.org
BUG=v8:4309
LOG=N

Review URL: https://codereview.chromium.org/1239033002

Cr-Commit-Position: refs/heads/master@{#29697}
2015-07-16 09:28:20 +00:00
mstarzinger
b76acef799 [turbofan] Implement super call support in TurboFan.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1238743002

Cr-Commit-Position: refs/heads/master@{#29696}
2015-07-16 08:54:05 +00:00
caitpotter88
124d2011ea [cleanup] remove --harmony-classes flag from mjsunit/harmony/new-target
Unknown flag warning is adding unnecessary noise to terminal during
test runs

BUG=
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1236993003

Cr-Commit-Position: refs/heads/master@{#29691}
2015-07-15 22:16:38 +00:00
bbudge
e5ed3bee99 Expose SIMD.Float32x4 type to Javascript.
This CL exposes the constructor function, defines type related
information, and implements value type semantics.
It also refactors test/mjsunit/samevalue.js to test SameValue and SameValueZero.

TEST=test/mjsunit/harmony/simd.js, test/cctest/test-simd.cc

LOG=Y
BUG=v8:4124

Review URL: https://codereview.chromium.org/1219943002

Cr-Commit-Position: refs/heads/master@{#29689}
2015-07-15 19:17:06 +00:00
adamk
24e982816f Fix spread array inside array literal
During parsing, we now keep track of the first spread seen in an array
literal (if any), and make use of that information when creating the
FixedArray backing store representing the constant elements for array
literal materialization.

The old code tried to do this by setting the generated JSArray's length
in ArrayLiteral::BuildConstantElements(), but that Array length is never
read by the rest of the literal materialization code (it always uses
the length of the FixedArray backing store).

BUG=v8:4298
LOG=n

Review URL: https://codereview.chromium.org/1225223004

Cr-Commit-Position: refs/heads/master@{#29684}
2015-07-15 15:16:13 +00:00
adamk
9c8f78e26f [es6] Fix String.prototype.normalize to properly validate argument
BUG=v8:4302
LOG=n

Review URL: https://codereview.chromium.org/1237873003

Cr-Commit-Position: refs/heads/master@{#29683}
2015-07-15 15:15:14 +00:00
verwaest
047b4bfbb4 Fix non-standard element handling
BUG=

Review URL: https://codereview.chromium.org/1228113003

Cr-Commit-Position: refs/heads/master@{#29677}
2015-07-15 12:06:31 +00:00
rossberg
207fbbbe32 [es6] Implement inner scope for functions with destructuring
R=adamk@chromium.org, littledan@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1240463002

Cr-Commit-Position: refs/heads/master@{#29674}
2015-07-15 10:59:58 +00:00
yangguo
fc9c5275c3 Debugger: use debug break slots to break at function exit.
By not having to patch the return sequence (we patch the debug
break slot right before it), we don't overwrite it and therefore
don't have to keep the original copy of the code around.

R=ulan@chromium.org
BUG=v8:4269
LOG=N

Review URL: https://codereview.chromium.org/1234833003

Cr-Commit-Position: refs/heads/master@{#29672}
2015-07-15 09:22:51 +00:00
mvstanton
ae11f20e26 Scoping error caused crash in CallICNexus::StateFromFeedback
A sloppy mode eval call that establishes strict mode will leak that strictness
into the sloppy surrounding scope on recompile. This changes the structure
of the type feedback vector for the function and crashes follow.

The fix is straightforward.

BUG=491536, 503565
LOG=N

Review URL: https://codereview.chromium.org/1231343003

Cr-Commit-Position: refs/heads/master@{#29671}
2015-07-15 09:15:05 +00:00
ishell
edc61b26b4 Debugger test updated to avoid setting breakpoints into random scripts.
Review URL: https://codereview.chromium.org/1231893007

Cr-Commit-Position: refs/heads/master@{#29668}
2015-07-15 07:42:06 +00:00
binji
3ec841f2b5 Disable d8-worker-sharedarraybuffer test (fails on TSAN)
See http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4695/steps/Check%20%28flakes%29/logs/d8-worker-sharedarray..

BUG=v8:4306
R=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/1241713003

Cr-Commit-Position: refs/heads/master@{#29664}
2015-07-14 23:34:35 +00:00
binji
4073657ec8 Reland of d8 workers: make sure Shell::Quit is only called once (patchset id:1 of https://codereview.chromium.org/1235083004/)
Reason for revert:
Looks like the failure is unrelated to my change (still fails after the revert). See http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/856/steps/webkit_unit_tests/logs/stdio

Original issue's description:
> Revert of d8 workers: make sure Shell::Quit is only called once (patchset  id:80001 of https://codereview.chromium.org/1230403003/)
>
> Reason for revert:
> Breaks webkit_unit_tests. See http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/853/steps/webkit_unit_tests/logs/stdio
>
> Original issue's description:
> > d8 workers: make sure Shell::Quit is only called once
> >
> > When running with isolates, Quit can be called simultaneously by two threads.
> > If this happens, then both threads try to clean up the Workers, which could
> > crash.
> >
> > BUG=v8:4279
> > R=jarin@chromium.org
> > R=machenbach@chromium.org
> > LOG=n
> >
> > Committed: https://crrev.com/76184292b392d107609f21662a949b58bb1e258c
> > Cr-Commit-Position: refs/heads/master@{#29654}
>
> TBR=jarin@chromium.org,machenbach@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4279
>
> Committed: https://crrev.com/6b2c6eb75678747afca59b4a78ace597e218145d
> Cr-Commit-Position: refs/heads/master@{#29656}

TBR=jarin@chromium.org,machenbach@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4279

Review URL: https://codereview.chromium.org/1224203004

Cr-Commit-Position: refs/heads/master@{#29663}
2015-07-14 23:04:32 +00:00
binji
5a9722b2ab d8 workers: Fix transferring SharedArrayBuffer to multiple Workers. (try 2)
Note: the previous try was reverted for occasional flaky tests. This continued
after the revert, and should be fixed by
https://codereview.chromium.org/1226143003.

Previously, the serialization code would call Externalize for every transferred
ArrayBuffer or SharedArrayBuffer, but that function can only be called once. If
the buffer is already externalized, we should call GetContents instead.

Also fix use-after-free bug when transferring ArrayBuffers. The transferred
ArrayBuffer must be internalized in the new isolate, or be managed by the
Shell. The current code gives it to the isolate externalized and frees it
immediately afterward when the SerializationData object is destroyed.

BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1223813008

Cr-Commit-Position: refs/heads/master@{#29658}
2015-07-14 19:56:54 +00:00
binji
6b2c6eb756 Revert of d8 workers: make sure Shell::Quit is only called once (patchset id:80001 of https://codereview.chromium.org/1230403003/)
Reason for revert:
Breaks webkit_unit_tests. See http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/853/steps/webkit_unit_tests/logs/stdio

Original issue's description:
> d8 workers: make sure Shell::Quit is only called once
>
> When running with isolates, Quit can be called simultaneously by two threads.
> If this happens, then both threads try to clean up the Workers, which could
> crash.
>
> BUG=v8:4279
> R=jarin@chromium.org
> R=machenbach@chromium.org
> LOG=n
>
> Committed: https://crrev.com/76184292b392d107609f21662a949b58bb1e258c
> Cr-Commit-Position: refs/heads/master@{#29654}

TBR=jarin@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4279

Review URL: https://codereview.chromium.org/1235083004

Cr-Commit-Position: refs/heads/master@{#29656}
2015-07-14 18:14:01 +00:00
binji
76184292b3 d8 workers: make sure Shell::Quit is only called once
When running with isolates, Quit can be called simultaneously by two threads.
If this happens, then both threads try to clean up the Workers, which could
crash.

BUG=v8:4279
R=jarin@chromium.org
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1230403003

Cr-Commit-Position: refs/heads/master@{#29654}
2015-07-14 17:42:17 +00:00
binji
a55fcc93ae Don't use length property when bounds checking atomics functions
The length property can be monkey-patched, so use the native function instead.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1227913006

Cr-Commit-Position: refs/heads/master@{#29653}
2015-07-14 16:17:21 +00:00
verwaest
5f24690384 Properly handle missing from normalized stores with keys convertible to array indices
BUG=chromium:509961
LOG=n

Review URL: https://codereview.chromium.org/1241613003

Cr-Commit-Position: refs/heads/master@{#29648}
2015-07-14 11:44:56 +00:00
conradw
f996793ec0 [strong] class objects created in strong mode have their prototype frozen
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1235983002

Cr-Commit-Position: refs/heads/master@{#29646}
2015-07-14 11:31:47 +00:00