AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
22,953 Commits 1 Branch 0 Tags 839 MiB
19312c1631
Commit Graph

1321 Commits

Author SHA1 Message Date
mstarzinger
558efe21f0 Add missing BailoutId and FrameState to with statements. 
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-450642
BUG=chromium:450642
LOG=N

Review URL: https://codereview.chromium.org/865833002

Cr-Commit-Position: refs/heads/master@{#26218}
 2015-01-22 10:57:42 +00:00
bmeurer
0381acf7b3 Double field values need sNaN -> qNaN canonicalization. 
Also fix mjsunit/regress/regress-undefined-nan to ensure that we are
testing transfer via xmm registers by forcing the transfer to be in an
optimized function.

BUG=v8:3839
LOG=n
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863153002

Cr-Commit-Position: refs/heads/master@{#26213}
 2015-01-22 08:36:12 +00:00
Benedikt Meurer
ee86227600 [arm] Fix sNaN quietening in the ARM simulator on IA-32. 
TEST=msjunit/regress/regress-undefined-nan2
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/802243004

Cr-Commit-Position: refs/heads/master@{#26185}
 2015-01-21 13:01:23 +00:00
Benedikt Meurer
9eace97bba Use signaling NaN for holes in fixed double arrays. 
TEST=mjsunit,cctest,unittests
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/863633002

Cr-Commit-Position: refs/heads/master@{#26180}
 2015-01-21 08:52:25 +00:00
ishell
33994b4a22 Massive renaming of PropertyType values and other implied stuff. 
PropertyKind:
  DATA -> kData
  ACCESSOR -> kAccessor

PropertyType:
  FIELD -> DATA
  CONSTANT -> DATA_CONSTANT
  ACCESSOR_FIELD -> ACCESSOR
  CALLBACKS -> ACCESSOR_CONSTANT

PropertyLocation:
  IN_OBJECT -> kField
  IN_DESCRIPTOR -> kDescriptor

StoreMode:
  FORCE_IN_OBJECT -> FORCE_FIELD

FieldDescriptor -> DataDescriptor
ConstantDescriptor -> DataConstantDescriptor
CallbacksDescriptor -> AccessorConstantDescriptor

Review URL: https://codereview.chromium.org/856503002

Cr-Commit-Position: refs/heads/master@{#26146}
 2015-01-19 17:49:22 +00:00
mvstanton
173b69f041 ClusterFuzz fix: %NormalizeElements shouldn't process the global proxy. 
BUG=449070
R=yangguo@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/859713002

Cr-Commit-Position: refs/heads/master@{#26126}
 2015-01-19 09:31:19 +00:00
Sven Panne
e5184734b3 Another attempt to fix regress-crbug-178790. 
This time we simply undo the change introduced by the PPC port for
this test. No idea why it should be necessary, and Windows XP
obviously doesn't give us that much stack, anyway.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/826833003

Cr-Commit-Position: refs/heads/master@{#26093}
 2015-01-16 10:12:15 +00:00
Sven Panne
54570cfa74 PPC aftermath: Fix regress-crbug-178790. 
The test fails on XP only, so let's tentatively raise the stack limit more. We probably need to investigate what a tighter limit might be and (more importantly) what the underlying reason for the failure is.

Hopefully 1800kB is enough, we can't test this via try jobs, because we don't have XP try bots. :-/

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/791693005

Cr-Commit-Position: refs/heads/master@{#26092}
 2015-01-16 09:45:31 +00:00
Sven Panne
e4c5b84652 Contribution of PowerPC port (continuation of 422063005) 
Contribution of PowerPC port (continuation of 422063005). The inital patch
covers the core changes to the common files.  Subsequent patches will cover
changes to common files to support AIX and to update the ppc directories so
they are current with the changes in the rest of the project.

This is based off of the GitHub repository
https://github.com/andrewlow/v8ppc

BUG=
R=svenpanne@chromium.org, danno@chromium.org, sevnpanne@chromium.org

Review URL: https://codereview.chromium.org/817143002

Cr-Commit-Position: refs/heads/master@{#26091}
 2015-01-16 07:42:15 +00:00
bmeurer
e1d878d16f Add proper support for proxies to HType. 
TEST=mjsunit/regress/regress-crbug-448730
BUG=chromium:448730
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/847373002

Cr-Commit-Position: refs/heads/master@{#26056}
 2015-01-14 13:57:09 +00:00
dslomov
a4124b3bfc Map -0 to integer 0 for typed array constructors. 
R=bmeurer@chromium.org
BUG=chromium:447756
LOG=Y

Review URL: https://codereview.chromium.org/790813005

Cr-Commit-Position: refs/heads/master@{#26021}
 2015-01-12 11:42:57 +00:00
titzer
7e98658e31 [turbofan] Fix control reducer for degenerate cases of self-loop branches. 
R=jarin@chromium.org
BUG=chromium:447526

Review URL: https://codereview.chromium.org/828823006

Cr-Commit-Position: refs/heads/master@{#26009}
 2015-01-09 12:28:14 +00:00
Yang Guo
2050994d80 Correctly parse line ends for debugging. 
Instead of using only \n as line terminator, we now use the definition
in http://www.ecma-international.org/ecma-262/5.1/#sec-7.3

R=marja@chromium.org
BUG=v8:2825
LOG=Y

Review URL: https://codereview.chromium.org/821383009

Cr-Commit-Position: refs/heads/master@{#25989}
 2015-01-08 10:46:13 +00:00
ishell
0d6785805c Correct handling of exceptions occured during getting of exception stack trace. 
BUG=chromium:444805
LOG=Y

Review URL: https://codereview.chromium.org/793333003

Cr-Commit-Position: refs/heads/master@{#25978}
 2015-01-07 14:50:16 +00:00
titzer
d77d3ba9a3 Fix bug in Runtime_CompileOptimized resulting from stack overflow. 
R=jarin@chromium.org
BUG=chromium:446389
LOG=Y

Review URL: https://codereview.chromium.org/844503002

Cr-Commit-Position: refs/heads/master@{#25974}
 2015-01-07 13:43:44 +00:00
svenpanne
cbf3b0bcc7 More -fsanitize=vptr fixes. 
This actually fixes 3 different issues when accessing Operand1:

   * Object vs. HeapObject

   * Wrong defaults for equals/hash

   * silently dropping const

TEST=test/mjsunit/regress/regress-441099.js
BUG=chromium:441099
LOG=y

Review URL: https://codereview.chromium.org/812563002

Cr-Commit-Position: refs/heads/master@{#25843}
 2014-12-16 14:20:28 +00:00
marja
978f41a1da RegExpParser: Fix Reset()ting to the end. 
The bug would occur when we try to Reset() to a position already at the end.

This happens e.g., when the regexp ends with \u. What used to happen in that
case: 1) Advance past \ and u (to the end) (which wouldn't increase next_pos_
enough) 2) Try to parse 4 hex digits 3) When that failed, Reset() to the
position which should've been at the end but wasn't.

To be able to properly Reset() to a position at the end, we need to allow
next_pos_ to move beyond the end (since position() is next_pos_ - 1).

Minimal repro case:

var r = /foo\u/
r.test("foou") // should be true, was false.

(Note that \u not followed by 4 hex didits should be interpreted as an identity
escape. It already worked unless \u was at the end of the regexp.)

BUG=v8:3756
LOG=NO

Review URL: https://codereview.chromium.org/802313003

Cr-Commit-Position: refs/heads/master@{#25838}
 2014-12-16 12:14:19 +00:00
jkummerow
c060f4e26c Internalize strings being stored into uninitialized property cells 
Review URL: https://codereview.chromium.org/804993002

Cr-Commit-Position: refs/heads/master@{#25822}
 2014-12-15 15:46:11 +00:00
dslomov
e6198a0fed Update tests in preparation for shipping classes. 
R=arv@chromium.org
BUG=v8:3330
LOG=N

Review URL: https://codereview.chromium.org/788773003

Cr-Commit-Position: refs/heads/master@{#25783}
 2014-12-11 15:54:09 +00:00
ishell
7d13ca278a Reland of "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Review URL: https://codereview.chromium.org/793453004

Cr-Commit-Position: refs/heads/master@{#25750}
 2014-12-10 15:18:52 +00:00
svenpanne
c16b8f6cbb Fixed environment handling for LFlooringDivI on ARM. 
Beautiful code... :-}

BUG=chromium:437765
LOG=y

Review URL: https://codereview.chromium.org/775613002

Cr-Commit-Position: refs/heads/master@{#25613}
 2014-12-02 13:47:19 +00:00
ishell
1a2e4b265a Map::CopyGeneralizeAllRepresentations() left incorrect layout descriptor in a new map. 
BUG=chromium:436820
LOG=N

Review URL: https://codereview.chromium.org/759823004

Cr-Commit-Position: refs/heads/master@{#25530}
 2014-11-26 17:37:05 +00:00
titzer
9da4998204 Abort optimization in corner case. 
The %OptimizeFunctionOnNextCall sledgehammer can cause a function to be
marked for optimization before it's ever been compiled by fullcode.
This can lead to the situation where a function doesn't have optimization
disabled until we try to compile it optimized.

Basically, the assert should just handle this case more gracefully.

R=yangguo@chromium.org
BUG=436893
LOG=Y

Review URL: https://codereview.chromium.org/760063002

Cr-Commit-Position: refs/heads/master@{#25528}
 2014-11-26 16:57:52 +00:00
jarin
97cab985b8 Do not try to inline if the function has an illegal redeclaration. 
R=mvstanton@chromium.org
BUG=chromium:436896
LOG=n

Review URL: https://codereview.chromium.org/755333003

Cr-Commit-Position: refs/heads/master@{#25527}
 2014-11-26 16:32:46 +00:00
dslomov
626f110f0b Introduce legacy const slots in correct context. 
R=rossberg@chromium.org
BUG=chromium:410030
LOG=Y

Review URL: https://codereview.chromium.org/756293004

Cr-Commit-Position: refs/heads/master@{#25519}
 2014-11-26 12:16:30 +00:00
dslomov
6ac4de87a8 harmony-scoping: make assignment to 'const' a late error. 
Per TC39 Nov 2014 decision.

This patch also changes behavior for "legacy const": assignments to sloppy const in strict mode is now also a type error. This fixes v8:2243 and also brings us in compliance with other engines re assignment to function names (see updated webkit test), but might have bigger implications.
That change can easily be reverted by changing Variable::IsSignallingAssignmentToConst.

BUG=v8:3713,v8:2243
LOG=N

Review URL: https://codereview.chromium.org/749633002

Cr-Commit-Position: refs/heads/master@{#25516}
 2014-11-26 11:21:23 +00:00
jarin
d9cabb9b22 [turbofan] Fix matching of the lea instruction. 
Resets the scaled exponent to 0 when the scaling match fails.

BUG=

Review URL: https://codereview.chromium.org/756643002

Cr-Commit-Position: refs/heads/master@{#25491}
 2014-11-24 17:45:33 +00:00
yangguo
270dccf6db Correctly find shared function info for debugging when compiling eagerly. 
R=ulan@chromium.org
BUG=v8:3717
LOG=N

Review URL: https://codereview.chromium.org/758523004

Cr-Commit-Position: refs/heads/master@{#25486}
 2014-11-24 15:43:35 +00:00
yangguo
14a3b9188d Fix RegExp.source for uncompiled regexp. 
R=jkummerow@chromium.org
BUG=435825
LOG=N

Review URL: https://codereview.chromium.org/753983002

Cr-Commit-Position: refs/heads/master@{#25476}
 2014-11-24 11:21:52 +00:00
yangguo
5414c39974 Slightly improve tests that rely on lazy compilation. 
R=rossberg@chromium.org
BUG=v8:3712
LOG=N

Review URL: https://codereview.chromium.org/743843003

Cr-Commit-Position: refs/heads/master@{#25463}
 2014-11-21 12:41:06 +00:00
yangguo
61bee5c898 Correctly escape RegExp source. 
R=ulan@chromium.org
BUG=v8:3229
LOG=N

Review URL: https://codereview.chromium.org/736003002

Cr-Commit-Position: refs/heads/master@{#25457}
 2014-11-21 10:50:24 +00:00
Michael Stanton
cf572694fe Assert to protect against polymorphic string loads fires on valid stores. 
BUG=435477
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/751513002

Cr-Commit-Position: refs/heads/master@{#25456}
 2014-11-21 10:29:08 +00:00
Michael Stanton
3d58b82add Fix for 435073: CHECK failure in CHECK(p->IsSmi()) failed. 
The bug was an error when copying arrays in crankshaft. If it's a holey smi
array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation
changes from being inserted that deopt on encountering the hole.

Also, prevent inlining array pop() and shift() if the length is read-only.

BUG=435073
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/737383002

Cr-Commit-Position: refs/heads/master@{#25455}
 2014-11-21 10:14:19 +00:00
ulan
dc88962350 Do not bailout from optimizing functions that use f(x, arguments) 
if there is not enough type-feedback to detect that f is Function.prototype.apply.

BUG=v8:3709
LOG=N
TEST=mjsunit/regress/regress-3709

Review URL: https://codereview.chromium.org/736043002

Cr-Commit-Position: refs/heads/master@{#25447}
 2014-11-20 17:07:44 +00:00
Andreas Rossberg
4f63564700 Fix lower bound violation 
R=jarin@chromium.org
BUG=433332
LOG=N

Review URL: https://codereview.chromium.org/739563002

Cr-Commit-Position: refs/heads/master@{#25436}
 2014-11-20 11:22:49 +00:00
yangguo
5bea77f786 Fix disabling all break points from within the debug event callback. 
BUG=chromium:432493
LOG=Y

Review URL: https://codereview.chromium.org/728103008

Cr-Commit-Position: refs/heads/master@{#25400}
 2014-11-18 14:57:48 +00:00
Jakob Kummerow
bf22724e0d Fix one more missing c0_ < 0 check in scanner 
BUG=chromium:433766
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/731953003

Cr-Commit-Position: refs/heads/master@{#25371}
 2014-11-17 09:43:31 +00:00
Jaroslav Sevcik
c3af691e72 [turbofan] Remove int32 narrowing during typed lowering. 
With Int32Add we lose the int/uint distinction, so later, in simplified lowering we can make a wrong decision. E.g., see the attached test case, where we lower NumberAdd -> Int32Add because inputs are Uint32, but during simplified lowering we change the inputs to Int32, so we get a wrong result.

Simplified lowering will lower the NumberAdd operations anyway, so we should lose performance.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/721723004

Cr-Commit-Position: refs/heads/master@{#25368}
 2014-11-17 09:04:52 +00:00
ishell@chromium.org
2e38f33911 Revert "TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name." 
Revert "Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136."

This revert is made in order to revert r25099 which potentially causes renderer hangs.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/722873004

Cr-Commit-Position: refs/heads/master@{#25332}
 2014-11-13 15:31:04 +00:00
ishell@chromium.org
bc8c41c08d Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions. 
It started showing after r25253.

BUG=v8:3687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/715313003

Cr-Commit-Position: refs/heads/master@{#25324}
 2014-11-13 10:56:31 +00:00
Jaroslav Sevcik
2d075e2298 Reland "[turbofan] Weakening of types must weaken ranges inside unions." 
This relands commit 4c1f4b796d.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/723023002

Cr-Commit-Position: refs/heads/master@{#25317}
 2014-11-13 09:02:14 +00:00
Yang Guo
b96309b776 Move public symbols to the root set. 
This allows serializing public symbols that are embedded in code.

BUG=v8:3689
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722723002

Cr-Commit-Position: refs/heads/master@{#25315}
 2014-11-13 08:48:08 +00:00
Jaroslav Sevcik
c513297f9f Revert "[turbofan] Weakening of types must weaken ranges inside unions." 
This reverts commit 4c1f4b796d.

TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/722943003

Cr-Commit-Position: refs/heads/master@{#25312}
 2014-11-13 06:10:42 +00:00
Jaroslav Sevcik
4c1f4b796d [turbofan] Weakening of types must weaken ranges inside unions. 
BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/712623002

Cr-Commit-Position: refs/heads/master@{#25311}
 2014-11-13 05:31:47 +00:00
dslomov@chromium.org
0e2f7e3c35 Re-enable serialization under harmony-scoping. 
R=yangguo@chromium.org
BUG=v8:3689
LOG=N

Review URL: https://codereview.chromium.org/717153002

Cr-Commit-Position: refs/heads/master@{#25294}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25294 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 13:12:50 +00:00
yangguo@chromium.org
1dbd6369b1 Correctly compute line numbers in functions from the function constructor. 
R=aandrey@chromium.org
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/701093003

Cr-Commit-Position: refs/heads/master@{#25289}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-12 10:06:47 +00:00
adamk@chromium.org
1386257c55 Correctly handle Array unshift/splices that move elements past the max length of an Array 
BUG=v8:2615
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/679113003

Cr-Commit-Position: refs/heads/master@{#25270}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25270 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 19:08:14 +00:00
jkummerow@chromium.org
3b3929fdc7 Reland "Avoid some unnecessary fast-properties map creations." 
This relands commit ea74f0f85a.

The revert was due to failures in cctest/test-heap/ReleaseOverReservedPages,
caused by apparent changes to memory layout and fragmentation of the
first page. Eliminating a situation in messages.js where this CL has had
an effect on map transitions seems to solve the issue.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/714883003

Cr-Commit-Position: refs/heads/master@{#25266}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-11 15:41:30 +00:00
jkummerow@chromium.org
d3b68cf370 Fix has_constant_parameter_count() confusion in LReturn 
BUG=chromium:431602
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/714663002

Cr-Commit-Position: refs/heads/master@{#25249}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25249 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-10 15:25:50 +00:00
arv@chromium.org
c24ebcd387 Revert "Avoid some unnecessary fast-properties map creations." 
This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2.

Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa..

BUG=None
LOG=N
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/709123002

Cr-Commit-Position: refs/heads/master@{#25224}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 18:49:45 +00:00
jkummerow@chromium.org
ea74f0f85a Avoid some unnecessary fast-properties map creations. 
(1) When we have just normalized and re-fastified a map, we don't need to copy it again to set the is_prototype bit.
(2) When defining accessors causes a non-prototype object to go slow, don't force re-fastification.

BUG=v8:3267
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/706243002

Cr-Commit-Position: refs/heads/master@{#25221}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 16:33:47 +00:00
marja@chromium.org
2b026851ac Scanner: disallow unicode escapes in regexp flags. 
The spec explicitly forbids them. V8 never handled them properly either, just
the Scanner accepted them (it had code to add them literally to the
LiteralBuffer) and later on, Regexp constructor disallowed them.

According to the spec, unicode escapes in regexp flags should be an early error
("It is a Syntax Error if IdentifierPart contains a Unicode escape sequence.").

Note that Scanner is still more relaxed about regexp flags than the
spec. Especially, it accepts any identifier parts (not just a small set of
letters) and doesn't check for duplicates.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/700373003

Cr-Commit-Position: refs/heads/master@{#25215}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25215 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-07 14:32:19 +00:00
ishell@chromium.org
e1f93a82f2 Fix for an assertion failure in Map::FindTransitionToField(...). Appeared after r25136. 
BUG=chromium:430846
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/704183002

Cr-Commit-Position: refs/heads/master@{#25185}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25185 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-06 11:50:33 +00:00
jarin@chromium.org
91eeae5849 [turbofan] Fix deopt for assignments in non-effect context. 
BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/701853002

Cr-Commit-Position: refs/heads/master@{#25151}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25151 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 13:09:14 +00:00
ishell@chromium.org
33dde8d92c TransitionArray now uses <is_data_property, name, attributes> tuple as a key, which allows to have several entries for the same property name. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/661133002

Cr-Commit-Position: refs/heads/master@{#25136}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25136 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-05 09:26:48 +00:00
rossberg@chromium.org
357882a8e5 1..isPrototypeOf.call(null) should return false, not throw TypeError. 
BUG=v8:3483
LOG=Y
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/433413002

Cr-Commit-Position: refs/heads/master@{#25116}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-11-04 16:14:18 +00:00
mstarzinger@chromium.org
cd3273b562 Properly handle stack overflows in the AST graph builder. 
R=jarin@chromium.org
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159
LOG=N

Review URL: https://codereview.chromium.org/697473006

Cr-Commit-Position: refs/heads/master@{#25037}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25037 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-31 14:02:46 +00:00
yangguo@chromium.org
76292d2daf Fix assertion scope in Runtime_GetScript. 
The HeapIterator implies DisallowHeapAllocation, but Script::GetWrapper
may allocate.

LOG=N
R=jkummerow@chromium.org
BUG=chromium:410033

Review URL: https://codereview.chromium.org/680283002

Cr-Commit-Position: refs/heads/master@{#25001}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-30 07:25:43 +00:00
yangguo@chromium.org
64cef0b2e9 Reland "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
BUG=chromium:424142
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/692453002

Cr-Commit-Position: refs/heads/master@{#24970}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24970 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 10:19:44 +00:00
yangguo@chromium.org
67b76ebaea Revert "In PrepareForBreakPoints, also purge shared function info not referenced by functions." 
This reverts commit r24964.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/687163002

Cr-Commit-Position: refs/heads/master@{#24966}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24966 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 09:23:10 +00:00
yangguo@chromium.org
7668c4c29a In PrepareForBreakPoints, also purge shared function info not referenced by functions. 
R=ulan@chromium.org
BUG=chromium:424142
LOG=N

Review URL: https://codereview.chromium.org/685753002

Cr-Commit-Position: refs/heads/master@{#24964}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-29 08:11:41 +00:00
yangguo@chromium.org
0dfbf83468 Use shared function info for eval cache key. 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/678843004

Cr-Commit-Position: refs/heads/master@{#24927}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24927 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 10:01:44 +00:00
yangguo@chromium.org
efc01f4736 Prevent recursion in the debug event listener. 
R=ulan@chromium.org
BUG=chromium:409614
LOG=N

Review URL: https://codereview.chromium.org/684573005

Cr-Commit-Position: refs/heads/master@{#24924}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24924 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-28 09:44:43 +00:00
adamk@chromium.org
f1954232b0 SimpleMove now calls [[Has]] before [[Get]] when moving elements 
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/678753002

Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-27 13:05:13 +00:00
jarin@chromium.org
23df66ee24 Add more missing deopts 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/639883002

Cr-Commit-Position: refs/heads/master@{#24886}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24886 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-26 10:25:48 +00:00
adamk@chromium.org
c9ea8d6512 SimpleSlice now calls [[Get]] before [[Has]] when generating copy 
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.

BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/674003002

Cr-Commit-Position: refs/heads/master@{#24884}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24884 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:08:13 +00:00
adamk@chromium.org
02d37b8f10 Widen definition of %HasComplexElements() to include non-enumerability 
This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-24 18:04:13 +00:00
adamk@chromium.org
0ef073d556 Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/673893002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24856 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 21:13:29 +00:00
adamk@chromium.org
5f1ae66d56 Narrow cases where Sparse/Smart versions of Array methods are used 
Added a new %HasComplexElements runtime function (meaning elements that are
non-writable, non-configurable, or have getters and setters) and use it
in UseSparseVariant to filter out cases where the sparse optimizations
can cause V8 to fall out of spec compliance.

Renamed SmartMove/SmartSlice to SparseMove/SparseSlice and guarded them
with the new and improved UseSparseVariant.

These two changes combine let us pass nearly every test in bug-2615.js,
as well as fixing reverse and join on sparse arrays.

Note that there are various test changes in this patch that correct existing
tests to match the correct-by-spec behavior.

This patch depends on https://codereview.chromium.org/666883009, which
better-aligns the behavior of SmartMove with SimpleMove.

BUG=v8:2615,v8:3612,v8:3621
LOG=y
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/656423004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24855 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 18:21:50 +00:00
ishell@chromium.org
5509cc2c07 Fixed mutable heap numbers leak in JSON parser. 
BUG=chromium:423687
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/669403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24849 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 14:41:39 +00:00
dslomov@chromium.org
96105a90fc harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=24834

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24842 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 12:30:20 +00:00
dslomov@chromium.org
707ed29a51 Revert "harmony-scoping: Allow 'const' iteration variables in strict mode." 
This reverts commit r24834 for breaking debug tests.

TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/672193002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24839 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:55:19 +00:00
dslomov@chromium.org
b54f7d3c46 harmony-scoping: Allow 'const' iteration variables in strict mode. 
R=rossberg@chromium.org
BUG=v8:2506
LOG=N

Review URL: https://codereview.chromium.org/671913002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-23 11:18:50 +00:00
rodolph.perfetta@arm.com
ecbfc43f37 ARM64: Fix stack manipulation. 
Builtins::Generate_StringConstructCode was claiming stack space instead of
giving it back.

BUG=chromium:425585
LOG=Y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/672623003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24815 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 18:24:20 +00:00
dslomov@chromium.org
b664c12235 Flatten the string in StringToDouble function. 
R=yangguo@chromium.org
BUG=chromium:425551
LOG=N

Review URL: https://codereview.chromium.org/654763003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24796 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-22 08:19:05 +00:00
adamk@chromium.org
b6d0113abc Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value 
BUG=chromium:423633
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/649063003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24784 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 17:46:42 +00:00
mvstanton@chromium.org
8330178b4c The issue is that by handling strings with map/handler pairs instead of a special 
version of the keyed load stub (https://code.google.com/p/v8/source/detail?r=24661),
I allowed polymorphism between string and non-string types in the IC. Before, the
IC would go generic.

Then, at crankshaft time, we special case when we only saw strings. The error
here is that crankshaft can't emit code that handles polymorphism between string
and non-string types. The choice is either to get that to happen (I don't deem
this necessary from a performance point of view, an IC with such type feedback
before would have gone generic), or simply check for the case of "polymorphic
with some string maps" and require crankshaft to go generic. I'll do the latter.

BUG=425519
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/667923004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24775 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-21 13:04:51 +00:00
yangguo@chromium.org
83ddaa0df7 Fix break location calculation. 
R=ulan@chromium.org
BUG=chromium:419663
LOG=Y

Review URL: https://codereview.chromium.org/658723005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24697 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-17 14:11:01 +00:00
adamk@chromium.org
ae7161e4cb Revert "Remove SmartMove, bringing Array methods further into spec compliance" 
This reverts https://code.google.com/p/v8/source/detail?r=24647

It caused test failures in Array methods in Linux64 OptimizeForSize.

BUG=v8:2615
TBR=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/656683003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24648 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:53:02 +00:00
adamk@chromium.org
bb885a79db Remove SmartMove, bringing Array methods further into spec compliance 
This is one step towards a single codepath for each method in array.js.

This patch is based on rafaelw's https://codereview.chromium.org/349073002

BUG=v8:2615
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/455933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24647 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 23:36:58 +00:00
adamk@chromium.org
a6ff3f7f4a Handle exceptions thrown by Array.observe machinery 
BUG=chromium:417709
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/651323003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24646 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 18:22:20 +00:00
verwaest@chromium.org
23868b419c Optimize Function.prototype.call 
BUG=
R=verwaest@chromium.org, jarin@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/588573002

Patch from Petka Antonov <p.antonov@partner.samsung.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24631 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-15 12:22:15 +00:00
yangguo@chromium.org
9a21ba499c Catch exceptions thrown when enqueuing change records. 
R=ishell@chromium.org
BUG=chromium:417709
LOG=N

Review URL: https://codereview.chromium.org/653593002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-14 14:46:11 +00:00
ulan@chromium.org
29296d7e50 Fix computation of UTC time from local time at DST change points. 
This also reverts r23606, which was an incorrect fix.

BUG=v8:3116,chromium:417640,chromium:415424
LOG=Y
TEST=mjsunit/regress/regress-3116.js
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/639383002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-09 14:17:33 +00:00
jkummerow@chromium.org
1bb52d0da8 Fix Hydrogen's BuildStore() 
BUG=chromium:417508
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/612423002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24366 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-10-01 13:17:34 +00:00
jarin@chromium.org
5b742b356d Adding more missing deoptimization points in Turbofan. 
BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/595863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-29 13:37:58 +00:00
jarin@chromium.org
b11c925142 Disable merging simulates across captured objects. 
BUG=chromium:416730
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/607453002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 12:16:32 +00:00
yangguo@chromium.org
86b3c3eea7 Insert materialized context at the right place in DebugEvaluate. 
R=aandrey@chromium.org, ulan@chromium.org
BUG=chromium:323936
LOG=N

Review URL: https://codereview.chromium.org/599113002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24218 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 09:33:40 +00:00
jkummerow@chromium.org
1903e560b0 Non-JSArrays must always have holey elements. 
Drive-by cleanup: remove unused elements_kind_ field in CallNew.

BUG=chromium:416558
LOG=n
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/595333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-25 08:25:25 +00:00
mvstanton@chromium.org
b0b59073ac Fix IC cache confusion on String.prototype.length 
BUG=416416
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/587363002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-24 09:33:04 +00:00
jarin@chromium.org
9ef343c18d [Turbofan] Insert nops for lazy bailout patching, fix translation of literals. 
The code for EnsureSpaceForLazyDeopt is taken from lithium-codegen-*.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/562033003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24138 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-23 08:46:18 +00:00
verwaest@chromium.org
83f64e8c1f Fix escaped index JSON parsing 
BUG=416449
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/592813002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24125 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-22 15:21:19 +00:00
mstarzinger@chromium.org
429924b780 Fix typed lowering to number comparison. 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3564
BUG=v8:3564
LOG=N

Review URL: https://codereview.chromium.org/574653002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-16 11:33:30 +00:00
mstarzinger@chromium.org
d313551a3e Disable lowering to StringAdd due to various issues. 
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/566303003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-16 08:29:46 +00:00
yangguo@chromium.org
7cb82a76b4 Reland "Remove V8_HOST_CAN_READ_UNALIGNED and its uses." 
BUG=chromium:412967
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/571903002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23938 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-15 10:54:49 +00:00
jarin@chromium.org
00e90b7e6e Remove deoptimization by patching the call stack. 
We go back to patching the code for lazy deoptimization because ICs need the on-stack return address to read/update the IC address/state.

The change also fixes bunch of tests, mostly by adding more deoptimization points.

(We still need to add code to ensure lazy deopt patching does not overwrite ICs and other lazy deopts; this is coming next.)

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/568783002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23934 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-15 09:21:39 +00:00
jarin@chromium.org
e401262400 Reland "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic." 
This relands commit r23899.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/565093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23910 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 10:58:43 +00:00
jarin@chromium.org
bc0674d0a7 Revert "Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic." 
This reverts commit r23899.

TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/552253003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:49:22 +00:00
jkummerow@chromium.org
b4375b77ec Fix Smi vs. HeapObject confusion in HConstants. 
Representation and HType should agree with each other.

BUG=chromium:412215
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/556563005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23901 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:44:14 +00:00
jarin@chromium.org
91e97f8371 Change the order of arguments of the (One|Two)ByteSeqStringSetChar intrinsic. 
This makes the syntactic order consistent with the evaluation order.

BUG=
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/561133005

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23899 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-12 08:18:29 +00:00
rossberg@chromium.org
fc71f7fdb3 Fix inaccurate type condition in Hydrogen 
R=bmeurer@chromium.org
BUG=chromium:412210
LOG=Y

Review URL: https://codereview.chromium.org/550453003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23873 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 12:13:34 +00:00
jkummerow@chromium.org
bd97fcaed0 Fix regress-crbug-412203.js 
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/563733002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23869 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 11:47:39 +00:00
jkummerow@chromium.org
11f7584d0a Fix ElementsKind handling of prototypes in Array.concat 
Double elements, typed elements, and sloppy arguments elements were all erroneously marked UNREACHABLE.

BUG=chromium:412203
LOG=n
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/560463002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23863 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-11 10:04:13 +00:00
ulan@chromium.org
d66ed1176f Don't inline Array functions if receiver map is not extensible. 
BUG=405517
LOG=N
TEST=mjsunit/regress/regress-crbug-405517.js
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/552333002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 09:22:13 +00:00
ulan@chromium.org
99301fc8c5 Fix regress-411210 after r23824. 
BUG=
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/559863004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 08:48:40 +00:00
hpayer@chromium.org
ed37edc5c0 Remove guard page mechanism from promotion queue. 
BUG=chromium:411210
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/557243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23824 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-10 07:51:29 +00:00
jarin@chromium.org
01d63e43b2 Handle non-object constants in HConstant::GetMonomorphicJSObjectMap. 
R=ulan@chromium.org
BUG=chromium:412162
LOG=N

Review URL: https://codereview.chromium.org/552243002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23803 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 12:58:34 +00:00
jkummerow@chromium.org
fd3e505fb6 Hydrogen: bailout when there is a throw statement in a non-effect context. 
This mirrors the behavior of the compilation pipeline before recent OptimizeFunctionOnNextCall changes.

BUG=chromium:412208
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/558593002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23799 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 12:16:33 +00:00
yangguo@chromium.org
4b0c076052 Turn old space cons strings into regular external strings (not short). 
R=hpayer@chromium.org
BUG=v8:3530
LOG=N

Review URL: https://codereview.chromium.org/368223002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23794 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-09 11:41:56 +00:00
jarin@chromium.org
83af12c21b Harden OptimizeFunctionOnNextCall. 
BUG=411237
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/547553003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23743 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 15:13:44 +00:00
verwaest@chromium.org
1dddf69fdc Allocate a new empty number dictionary when resetting elements 
BUG=410332
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/545773003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23727 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 11:38:22 +00:00
jarin@chromium.org
b74fae5511 Fix EvacuateJSFunction to obtain the target address from the forwarding pointer. 
R=mstarzinger@chromium.org
BUG=410912
LOG=N

Review URL: https://codereview.chromium.org/541353003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23722 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-05 09:38:04 +00:00
titzer@chromium.org
4923810a68 Remove redundant --always-full-compiler flag. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/538613006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23703 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 16:29:47 +00:00
jarin@chromium.org
1afada8d04 Ignore numbers as values of --expose-natives-as flag. 
R=yangguo@chromium.org
BUG=408036
LOG=N

Review URL: https://codereview.chromium.org/534943004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23700 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 15:05:06 +00:00
bmeurer@chromium.org
0baf275e20 Enforce correct number comparisons when inlining Array.indexOf. 
TEST=mjsunit/regress/regress-crbug-407946
BUG=407946
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/536393003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23691 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-04 12:25:57 +00:00
jarin@chromium.org
7572e779d0 Exclude LoadMutableDouble and FunctionBindArguments from fuzzing. 
BUG=409542,410262
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/535153002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23663 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-03 14:28:46 +00:00
verwaest@chromium.org
03b0237e1d Fix loading non-configurable non-writable value from a constant with mismatching type feedback 
BUG=410209
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/534093003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23650 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-03 12:13:46 +00:00
jarin@chromium.org
a668cd6fc8 Context deoptimization and removal of the deoptimization block in Turbofan 
This adds context deoptimization to Turbofan and Crankshaft (also submitted separately as https://codereview.chromium.org/515723004/).

The second patchset removes the deoptimization/continuation block from calls.

BUG=
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/522873002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23547 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-01 09:31:14 +00:00
jarin@chromium.org
73da434b8e Fix manual allocation folding of RegExpConstructResult. 
R=mstarzinger@chromium.org
BUG=409533
LOG=N

Review URL: https://codereview.chromium.org/532453003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23543 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-09-01 08:08:31 +00:00
verwaest@chromium.org
2a37ab79ad Fixed inlining of constant values 
Use CopyToRepresentation to elide HForceRepresentation of HConstant

BUG=v8:3529
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/507613002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23397 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-26 11:34:25 +00:00
yangguo@chromium.org
ba09fa35fd Handle null receiver in sloppy mode in %GetFrameDetails. 
R=jarin@chromium.org
BUG=405922
LOG=N

Review URL: https://codereview.chromium.org/492303006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23312 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-22 12:55:23 +00:00
bmeurer@chromium.org
0142786cea Don't inline Array.shift() if receiver map is not extensible. 
TEST=mjsunit/regress/regress-crbug-405517
BUG=405517
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/491863002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-21 06:23:44 +00:00
yangguo@chromium.org
f7947b8ec4 Fix --expose-debug-as with number as argument. 
R=jkummerow@chromium.org
BUG=405491
LOG=N

Review URL: https://codereview.chromium.org/468803004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-20 11:52:22 +00:00
hpayer@chromium.org
91599ffc6c Do not install fillers when right trimming large objects. 
BUG=
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/487703002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23183 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-19 08:35:39 +00:00
jkummerow@chromium.org
dacca11cb9 Correctly handle holes when concat()ing double arrays 
BUG=chromium:403409
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/468863003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-18 08:51:35 +00:00
dslomov@chromium.org
eebb61a3f9 Fix OrderedHashTabelIterator accessors. 
They might be undefined for uninitialized iterators.
The rest of the code is ready for this eventuality.

R=arv@chromium.org, adamk@chromium.org
BUG=403292
LOG=N

Review URL: https://codereview.chromium.org/468813003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23126 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-14 10:24:19 +00:00
yangguo@chromium.org
413b20b6c1 Make %DebugPushPromise more robust wrt fuzzing. 
If %DebugPushPromise and throwing is called outside its intended context,
we may encounter assertion failures.

R=hpayer@chromium.org
BUG=401915
LOG=N

Review URL: https://codereview.chromium.org/453933002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-11 07:59:10 +00:00
adamk@chromium.org
bcf8b05072 Enable ES6 Map and Set by default 
In doing so also remove all references to the --harmony-collections flag.
Due to the way context snapshotting works, it's not possible to simply
enable the flag by default.

Depends on ES6 Symbols: https://codereview.chromium.org/421313004

BUG=v8:1622
LOG=Y
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/427723002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22889 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-05 19:37:32 +00:00
adamk@chromium.org
d8c30bd8e7 Enable ES6 Symbols by default 
In doing so also remove all references to the --harmony-symbols flag.
Due to the way context snapshotting works, it's not possible to simply enable
the flag by default.

BUG=v8:2158
LOG=Y
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/421313004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22831 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-08-04 18:17:54 +00:00
mstarzinger@chromium.org
57c315d0b3 Fix handling of potential string additions in hydrogen. 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3476
BUG=v8:3476
LOG=N

Review URL: https://codereview.chromium.org/423083004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22677 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-29 14:53:11 +00:00
verwaest@chromium.org
f08d2690c6 Fix Object.freeze with field type tracking. 
Keep the descriptor properly intact while update the field type.

BUG=v8:3458
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/424093002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22671 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-29 13:30:29 +00:00
mvstanton@chromium.org
6980c4277c CallIC customization stubs must accept that a vector slot is cleared. 
The CallIC Array custom IC stub read from the type vector, expecting
to get an AllocationSite. But there are paths in the system where a
type vector can be re-created with default values, even though we
currently grant an exception to clearing of vector slots with
AllocationSites in them at gc time.

BUG=392114
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/418023002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22668 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-29 11:53:30 +00:00
danno@chromium.org
afcfa7d2b7 Keep new arrays allocated with 'new Array(N)' in fast mode (revisited) 
Also explicit length setting with a.length = N should remain in fast mode.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/416403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22645 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-28 13:12:26 +00:00
verwaest@chromium.org
60df9dabad In GrowMode, force the value to the right representation to avoid deopts between storing the length and storing the value. 
BUG=16459193
LOG=n
R=danno@chromium.org

Review URL: https://codereview.chromium.org/419683004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22616 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-25 11:48:25 +00:00
verwaest@chromium.org
77a37e44f6 Fix issue with setters and their holders in accessors.cc 
BUG=3462
LOG=Y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/417793002

Patch from Erik Arvidsson <arv@chromium.org>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22606 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-24 16:42:54 +00:00
danno@chromium.org
b5a5148260 Revert 22595: "Keep new arrays allocated with 'new Array(N)' in fast mode" 
Due to failures in mjsunit/array-functions-prototype-misc

TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/417953004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22601 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-24 13:38:05 +00:00
danno@chromium.org
ac89b17813 Keep new arrays allocated with 'new Array(N)' in fast mode 
Also explicit length setting with a.length = N should remain in fast mode.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/397593008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22595 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-24 12:08:23 +00:00
verwaest@chromium.org
6798779031 Fix ArrayLengthSetter to not throw on non-extensible receivers. 
BUG=v8:3460
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/411983003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22576 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-23 20:27:32 +00:00
danno@chromium.org
1d2a4b8333 Remove experimental flags that are now required 
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/397253002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22461 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-18 07:17:21 +00:00
rodolph.perfetta@arm.com
56ec59bd26 ARM64: always restore regexp register cache after a C function call. 
BUG=v8:3444
TEST=mjsunit/regress/regress-regexp-nocase.js
LOG=N
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/392403002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-17 09:55:48 +00:00
yangguo@chromium.org
49ae3081d2 Error.captureStackTrace should define "stack" property as configurable. 
R=verwaest@chromium.org
BUG=393988
LOG=N

Review URL: https://codereview.chromium.org/396063008

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22420 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-16 07:55:05 +00:00
verwaest@chromium.org
1d55a634a9 Replace AddProperty by AddNamedProperty to speed up the common case 
BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/384003003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-14 14:05:30 +00:00
verwaest@chromium.org
aa7198dfdd This CL simplifies var / const by ensuring the behavior is consistent in itself, and with regular JS semantics; between regular var/const and eval-ed var/const. 
Legacy const is changed so that a declaration declares a configurable, but non-writable, slot, and the initializer reconfigures it (when possible) to non-configurable non-writable. This avoids the need for "the hole" as marker value in JSContextExtensionObjects and GlobalObjects. Undefined is used instead.

BUG=
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/379893002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22379 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-14 14:01:04 +00:00
jarin@chromium.org
457de26330 Fix arm64 deoptimization from double registers (reverts r20613). 
This reverts "ARM64: Use pair memory access in deoptimizer entry", r20613. It does not really make sense to micro-optimize the deoptimizer as it is the ultra-slow path. Moreover, the original code was easier to read (in addition to being correct).

BUG=391313
LOG=N
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/389583003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22360 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-11 19:30:09 +00:00
mstarzinger@chromium.org
50beec9738 Follow-up to a pre-existing regression test. 
R=yangguo@chromium.org
BUG=v8:1530,v8:1872
TEST=mjsunit/regress/regress-1530
LOG=N

Review URL: https://codereview.chromium.org/378233006

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22295 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-09 10:23:58 +00:00
verwaest@chromium.org
ad6202d989 Fix computed properties on object literals with a double as propertyname. 
BUG=390732
LOG=y
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/371973002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-07 17:08:54 +00:00
yangguo@chromium.org
a0c10d119a Revert "Turn old space cons strings into regular external strings (not short)." 
This reverts commits r22192 and r22194.

TBR=hpayer@chromium.org

Review URL: https://codereview.chromium.org/367113003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22195 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-03 12:24:41 +00:00
yangguo@chromium.org
6574f33d2a Turn old space cons strings into regular external strings (not short). 
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/368223002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22192 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-03 11:46:31 +00:00
ishell@chromium.org
2fba190240 One of the fast cases in JSObject::MigrateFastToFast() should not be taken if the number of fields did not change. 
BUG=chromium:390918
LOG=N
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/363073002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-02 19:10:19 +00:00
yangguo@chromium.org
f353ff668a Harden Runtime_LiveEditCheckAndDropActivations against unsafe args. 
R=jarin@chromium.org
BUG=390925
LOG=N

Review URL: https://codereview.chromium.org/362983004

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2014-07-02 15:09:44 +00:00