AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
11,380 Commits 1 Branch 0 Tags 839 MiB
1a4482ab3f
Commit Graph

2060 Commits

Author SHA1 Message Date
ulan@chromium.org
74839e86d7 Modifications to tests and test tools for Native Client V8. 
BUG=2614

Review URL: https://chromiumcodereview.appspot.com/13638013
Patch from Brad Chen <bradchen@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14178 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 08:39:01 +00:00
yangguo@chromium.org
fe6fc554b0 Fix slow path of JSON.stringifier when GC strikes. 
FlatContent is not GC-safe.

R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13782002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14175 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 08:12:59 +00:00
verwaest@chromium.org
c569d31ff5 Adding standard-compliance tests for array functions. 
BUG=v8:2615

Review URL: https://chromiumcodereview.appspot.com/13601009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14174 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 08:09:52 +00:00
verwaest@chromium.org
98d8c9e452 Always check global property cells for readonliness before storing. 
Add check when the global object is the last in the chain.

Review URL: https://chromiumcodereview.appspot.com/13730002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14173 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-09 08:09:05 +00:00
yangguo@chromium.org
9559181b0e Fix worst-case behavior of MergeRemovableSimulates(). 
Currently, when a long series of removable simulates are merged, we do
this by merging them one by one as we find them.  As we merge the value
value lists of the simulates, those lists snowball so that we get a
quadratic complexity wrt runtime and memory consumption.

Instead, we gather simulates that need to be merged, and merge them
backwards starting from the last simulate.

R=jkummerow@chromium.org
BUG=v8:2612

Review URL: https://chromiumcodereview.appspot.com/13649003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14169 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-08 17:37:22 +00:00
yangguo@chromium.org
e33b68817b Fix Array.prototype.concat when exceeding array size limit. 
R=verwaest@chromium.org
BUG=v8:581

Review URL: https://chromiumcodereview.appspot.com/13465008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-05 15:12:59 +00:00
mstarzinger@chromium.org
b6efbd79de Force context allocation for variables in generator scopes. 
* src/scopes.h (ForceContextAllocation, has_forced_context_allocation):
  New interface to force context allocation for an entire function's
  scope.

* src/scopes.cc: Unless a new scope is a function scope, if its outer
  scope has forced context allocation, it should also force context
  allocation.
  (MustAllocateInContext): Return true if the scope as a whole has
  forced context allocation.
  (CollectStackAndContextLocals): Allow temporaries to be
  context-allocated.

* src/parser.cc (ParseFunctionLiteral): Force context allocation for
  generator scopes.

* src/v8globals.h (VariableMode): Update comment on TEMPORARY.

* src/arm/full-codegen-arm.cc (Generate):
* src/ia32/full-codegen-ia32.cc (Generate):
* src/x64/full-codegen-x64.cc (Generate): Assert that generators have no
  stack slots.

* test/mjsunit/harmony/generators-instantiation.js: New test.

BUG=v8:2355
TEST=mjsunit/harmony/generators-instantiation

Review URL: https://codereview.chromium.org/13408005
Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14152 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-05 13:19:31 +00:00
yangguo@chromium.org
deecbb2e01 Do not implicitly convert non-object receivers for strict mode functions. 
This was still the case for Array.prototype.* builtin functions.

R=rossberg@chromium.org
BUG=v8:2273

Review URL: https://chromiumcodereview.appspot.com/13473009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-05 11:57:02 +00:00
mstarzinger@chromium.org
48635f7d58 Fix minor typo in generator parsing test. 
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/13575010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14148 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-05 08:38:40 +00:00
mstarzinger@chromium.org
9fd5eb52d4 Skip long running regression test from r14078. 
R=yangguo@chromium.org
BUG=chromium:217858
TEST=mjsunit/regress/regress-crbug-217858

Review URL: https://codereview.chromium.org/13640004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14141 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 14:46:18 +00:00
mstarzinger@chromium.org
9e757a604c Make __proto__ a real JavaScript accessor property. 
This turns the __proto__ callback from a foreign callback into a real
JavaScript accessor. It makes the accessor behavior of this property
explicit.

R=rossberg@chromium.org
BUG=v8:1949,v8:2606
TEST=mjsunit/regress/regress-2606

Review URL: https://codereview.chromium.org/13533004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14139 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 12:10:23 +00:00
dslomov@chromium.org
370caca72c Test behavior of qNaN and sNaN 
BUG=v8:2607

Review URL: https://codereview.chromium.org/13470002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14133 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 09:31:24 +00:00
ulan@chromium.org
eee5884f8d Add extra flag for load-ic stubs in code cache. 
This allows to distinguish between stubs compiled for the current object from
stubs compiled for objects that have the current object as a prototype.

BUG=v8:2593
R=verwaest@chromium.org

Review URL: https://chromiumcodereview.appspot.com/13552003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14132 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-04 08:29:25 +00:00
rossberg@chromium.org
b449691db2 ES6 symbols: fix corner cases of equality operators 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13552002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 17:06:22 +00:00
dslomov@chromium.org
a172a5e839 Remove (H|L)JSArrayLength instructions 
BUG=

Review URL: https://codereview.chromium.org/12491023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14127 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 16:25:24 +00:00
danno@chromium.org
98281c62f0 Ensure UseRegisterAtStart not used with fixed temp/return register 
R=vegorov@chromium.org
BUG=chromium:201590

Review URL: https://codereview.chromium.org/13527007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14124 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-03 14:45:39 +00:00
mstarzinger@chromium.org
2816f19680 Add parser support for generators. 
This patchset begins by adding support for "yield", which is unlike other tokens
in JS. In a generator, whether strict or classic, it is a syntactic keyword.
In classic mode it is an identifier. In strict mode it is reserved.

This patch adds YIELD as a token to the scanner, and adapts the preparser and
parser appropriately. It also parses "function*", indicating that a function is
actually a generator, for both eagerly and lazily parsed functions.

Currently "yield" just compiles as "return".

BUG=v8:2355
TEST=mjsunit/harmony/generators-parsing

Review URL: https://codereview.chromium.org/12646003
Patch from Andy Wingo <wingo@igalia.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14116 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-04-02 17:34:59 +00:00
yangguo@chromium.org
443f85eed9 Add test to check that Function.caller must not expose native functions. 
R=svenpanne@chromium.org
BUG=v8:105

Review URL: https://chromiumcodereview.appspot.com/13166002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14096 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 14:31:48 +00:00
yangguo@chromium.org
a3f0f942a3 Always allocate symbols in old space. 
Keys are expected to be tenured. This now not only includes internalized
strings, but also symbols.

R=rossberg@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13158002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14095 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 13:52:31 +00:00
dslomov@chromium.org
47d8af7616 Canonicalize NaNs on store to Fast(Float|Double) arrays 
Also treat holey NaN coming from external float/double arrays correctly

BUG=2596

Review URL: https://codereview.chromium.org/12918028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14094 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 13:30:16 +00:00
dslomov@chromium.org
944c577c7b First steps towards implementing ArrayBuffer &co in V8 
BUG=

Review URL: https://codereview.chromium.org/13064003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 12:50:18 +00:00
rossberg@chromium.org
15ab3a0612 ES6 symbols: symbol properties should not cause going into slow mode. 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13042013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 12:01:46 +00:00
yangguo@chromium.org
9155d20282 Stack trace API: poison stack frames below the first strict mode frame. 
Function and receiver objects are not accessible for poisoned frames.

R=rossberg@chromium.org
BUG=v8:2564

Review URL: https://chromiumcodereview.appspot.com/13150003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14085 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-28 10:40:07 +00:00
yangguo@chromium.org
a942fcd984 Add test case for missing deopt sequence after forced deopt. 
R=danno@chromium.org
BUG=217858

Review URL: https://chromiumcodereview.appspot.com/13042005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14078 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-27 09:58:32 +00:00
yangguo@chromium.org
bb632dc49d Only copy with, block and catch scopes in DebugEvaluate. 
R=ulan@chromium.org
BUG=171715

Review URL: https://chromiumcodereview.appspot.com/13093003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14077 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-26 17:46:16 +00:00
danno@chromium.org
c3486bc4eb Remove bogus test flags 
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/12872007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14072 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 17:59:15 +00:00
danno@chromium.org
dfd9ea8087 Fix store_mode bug involving polymorphism with external and JS arrays. 
Review URL: https://codereview.chromium.org/12987014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14064 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 15:19:22 +00:00
verwaest@chromium.org
a8b3215afa Change LookupForWrite to always do a full lookup and check the result. 
If we find a property in the prototype-chain that we can overwrite, and
we have a transition, keep the holder in the lookup-result as the actual
holder. We will need it for the consistency-check in GenerateStoreField.

By directly checking the entire chain we avoid having to lazily bail out
to a copy of the miss stub while generating the Field Store IC.

Currently this CL disallows a normal non-receiver holder, given that
that would require a positive lookup + details verification to ensure
the property did not become read-only. This fixes the regressions in the
attached tests.

Review URL: https://chromiumcodereview.appspot.com/12810006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14061 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 12:55:27 +00:00
yangguo@chromium.org
b347a0dcae Correctly materialize arguments object in Runtime_DebugEvaluate. 
The problem was that if the # arguments specified in the function
declaration and the # arguments passed to the function are not
the same, we use an arguments adapter frame to make it work. This
confuses the existing implementation to materialize the arguments
object.

R=peter.rybin@gmail.com
BUG=222893

Review URL: https://chromiumcodereview.appspot.com/12674027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14059 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-25 10:01:53 +00:00
adamk@chromium.org
9bebd23d5c Fix %GetArrayKeys to not skip non-enumerable indices 
This is one step in the direction of fixing a range of small bugs in the array methods when dealing with non-standard element attributes.

Added tests exercising this behavior for shift and unshift.

For Proxies and Interceptors, the behavior of %GetArrayKeys is now to just return an interval, rather than trying to list all their indexed properties. In the Proxy case, this seems like the only way to avoid an observable difference between smart and non-smart array methods. For Interceptors, the usual case (in WebKit, anyway) is for them to have all indices in [0, length), so enumerating them won't be any better than simply iterating over that range.

Review URL: https://codereview.chromium.org/12653010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14057 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 18:04:32 +00:00
rossberg@chromium.org
52aec4722d ES6 symbols: prevent reflection, proxy, and observe APIs from leaking symbols 
R=svenpanne@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12422019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14056 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 17:27:44 +00:00
rossberg@chromium.org
2657e432e4 ES6 symbols: implement name property 
Adds string-valued name property to symbols, and uses it for pretty-printing.

Requires allocating symbols in pointer space, with a custom iterator to skip the unboxed hash.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12459026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14053 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 16:51:28 +00:00
rossberg@chromium.org
83d4a41dec ES6 symbols: turn symbols into a proper primitive type 
(qua last week's TC39)

Specifically:
- Install Symbol constructor function on the global object.
- Adjust code generation for typeof.
- Remove IsSymbol built-in, IS_SYMBOL macro now defined using typeof.
- Remove hack that allowed symbols as constructor results, and some other special cases.
- Remove symbol_delegate and GetDelegate function.
- Extend ToBoolean stub to handle symbols.
- Extend ToNumber to return NaN on symbols.
- Poison symbol's toString function, and thereby ToString on symbols.

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12957004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 16:33:50 +00:00
adamk@chromium.org
51a888ff48 Fix bogus left-shifts in Array tests 
Review URL: https://codereview.chromium.org/12729014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14050 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 15:08:30 +00:00
yangguo@chromium.org
27b0979347 Restore correct regression test for crbug/146910. 
For some reason (rebase conflicts?) the regression test introduced
in r12547 was overwritten by r13340.

The test in question already exists in regress-latin-1

R=dcarney@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/13023003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14043 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 09:04:36 +00:00
yangguo@chromium.org
006b1a88a0 Fix JSON.stringifier's slow path wrt external strings. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12825016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14042 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-22 08:42:38 +00:00
yangguo@chromium.org
5fcc52fcb9 Simplify debug evaluate. 
R=peter.rybin@gmail.com
BUG=v8:2585, 173608

Review URL: https://chromiumcodereview.appspot.com/12953002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14019 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-21 08:50:29 +00:00
yangguo@chromium.org
b522319a98 Extend test coverage for JSON.stringify's slow path. 
R=verwaest@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12702009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14008 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-20 14:07:30 +00:00
danno@chromium.org
ffd0c712e8 Implement many KeyedStoreStubs using Crankshaft 
- Addition of a compiled hydrogen stub for KeyedStores.
- Inlining of "grow" stubs into OPTIMIZED_FUNCTIONs
- Addition of new "ignore OOB" ic stub that silently swallows out-of-bounds stores to external typed arrays.
- Addition of new "copy-on-write" ic stub that inlines allocation and copying operations for cow array
- New stub are generated with Crankshaft, so they are automatically inlined into OPTIMIZED_FUNCTIONs

Review URL: https://codereview.chromium.org/12221064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14001 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-20 10:37:13 +00:00
verwaest@chromium.org
002ba9c76d Turn Flags into a uint32_t typedef. 
We cannot rely on C++ compilers inferring the int-type from the enum
value range. Whereas Linux/OSX find uint32_t as type for [0,MaxUInt32],
Windows insists it's int.

Update the test to execute its original intent on all platforms: 1 value
larger than max arguments, 1 smaller than max arguments (on all
platforms). This makes the test run a lot faster.

BUG=chromium:194749

Review URL: https://chromiumcodereview.appspot.com/12507010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13988 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-19 13:11:49 +00:00
verwaest@chromium.org
010f36f94b Raise the limit since it is 2**16 (65536) on x64. 
Review URL: https://chromiumcodereview.appspot.com/12700012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13973 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 15:49:33 +00:00
jkummerow@chromium.org
e2cd7aa423 Fix detection of |handle_smi| case in HOptimizedGraphBuilder::HandlePolymorphicCallNamed 
BUG=chromium:196583

Review URL: https://codereview.chromium.org/12620014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13963 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 12:41:52 +00:00
mmassi@chromium.org
73e83b0b0f Handling expression decomposition and array bounds check hoisting: working code with lots of debugging PrintFs, postdominance check still missing. 
Review URL: https://codereview.chromium.org/12377072

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13961 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-18 08:06:00 +00:00
mstarzinger@chromium.org
9aa25ad1a0 Allow inlining of functions containing function literals. 
R=yangguo@chromium.org
BUG=v8:1322
TEST=mjsunit/compiler/inline-literals

Review URL: https://codereview.chromium.org/10702036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13945 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-14 14:29:10 +00:00
adamk@chromium.org
004452bff9 Use InternalArray in Object.getOwnPropertyNames() implementation 
Review URL: https://codereview.chromium.org/12342003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13918 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 20:15:03 +00:00
yangguo@chromium.org
479e39a058 Parallel recompilation: remove interrupt for code generation. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12488006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 18:03:18 +00:00
yangguo@chromium.org
173d9e8f4a Correctly override parallel recompilation flag for test case. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12655006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13915 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-12 17:33:51 +00:00
yangguo@chromium.org
b85237a0bc Fix white space matching in latin-1 strings wrt \u00a0. 
R=dcarney@chromium.org
BUG=181422

Review URL: https://chromiumcodereview.appspot.com/12644008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13898 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 11:52:11 +00:00
svenpanne@chromium.org
e44d3b7a87 Fixed register allocation corner case. 
The predicate CanBeSpilled had a bug, prohibiting the necessary spilling and
correct splitting of live ranges. Removed a redundant assertion immediately done
by the callee anyway.

Thanks to Slava for help with that issue and the entertaining historical
background of the whole story... ;-)

BUG=177883

Review URL: https://codereview.chromium.org/12631012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13891 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-11 09:49:00 +00:00
mstarzinger@chromium.org
d70523dce6 Restore Function()'s expected string representation. 
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470

Review URL: https://codereview.chromium.org/12687002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13880 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-08 11:47:20 +00:00
mstarzinger@chromium.org
4b0395cc23 Harden Function()'s parsing of function literals. 
R=rossberg@chromium.org
BUG=v8:2470
TEST=mjsunit/regress/regress-2470

Review URL: https://codereview.chromium.org/12613007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13867 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 15:46:14 +00:00
rossberg@chromium.org
accbbd2c10 ES6 symbols: refine test for getOwnPropertyNames 
R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12432005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13866 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 15:43:47 +00:00
yangguo@chromium.org
3a497dfd51 Insert missing type cast in JSON.stringify. 
R=dcarney@chromium.org
BUG=v8:2570

Review URL: https://chromiumcodereview.appspot.com/12599003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13853 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-07 09:58:27 +00:00
danno@chromium.org
bbc599f334 Unify grow mode and stub kind 
In the process, ensure that transition-causing element stores handle all cases of the transitioned receiver map.

Review URL: https://codereview.chromium.org/12390031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13850 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-06 21:51:07 +00:00
yangguo@chromium.org
a62cfd1db0 Fix Array.length, String.length and Function.prototype LoadICs on x64. 
R=jkummerow@chromium.org
BUG=v8:2568

Review URL: https://chromiumcodereview.appspot.com/12545004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13847 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-06 18:19:35 +00:00
rossberg@chromium.org
bdc65b3e1e ES6 symbols: filter symbols form for-in loops and Object.keys 
R=verwaest@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12455002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13838 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-06 13:55:21 +00:00
rossberg@chromium.org
29e6b4437f ES6 symbols: enable symbols as weak map keys 
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12456004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13829 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 17:24:08 +00:00
adamk@chromium.org
7fe9bd5a09 Properly handle misses for StoreArrayLengthStub on ia32 and x64 
Both failed to generate a miss if the key wasn't "length".
ARM and MIPS were already correct.

BUG=v8:2566

Review URL: https://codereview.chromium.org/12378085

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13828 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 16:31:11 +00:00
yangguo@chromium.org
03375a68d7 Details wrt parallel recompilation. 
This includes:
- actually release handles kept by compilation info when compilation completes.
- do not use parallel recompilation on single core CPUs.
- artificially delay parallel recompilation for debugging.
- fix outdated assertions wrt optimization status.
- add "parallel" option to %OptimizeFunctionOnNextCall.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12442002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13827 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 16:22:08 +00:00
ulan@chromium.org
be2b1a980f Improve integer division on ARM in favor of power of 2 constant divisor 
BUG=none
TEST=none

Review URL: https://chromiumcodereview.appspot.com/12052032
Patch from Rajeev R Krithivasan <rkrithiv@codeaurora.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13819 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-05 08:47:59 +00:00
mstarzinger@chromium.org
2aabf6257d Add workaround for redefinition of __proto__ property. 
This is a temporary workaround when the __proto__ property is being
redefined (e.g. by Object.freeze()) to not loose the foreign callback.
Once the __proto__ property is a real JavaScript accessor this hack is
no longer necessary. This change also makes __proto__ configurable.

R=rossberg@chromium.org
BUG=v8:2565
TEST=mjsunit/regress/regress-2565

Review URL: https://codereview.chromium.org/12398010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13817 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 17:53:40 +00:00
rossberg@chromium.org
5c93b18eb2 ES6 symbols: Allow symbols as property names 
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).

Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.

(Baseline CL: https://codereview.chromium.org/12296026/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12330012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-04 15:00:57 +00:00
mvstanton@chromium.org
c4caf766bf Allocation Info Tracking, continued. 
Addresses missing cases for array literals.
Adds support for "new Array()" call sites. This isn't complete yet, I have to run with --noinline_new.

BUG=

Review URL: https://codereview.chromium.org/11818021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13790 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 16:06:34 +00:00
yangguo@chromium.org
358311e8ec Limit EatAtLeast recursion by a budget. 
BUG=178790

Review URL: https://chromiumcodereview.appspot.com/12380026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13788 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 14:50:14 +00:00
rossberg@chromium.org
090d09d685 ES6 symbols: Implement Symbol intrinsic and basic functionality 
- Add --harmony-symbols flag.
- Add Symbol constructor; allow symbols as (unreplaced) return value from constructors.
- Introduce %CreateSymbol and %_IsSymbol natives and respective instructions.
- Extend 'typeof' code generation to handle symbols.
- Extend CompareIC with a UNIQUE_NAMES state that (uniformly) handles internalized strings and symbols.
- Property lookup delegates to SymbolDelegate object for symbols, which only carries the toString method.
- Extend Object.prototype.toString to recognise symbols.

Per the current draft spec, symbols are actually pseudo objects that are frozen with a null prototype and only one property (toString). For simplicity, we do not treat them as proper objects for now, although typeof will return "object". Only property access works as if they were (frozen) objects (via the internal delegate object).

(Baseline CL: https://codereview.chromium.org/12223071/)

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12296026

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-03-01 13:28:55 +00:00
yangguo@chromium.org
5c264ade8e Fix wrong test in r13766 (Insert conversion to string in string.replace). 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12315130

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13770 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 15:36:02 +00:00
yangguo@chromium.org
6e64bdfc6e Insert conversion to string in string.replace. 
(missing since r13761)

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12316158

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 15:12:30 +00:00
yangguo@chromium.org
2a3063a7c3 Handle negative input in inlined Math.round on Intel CPUs. 
R=jkummerow@chromium.org
BUG=v8:2451

Review URL: https://chromiumcodereview.appspot.com/12342037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13764 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 14:44:57 +00:00
mstarzinger@chromium.org
ea5e9edac4 Fix materialization of arguments objects with unknown values. 
This fixes the deoptimizer to materialize arguments objects of correct
length even in cases where the actual argument values are unknown and
were optimized away by Crankshaft. This can happen if only the length
property or the identity of an arguments object is used.

R=svenpanne@chromium.org
BUG=chromium:163530
TEST=mjsunit/regress/regress-crbug-163530

Review URL: https://codereview.chromium.org/12335132

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13763 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 14:37:51 +00:00
yangguo@chromium.org
4cbe7100e6 Refactor implementation for String.prototype.replace. 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12177015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 14:14:45 +00:00
ulan@chromium.org
211f4a7be0 Disable regress-crbug-160010 for Android because it triggers OOM. 
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12314150

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13753 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 12:14:21 +00:00
jkummerow@chromium.org
732a2af96a Clean up mjsunit/array-bounds-check-removal 
Review URL: https://codereview.chromium.org/12317142

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 10:50:37 +00:00
ulan@chromium.org
87265114c4 Emit VMLS for multiply-subtract on ARM. 
BUG=none

Review URL: https://chromiumcodereview.appspot.com/12319113
Patch from Hans Wennborg <hans@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13748 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-27 10:24:40 +00:00
dcarney@chromium.org
52a015b1af Fix overflow in WriteQuoteJsonString and SlowQuoteJsonString 
R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/12326120

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13730 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-26 11:02:39 +00:00
mstarzinger@chromium.org
ce1e10f5fc Make __proto__ a foreign callback on Object.prototype. 
This moves the __proto__ property to Object.prototype and turns it into
a callback property actually present in the descriptor array as opposed
to a hack in the properties lookup. For now it still is a "magic" data
property using foreign callbacks and not an accessor property visible to
JavaScript.

The second effect of this change is that JSON.parse() no longer treats
the __proto__ property specially, it will be defined as any other data
property. Note that object literals still have their special handling.

R=rossberg@chromium.org
BUG=v8:621,v8:1949,v8:2441
TEST=mjsunit,cctest,test262

Review URL: https://codereview.chromium.org/12212011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13728 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-26 10:46:00 +00:00
yangguo@chromium.org
0d63cef35b Constant fold math and string operations. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12315005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13705 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-21 11:40:37 +00:00
mstarzinger@chromium.org
300413b5a9 Fix f.apply() optimization when declared arguments are mutated. 
R=verwaest@chromium.org
BUG=v8:2539
TEST=mjsunit/regress/regress-2539

Review URL: https://codereview.chromium.org/12255033

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13673 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-14 15:12:49 +00:00
mstarzinger@chromium.org
05e95eee0e Allow full inlining of f.apply(this, arguments) calls. 
This allows Crankshaft to completely inline a f.apply() dispatch if the
exact number of arguments is known and the function is constant. The
deoptimizer doesn't generate the f.apply() frame during deoptimization,
so the materialized frames look like f.apply() did a tailcall.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-function-apply

Review URL: https://codereview.chromium.org/12263004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13665 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-14 09:55:50 +00:00
jkummerow@chromium.org
19dab057b4 Fix NegateCompareOp and InvertCompareOp 
BUG=v8:2537

Review URL: https://codereview.chromium.org/12217136

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13658 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-13 14:36:19 +00:00
jkummerow@chromium.org
b09cc0be50 Adjust the stack-size value for big-array-literal.js 
Review URL: https://codereview.chromium.org/12114002
Patch from Haitao Feng <haitao.feng@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13623 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-07 15:45:47 +00:00
jkummerow@chromium.org
e83ff197bf Add regression test for r13617 
Many thanks to Vyacheslav Egorov for coming up with this test!

BUG=173907

Review URL: https://codereview.chromium.org/12212066

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13622 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-07 15:38:24 +00:00
mstarzinger@chromium.org
79607d20e6 Make the GC stress builder go green. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/12218034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13608 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-06 13:21:28 +00:00
adamk@chromium.org
dbf50cf948 Object.observe: change array truncation logic to efficiently handle large sparse arrays 
Review URL: https://codereview.chromium.org/12041084

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13592 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-04 21:03:08 +00:00
verwaest@chromium.org
aca87c2fcd Tag stubs that rely on instance types as MEGAMORPHIC. 
BUG=chromium:173974

Review URL: https://chromiumcodereview.appspot.com/12178017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13586 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-04 13:12:03 +00:00
danno@chromium.org
0c3575c874 Generate the TransitionElementsStub using Crankshaft 
This includes:
* Adding support for saving callee-clobbered double registers in Crankshaft code.
* Adding a new "HTrapAllocationMemento" hydrogen instruction to handle AllocationSiteInfo data in crankshafted stubs.
* Adding a new "HAllocate" hydrogen instruction that can allocate raw memory from the GC in crankshafted code.
* Support for manipulation of the hole in HChange instructions for Crankshafted stubs.
* Utility routines to manually build loops and if statements containing hydrogen code.

Review URL: https://codereview.chromium.org/11659022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13585 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-02-04 12:01:59 +00:00
adamk@chromium.org
c001d928df Object.observe: don't unnecessarily emit oldValue for reconfigurations of data properties 
When a data property has its attributes changed but its value remains the same,
don't emit an oldValue. This makes the API more consistent by only emitting
oldValue when the value of a property has actually changed (or been removed,
in the case of a reconfiguration as an accessor property or a deletion).

Review URL: https://codereview.chromium.org/11820004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13565 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-30 21:07:28 +00:00
yangguo@chromium.org
c5883d442e Add option to limit tick processor to a time range. 
R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/12077043

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13541 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-29 14:41:02 +00:00
verwaest@chromium.org
c8636a2809 Do not try to collect the map if the monomorphic IC stub has no map. 
This is necessary for monomorphic stubs that rely on instance types,
such as ArrayLength, StringLength and FunctionPrototype.

BUG=chromium:172345

Review URL: https://chromiumcodereview.appspot.com/12082023

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13526 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-28 13:19:53 +00:00
mstarzinger@chromium.org
fe8e97798e Allow inlining of multiple closures from shared function. 
This allows Crankshaft to allow inlining of multiple different closures
that were all derived from the same shared function info. This pattern
appears when libraries provide generic closures that are used over and
over again at different call-sites.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/inline-closures

Review URL: https://codereview.chromium.org/12071002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13522 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-25 16:55:00 +00:00
yangguo@chromium.org
24ec13cbd2 Fix additional spec violations wrt RegExp.lastIndex. 
R=svenpanne@chromium.org
BUG=v8:2437

Review URL: https://chromiumcodereview.appspot.com/12033099

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13504 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-25 10:53:26 +00:00
mstarzinger@chromium.org
44ffa0dcd3 Allow monomorphic loads when static type is known. 
This allows Crankshaft to generate monomorphic loads when the receiver
type is statically known even though the load site has polymorphic type
feedback. This applies to inlined constructor calls and literals.

R=jkummerow@chromium.org
TEST=mjsunit/compiler/property-static

Review URL: https://codereview.chromium.org/12051058

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13500 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-24 17:54:30 +00:00
ulan@chromium.org
e6224d275f Make embedded maps in optimized code weak. 
Each map has a weak array of dependent codes, where the map tracks all the optimized codes that embed it.
Old space GC either clears the dead dependent codes from the array if the corresponding map is alive or deoptimizes the live dependent codes if the map is dead.

BUG=v8:2073
R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11575007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13490 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-24 11:55:05 +00:00
ulan@chromium.org
d29826544e Correctly set kCanBeDivByZero flag for HMathFloorOfDiv. 
After r13289 the divisor can be non-constant, so we should check for zero.

BUG=171641
R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047050

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13479 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-23 15:58:49 +00:00
yangguo@chromium.org
9296975c04 Correctly reset lastIndex in an RegExp object. 
R=svenpanne@chromium.org
BUG=170856

Review URL: https://chromiumcodereview.appspot.com/11896060

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13471 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-23 12:28:16 +00:00
ulan@chromium.org
79a0e3b017 Fix pattern detection for replacing shifts by rotation. 
BUG=2499
R=svenpanne@chromium.org

Review URL: https://chromiumcodereview.appspot.com/12047015
Patch from Hirofumi Mako <mkhrfm@gmail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13464 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-22 13:55:22 +00:00
mstarzinger@chromium.org
f8d5260af7 Allow loading constant function from proto chain. 
This enables Crankshaft to use HConstant for loading constant functions
on the prototype chain when building a monomorphic load. This pattern
appears in several JavaScript frameworks.

R=svenpanne@chromium.org
TEST=mjsunit/compiler/proto-chain-constant

Review URL: https://codereview.chromium.org/12052008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13463 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-22 12:03:35 +00:00
mvstanton@chromium.org
90d0f18007 Incorrect ARM assembly in MacroAssembler::TestJSArrayForAllocationSiteInfo 
Restored test code in allocation-site-info.js that was failing on ARM because of this bug.

BUG=

Review URL: https://codereview.chromium.org/12045017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13462 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-22 10:49:23 +00:00
mvstanton@chromium.org
c3746b4388 allocation-site-info.js broken on arm with new changes. Reverting to previous version until diagnosed. 
Regress-2185.js test takes too long on slow path when allocation site info is discovered.

BUG=

Review URL: https://codereview.chromium.org/12049003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13456 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 16:15:08 +00:00
yangguo@chromium.org
0c822b21cb Fix some latin-1 webkit units tests 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11962035
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13455 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 16:11:31 +00:00
yangguo@chromium.org
7f331f6280 Make HCheckPrototypeMaps compatible with parallel recompilation. 
HCheckPrototypeMaps currently records the prototype and the holder of the
prototype chain (both ends of the chain) and assumes that the chain elements
and their maps did not change in during the entirety of Crankshaft. The actual
traversal of the prototype chain happens in Lithium at code generation.
With parallel compilation, this assumption is not longer correct.

R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11864013

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13454 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 15:49:00 +00:00
mvstanton@chromium.org
3414a514cd Fixed test failure. 
A test case erroneously expected a transition to a double array, but the array remains FAST_SMI.

In person LGTM from Danno...
BUG=

Review URL: https://codereview.chromium.org/12038008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13447 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 13:21:53 +00:00
mvstanton@chromium.org
d7d917e6f0 Out of bounds memory access in TestJSArrayForAllocationSiteInfo. 
The function intended to check the map pointer of an AllocationSiteInfo object, but neglected to
subtract an offset to do so.

BUG=169928

Review URL: https://codereview.chromium.org/11931037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-21 12:26:29 +00:00
jkummerow@chromium.org
7924492ce3 tools/run-tests.py: Fixes for Windows 
Review URL: https://codereview.chromium.org/11926015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13436 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-18 14:55:23 +00:00
yangguo@chromium.org
284a28e797 Temporarily disable deferred stack trace formatting. 
R=mstarzinger@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11859027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13431 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-18 13:05:03 +00:00
mvstanton@chromium.org
7884216804 Additional work to get array literal allocation tracking working, even with --always-opt 
BUG=

Review URL: https://codereview.chromium.org/11817017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13406 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-17 08:41:27 +00:00
mstarzinger@chromium.org
0484ddcf50 Fix arguments materialization for inlined apply(). 
This fixes materialization of the arguments object in case the constant
function check if TryCallApply() inside an inlined frame fails.

R=svenpanne@chromium.org
BUG=v8:2489
TEST=mjsunit/regress/regress-2489

Review URL: https://codereview.chromium.org/11931012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-16 09:25:45 +00:00
yangguo@chromium.org
f15f294127 Sync laziness between BuildFunctionInfo and MakeFunctionInfo. 
BuildFunctionInfo compiles the function eagerly when there are debug
break points. However, the AST may have been parsed lazily since
MakeFunctionInfo does not check for debug break points.

This fixes a regression introduced in r11866.

BUG=147497

Review URL: https://chromiumcodereview.appspot.com/11661008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13382 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-15 10:16:52 +00:00
yangguo@chromium.org
eadcc1c10c Reland r13188, r13194, r13256 (Deferred formatting of error stack trace during GC). 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11880018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13371 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-14 13:19:27 +00:00
mstarzinger@chromium.org
c5cff2c75a Make recent regression test resilient against GC stress. 
R=danno@chromium.org
TEST=mjsunit/regress/regress-165637

Review URL: https://codereview.chromium.org/11824062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13353 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-10 14:21:27 +00:00
mstarzinger@chromium.org
1079642c97 Fix missing exception check in typed array constructor (2). 
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.

R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js

Review URL: https://codereview.chromium.org/11791052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-10 11:45:29 +00:00
yangguo@chromium.org
e41c17084f Continues Latin-1 support. All tests pass with ENABLE_LATIN_1 flag. 
R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11818025
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13344 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 15:47:53 +00:00
yangguo@chromium.org
45f20e366a Introduce ENABLE_LATIN_1 compile flag 
Mostly a bunch of renaming when flag is disabled.

R=yangguo@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11759008
Patch from Dan Carney <dcarney@google.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13340 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 10:30:54 +00:00
svenpanne@chromium.org
0aacbf9619 Added %FlattenString and use it to speed up a regression test. 
Flattening strings is relatively costly and by doing it after every duplication
we avoid combinatorial explosion.

Note that flattening could have been done by e.g. using a regular expression,
too, but this is just another implementation detail and %FlattenString seems
general enough to be useful in other tests, too.

Review URL: https://codereview.chromium.org/11828014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13337 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-09 09:32:12 +00:00
mvstanton@chromium.org
529f801fde Adapt Danno's Track Allocation Info idea to fast literals. When allocating a literal array, 
we store an AllocationSiteInfo object right after the JSArray, with a pointer to the
boilerplate object. Later, if the array transitions we check for the continued existence
of the temporary AllocationSiteInfo object (has no roots). If found, we'll use it to
transition the boilerplate array as well.

Danno's original changeset: https://codereview.chromium.org/10615002/

Review URL: https://codereview.chromium.org/11663005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13330 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-08 09:03:16 +00:00
mstarzinger@chromium.org
0e46919c32 Fix missing exception check in typed array constructor. 
The typed array constructor might fail if the first argument is an
object with a length property. Accessing the property can cause an
exception to be thrown and an explicit check needs to be performed.

R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js

Review URL: https://codereview.chromium.org/11777014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13325 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-07 14:01:04 +00:00
danno@chromium.org
4246ac3009 Generalize calling to C++ on stub deopt 
Remove code specific to KeyedLoadICs in DoCompiledStubFrame on all platforms, driving stub frame translation by the register parameter information found in a stub's CodeStubInterfaceDescriptor.

Review URL: https://codereview.chromium.org/11635015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13320 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-07 10:06:11 +00:00
yangguo@chromium.org
4ee20d857b Check for read-only-ness when preparing for array sort. 
R=verwaest@chromium.org
BUG=v8:2419

Review URL: https://chromiumcodereview.appspot.com/11759022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13313 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2013-01-04 15:24:47 +00:00
yangguo@chromium.org
e536abb777 Handle non-constant divisor in MathFloorOfDiv, on ia32/x64 
Zheng Liu
zheng.z.liu@intel.com

Review URL: https://chromiumcodereview.appspot.com/11624022
Patch from Zheng Liu <zheng.z.liu@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13289 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-28 15:52:17 +00:00
yangguo@chromium.org
2f821f1ed9 Revert r13188, r13194, r13256 (Deferred formatting of error stack trace during GC). 
R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11678006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13279 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-27 13:12:27 +00:00
ulan@chromium.org
b64f834383 Fix x64 MathMinMax for negative untagged int32 arguments. 
An untagged int32 has zeros in the upper half even if it is negative.
Using cmpq to compare such numbers will incorrectly ignore the sign.

BUG=164442
R=mvstanton@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11665007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13273 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-21 17:52:00 +00:00
danno@chromium.org
653a66f527 ARM: Use division instructions in lithium and stubs 
BUG=none
TEST=Added to test/mjsunit/math-floor-of-div.js, math-floor-of-div-nosudiv.js

Review URL: https://codereview.chromium.org/11316105
Patch from Martyn Capewell <m.m.capewell@googlemail.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13257 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 16:31:19 +00:00
yangguo@chromium.org
a3f16f8e65 Fix several bugs in error stack trace formatting. 
GetScriptWrapper can be called recursively:
GetScriptWrapper -> GC -> DeferredFormatStackTrace -> GetScriptWrapper

GC-unsafe code in ErrorObjectList::DeferredFormatStackTrace

Enable overwriting Error.prepareStackTrace by itself while not
causing infinity recursion when it triggers an exception.

R=ulan@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11649037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13256 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 16:25:26 +00:00
rossberg@chromium.org
97eba9d3cd Object.observe: fix observation for optimised in/decrement and compound assignment. 
R=svenpanne@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11642042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13255 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 15:03:30 +00:00
rossberg@chromium.org
d2ed67a958 Object.observe: temporarily disable one test to unbreak ARM. 
R=danno@chromium.org
BUG=

Review URL: https://codereview.chromium.org/11646004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13254 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-20 14:12:41 +00:00
yangguo@chromium.org
362218a037 Deopt on overflow in integer mod. 
R=ulan@chromium.org
BUG=166379

Review URL: https://chromiumcodereview.appspot.com/11618017

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13241 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 12:01:22 +00:00
rossberg@chromium.org
c9da5fadcb Object.observe: Change semantics of deliverChangeRecords to iterate. 
Added test for recursive change generation.

R=yangguo@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11593028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13239 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-19 09:51:46 +00:00
danno@chromium.org
1f4b4625ff Re-land Crankshaft-generated KeyedLoad stubs. 
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11528003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-18 16:25:45 +00:00
ulan@chromium.org
8574054b59 Correctly handle negative codes in String.fromCharCode() 
BUG=166553

R=yangguo@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11576069

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13235 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-18 12:37:57 +00:00
rossberg@chromium.org
c6bb497437 Simplify implementation of assignment-to-const checks. 
Also, add test that assignment to function name is a syntax error with harmony scoping.

Does not fix issue 2243 directly, but with ES6, the required behaviour will change to what is implemented already anyway.

R=yangguo@chromium.org
BUG=v8:2243

Review URL: https://codereview.chromium.org/11607016

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13234 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-18 12:00:50 +00:00
yangguo@chromium.org
6e953d51af Make sure error message formatting does not have side effects. 
R=vegorov@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11598011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13228 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-17 14:00:50 +00:00
peter.rybin@gmail.com
133957e743 Fix set variable value bug: a function argument must be updated in 2 places 
Review URL: https://codereview.chromium.org/11519020

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13225 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-14 18:36:51 +00:00
rossberg@chromium.org
1080d2aade Object.oberve: assertions to narrow down flaky crashes with array length mutation. 
R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11566027

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-14 14:19:18 +00:00
rossberg@chromium.org
fb5a5e22ec Object.observe: Make array length and other magic data properties work correctly. 
Also, disable TestFastElementsLength test for now, since it flakes on buildbots for yet unknown reasons.

R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11554019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13213 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-13 09:31:44 +00:00
danno@chromium.org
facad070e9 Remove over-zealous hole checking in Array.slice() 
R=jkummerow@chromium.org
BUG=chromium:165637
TEST=regress-165637.js

Review URL: https://codereview.chromium.org/11442054

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13211 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-12 15:20:45 +00:00
rossberg@chromium.org
76375de29d Object.observe: prevent observed objects from using fast elements. 
This is necessary because polymorphic stores generally
do not perform a map check but only an instance type check,
which misses out on changes in the observation status.
Unfortunately, there currently is no efficient way in V8
to maintain that optimisation in the presence of Object.observe.

R=mstarzinger@chromium.org
BUG=v8:2409

Review URL: https://codereview.chromium.org/11477006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13205 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-12 11:38:24 +00:00
peter.rybin@gmail.com
6eef2f0682 Issue 2399 part 2: In debugger allow modifying local variable values 
Review URL: https://codereview.chromium.org/11412310

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13202 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 23:27:38 +00:00
mmassi@chromium.org
ae54f9cfe0 Fix for when array bounds check elimination tries to modify a phi index. 
BUG=

Review URL: https://chromiumcodereview.appspot.com/11486007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13193 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 14:23:04 +00:00
mstarzinger@chromium.org
07077798af Disable GC stress for mjsunit/fast-prototype. 
R=yangguo@chromium.org
TEST=mjsunit/fast-prototype --gc-interval=500 --stress-compaction

Review URL: https://codereview.chromium.org/11534004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13190 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 10:33:04 +00:00
yangguo@chromium.org
72dfb27909 Fire 'stack' getter of error objects after GC. 
BUG=v8:2340

Review URL: https://chromiumcodereview.appspot.com/11377158

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13188 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-11 10:14:01 +00:00
danno@chromium.org
64fc1f99cb Revert 13157, 13145 and 13140: Crankshaft code stubs. 
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/11498006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13179 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 11:09:12 +00:00
yangguo@chromium.org
c70a0f9334 Improve integer division on IA32 and X64 
If the divisor is a Power-of-2 constant, we could use shifts instead of the
expensive idiv instructions, which also loose the register constraints.

Review URL: https://chromiumcodereview.appspot.com/11478043
Patch from Yuqiang Xian <yuqiang.xian@intel.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13178 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 11:02:22 +00:00
rossberg@chromium.org
9a0623f296 Object.observe support for Function 'prototype' property 
BUG=v8:2409

Review URL: https://codereview.chromium.org/11416353
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13177 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-10 10:53:57 +00:00
rossberg@chromium.org
3348b5c2b4 Allow lazy compilation (and thus optimisation) of functions inside eval. 
For strict-mode eval, this requires _disabling_ lazy parsing of inner functions,
because we need to collect their free variables to do allocation for the
eval scope properly.

R=mstarzinger@chromium.org
BUG=v8:2315

Review URL: https://codereview.chromium.org/11438042

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13161 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-07 10:35:50 +00:00
yangguo@chromium.org
3388f92e63 Fix spec violations in methods of Number.prototype. 
R=svenpanne@chromium.org
BUG=v8:2443

Review URL: https://chromiumcodereview.appspot.com/11465005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13160 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-07 10:20:35 +00:00
yangguo@chromium.org
276c790c61 Iterate through all arguments for side effects in Math.min/max. 
R=svenpanne@chromium.org
BUG=v8:2444

Review URL: https://chromiumcodereview.appspot.com/11444030

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13150 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-06 13:13:38 +00:00
yangguo@chromium.org
2200972f48 Update test expectations. 
Test failure has been fixed in r13050.

R=jkummerow@chromium.org
BUG=

Review URL: https://chromiumcodereview.appspot.com/11450004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13149 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-06 13:13:01 +00:00
yangguo@chromium.org
c75ca45000 Improve array to string conversion. 
BUG=v8:2435

Review URL: https://chromiumcodereview.appspot.com/11348349

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13144 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 15:49:22 +00:00
yangguo@chromium.org
6c92aba643 Fix spec violations related to regexp.lastIndex 
BUG=v8:2437, v8:2438

Review URL: https://chromiumcodereview.appspot.com/11451005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13143 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 12:32:25 +00:00
rossberg@chromium.org
6b16d0bcae Make Object.observe on the global object functional 
The approach in this change is to handle the unwrapping/wrapping of the global object transparently with respect to the JS implementation of Object.observe. An alternate approach would be to add a runtime method like %IsJSGlobalProxy and %UnwrapJSGlobalProxy, but it seems ugly to give JS (even implementation JS) access to the unwrapped global.

BUG=v8:2409

Review URL: https://codereview.chromium.org/11414094
Patch from Adam Klein <adamk@chromium.org>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13142 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 12:03:57 +00:00
rossberg@chromium.org
23850c16b2 Object.observe: notify of __proto__ changes 
BUG=v8:2409

Review URL: https://codereview.chromium.org/11299260

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13141 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
 2012-12-05 11:47:45 +00:00